The C++ i2p looked to be coming along but not stable enough to integrate, if I recall correctly what fluffypony said the last time he looked at it. That was a while ago though, so perhaps it is closer now. No specific target has been set for it though, I think the main push now is to get the database release tagged.
It's getting there, the reseeding is working and some other core functionality has been completed, but there's still a lot of work to be done to get it stable on all the platforms we support. |
|
|
|
I thought you didn't release a new wallet since last december, am I wrong?
you're thread title says "[XMR] Monero - A secure, private, untraceable cryptocurrency - 0.8.8.6"
so when was V0.8.8.6 released then?
0.8.8.6 is the latest stable release. I'll quote from the project README on Github so you can understand: "As with many development projects, the repository on Github is considered to be the "staging" area for the latest changes. Before changes are merged into that branch on the main repository, they are tested by individual developers, committed to the "development" branch, and then subsequently tested by contributors who focus on thorough testing and code reviews. That having been said, the repository should be carefully considered before using it in a production environment, unless there is a patch in the repository for a particular show-stopping issue you are experiencing. It is generally a better idea to use a tagged release for stability." |
|
|
|
Maybe some newbie accounts or some reverse monero supporter shills should stop acting like the XMR Community opened these threads.... look at the XMR Ann thread and at the Monero Speculation Thread for those that are supporters ... i guarentee that you will not find anybody besides TC, icebreaker and maybe generalizethis...
This thread with another Newbie Account is just another sign some one has an agenda... wish there were IP Bans to stop most of Sock-Puppets at once...
Just one vote was this you? Feeling awkard when devs say theres a lot of progress but the wallet wasn't updated for 8 monthsIf you think so https://github.com/monero-project/bitmonero/commits/master... i saw lots of progress... and i even compiled it myself with some help. last release was December 2014 https://github.com/monero-project/bitmonero/releasesI was going through the spam threads, and this just caused me to chuckle, especially because of your "just a Bytecoin clone" voting option. https://github.com/amjuarez/bytecoin/releases - they haven't done anything for 14 months, by your definition. Right? And I guess 1000+ commits by 28 active contributors (including a commit by Bitcoin's lead developer) is no progress? |
|
|
|
This is part of the new marketing actions in order to reach new target groups for Monero. Doubt it will be successful this way  Monero core team here. Please tell me more about our new marketing actions, since we know nothing about them. Also, I don't agree with all the threads that have been opened, and would respectfully suggest the idiots opening them direct their efforts to the Monero forum and leave Bitcointalk out of it: https://forum.getmonero.orgFeel free to quote the above message to the new thread starters. |
|
|
|
question: can we get credited for the forum specific donations? I for example donated 50 XMR to the "fund a dev" fundraising on the forum  (and some other things IIRC, I should check it) Fluffypony said you could get credited for this and if wanted it could be added to your hall of fame amount, but I am not entirely sure how it would be arranged and what the procedure is. I'll ask him to clarify. cAPSLOCK mostly maintains that list, so I'd suggest letting him know. Not everyone wants to be on the list, so it is a manual process. Typically when letting him know you include a transaction ID, and he's able to verify them with me or another member of the core team, and then Bob's your uncle (or aunt). |
|
|
|
|
I speculate that Eddie and I should stop using wide screens when checking forum changes...
|
|
|
|
|
Commit updates:
6 hours ago c8593fb Added test script to export colour of cells from Google spreadsheets.
