Whenever you go to a poker game, the first thing you do is try to identify the fish. If you can't figure that out, you're the fish.
Guys, I've got some bad news for you.
You're the fish.
I will shamelessly admit to non-purposefully being the fish. |
|
|
|
I believe the problems with limiting (automatic) rollback to 120 blocks is smaller than the possible problem with a government building a lot of ASICs, making blocks in the dark and release them to the network after a long time. This could kill Bitcoin.
Say you limit rollback. Say about half the network watched chain X unfold and it's the longest chain. And say half the network is on chain Y and would need a rollback past the limit to get to chain X. Isn't it true that both chains are now equally correct by the rules? I'm not so sure it's such a good idea to introduce path dependence to a network that can't even remotely guarantee that all nodes take the same path. I agree, if you ever need a rollback passed a sensible limit, you're kind of screwed. But it seems to me that you're screwed whether or not you limit the rollback. You can now have two perfectly functioning clients with the same information who disagree on the which set of blocks is valid. I would say it makes sense to detect that a very large rollback would normally occur. But as for what you do in that case, I can't see not rolling back as being right. Perhaps prevent further operation until humans can decide what to do. So let's find the sensible limit and use that. If we set the limit at 288 blocks, we would have about 96 hours to merge the network again if there was a 50 / 50 split. I don't think we ever will have a network split larger than 96 hours with exactly 50 / 50 share on both sides. If the network merged again after 96 hours, and one side have made more blocks than the other side, miners would jump to the largest blockchain and the small one will die.Isn't this the very definition of a "rollback"? Miners always jump to the longest chain. |
|
|
|
|
I'd like to bring this thread back to the QT client specifically, rather than focusing on paper wallets. I understand paper wallets have their merits, I would just like to better understand the risks of the QT client and how those risks can be mitigated.
|
|
|
|
I would, but I am afraid of fire or forgetfulness wiping out my Bitcoin savings in such a case.
Your plan to keep your private keys in a an encrypted form in a wallet.dat file (even if you find a way to rename it) isn't any safer from fire or forgetfulness than that piece of paper. Yes it is... I could store it in my gmail or something, then access it no matter where a fire is (unless said fire is at Google, but I still have my local backup in such a case). Is there anything else I should be doing to better secure my wallet?
Keeping your bitcoins on securely produced paper wallets and only importing the ones you immediately intend to spend. 100% effective. Second only to total abstinence from bitcoin. You can never lose more BTC than you have online at any given time. I would, but I am afraid of fire or forgetfulness wiping out my Bitcoin savings in such a case. For this I came up with encrypted paper wallets. Put two copies in two safe places. Keep the encryption pass phrase in two or three safe places, one of which is your brain. The encryption opens up so many options. Safes, spouses, safety deposit boxes, attorneys, family members. I suppose distributing them does make it easier... would it be any better than distributing an encrypted wallet.dat various places? Why? Keep a small amount on a machine as a security test. If it goes you have a problem.
And if it doesn't go? What happens when the problem comes later down the line? I've always held less than 100 BTC (with one exception where I held ~500 BTC for a couple of days), and I've held it for almost 2 years on the same machine. It's been safe so far, but that doesn't necessarily indicate safety for the future. |
|
|
|
I have used the scientific method (hypothesis followed by experiment). It's pretty simple actually: Every time I buy the price goes down. Every time I sell the price goes up. Last night I bought in with half my capital, so we should now see a period of stability  My wife and I joke about this... happens like clockwork for me as well. This is why I no longer attempt to day trade on BTC. |
|
|
|
Is there anything else I should be doing to better secure my wallet?
Keeping your bitcoins on securely produced paper wallets and only importing the ones you immediately intend to spend. 100% effective. Second only to total abstinence from bitcoin. You can never lose more BTC than you have online at any given time. I would, but I am afraid of fire or forgetfulness wiping out my Bitcoin savings in such a case. |
|
|
|
Would you rather have:
* $50 million US guaranteed
* 10% chance at $4 Billion US
2nd option is worth 8x the first, so you take that one?
