Too many subforums, therefore likely to die a stale death. Whoever is running this needs some forum admin 101 lessons.

Would it be possible to sign transactions on a completely different host to the machine that is publishing them to the bitcoin network? If this is possible then the machine that signs the transactions can be a completely isolated piece of kit, accessible only via a fraud detection proxy.

If it knew the output addresses for each user then it could generate all the transactions it needs and keep them in RAM, this way the "release funds" part is completely separate from the "sign transactions" part and could be much harder to take control over.

This is the key thing we should take away from this. Real currency stored by banks is also digital currency but is heavily protected physically, digitally and legally. Given that Bitcoin doesn't have legal protection (they can't be seized), digital protection is very hard (private keys need to be available to sign a transaction) then the bare-bones level of protection you should have as a holder of many bitcoins is physical security at the server access level. Letting third-party admins have access to your server and having admin panels exposed over the Internet is incredibly foolish.

I'm using a wallet stored in multiple encrypted containers with enormous but memorable passwords. My main concern is losing access to the wallet, so I have a copy on my phone, laptop, desktop, flash drives, dropbox and email.

I'll eventually move to some other system where I have a single private key stored in stashes rather than wallet files, but I've not done this yet because never unencrypting my stash is the best way to keep it safe.

I can't say I think this is a good thing, I'm from the UK and believe that a civilized society has no need for handguns, possession of an unlicensed firearm runs a 10 year prison sentence here.

However, if they're for sale on that site then I can't say I care that much, if technology allows people to risk imprisonment in a new and interesting way then they're free to do so.

If the real Satoshi has published a lot of text under his real name, it should be possible to figure out who he's most likely to be using statistical analysis.

I'm surprised nobody has attempted this, a general solution to this problem would have some pretty cool uses in computer forensics.

Stopped reading right there. Ethics is subjective by nature, first principles (axioms) are always unprovable and often arbitrary, even more so in ethics. Furthermore, humans and systems created by humans are not mathematical constructs and binary logic need not apply.

All ethics is based on opinions, not facts. Some opinion may hold true given a certain set of axioms but that doesn't make it an absolute truth outside that system, no matter how much you wish it to be true.

I know that this is getting off-topic, but this really bugs me. Software engineering is more than just writing and debugging code, you need to be able to design systems and document them too. Programming is the easy bit, design and documentation are IMO much harder problems, and if you aren't documenting then you're missing out on valuable experience in your journey as a developer.

Comments can only go out of date if you describe what the software is doing, which isn't the way to write comments. Good inline comments describe the whys and don't go out of date when the how changes, this is exactly what makes them a difficult ordeal because as codemonkeys we're used to dealing with hows without really pondering the whys. Good function comments describe the interface rather than the implementation, if they go out of date then you can almost guarantee that you've introduced bugs because you've broken your interface.

I don't even claim to be good at it myself, but I do practice and try to improve.

As you don't list any terms and conditions, does that mean you reserve the right to randomly shut people down or that anything goes?

Ah okay, it's fairly neat for auto-generated. Better than most disassembled stuff anyway.

I wasn't talking about comments on individual lines or blocks of code, I actually meant function documentation. I can see that I've irked you though, so I won't offer any more critique as you didn't actually ask for it.

Excellent, thanks for the explanation

I set up a daily ChangeDetection.com alert on one of my addresses changing, as per Casascius's smart idea of using Bitcoin as a hacker canary, and got a couple of email alerts which are worrying:

http://www.changedetection.com/log/blockexplorer/1gyzhwalymnvkgrkszcabruuhcxvtwpawf_log.html

As you can see, the balance didn't change but the transaction history did, there's no mention of a bug on BlockExplorer's home page.

Was BlockExplorer's transaction history wrong for a day? Is it right now? Does this happen often? Can we trust it‽

The first file I randomly clicked on was over 4000 lines long, contains no function documentation, huge stretches of if/elseif blocks (not sure if that's avoidable, but it's damn ugly), magic numbers in your switch blocks and huge code duplication.

I don't mean to crap on your work, but in any mildly successful software company that wouldn't get through a code review. It wouldn't get past me anyway and I'm not even employed as a software engineer.

I'm not bidding but I'd just like to pipe up and say that you should consider making it an extension to some already developed and free software solution (ie phpBB3) rather than developing it from scratch.

Economic: This ensures that it's maintainable by anyone with experience in the platform, larger the platform's user base the larger the pool of developers you can pull from. The vast majority of the code has already been written, so it ought to be cheaper.

User: The UI components will have already been tested by millions of people, ensuring a consistent user experience if not a "great" one. It's what users have used before and what they expect.

Security: Because thousands of hackers have already tried to break into it, it's already proven to be robust. When anyone else anywhere in the world gets exploited, you get a bugfix and a security update.

IMO this doesn't sound like a good thing.

It bloats all future client implementations with a complex interpreter, raises the bar of transaction rule-verification to the mathematical elite, encourages closed source clients, further strongly couples the protocol to the default client and removes the ability for the block chain to fork in a democratic manor.

You can use ChangeDetection for email alerts when a blockexplorer.com page changes.

May as well just start doing this and advise others to do the same, it might just catch on.

This is a really cool idea. User pays $10 for $5 worth of BTC, they get an installer that creates a wallet.dat in their user profile, they enter their email address and vault address, they get an email alert when the money moves.

This could be a viable and completely automated business, I hope someone makes it.

My balance was reset to 0 when the site was upgraded or something. That's incredibly scammy behaviour and people should avoid them at all costs.

I guess the opaqueness of the wallet data file prevents people from having a poke around and reading it.

Binary formats are efficient for the computer, but they aren't very transparent and actively discourage casual reading by curious users. If the wallet were in XML, JSON or some other text-based format then I guess this would have been immediately obvious to anyone with a text editor and a pair of eyes.

Blaster is an old memory resident worm from 2006 and doesn't spread anymore, you've probably got a scareware infection.