Couldn't be a team of Indians... The menu of the qt client doesn't contain the word "sir" not nearly enough... (jk)

When two miners find a new valid blockheader for height x, only one of those blocks can become part of the main chain... The other is orphaned.
If the orphaned block contains other transaction than the block that became part of the main chain, these other transactions will remain unconfirmed untill at least one more block is found and added to the main chain. The transactions that were present in the orphaned block but not in the block on the main chain will still be in the mempool of most mining nodes, so they'll be added to a block later on (unless there's a problem with the transaction, like dust outputs, insufficient fees, improper propagation troughout the network,...)

However, as a "normal" user, you shouldn't worry about this... If you sell something expensive just wait for 2 or 3 confirmations before you send the goods or service.

Foreword
I have been running a full node, c-lightning and lightning-charged for a while now, recently i added a private electrs server and i installed/configured btcpayserver. Since it's quite a task to set all these services up in order to receive lightning payments, there's quite a learning curve, not to mention the hardware requirements and the time needed to set everything up.
I realise the lightning network is still in alpha stage, and at any point it's less secure than an on-chain payment... However it's instant and cheap (once you have open, funded channels), so i wouldn't mind helping people try out accepting lightning payments on my lightning node before going trough the troubles of setting everything up themselfs.

The service
I can setup a useraccount on btcpayserver and install a store for you... That way you'll be able to write lightning invoices for MY lightning wallet. Btcpayserver also allows you to enter your xpub/zpub so it can derive addresses for on-chain payments (altough this is not the focus of this service). Btcpay isn't 100% stable when creating LN invoices tough (the service needs to be restarted manually since it seems to lose connection to my lightning-charged deamon from time to time).
Alternatively, i can work with you to setup a service trough my lightning-charged daemon, it's less user friendly, less fancy, allows less statistics to be made, but seems to be running stably.
After you've created a bunch of lightning invoices (and received a bunch of lightning payments), you can PM to request an on-chain payout of the sum of the payed invoices minus the service fee.

Who can apply for this service
I'm not a commercial entity (altough this service is not free), so my primary focus group are people that receive micro-payments on an occasional basis. I'm thinking about private auctions on this forum, raffles on this forum, tipjars, donation pages,... Commercial websites can apply as long as we're talking about trial runs: if you own a webshop and want to try out btcpay integration to receive a couple dozen payments before installing your own service or migrating to bitpay, i'll accept you to.

What are the guarantees
Like i said: i'm not a commercial entity, so i give NO guarantees whatsoever. You should consider all lightning software to be in alpha phase, i will not reimburse any funds in case something goes wrong. I also take no responsability if you lose your job, wife, house, health,... due to problems with my service...
However, in case you're running something solid and you need basic guarantees, i'd be willing to put some funds into escrow so i can't run away... This being said: it'll be pretty hard for most escrows to prove lightning invoices have been payed, so good agreements have to be made beforehand. I'm unwilling to pay the escrow fee or the transaction fees from/to the escrow tough (those ones have to be payed by you)

How much does it cost?
In a perfect world, this service would be free... However, after receiving a reasonable amount of lightning payments on my site (unblur.ninja), i realised that a most customers open a new channel with my node to test out the lightning network. As soon as those channels close i'll be left with a bunch of very small unspent outputs funding my addresses. I'll be forced to spend a bunch on fees in order to spend those small unspent outputs, and i don't want to pay those fees out of my own pocket, even if it's for the good cause.
This is why, at the moment, i propose following service fee:
I propose to visit https://coinb.in/#fees at the moment you request a withdrawal, at this moment we'll simulate how much fees it would cost me to spend the unspent outputs funding my node because of your invoices. We'll count each invoice as 1 input, 50% 'regular' 50% 'segwit' and add 2 outputs (1 regular, 1 segwit). Then we'll add 50% on top (just in case the fees go up by the time the channels have actually closed). Offcourse, if (after a while) you can more or less prove most payments come from repeat customers that already have open, funded, channels, i'll give you a discount.
I consider the fee to be sufficient for me to break even, maybe even make enough to treat myself to a beer over the weekend... However, you should not treat the fee as a "get rich quick" scheme from my side, it's basically enough to make sure i don't have to fund this service out of my own pocket... So don't expect professional grade support or uptime here!

