Without knowing where the bug is, attempts to work around it like that will only complicate the code.
There is no proof it was not a human error, which is possible when there are many transactions to be sent in manual mode. Has dgex ever reported this error? He sent the most transactions on the network. I mean, somehow he lost that 800k. You'd think that'd be the first thing he would do. Has he? If not, why not? He also reported being hacked. And he has also alluded to dgex being a beta. So how much of those 800k lost is down to - NXT client error - hacking - dgex software error He hasn't said. I did ask but he hasn't updated the topic with anything |
|
|
|
NEWSThe last chance to claim unclaimed coins is over. We have ~13M coins left and they'll be spent for rewards, bounties and development. Now we are running a reward program. I ask the community to post here links (with short description and link to BTT profile) to projects/persons that helped to promote Nxt. Only projects launched before the 3rd of Jan can apply. There will be several categories, BCNext will choose 3 best participants from each category. I'll contact project owners via BTT personal message to get Nxt account ids for reward payments. The 1st place will receive 50'000, 2nd - 30'000 and 3rd - 20'000 NXT. Categories: - Exchanges - Faucets - Giveaways - Utilities (blockchain explorer or http://nxtra.org/nodes/, for example) - Videos - Articles - Bug reports - Tech support - Public nodes deployment - Clients Please, mark project/person names with bold blue font. We r supposed to complete the list within 24 hours starting from now. If I can give a suggestion, you do not need to give away all those NXT at once. By all means reward the community but also keep a good amount held back in my opinion. We've got a long 2014 ahead of us and those funds spent wisely could propel NXT very high up the market cap ranks. |
|
|
|
Does anyone have concrete examples of the problems Graviton is referring to that cause him to lose so much money? If these problems exist we need to fix them as high priority please. No good or reliable services will appear until it is sorted.  |
|
|
|
|
Questions for DGEX operator
1. Regarding the 800,00 NXT you need to cover. You seem to blame the NXT code yet you posted earlier today that you was also hacked? How much of the 800,000 NXT was lost in the hack and how much was lost due to the software error? And how much of that NXT is due to your own coding errors?
My opinion is if you are out of pocket that much due to NXT software errors or blockchain faults then I can understand somewhat. However server hacks and your own coding errors are your own responsibility.
2. Is the withdrawal fee for new deposits only, or does it include existing deposits? If it covers existing deposits that is quite frankly taking the piss. You can't take people's money and then say ok I'm now charging you to get it back. At least give people notice to withdraw their funds out first - I certainly saw no notice on the site.
|
|
|
|
Man, the B.S. is unbelievable.
Well, I think u shouldn't bother with talking to me anymore, unless someone quotes ur post. Welcome to my collection of trolls. You have a fiduciary duty to tell every one who invested in this system. (1) How much experience you have developing Java programs. (2) How many hours you spent writing this code and testing it. If you think what you are doing is legal, then you have a lot to learn. Cool story bro. Go back to Bitcoin if you don't like it. |
|
|
|
offline mining of all NXT accounts in parallel
problem gets worse the more NXT accounts there are
this attracts more hackers the more NXT is worth
This will create an equilibrium effect like a boat anchor to a hot air balloon. The more NXT succeeds, the more it will be hacked.
CfB, tell me there is a solution that is more effective than the user needs to not be unlucky
James
If they can do this with NXT why can't they do it with Bitcoin? |
|
|
|
Is this a really random pass or a passphrase that you can remember ? While Nxt security is not yeat at a desirable level I think it is an user's issue that your acc got hacked. Utopian, thanks. COMPLETELY random like (not exactly) *&D(_xa,I7:{"X plus another 28 characters, etc. 35 total. wth? Gotta try to sleep now. argh! Then it wasn't brute forced. Not possible. How much NXT did you lose pal? |
|
|
|
I believe I mentioned SQL injection as a possibility in the original thread on ecrypto. It's basic security 101 for SQL and user input though.