I'd take the $50M hands down, every time. On sums of money that are small enough as to be insignificant, I'd probably take the gamble if the odds were in my favor. 100 BTC is significant as well, so I went for the sure thing in that case too. If the odds were more around 50% for 1000 BTC, then I'd go the 1000 BTC route. A 75% chance of going home with nothing is just too great though. |
|
|
|
|
I have Bitcoin-QT with some coins in it, encrypted with a decently-lengthy password (11 chars). From what I understand, a trojan built to steal my Bitcoins would have to have both a keylogger (to get the wallet password) and a file-grabber (to grab the wallet.dat). How likely is this to happen, and has anyone ever seen such a trojan in the wild?
I know security through obscurity is generally looked down upon around here, but is there a way to point Bitcoin-QT to a wallet file that isn't named "wallet.dat"? How?
Are there any other possible vectors of attack on an encrypted QT wallet?
Is there anything else I should be doing to better secure my wallet?
|
|
|
|
Even just offering the option to assign one pre-determined bitcoin address would provide an equivalent level of security, even if you did no PGP automation whatsoever. The pre-determined bitcoin address could either be a) withdrawn to directly, or b) for those who know how to sign messages, it could be used to sign a message that permits withdrawal to some other address. All of this could be evaluated in any environment already accustomed to working with bitcoin keypairs.
We could easily add the "limit to one bitcoin address" thing, but there is a problem with the bitcoin message signature process that makes it difficult to implement (last time I checked the bitcoin message signature uses a different way of signing compared to transactions to make shorter signatures, but it's been an issue). Add optional "withdraw to one address only". Add 48 hour delay before changing the addresses, during which you'd get two emails, and see a giant warning when you log in. This should really be an option. In fact, a user should be able to specify their own time limit, in hours, that they want a withdrawal address change to be delayed. They might set it to 1 hour, or 5 days. A good default might be 48 hours. The email should contain a link required to confirm the address change. A person should be allowed to lock their account indefinitely in the event of it being compromised. A "Freeze my account - it may be compromised" link. Perhaps this could be a unique link existing in their original registration email (to prevent just anyone from locking other random people's accounts). This lock could be undone by the person verifying their identification with MtGox support. The yubikey is good, but not everyone uses it or has one. Even with the yubikey, I am still afraid of a keylogger. The above security procedures would largely mitigate risk even against keyloggers and other malware. |
|
|
|
|
That UK chart is interesting... US debt recently went above 100% of GDP (it had previously only reached this level during WWII), but the fact that the UK recovered quite well from debt at 2.5 times GDP is fairly impressive.
I think the US is going to see some pretty quick inflation in coming years, as well as more taxes, in order to pay off the debt they have accumulated.
|
|
|
|
This is not a good service. This guy is passing out anyone's information to any one who asks . This shit is sketch it is bad for the bitcoin community and is an excellent way for identity thieves to get the information they need to scam and steal. F!@# this guy for giving my information to a bunch of tech kids.  Who did he give it out to, and why? What did you do that makes people want more information about you? |
|
|
|
|
I can see this sort of thing being useful...!
|
|
|
|
Hmm... I am not willing to modify my list and criteria just yet - at least for LARGE (10,000btc +) holdings!
Now, I do agree that most of the points made so far do apply to smaller holdings, but seriously, do you really believe anyone with USD 200,000+ invested in such a volatile thing as bitcoin will let it lose 90% of its peak value and not use any kind of stoploss rule? After all, isn't this one of the basic rules of investing?
Anyway, let's try a different, slightly more aggressive approach: I will tag all of the above coins as LOST 4EVER and will only untag an address if its owner ever spends a coin from it OR just simply ADDS 50btc or more to it (which might be preferable from a security point of view as it does not require any cold storage private key to be used.)
I know this is a controversial statement (and please keep bringing good arguments), but until I see hard evidence, I still strongly believe that my list is 95%+ correct.
Tag and untag your list however you like. It's your list. That doesn't mean anyone else will take it seriously though... This is like saying anyone who didn't sell their Apple holdings when it was up to $10/share was completely out of their mind. Obviously, some people sold, and some people held, all depending on what they believed the future would hold. |
|
|
|
Paul Harvey killed it for Dodge.
