Bet between Inaba and Phinnaeus Gage.

Bet terms:  Bruno will refrain from posting false information until January 1st, 2014. False information is defined as posting any information that is false, incorrect or unverified, including overt, non-overt, implied, speculated or otherwise not backed by hard, verifiable facts and/or proof.  Posting any false or incorrect information, making any implications or posting any "speculation" or unverified information will result in an immediate loss of the bet. Posting anything other than verified and verifiable facts will result in a loss of the bet. Posting with any sockpuppet accounts, alternate accounts or trying to circumvent the bet through third party posting, whether paid or unpaid will result in an immediate loss of the bet.

The bet is considered satisfied and won on January 1st, 2014 UTC if and only if Bruno Kucinskas or his agents have posted no false, incorrect, or unverified information as stipulated above. Any other outcome is considered a loss on the part of Phinnaeus Gage as per the terms of the bet.

The bet is for 10 BTC.  If Phinnaeus wins, Inaba will pay 10 BTC to the BTC address of Phinnaeus choice.  If Inaba wins, Phinnaeus will pay 10 BTC to the BTC address of Inabas choice and request and accept a permanent ban from Bitcointalk staff willingly and without recourse or appeal.  If the Bitcointalk staff refuse to ban his accounts, for whatever reason, Phinnaeus will refrain from ever posting on Bitcointalk again, either as himself or any alternate accounts.

That probably is the least of your worries.  BFL hasn't even shipped all minirigs from last year.

What about a raw/custom formatted USB stick?

I think a real danger after disabling autoplay is the filesystem itself. There have been exploits within several kernel modules for the different filesystems (e.g. http://www.cvedetails.com/cve/CVE-2013-1773, http://www.cvedetails.com/cve/CVE-2011-4330, http://www.cvedetails.com/cve/CVE-2009-4020). I don't know how severe these bugs are and if they could have been used for malicious code execution, but I think it is reasonable to expect an existing, unfixed bug, which can be used for code execution.

A custom format, which only defines the most necessary fields to transfer the raw transaction data should be much safer. The code to read the custom format should be much simpler and thus less error prone than conventional kernel filesystem modules. Additionally, any exploit of this custom format parser will be executed in the user space and not within the kernel, because only the signing application (e.g. Armory) must read and parse the data.


My thoughts about the USB stick infection of "badBIOS":
I don't think, that it is possible for a simple mass storage device to infect a pc just by plugging in (and not reading and interpreting any data on it). The circuit to read and write data on the drive is hardwired and can't be manipulated by software (correct me if I'm wrong). This should be true for the USB host interface in the mainboard, too. So as long as there is no data transfer it is impossible to infect anything. Things might change if data is transfered. However, even then, the hard wired host interface or the kernel code which handles the usb frames must be compromised by a malformed usb frame. This however should be prevented by the hard wired circuit on the drive itself.
Don't get me wrong, I think it is perfectly believable, that a system can be compromised by its USB subsystem. This has been demonstrated with the PS3. However, a special USB frame had to be crafted for this to happen. A simple mass storage device could not do this.

In many ways, I have designed the system assuming the online system is compromised, but without the ability to spread USB viruses (easily).   As long as you check very carefully on the offline system that the amounts and addresses are what you expect, then it's an exceptionally safe setup (because we've assumed no USB viruses like this).  The data that is transferred over USB is public, non-sensitive, and contains everything the offline computer needs to fully verify all the details of the transaction.  I had even considered an operational mode where people could run just the wallet, and then send their watching-only wallets to a server, and the server would prepare the transactions for them to sign (for the people without the resources to run Armory online).  I could provide such a service confidently, because it would actually be a very safe system -- the downside would be how easy it is for the server to feed bogus UTXO information and effectively DoS the wallet (every signature produced would be invalid, thus making the system unusable -- but better than losing coins!).

So, under the offline-system-is-secure scenario, the worst that happens is having your transactions become invalid (though, you can lose coins because you didn't verify the addresses and amounts on the offline system before pressing "sign" -- the virus could exploit someone simply being non-attentive).  If the offline system is compromised, then it would be a pretty advanced virus (jumped through hidden data on USB), and thus should be sufficiently advanced to shuttle private key data back over USB.  Or hide data in transaction malleability.  Or if both systems are compromised, it just flat out jams the private key into the signature space, and tells you it's valid, and the online system recognizes and sweeps the funds to the attacker before you've even realized your broadcast transaction is invalid.

Because of this, it's worth visiting how to minimize damage of an offline computer compromise, but it's a very difficult problem and one I can't claim to solve.  Use anti-virus on your online computer, dedicate a small USB key to be used for only offline transaction shuttling, and really check all the addresses and amounts of the transactions before signing.  Also, if the transaction is sufficiently large, I recommend making a phone call to the recipient to manually verify the addresses.    This will keep you from being "low-hanging fruit" to the next piece of Bitcoin malware

So come in, barf on my nice rug, cry on my shoulder and smear your snot on my bespoke lapel.
Let it all out, vent, rage in my nice clean thread, i deserve it.
Drag your rancid carcass over to deface my abode with your insolent, shameless, leering poverty.

Do any of you trade in stocks?   It is completely different if you bought BTC instead in August since you probably would of sold them in Sept on a small increase, then sat on the sidelines saying ...'I should not of sold my bitcoins so early, I would have made quite a bit of money by now'

It's a lot easier when someone else holds your money hostage and then comment on what you 'would have done' which of course would be to perfectly play the market