Can somebody fix the recovery password option.  I forgot my password and i tried recover your password option for the past week no email is coming.  May be a silly question but have you checked you spam folder? Hey. This is why i say send us an email this could have been resolved a long time ago. |
|
|
|
Its a new exploit but it seems to have the same affect as that issue. The fix has been applied to the pools experiencing this also which is why i need more help. |
|
|
|
Pool owners running stratum from viperaous or startum etc.. you may be susceptible to a new attack this has been noted on a few pools recently. This may not be affecting all pools but it is defiantly worth a mention.
here's the issue a significant fake hash rate may be counted as valid instead of rejected by the vulnerable pool server. I am working with a bunch of pool operators as well as the litecoin dev team at the moment to find the cause of this issue.
I Believe the attacker is able to trick the server into accepting shares at a lower difficulty then the server sends out thus causing their hash rate to spike. I am not 100% sure on this which is why i make this post if you think you pool is affected please join us
Here is what i have suggested so far. Disabling vardiff code and setting the share difficulty cap at 32.
Please take note.
Any pools that has custom coded stratum software will not be affected by this bug this is for pools that are using the same codebase as each other.
I would also like to mention that there is NO issue with the LTC network at all! this is all to do with attacks and exploits on pool software.
if you're a pool op, join us on #unitedminers-2 on freenode.
Is this exploit fixed on givemeltc? Noticed my payouts in the last 2 days are about 15% lower then projected. We run our own custom software. It did not affect us i left that out of my post because this is not to promote our pool this is to raise awareness on this issue and fix it. |
|
|
|
|
Pool owners running pool software from viperaus or startum etc.. you may be susceptible to a new attack this has been noted on a few pools recently. This may not be affecting all pools but it is definitely worth a mention.
here's the issue a significant fake hash rate may be counted as valid instead of rejected by the vulnerable pool server. I am working with a bunch of pool operators as well as the litecoin dev team at the moment to find the cause of this issue and resolve it.
I Believe the attacker is able to trick the server into accepting shares at a lower difficulty then the server sends out thus causing their hash rate to spike. I am not 100% sure on this which is why i make this post, if you think you pool is affected please join us
Here is what i have suggested so far. Disabling vardiff code and setting the share difficulty cap at 32. This will not be a permanent solution but might potentially stop these attacks until we can find the root cause.
Please take note.
Any pools that has custom coded stratum software will not be affected by this bug this is for pools that are using the same codebase as each other.
The litecoin dev team are not responsible for pool code but they are lending a hand where they can.
I would also like to mention that there is NO issue with the LTC network at all! this is all to do with attacks and exploits on pool software.
if you're a pool op, join us on #unitedminers-2 on freenode.
|
|
|
|
No we were not affected by this bug. But i was part of team that found and fixed it. I believe pooler was the one able to replicate it. I saw earnings drop exactly in line with the time the exploit hit, and continued for about 2 days - are you sure?  When I moved earnings returned to historical averages. Please go and read the news section and you will see why. Completely unrelated issue.... |
|
|
|
No we were not affected by this bug. But i was part of team that found and fixed it. I believe pooler was the one able to replicate it. |
|
|
|
lots of unpaid shares. all workers showing 0kH on front end - however cgiminer shows them all still working on my end LAN?
They will be paid. Site looks to be catching up. i assure your work is counted. Thanks for the heads up tho nice find! |
|
|
|
|
Sorry guys. We had to do a emergency upgrade due to the long round times. We were down for 15min. Users had trouble connecting sue to the ddos protection kicking in.
Fees are at 0% for a day then 1%. We are hoping this new upgrade will stop these round time issues once and for all.
Once again we are very sorry and thank you all for your support.
Any issues contact us ASAP.
Thanks guys
|
|
|
|
|
you have our support already donated and will continue to
|
|
|
|
Vardiff has been enabled on the pool. Check it out  I'm mining on the vardiff server (port 3334), and my difficulty is set to 16 (eg: half of what it is on the non-vardiff server). I have a couple 2000 Kh/sec rigs, and I expected a much higher difficulty on the vardiff server to reduce network back-and-forth. Is vardiff working properly, or am I doing something wrong? Edit: Nevermind, I see the difficulty adjusting upwards now.  It takes a few min to adjust . Were lookign to enhance it so its much faster. |
|
|
|
|
So far great. I've lost count of the amount of infected machine that have been shutdown not to mention open and servers. I hope you are all spreading the round and using it every little bit helps.
I know I've learned from the responces. A thanks goes out to all those sys admins for prompt action in this matter.
|
|
|
|
In my head what I'm about to explain sounds correct, but I'm posting here as I'm willing to admit often I am wrong and want to be sure...