Nice HDR too.
Dodge was my favorite, along with the one for the turbo Hyundai. The Dodge one was pretty good indeed. |
|
|
|
Excellent, thanks all for the great replies! Any suggestions on where to buy a longer USB cable? (Online)
monoprice.com Or, heck, check out bitcoinstore.com and see what they've got? |
|
|
|
USB 2.0 provides for a maximum cable length of 5 meters for devices running at Hi Speed (480 Mbit/s). The USB 3.0 standard does not directly specify a maximum cable length, requiring only that all cables meet an electrical specification: for copper cabling with AWG 26 wires the maximum practical length is 3 meters (9.8 ft). 5 meters = 16.4042 feet. http://en.wikipedia.org/wiki/Universal_Serial_BusInteresting... I always KNEW the limit was 24 feet? Regardless, I have a little USB webcam I use as a "security camera", and it's on two 10-foot USB extensions without trouble. I'd say 15-20 feet of USB will be just fine. |
|
|
|
I just called DHL and asked about my shipment status even though I don't have a tracking number. I was surprised when she said she would help me. She asked for my address details and name. Nothing came up. I was one of the earlier orders in the first 50. So I doubt if anyone is going to get their miner this week, but I could be wrong.
Give it a try 1-800-CALL-DHL and let us know.
Dang... |
|
|
|
Since I prematurely reviewed the site, I'll update: Beta tester: 1JR66i29FDEDZ1rJfWZnNaN6ourw1Uzmxu EDIT: Ok, my first comment: I was confused as to what I was supposed to do after sending money to my ticket. I didn't want to close the "Purchase your Ticket" dialog, because I wasn't sure if I needed to keep it open until something happened. Turns out, I didn't need to do anything but close it out and add my transaction ID to the end of the URL. A bit cumbersome. UPDATE: You should still add a message about what to do after sending the money to the ticket.My suggestion is to have your site actively search out a transaction to the particular address, and as soon as a transaction is detected, use some AJAX magic to create a very obvious link to the winnings page ( http://bitmillions.com/tickets/1498ae78a6eb231b0512f942409f80e6f6ee1fefb1044429e99f4d3665eff9fe) (Not sure if you've done this since the first time I played)If not that, then at least say something along the lines of "As soon as you send payment, close this dialog and search for your address to find your tickets" Also, I tried finding my ticket by searching for the pay-to address. It says "0 tickets found". (EDIT2: just figured out that I have to search for my send from address) Also, the address page (http://bitmillions.com/address/1HSDNZYfcevZBNCZjj4y5wyxzbc79a6y32#) says "5 Free Plays Found! Some will expire soon! Click Here to Learn How to Redeem Your Free Plays!", but when I click on it, nothing happens. Fixed!All of this said, it's definitely one of the most polished Bitcoin-only sites I've seen at its launch. Nicely done! Nothing really new to add to this since my previous play. I'm unclear about how to reclaim "free plays pending". I'm up about 5.5BTC, thanks guys!
From the FAQ: "You can use your Free Plays any time after they have been confirmed. Once confirmed, they will appear in all your tickets and also in the detail page of all your bets. For each Free Play you want to use, you have to play 1 BTC. For instance, if you want to use four Free Plays, you have to bet 4 BTC." |
|
|
|
I may be wrong, but I believe the following rule allows identification of lost coins with pretty high confidence.
Any address that was existing before July 2011, has had zero outgoing transactions since then, and has received less than 5 coins since then.
Q: Why does this formula manage to distinguish lost coins from coins in cold storage? And why July 2011?
A: That's the time of the great market crash and start of the plunge to near zero. Any large holders would have surely sold at that time or in the following weeks.