I agree for 100% with bob123, NeuroticFish and Pmalek, do not store private keys, seeds, xprv's,... on an online machine.

However, i did wanted to add one remark: there seems to be a misconception about hashicorp's vault in your OP: if you're storing the unseal keys or root tokens on your online machine, you're doing it wrong... But i do have to agree that IF you unsealed your vault AND your system gets compromised AND the hacker gets his hands on your machine AND a token (or user/pass or...) he will be able to get your private keys from your server if you were storing them in vault... It's the chicken or the egg dilemma, if you want your scripts to be able to access your private keys directly, a hacker will always have a loophole to do thesame. So your best sollution would be not to store your private keys on an online machine

There are tons of exchanges that had excellent programmers and security audits and strict procedures but still got abused in the end... Don't make the mistake of thinking you're better than those exchanges!

I just added btcpay as a payment backend making it smoother and better looking

Well... I use ubuntu from time to time, but not professionally... A quick google told me that https://ubuntuforums.org/ is the ubuntu support forum where you should be able to find an anwer to your ubuntu related questions...
As for issues with the node setup: bitcointalk's technical subforum => wallet software (https://bitcointalk.org/index.php?board=37.0). This is the subforum that's been started for these issues, altough it's "abused" by people to post their non-core related questions aswell...

There are 3 sollutions to run bitcoind on ubuntu:

• use prebuilt binaries... a tutorial for ubuntu 16.04 can be found here: https://bitcoin.org/en/full-node#ubuntu-1604
• compile bitcoind yourself... a tutorial for ubuntu 16.04 can be found here : https://github.com/bitcoin/bitcoin/blob/master/doc/build-unix.md
• you can download the linux binaries directly: https://bitcoin.org/bin/bitcoin-core-0.17.1/bitcoin-0.17.1-x86_64-linux-gnu.tar.gz

If you want to run bitcoind as a service: https://github.com/bitcoin/bitcoin/blob/master/contrib/init/bitcoind.service

I'm responsible for about 60 x86 servers myself nowadays (my company is moving away from our power architecture towards x86), all my x86 machines are running SLES (everything from 11SP1 till 12SP4), they have tons of good documentation i can access whenever i run into issues. IIRC, ubuntu offers less off the shelve documentation, but they do have good community support forums you can join if you need help. Also, if you post specific, general, questions in this thread, i might be able to point you into the correct direction.

Might i ask which service you're trying to setup? Maybe you're making things to complex? Depending on the virtualisation sollution your VPS provider is offering there might be turnkey sollutions available?

Well... It's kind of hard to give you advice without knowing the specifics of what you're doing...

You have an ubuntu VPS... Sure, but which version (cat /etc/os-release), which VPS provider (digitalocean, ramnode,...), which virtualisation technology (openVZ, XEN,,...), which resources (vCPU's, RAM, disks,...).

Walktroughs seldomly work out-of-the-box unless you follow a walktrough that's tailored to your exact linux distro and version AND the VPS provider you're using... Even then, there are providers that offer openVZ, KVM, Vmware,... virtualisation... There can be a different approach when using ubuntu 18.04 on ramnode's openVZ cluster vs ramnode's KVM cluster...

Bottom line: if you want some advice, it might be good if you told us which exact package from which VPS provider you purchased and which exact OS image you installed on the VM... If not, telling us which error you encounter might also help... But i don't think there's any "general" advice i can give you

Hi,

It might be a good idear to lock one of these threads:
https://bitcointalk.org/index.php?topic=5133137
or
https://bitcointalk.org/index.php?topic=5133139

It's frowned upon when you make duplicate threads (unless you're posting translations in the regional subforums)...

That being said... I do have some remarks:
1) why are you using cloudflare's SSL certificate? You realise they're basically a MITM?
2) how can you say you're the most trusted when your domain was registered less than a month ago?
3) you're not the cheapest in the market... I know i'm wearing chipmixer's sig, and i get payed by them, but they charge 0% fee if you tailor your inputs correctly... There are also other competitors of yours that charge 0.5%.

Don't take this the wrong way tough... You have a nice site, and i wish you the best of luck, my critisism was meanth to set you on the right track, not to stop you from running your business

I have never heared about the "experience point" altcoin, but if you say the wallet has a lot in common with the BTC wallet, i assume you mean bitcoin core?