yesterday f6cb27f Lot view connects to character view and building view, although data is still false
yesterday 296eef4 Fixed some small typos
2 days ago ca38bef Added simple dialog for giving resources
2 days ago fd31e1b Fixed small bug for showing buildings
2 days ago f7ff416 Allowed NPC status change on click
2 days ago ccea7e3 Split chatbox into seperate screen because of css maniplulation by final.js
2 days ago 850294 Added buildings view from map display screen
3 days ago b9d0c20 Fixed some layout issues now line spacing has changed
3 days ago a956310 Line spacing is working properly
3 days ago 7bf9255 Static background image stays same on non-map screens
3 days ago 13bed81 Added back button functionality, with correct placement and image
3 days ago 351dbfa Split resize code away from character screen
6 days ago f9c8358 Changed map
6 days ago 7319e0e Fixed bug that hid background on back button activation
6 days ago ff8fc24 Added back button and functionality
7 days ago 26e7940 Added building links to character
8 days ago 157921f Added wiki to new pages
8 days ago ca4d8ac Implementation of callbacks and AJAX code for single-item views works fine
9 days ago d2c648c Added missing templates
9 days ago e3e41ff Converted all old single and multiple data displays into new core single-page display
9 days ago 6a97c48 Map, chatbox and character screen integrated as original
9 days ago fa32cfc Chatbox same as original, mainly
|
|
|
|
We recently discovered that the OpenAlias plugin, shipped in Electrum 2.0 to 2.3, does not correctly validate DNSSEC records. A fixed version is in the works, and will be shipped in version 2.4. (ETA: a week) In the meantime, please do not trust aliases verified by this plugin. See the release notes for more details: https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTESTo be more specific: the way it used to work was to split the URL up into parts separated by . (ie. waffle.blah.example.com is split into waffle, blah, example, com) and then check each part (from the last to the first) as follows: 1. concatenate it with the previous parts (so if we're checking "blah" then we'd be verifying blah.example.com) 2. using the system resolver get the NS record for the domain 3. ask the main nameserver (per the NS record) for the DNSKEY for that sub-domain, pass the D0 flag (ie. tell it we want DNSSEC data) 4. if it is DNSSEC signed we should receive the RRSET, which contains the DNSKEY and the RRSIG for that DNSKEY 5. validate that the signature is correct 6. repeat for the next part This is reasonable, except it doesn't *actually* check the chain, it just checks each part of the chain. For DNSSEC to work you have to start at the root zone (which is .) as that is *the only certificate you will have on your computer*, and then you work your way down the chain, checking delegation at each point. Our checking sub-parts without delegation (and without starting at .) was lazy, and whilst it is unlikely you'd be able to cheat validation the risk is still non-negligible. The updated verification that ThomasV has written validates the chain correctly. |
|
|
|
Exactly, this should be a non-issue. I would simply ignore them, they seem to be butt-hurt over nonsense.
You mean buutt-huurt, right? |
|
|
|
Hi all - just to formally state: we're aware of the trademark claims, and after consulting with the EFF we are now working with the Software Freedom Law Center to figure out how best to deal with it. Please be aware that it is a slow process we have to work through, and there isn't much we can state publicly, until we are told otherwise by the attorneys. We will keep everyone updated as and when we are able to:) Edit: any who have received trademark complaints, who don't need to stay pseudonymous, and want to work with us on this, please email us: dev@getmonero.org |
|
|
|
Nice reply. Sufficed to say your "cooperation" would not go so far as to backdoor anything or use libs you otherwise would not have, correct?
While perhaps "we have to pragmatically recognise that the "status quo" is going to stay as it is for the foreseeable future in most countries" my concern is that things might become considerably worse, and quickly. In other words you might be be doing more listening than talking.
Don't disappear yet, we hardly know ye. On second thought, run for the hills!
Absolutely, any "assistance" would naturally be limited to what is actually achievable by blockchain / data analysis of Monero transactions (practically nothing). In fact, going down the road of trying to assist them would be an excellent education in-and-of-itself, so that's good:) Also I didn't mean I'd willingly disappear, I meant I'd *be* "disappeared" by forces unknown:) |
|
|
|
p.s. @fluffypony: do you ever worry about the future of crytographic software development in this tense/paranoid geopolitical climate? The "Man" knocking at the door?
On a completely personal level...not really. I'm more than happy to cooperate with governments, TLAs, and law enforcement, and to educate and give them guidance on how this newfangled world works. Look at how "the man" has struggled to adapt to everything from p2p distribution mechanisms to consumer-grade "drones". They don't understand Twitter or Instagram or Snapchat, they don't know how to police or govern any of it. Personal beliefs aside, we have to pragmatically recognise that the "status quo" is going to stay as it is for the foreseeable future in most countries, and it's better to help them understand potentially ubiquitous technology. The worst thing that can happen to me is that I'm "disappeared", but that's why the core team is seven strong:) |
|
|
|
As for the latter I have no idea so would also include the ? you did.
question marknoun 1. Also called interrogation point, interrogation mark. a mark indicating a question: usually, as in English, the mark (?) placed after a question. Because I was asking generalizethis if that was the correct tl;dr. |
|
|
|
I like the Monero Forum for resource gathering, but for interaction, I like HERE--it has more of a conversational feel, while the Monero....Why bother explaining; it's in the etymology.