Applying this rule, we find that a LOT of the richest addresses are actually lost forever (hopefully this list doesn't have any mistakes):
79957.042 1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF
50000.041 1P3S1grZYmcqYDuaEDVDYobJ5Fx85E9fE9
50000.041 1DEpjpftLbsGiCJvJDp2F2quVRnymV8U5Q
40000.041 1cXNTyXj4xPGopfYZNY5xfSM1EPJJvBZV
40000.041 12HddUDLhRP2F8JjpKYeKaDxxt5wUvx5nq
40000.041 16Ls6azc76ixc9Ny7AB5ZPPq6oiEL9XwXy
38058.041 1FngtAcZsLfK89MNe7TqzyqVtSype8TiVD
38000.041 18Hsgq92AUB1PYLU6MUMQXiwdebaDRo9oQ
35254.503 19Gt9VKmmyMpMHEv6dkf8ddwmwddoSoJ8w
31000.041 12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr
28150.041 12tkqA9xSoowkzoERHMWNKsTey55YEBqkv
23249.041 12fZ2HxkLjG9zn1u44XYsFFYKHM4A2zCea
19400.041 1PeizMg76Cf96nUQrYg8xuoZWLQozU5zGW
13050.000 1KX8EPDcziwbGaC7oDHDuKE9SfLWMmmbZy
12950.000 1MHdm5XZMrfoZFoUktEaGhYevmdiXoc4x4
12800.000 1B1wPLyrJ831sg1D8hnZLBG7SejXbqMMrH
11867.800 19n1JqKDnoqcc34HA3fdgzNxczic6Hu5Pi
10770.515 1F34duy2eeMz5mSrvFepVzy7Y1rBsnAyWC
10689.034 1FpqQnKQCgDkJFMC94JL8FpRyHTZ3uRVZ1
10009.251 1f1miYFQWTzdLiCBxtHHnNiW7WAWPUccr
10000.000 18k9tin39LKegFzHe8rxSgvJXDpuMriGJq
10000.000 1JtpgqCf3SSeCeYWEDJjkfYFH7Ruhy4Vp1
10000.000 1DJSiWg6Ci6DLmxZFjVNBKn9CcahLFx5gS
10000.000 1Du2jAQsBQnkkVZkN4oqC46tS78k7WMkVq
10000.000 1CPaziTqeEixPoSFtJxu74uDGbpEAotZom
10000.000 1ucXXZQSEf4zny2HRwAQKtVpkLPTUKRtt
10000.000 1BAFWQhH9pNkz3mZDQ1tWrtKkSHVCkc3fV
10000.000 12dUggmXPYsPVHaHr1DoW5J6bb6gvh4yZq
10000.000 1EyArywoLEhFto6uKWMxA9QKXJWLTNghsz
10000.000 14YK4mzJGo5NKkNnmVJeuEAQftLt795Gec
10000.000 1Le6MkiTvkorvC1JwYXzQUSfqA3ebzGW7N
10000.000 1P1iThxBH542Gmk1kZNXyji4E4iwpvSbrt
10000.000 1KbrSKrT3GeEruTuuYYUSQ35JwKbrAWJYm
10000.000 16TPVCpvtJ6FkV5xNKBp35aMo4BWFGxiEY
10000.000 145YHsQU7HMzkRnD5SBSuFAzQgCYnAnLkN
10000.000 12tLs9c9RsALt4ockxa1hB4iTCTSmxj2me
Total: 755,205 BTC
Do you agree with this reasoning? I'm not saying it's a perfect definition, but it should be reasonably accurate and with very little risk of overestimating lost coins. It is also easy to prove me wrong. If you control any of the above addresses, just spend a satoshi from them. That will be more convincing than any argument, plus you will remain anonymous!
That'll be completely off, I guarantee it. What I'm more curious about is why many of those have a balance with .041 attached to the end. Why? |
|
|
|
And then go back to PHP once your site gets hacked due to a Ruby on Rails vulnerability.
Instawallet and Bitcoin-Central remain unhacked and untrolled. Any further questions ? Yep, that's what I thought. Yes. HTML is kind of mostly deprecated at this point. You'll learn the remainder of it while learning PHP.
You can not possibly be serious. Maybe I said it wrong. I was thinking of styling tags and tables, which have been replaced with CSS and divs. |
|
|
|
|
Show Posts