If so, it's normal not to see your balance while you're synchronising. During this phase, your client downloads, verifies and parses all blocks in the altcoin's blockchain. As long as the block(s) containing the transaction(s) funding the addresses managed by your wallet are not downloaded/verified/parsed, your balance will remain 0...

If "experience point's" reference client was forked from an old version of bitcoin core, it might be a non-HD wallet. In this case, you'll need a recent backup of your wallet.dat since all private keys are randomly generated and stored in the wallet.dat (there's a gap limit tough, IIRC, usually 100 private keys are pre-generated). If "experience point" was forked from a more recent bitcoin core version, there's a big chance the wallet is HD. In this case it doesn't matter how old the backup of the wallet.dat is, since a HD wallet only stores the master private key, and from this master private key all other private keys can be derived (so it doesn't matter how old the backup of the wallet.dat is, any backup will do...).

Some good advice? Well, backup your wallet.dat onto several media... If you're unsure wether your wallet is HD or non-HD: stop syncing and use a file recovery tool to attempt to restore the most recent version of your wallet.dat. The more recent the wallet.dat version, the bigger the odds the wallet contains as much potentially randomly generated private keys as humanly possible.

So basically: stop what you're doing, backup the wallet.dat, find out wether or not the wallet you're using is HD or not...
If it's HD and you're sure you have a backup of the correct wallet.dat: continue syncing and don't panick before the blockchain is completely sync'd
If it's not HD or you're not 100% sure you have a backup of the correct wallet.dat: use a file recovery tool and try to recover the last version of the wallet.dat

I have no problem allowing a relatively small subnet instead of a single ip if that would help?

@DireWolfM14, bob123's answer is completely correct
@bob123: I did miss that point in the disclaimer, altough i did warn people i could potentially be running a modified node, so the extreme cases of abusing the flaw *could* fall under this disclaimer item

Hi guys,

It seems the public electrum nodes are being DDos'ed pretty badly lately, so i tried to setup a private electrum node using electrs (https://github.com/romanz/electrs/) using nginx as an ssl endpoint and nginx's ngx_http_access_module module to automatically deny incoming connections EXECPT the ones i manually added to my whitelist.
I have no idear wether my setup will hold if it's being attacked to.

There are a couple of things you should realise before using my service:

• I need to whitelist your public ip, so if you use my service you'll have to send your ip to me (encryption available)
• My server keeps logs... I have no intention to start digging, but if i really wanted to, i could... And since i have your public ip, forum name, timestamps, potentially electr logs (see next point) i *could* do some heavy digging...
• I didn't edit the elecrs software, but there is no way for me to prove this... So you should progress under the assumption that i *could* be running a modified node
• By only connecting to one single node, i could distort the way you look at the network... I could easily block your access to the mempool for an unconfirmed transaction making it look like you didn't get payed. I could also delay your view on new blocks, or (in extreme cases) i could deliberately go with a forked chain so it looks like you got payed but in reality you didn't... I'm not planning on any of these things, but you should operate under
   the assumption you need to verify important transactions using a thirth party block explorer
• It's a free service, i don't accept any liability... If you lose funds, your wife, your house or even your health because of me, sorry, but i won't reimburse you!
• Even if you made a donation, i reserve the right to close this service at any time for any reason, or kick anybody from my server at any time for any reason without owing anybody an explanation

If you still want to connect to my private node, send your public ip to me using a PM. You can pgp encrypt  the address using my public key, available here => https://keybase.io/mocacinno/key.asc
or even use keybase's encryption utility directly => https://keybase.io/encrypt#mocacinno

You can find your public ip by using a service like this one: https://whatismyipaddress.com/

last remarks: i realise ip's can be spoofed... This is just a quick and easy sollution... Also, electr doesn't support setting a donation address (yet)... If you want to send a tip, you can find my tipping address in my bitcointalk profile (but a tip is not necessary at all!)

After you sent me a PM, i'll reply as soon as your ip is whitelisted... I'll also send you the address to connect to. Afterwards, you can connect to my node by using the cli:
./electrum-3.3.4.exe --oneserver --server=[address i'll send you in PM]:50002:s

You can also just open electrum, click on the icon in the right bottom corner, go to the "server" tab and enter my server's address and port 50002

I just visited the site and i was allmost tempted to open an account to answer some of the questions that are asked over there... People on that forum seem to ask completely newbie questions that go completely unanswered... I kinda feel sorry for them.