Someone specifically said the GET variables were not being sanitised. I didn't check myself at the time. If that is the case then it's almost certainly how the hacker gained entrance so easily. A single un-escaped input gives the hacker complete control over the server. There's no way to check for GET sanitation on the front end of the site that I'm aware of, as it happens on the server after it retrieves the input. An SQL query is just a string, like any data. If you're coding a website that processes financial transactions and don't know how to prevent SQL injection, then you shouldn't be coding financial websites period. I cannot express how basic knowledge that is in secure web development. If this is what caused the hack, then I'm sorry, but I wouldn't put a single Dimecoin on Ecrypto. Yes I am assuming the person who claimed there is no GET sanitisation injected into the sql to test his hypothesis, otherwise it would make no sense since there's literally a million ways to penetrate a server. It is v basic php security which you'll learn in any beginner's book on php. This is why I posed OP the question, to ascertain how much of a php noob he is. Unfortunately the fact his site got hacked so damn quickly suggests in itself it was a basic security hole he left uncovered and not some sophisticated hack attempt. |
|
|
|
I believe I mentioned SQL injection as a possibility in the original thread on ecrypto. It's basic security 101 for SQL and user input though.
Someone specifically said the GET variables were not being sanitised. I didn't check myself at the time. If that is the case then it's almost certainly how the hacker gained entrance so easily. A single un-escaped input gives the hacker complete control over the server. |
|
|
|
Thanks for the update. The old posting pof dating profile trick usually works  Tbh it looks like you're only updating because you're realised you can't just run away from this without consequences. Why has it taken you so many days to issue *any* kind of statement? I made great efforts to make the servers impossible to hack, however the hacker simply walked right in and stole everything.
Someone suggested you was not sanitising user input on your GET variables? Is this true? Because it would leave the doors to your database wide open for anyone to walk in via SQL injection. |
|
|
|
|
If he had good intentions and was hacked he should release a statement.
|
|
|
|
|
So was all the hype around this coin empty air in the end?
What happened to the promised features? The anonymous transactions? etc
|
|
|
|
What do you mean by automate dgex? withdrawal are now handled manually....but deposits are automated. That is because of the risk of bugs in the new software or chain forks. If withdrawals are automated (handled by code with no intervention) and the dgex site owner is not awake and something bad happens money on the exchange will be lost. Potentially a lot of money. I assume automatic NXT withdrawal will happen when confidence grows? |
|
|
|
Do we have a list of all the developers working on NXT. From what I can gather we have: Developers- BCNext - Come-From-Beyond - Nexern? (This is from memory correct me if I am wrong) - Jean Luc 1. Is this list complete? 2. Are all these individuals anonymous or do we have a public figurehead here? Someone like Gavin for Bitcoin rather than BCNext acting as Satoshi. 3. What is the development timeline? - My understanding is parts of the source code will be open sourced on January 3rd. What features will be complete and when? I know when is difficult in software development The more developers we have working on this, the better it looks (and is) for NXT! And the development timeline is also important in my opinion to inspire confidence that we are working to a schedule and have a plan. It will also make the features seem more real. When alias suddenly appeared it generated a lot of buzz for NXT. Three things are important I feel: - Development/features - Marketing! Spreading the word in related forum topics, reddit, blog posts, getting on sites like coindesk etc - Services Those are my thoughts for the day  I am trying to collect Nxteam here: https://docs.google.com/spreadsheet/ccc?key=0AgAGADgnQcrtdHRrV3V3Z1lzOXVEMWtqdElUaEtqV1E&usp=drive_web#gid=6But - BCNext - Come-From-Beyond - Jean Luc belong to the paid Core, while othes are only activists Cool. When you said paid Core, you mean they are being paid for their development work? If so, full details of this should be provided (not the amounts obviously, but who is paying who, for what duration etc). Development team is a major plus of this coin. |
|
|
|
I AM JUST PROPOSING WE AUTOMATE DGEX AND SET IT AS THE FIRST AUTONOMOUS CORPORATION TRADED ON THE NXT ASSET EXCHANGE.
