But otherwise *yes* it would appear the plan was always to try and be more like Ripple than Bitcoin (and BCNext's comment that he didn't want NXT to really be worth anything is very reminiscent of Ripple's earlier statements about XRP being like "stamps").
Ripple does have value, as without value it will be useless. Since there are 100 times less nxt, one nxt should be 100 times more valuable than one ripple (if all the ripples are distributed, which they are not). |
|
|
|
Prove positive Emule is natural born liar |
|
|
|
I also believe the seed string of characters used should not be a fixed string, it should be random as should your 'allowedCharacters' variable in the sample you posted.
why? I don't think it makes any difference. |
|
|
|
Well, you can do everything whilst it's downloading the blockchain, of course you'll only get your balance once it reaches the correct block.
It opens NRS in the background, yes, locally.
Does it shut down NRS when you close it? Yes. Cool. You should add some kind of random password generator for creating new accounts, and then it should be distributed with all new NRS releases as a default client Not sure if there is a good and secure javascript.random available - However if you open the app and choose register new account, (new users will probably do this although they could just login), then it requires special characters, minimum length, etc. You can use random mouse movement to create pretty secure password. Copy their code https://www.bitaddress.org |
|
|
|
Well, you can do everything whilst it's downloading the blockchain, of course you'll only get your balance once it reaches the correct block.
It opens NRS in the background, yes, locally.
Does it shut down NRS when you close it? Yes. Cool. You should add some kind of random password generator for creating new accounts, and then it should be distributed with all new NRS releases as a default client |
|
|
|
Well, you can do everything whilst it's downloading the blockchain, of course you'll only get your balance once it reaches the correct block.
It opens NRS in the background, yes, locally.
Does it shut down NRS when you close it? |
|
|
|
I did my research on random string generator libraries, it seems apache RandomStringUtils is not compromised.
Why aren't you using SecureRandom random = new SecureRandom()? Simpler version from web char[] allowedCharacters = {'a','b','c','1','2','3','4'}; SecureRandom random = new SecureRandom(); StringBuffer password = new StringBuffer(); for(int i = 0; i < PASSWORD_LENGTH; i++) { password.append(allowedCharacters[ random.nextInt(allowedCharacters.length) ]); } I don't believe I know better than the people from Apache who made that library. That library is used in 1000s of production systems. You should not reinvent the wheel. You are right about the difference between SecureRandom and Random, in the code I posted it does however not make sense to use SercureRandom. If you believe it does please explain why it does make sense in the code I posted. They use java.util.Random Where do you see SercureRandom used by RandomStringUtils? |
|
|
|
In this case he is only using java.util.Random to pick up the length of the password, between 70 and 90 chars, so it does not need to be SecureRandom. Of course I hope the apache RandomStringUtils internally uses SecureRandom, this is where it would matter.
Instead of relying on RandomStringUtils, isn't it much simpler to just use SecureRandom to create the password? char[] allowedCharacters = {'a','b','c','1','2','3','4'}; SecureRandom random = new SecureRandom(); StringBuffer password = new StringBuffer(); for(int i = 0; i < PASSWORD_LENGTH; i++) { password.append(allowedCharacters[ random.nextInt(allowedCharacters.length) ]); } |
|
|
|
Just throw AE in the water... it will either swim or drown!
best test is production, if it breaks we can fix it.
If it drowns it will take the whole Nxt ecosystem with it. We cannot just roll back the production blockchain, the way we had to do yesterday with the test blockchain - I asked test nodes to delete their copies. We may have cosmetic bugs, but things like calculating account and asset balances have to be rock solid, otherwise it is free money for the lucky ones that first discover the bugs and run away after converting to Bitcoins. We had a bug where cancelling an asset order would give you back twice the original amount, imagine this on main net... Yes, don't release anything until it has been thoroughly tested on testNet |
|
|
|
I did my research on random string generator libraries, it seems apache RandomStringUtils is not compromised.