-forum (n.)
mid-15c., "place of assembly in ancient Rome," from Latin forum "marketplace, open space, public place," apparently akin to foris, foras "out of doors, outside," from PIE root *dhwer- "door, doorway" (see door). Sense of "assembly, place for public discussion" first recorded 1680s.
-talk (n.)
late 15c., "speech, discourse, conversation," from talk (v.). Meaning "informal lecture or address" is from 1859. Meaning "a subject of gossip" is from 1620s (in talk of the town). Talk show first recorded 1965; talk radio is from 1985.
-talk (v.)
c. 1200, talken, probably a diminutive or frequentative form related to Middle English tale "story," and ultimately from the same source as tale, with rare English formative -k (compare hark from hear, stalk from steal, smirk from smile) and replacing that word as a verb. East Frisian has talken "to talk, chatter, whisper." Related: Talked; talking.
To talk (something) up "discuss in order to promote" is from 1722.
tl;dr - Bitcointalk is for gossip, Monero Forum is for discussion? :-P |
|
|
|
Do you need help in Portuguese translation?
It's not so much the translation itself, though help will be most welcome when the time comes. I'm stuck at understanding the translation framework (if one is at all in place already, or perhaps planned for later on). Reference location for any related followup: Translating GetMonero.orgCan't keep a straight face reading your nick bytemuma Just replied to that thread with details |
|
|
|
2015-Jun-21 12:35:33.245248 Initializing cryptonote protocol...
2015-Jun-21 12:35:33.246312 Cryptonote protocol initialized OK
2015-Jun-21 12:35:33.246458 Initializing p2p server...
2015-Jun-21 12:35:33.919206 Set limit-up to 128 kB/s
2015-Jun-21 12:35:33.920365 Set limit-down to 128 kB/s
2015-Jun-21 12:35:33.921370 Set limit to 128 kB/s Now I understand why it took me 5 days download the blockchain but I do not understand why putting limits if one wanted them did set them alone When we didn't have QoS then we had people complaining about the bandwidth usage. Now we have QoS and a sane bandwidth limit, and people are complaining about it not using enough bandwidth:-P |
|
|
|
If the actual input to a transaction (in Monero terminology this is the output of the prior transaction) is not also an input to another transaction's ring signature (and when all the other inputs to the ring are spent) or if it is also the input to a subsequent ring in which all the other inputs were outputs created after the said transaction was created, then the anonymity of the said transaction is entirely unmasked.
This is really what MRL-0004 deals with (the section on Temporal Association attacks). A lot of this changes with the recommendations MRL4 made, which will come in a hard fork later this year (once we've established a forking strategy, per this forum post). I don't check this thread, so if you reply and don't hear back from me in a couple of days just send me a PM nudging me:) |
|
|
|
A friend of mine wants to test Monero. He already created a account on MyMonero.com. Is there a site / faucet to get a little amount of Monero to play around?
There isn't a mainnet faucet that I know of, but there is a testnet faucet: http://monerotap.com |
|
|
|
Fluffy - Just on the cookie issue because that's what i'm looking at, MyMonero is definitely serving the account.js?2 verison *with* the priv key being sent to the server in the cookie on every http request (so like 10 times on every page refresh and I think there is even a keep alive to send it up too...)
Ok so just to clarify: with AngularJS you basically just get index.html + a bunch of JS files, and then it gets "partials" (kinda like views in an MVC pattern) as it needs. BUT that's just static files. The stuff that is polled regularly / any actual interaction with MyMonero is done through the API. Now the MyMonero API is on a different domain (api.mymonero.com), so cookies are never sent to it (the cookie was explicitly for "mymonero.com", not ".mymonero.com" which would have included subdomains). So the risk we identified with it (ie. why we dropped that functionality) was because it would be included in static object requests, which is something that the developer who added that functionality in the very initial version never considered. ...same on Firefox / Chrome / Tor and from a few different locations so it is being served, for whatever reason, at least for me.
And on the web-archive you linked that's indexed today, it's there too if you just change the query string to a 2:
I understand that - what I meant is that ?2 should never be served by index.html:) Seems like something that should be fixed pretty quick e.g. just delete that code from the server and I would guess existing users need to be alerted that they may have had cookies with their priv key stored in clear-text on disk that can be recovered potentially unless it's been manually shredded?