I had never heared about https://github.com/romanz/electrs, but after looking into it, it seemed like a nice service to setup since it didn't require me to enable txindex and reindex all blocks (i use my node as a lightning backend, so i don't want to stop it for an extended period of time).

I'm currently running electrs and it's building an index, i've setup nginx as reverse proxy and i've setup a manual ip whitelist in nginx so i can block every connection exept the manually whitelisted ones... So if the indexing is finished, and the server starts properly (i can't make any promises), i'll be able to offer a private electrum server in a couple of hours.

Do note the following restrictions apply:

• The server will only run for as long as there's a need for a private electrum server. As soon as the DDos'ing stops, the server goes down
• No guarantees for uptime or load whatsoever... I can take the service down at any moment i want without warning
• No other guarantees either.. Either use my service or don't, but if you do: do not complain!
• You'll need to trust me... You'll be connecting to my service directly AND you'll need to send me your public ip since i'll have to add it to the whitelist (don't post your ip in this thread... Use privnote or encrypt it using pgp and send it to me using a PM and ONLY after i've announced the server to be up and running)

I realise ip's can be spoofed, but this setup was the easyest one i could come up with...

Confirmed transaction cannot be reverted, unconfirmed transaction can potentially be cancelled by doublespending the inputs of the unconfirmed transaction and broadcasting the doublespending transaction to as many nodes as humanly possible. This is something that's really hard to perform for a non-technical person, and even if you succeed in creating a double spending transaction, the odds of getting your tx in a mining nodes' mempool are really, really, really small (so the odds of success are really low).
Even if the transaction is unconfirmed, most of the time it isn't even worth the effort to try to create a double spending transaction... Only if we're talking about a thefth of several thousands of USD worth of BTC it becomes something you can try as long as the tx wasn't confirmed.

I guess you should focus on what went wrong... When you say you reinstalled "this" version, which version do you mean? Where did you download it from? Did you check the signature?

Also, addresses that "magically" change are never a good sign... Is your pc clean? do you install software from unknown sources? Do you have a virusscanner running? Is your OS patched?

Directly from https://electrum.org/#download:


Version 4 does not exist, so if you have installed version 4, you either misread the version number or you installed a fake version!

If you say that the address you were funding changed, and you funded an address you were not trying to fund, those funds are lost, the odds are pretty big you have a copy/paste virus installed on your pc, or you have a fake electrum version (as said before).

If the DDos attack continues, we can probably setup a private electrumX node for bitcointalk users... It's all written in python, so it shouldn't be that hard to add some authentication so non-invited users cannot connect. But usually those attacks don't continue that long...

I'm with Abdussamad on this one...
But my main point was twofold:

• FIRST and foremost: we can't blame the OP... He's a victim here, and i think he deserves our sympathy. He fell for a scam and lost money, everything we say is meaningless to him. The only one we can really blame for any scam is the scammer. Sure, he might use vulnerability's in order to scam his victim, but in the end it's his choice to take something that doesn't belong to him/her.
• SECOND point: the OP was victimized because he followed a popup leading him to a wrong website where he downloaded a fake electrum version. All this was possible because he ran an outdated electrum version, followed a popup that prompted him to go to an unofficial webpage and didn't check the signatures of the files he downloaded... I think he has the right to warn people about this, but i think he's sending the wrong message... If he would have made a post with the title: "warning, always check electrum's signatures, i lost xxx BTC by using a fake version" I would have agreed with him 100%, but if he makes a post driving people away from one of the better SPV desktop wallets i have to disagree with him

Now, in hindsight, i have to agree that the initial vulnerability that allowed a malicious node to send a message to it's connected users was bad... Electrum is free and open source, over it's lifetime a couple vulnerability's have been found, and all have been fixed in a reasonably short time. Other wallets will surely also have vulnerability's to.

I still recommend everybody to store his/her funds in either an airgapped wallet, a properly generated paper wallet or a hardware wallet and only use desktop wallets for storing a couple hundred bucks worth of crypto (at most). I'd also keep recommending people never to use online wallets, exchange wallets or casino wallets. My recommendation for using electrum as a desktop wallet will not change, however i have started issuing warnings for people to always double check from where they download electrum and double check the signature before running any electrum binary...