Why aren't you using SecureRandom random = new SecureRandom()? Simpler version from web char[] allowedCharacters = {'a','b','c','1','2','3','4'}; SecureRandom random = new SecureRandom(); StringBuffer password = new StringBuffer(); for(int i = 0; i < PASSWORD_LENGTH; i++) { password.append(allowedCharacters[ random.nextInt(allowedCharacters.length) ]); } |
|
|
|
Not sure about the Electrum passphrase generator. Offspring does have a passphrase generator since day one. This is the algorithm that generates that passphrase. import org.apache.commons.lang3.RandomStringUtils;
private String generatePassphrase() {
// No space, backslash, newline, tab
String symbols = "!\"$%^&*()-_=+[{]};:'@#~|,<.>/?"; //$NON-NLS-1$
String alphaNum = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890"; //$NON-NLS-1$
int low = 70;
int high = 90;
Random random = new Random();
int count = random.nextInt(high - low) + low;
return RandomStringUtils.random(count, symbols + alphaNum);
}
Java.util.Random is not cryptographically secure. Change it to SecureRandom or people using Offspring to create Nxt accounts would be vulnerable http://stackoverflow.com/questions/11051205/difference-between-java-util-random-and-java-security-securerandom"Random only has a 48-bit internal state and will repeat after 2^48 calls to nextLong() which means that it won't produce all possible long or double values." This means all passwords created by OffSpring should be crackable. It's not secure at all |
|
|
|
Not sure about the Electrum passphrase generator. Offspring does have a passphrase generator since day one. This is the algorithm that generates that passphrase. import org.apache.commons.lang3.RandomStringUtils;
private String generatePassphrase() {
// No space, backslash, newline, tab
String symbols = "!\"$%^&*()-_=+[{]};:'@#~|,<.>/?"; //$NON-NLS-1$
String alphaNum = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890"; //$NON-NLS-1$
int low = 70;
int high = 90;
Random random = new Random();
int count = random.nextInt(high - low) + low;
return RandomStringUtils.random(count, symbols + alphaNum);
}
Java.util.Random is not cryptographically secure. Change it to SecureRandom or people using Offspring to create Nxt accounts would be vulnerable http://stackoverflow.com/questions/11051205/difference-between-java-util-random-and-java-security-securerandom |
|
|
|
any date set for launch of AE yet?? or still to be decided?
Nobody seems interested to step up and launch. I proposed the 13th march, and asked if not some one should step up and take ownership for the launch of AE. no reactions. How can there be a "firm" date when CFB make a statement like there are "bugs" in AE? Unless it's working bug free on testNet there can't be a date. |
|
|
|
...
the transaction fees are still too damn high, forging rewards are way to low & come too slow for all but the richest Nxters.
...
Slow? Maybe. Low? No, everyone gets the same percentage. Anyways, you can't have high forging rewards and low fees. Well I've been at it over 1 month with 10k NXT and haven't seen a single block. Supposedly I'll get 100 Nxt sometime in the next 11 months but in the meantime it sure seems like a waste of time and the longer I wait the less I believe it. It's not about the Nxt for me, I've given away far more than that, but it makes me concerned for the system as a whole as I don't think many people will bother with forging if this is how it is. This is weird. One one hand people complain about "fees" being too high, on the other hand they want to make money by "forging" These are contradictory statements. |
|
|
|
Ok. All fees go to the genesis account.
If you send the fees to the genesis account you will destroy NXT because you will eventually run out of NXT. Nothing lasts forever. At 1 NXT tx fee, all the NXT would be depleted in under eight years if the network was under full load. The ROI would be phenomenal. I like this idea even more now. No, ROI will suck, as most people (including me) will sell Nxt and move to other thing as the platform won't have any future. |
|
|
|
Since eXocoin uses RSA just how long RSA it's going to use? RSA-768 has has been cracked and RSA really old algorithm anyway so why even use it?
RSA is slower and requires longer keys, but RSA 2048 should be secure for the next 40 to 50 years http://crypto.stackexchange.com/questions/8687/security-strength-of-rsa-in-relation-with-the-modulus-size/8692#8692RSA 1024 is 80-bit strong (not recommended if exocoin is using that -- probably entity like NSA with special hardware can break it, if not now then in next 5 years ) RSA 2048 is 112-bit strong (most likely unbreakable in our life time without quantum computers) Bitcoin's ECDSA is about 128-bit strong RSA 3072 128-bit RSA 4096 should be fine for hundreds of years, as long quantum computers remain vaporware. RSA 15360 (256-bit, same strength as AES 256) RSA really old algorithm anyway so why even use it Old is not always bad. Who knows if Bitcoin's ECDSA has some weakness not yet discovered that can be exploited in future? |
|
|
|
Than say what you think and dont let us guesse.
We need more core devs. Exactly this. A big project like NXT should at least have 5 active core developers for the next months. Hoarders should pay up if they want their NXT to become worth anything. Don't we have unclaimed funds for this? To say that Hoarders should pay up isn't productive. We need a budget, list of developers, timeline, etc.. Perhaps you can organize this Uniqueron? For future Core Dev team; I'd recommend; Chuckone, wesleyh, zahlen, ricot, gimre, ImmortAlex, CIYAM, BloodyRookie, Jaguar0625. We'll need to offer a significant amount of Nxt for 3 months of work. I would suggest 250k Nxt for each member from unclaimed. A few of these people (Jaguar0625, gimre, BloodyRookie, more?) are involved with NEM. They won't have time to work on two project, so they should be out of the list |
|
|
|
2. No, but if the only changes u want to do is changing the genesis block then u'll trigger a trap
I am really interested to see if/how those planning to clone Nxt will get past this obstacle.  Do you mean, that NEM will never appear? NEM is not clone. They are writing new code from scratch |
|
|
|
|
Show Posts