That code hasn't existed on the server (except as a git blob) for ages, so there's nothing to delete on that side. When you add ?2 to the file you're being served a cached file somewhere along the line, which is why I went and cleared a bunch of things server-side that could be caching it. I suspect the reason that actual file can still be accessed is because CloudFlare has longer lived caching on some of their endpoints. But beyond that nobody should ever be served ?2, so the caching of the actual JS should be/have been largely irrelevant. Re: shredding, we don't log static object requests, as that just clutters the log, and we've never logged cookies (even when we do receive them). Since all the heavy lifting is done client-side, and then on the server side by the API, the static objects are just cached aggressively and served as quickly as possible. Logging would interfere with that. We also don't log much of anything else, because I don't want to have an environment where I've got metadata that can be requested by LEA. One question about your comment: "As mentioned, there's little to no useful information I can gleam from MyMonero that would give me some edge in trading."
...but with the private keys being sent up to the server, that could be used to get a picture on distribution / richlist, plus if you see some of the large balances going up or down with withdrawals / deposits, wouldn't that be good for predicting pumps and dumps? (as statistically most of it I guess would be to Poloniex)
I appreciate what you are saying, but MyMonero has been live for what a year now (?) with the private keys going up to the server so assuming you fix it now, it has been happening up to this point.. at least for some people.......
Nowhere near a year:) It's been up since the end of last year (so about 5 months), and as mentioned above private keys weren't going to the API, and static requests weren't logged. ...So potentially some accounts are compromised and need to have funds moved because if those keys were intercepted in transit (like man in the middle / cross domain cookie hack / server breach / data retained on server was hacked) then those coins can be stolen at some point in the future too?
Yes absolutely to the MITM risk that existed with that code snippet, or to the risk that I'm outright lying and we've logged everything. But, at the same time, the risk profile doesn't change: if I really wanted to I could serve up some obfuscated JS buried deep in the code (not obvious and outright like you've seen) that surreptitiously sends me private keys. That's the risk you take with any webwallet, Bitcoin or otherwise, and that is why it doesn't matter how much is done client-side, you still have to trust the operator 100%. I don't think (or hope) that anyone that uses MyMonero is under any illusions there. They have to trust me, it's the nature of using a web wallet. How come there is the secrecy too, why is the backend closed source, and also why no indication of how many people use MyMonero - yes its private but you know yourself as do Google Analytics so why not share this with everyone?
It's a commercial project that cost a lot of money to develop and build out by a small team of accomplished developers. This isn't something I hacked up on a weekend, and I'm also not the only owner (Risto Pietilä owns half of it). There's no secrecy with the backend, it's just a commercial project that isn't going to be made open-source just yet. We do have long-term plans to provide a user-hostable version, but right now it's just too complex and "delicate" to release. No you can't have an indication as to the userbase for two reasons. Firstly, it's a commercial project, and the Google Analytics stats are not public. Secondly, even if I provided stats on the number of viewkeys it's all rather meaningless, as it's really easy to create multiple accounts. Do you plan to keep MyMonero going and as the #1 option for a wallet presented to users? - how does that tie in with Monero being designed for untraceability / security, it doesn't seem to be achieving that?
No, it'll be replaced by Monero Core as the first option when that is completed. MyMonero fills a usability gap that couldn't be filled with Monero Core fast enough, and there was (and is) a need for those that are interested in tinkering around with Monero to have something that they could use. I would never, ever recommend anyone store large quantities of value in Monero itself (which is somewhat trivially attacked by a motivated attacker with enough mining power) and definitely not in MyMonero. But overall I think you misunderstand what Monero is trying to achieve. It's not designed to be some super-secret currency that is so private that nobody even knows it exists. It's not designed to fill some specific use-case like "buying dildos on the dark web". It is designed to be truly fungible, sure, but that is only one aspect of its design. Things like our eternal emission (to retain mining incentives), or the move to a 6-month rolling hard fork window, are there to make Monero useful. Things like OpenAlias, and the slowly-increasing easy-to-understand content on GetMonero.org, are there to make Monero usable. Transactional privacy is a core feature, but even that is not yet complete (eg. we still have to implement the changes posited in MRL-0004). We ultimately want Monero to be easy to use by everyone, whether they're very familiar with cryptocurrencies or not. |
|
|
|
|
Show Posts