So as great as P2pool is for it's decentralized nature and all that, the many small payments (and variance if you have a low hashrate) can be annoying at times. Also it seems no matter what p2pool node I run on I will see, over time (a week or so) an average of between 80-90% efficiency of submitted shares. (without using add ons to your address to only submit higher dif shares).
I see a much better accepted rate on pools with fees (averaging 95% on my LTC CPU miners, and over 99% for stratum GPU mining). [Before you yell at me for CPU mining I have free power and CPU's to spare.]
So while there might be no fee on a p2pool node, it's still more efficient to mine on a pool with a fee that has a higher overall accepted percentage?
95% accepted with a 2% fee is still better then no fee and 85%(avg) accepted, or am I wrong here.
I await your mocking comments and being called dumb, but thanks in advance.
P2Pool runs on the PPLNS reward. If P2pool has a high hashrate and they find blocks all the time the payment will be more or less the same as a pool. |
|
|
|
nah - make it pps and we'll talk
The only way any new pool will do PPS is if they charge a 10% fee. Anything lower would pretty much be charity or a scam without having a 2000BTC buffer. ARS, MTRed and OzCoin remind you of anything? Agreed with you 100%. Perhaps after some coins are minted in the hot wallet PPS can be implemented i hate fees which is why i made my own pools on my own terms. In reality you cannot run a 2% PPS for a new pool and if you do it for an existing pool the hot wallet will surely take a massive hit unless you have a huge hashrate. |
|
|
|
Verry nice stratum on NVC. Next vardiff  |
|
|
|
|
With all the ASIC coming out i figured BTC might be in need of a new pool. Myself and Khaos are considering setting up a BTC pool to go along with give-me-ltc and give-me-ftc.
I wanted to see if anyone was interested before we go and invest time and effort into a pool that noone will mine on. It will start off as 100 confirms 2% as usall but as funds build up it will go down to 10 confirms PPLNS to come inline with how our current pools run.
Any interest or if you think its a horrible idea thats also welcomed to.
If this does go ahead we will devote as much time and dedication as we do to our other pools!
Thanks all.
|
|
|
|
This is minor, but is there a way you can add the ability to set your personal time zone on the site, or perhaps at least put a clock up on the menu bar with the current time for the site's clock? I think I'm 6 hours behind the site time and constantly trying to do the math in my head for the block found times.
Thanks.
Already on its way in the new updates. There are also a bunch of other suggestions on the pool forum in the suggestions section. Every suggestion is considered and most of them ate implemented. |
|
|
|
Vardiff has been enabled on the pool. Check it out |
|
|
|
Definitely is good plan forward, if enough people use scripts such as yours it, it would reduce the over all number of compromised networks in the long run, which these DDOS attackers make use of. Not necessarily a cure, but certainly make them weak enough to be easier to deal with.
I don't run a pool, but I do run a few servers, so I'll probably rewrite this to make it work along side one of my other scripts which usually just blocks these IP address' in the 1st layer firewall.
Great please post your script here also to share with everyone |
|
|
|
I often use report emails autogeneration. Sometimes this even could destroy the botnet, but usually makes it weaker.
100% what i was saying thanks balth |
|
|
|
Booters cost like $5/month and the pools need corporate grade protection to counter them; it's not cheap (2-4k/month for TCP applications like Stratum). If we manage to knock off 50% of the nodes, the booter price might go to $10/month or something so it's still a losing battle. These aren't the sophisticated attacks that mtgox has to deal with, but a simple UDP flood. Most hosts that offer DDoS protection, from my shopping experience, max out at 10Gbit/1-5MPPS, and I consistently saw attacks stronger than that with CNC (peak was 22Gbit, 75% of the attacks were over 10).
Some prices for dedicated DDoS protection I found: (not shared like awknet or VPS)
Staminus $1k/month for 10Gbit/1MPPS (not strong enough)
BlackLotus $675/month for 10Gbit/6MPPS
Some other $1k/month + $4k setup for similar
The solution I've come up with is to just use a suite of reverse proxies:
buyvm/etc VPS (10Gbit/5MPPS)
Minecraft-oriented VPS/Dedicated (Varies)
Cloud Load Balancer
For example, I used an amazon elastic load balancer and some micro instances for forwarding. By using the ELB, amazon soaks up the packet floods and does some filtering. I also use cloudflare free, but there's a risk. If your site gets a http-layer attack, and you're not on the 200/m plan, cloudflare will change your DNS record and effectively direct the traffic to your server. The pro is a packet flood goes to the CDN node, and that's not associated with any single domain, so it blocks those (you can route longpolling through cloudflare since it's HTTP traffic)
We do have protection in place. read up to my previous posts this is not going to stop DDOS attacks not by a long shot. If enough people use this script we might be able to make their job that little bit harder by shutting down bots and spreading awareness of tactics they are using. In the end its up the the person if they want to use it or not i just figured others might also find this useful |
|
|
|
|
Show Posts