PEOPLE JUST WANT A SAFE PLACE TO DEPOSIT/TRADE/WITHDRAW....A SAFE GATEWAY FOR NXT.
I REPEAT WE AUTOMATE DGEX AND ISSUE SHARES ON NXT ASSET EXCHANGE.
SIMPLE...EASY...
What do you mean by automate dgex? |
|
|
|
Do we have a list of all the developers working on NXT. From what I can gather we have: Developers- BCNext - Come-From-Beyond - Nexern? (This is from memory correct me if I am wrong) - Jean Luc 1. Is this list complete? 2. Are all these individuals anonymous or do we have a public figurehead here? Someone like Gavin for Bitcoin rather than BCNext acting as Satoshi. 3. What is the development timeline? - My understanding is parts of the source code will be open sourced on January 3rd. What features will be complete and when? I know when is difficult in software development The more developers we have working on this, the better it looks (and is) for NXT! And the development timeline is also important in my opinion to inspire confidence that we are working to a schedule and have a plan. It will also make the features seem more real. When alias suddenly appeared it generated a lot of buzz for NXT. Three things are important I feel: - Development/features - Marketing! Spreading the word in related forum topics, reddit, blog posts, getting on sites like coindesk etc - Services Those are my thoughts for the day |
|
|
|
Turned out it's the DGEX reserve account with 75 mil  What is your source for this statement? If true, it totally invalidates salsacz's video claim that 30% of NXT has changed owners in 21 days or my analysis that 20% had done so thru Dgex in 30 days... why would it invalidate anything? reserve account doesn't mean DGEX necessarily owns all of NXTs in it, it's just users of DGEX store their NXTs there, it's their trade money. Same goes for bitcoin exchanges, some of the biggest bitcoin wallets are actually exchanges' wallets with thousands of users owning bitcoins in those wallets. If it's still in storage at DGex it hasn't changed hands yet on the exchange and still belongs to the depositor. It can't be counted as NXT that has found a new owner yet until it's actually sold. We don't know what fraction of that 75 million belongs to buyers and sellers. If I deposit 1 million NXT, sell it on dgex, and the person who bought it hasn't withdrawn it from the exchange it will remain in the dgex reserves. Yet the 1 million NXT is now belonging to and controlled by the buyer not the seller. etc |
|
|
|
Distribution of NXT among the original 71 vs the rest of us, and the effects this will have on forging revenues for the "little guys" is one of the main points that NXT critics can use against NXT, and I kind of see their point. If enough people see NXT as a scam coin used by an elite inner circle to get rich, that could play hard against NXT, no matter how good it is or how pure the motives of the initial stakeholders are. The only solution: give all of the NXT to me, I'll take good care of it.....  But seriously: I propose some sort of massive giveaway to coincide with the Jan 3 launch. From what I can see on the blockchain explorer there are only 5000 or so active accounts (seems low, tbh). Give every account 10,000 NXT, that'll cost 50 million NXT, 5% of the total, and will generate the most publicity ever for a crypto launch. (imagine the headlines: Crypto-anarchists give away millions! ) And imagine the tsunami rush of new users hoping to get a piece of the action.......ready to buy in hard. Everyone will go to the moon...... i hugely second this idea. but i have to say if there was a large stakeholder who was interested in doing this he would definitely have to keep it quiet and it would definitely have to take everyone totally by surprise. either way if we want this thing to succeed the large stakeholders will HAVE to find ways to get rid of large portions of their stash soon. it must be done and it CANT be put off. I just hope that they understand that giving away huge portions of their stake is more likely to make them wealthy in the future than hording it. everyone has to do anything they can to make sure that the large stake holders understand this. one should give a 1M to Max Keiser Seriously this isn't a bad idea. Send him a link to the new video and a 1M donation. Maybe wait til the distributed exchange is out. As for the richest founders giving away significant chunks of their new found wealth - wonderful idea to dream about but in reality I can't see it happening. |
|
|
|
Wow. Amazing effort. Are you getting a bounty for that? Or are you relying solely on donations? |
|
|
|
|
Show Posts
