 Show Posts
|
|
Pages: « 1 2 [3] 4 5 »
|
|
I am working on a pool server/backend based on gevent with the multiminer protocol. It uses greenlets so it *should* theoretically scale to thousands of connections with minimal cpu and memory overhead. Right now it is humming along with 16 connections running at less then 0.5% cpu. I just finished up the workqueue thingy and notification on new block. I need to post it on github sometime once I stop being lazy. Also I need someone to go over everything to make sure I didn't f*ck something up.
There is still a long ways to go before it would be "production" ready. >_<
|
|
|
|
You mean aside from the incentive to walk away with thousands of dollars worth of bitcoins?
Those are blackhat incentives. You need to make the incentive large for skilled whitehats to care. So you are saying you wouldn't take the chance at walking off with tends of thousands of dollars worth of hard to trace currency? The only difference between "white hat" and "black hat" is that one has decided the risk isn't worth the reward. |
|
|
|
|
You mean aside from the incentive to walk away with thousands of dollars worth of bitcoins?
|
|
|
|
Has anyone seen this floating around today, sure hope is false;
--tradehill bitcoin exchange user/hash passes out now
pastebin
That is some guy looking for an idiot to scam. |
|
|
|
There are actually worst hosts like bluehost. Chances are if they list UNLIMITED bandwidth, disk space, etc they are retardedly overcrowded and will disable your site once it gets hit by more then a small breeze. |
|
|
|
|
Try connecting a monitor to see if the console is responsive when it goes out as it might be a bad network port. Maybe try starting one card or the other and see if it runs fine.
|
|
|
|
So you're telling me that I can't intentionally write beyond my own memory pointers in C++ on a VPM? Nonsense.
You can't even do that on most modern OSs. Write a program and try to write outside of the programs bounds and see what happens. |
|
|
|
If you successfully compiled or uploaded a packet sniffer on virtual machine #1, it will sniff packets for every other virtual machine on that box.
Each virtual machine is bound to their own IP address so you can't listen to other machines on the same box. You however could listen to any broadcasts on the local network, or anything else a bare metal server could do. It is the same physical card in the same physical machine. C++ is quite powerful. Except you don't have access to the device. In a VM you have a virtualized device you interact with and the host OS forward packets from the hardware. Saying a language is powerful is pointless. Most are touring complete so you can accomplish the same task in any of them. I don't need access to the device. I need access to the memory. Or are you going to tell me that they have separate memory sticks too?  Go ahead and write to the memory, you wont be able to address it so it is pointless. Just because you can compile a program on a machine doesn't mean you can access a device without root access. |
|
|
|
If you successfully compiled or uploaded a packet sniffer on virtual machine #1, it will sniff packets for every other virtual machine on that box.
Each virtual machine is bound to their own IP address so you can't listen to other machines on the same box. You however could listen to any broadcasts on the local network, or anything else a bare metal server could do. It is the same physical card in the same physical machine. C++ is quite powerful. Except you don't have access to the device. In a VM you have a virtualized device you interact with and the host OS forward packets from the hardware. Saying a language is powerful is pointless. Most are touring complete so you can accomplish the same task in any of them. |
|
|
|
You also place an inordinate amount of trust on the jail system of the OS -- making sure that the various virtual machines can't see each other across the harddrive(s) they share.
They don't share any partitions. In fact each virtual machine has their own install of an OS and they can't mount other volumes from the host machine. And lastly, you'd be sharing SQL database access with everyone else on the virtual machine. That could open up vulnerabilities if permissions are not exactly right.
No. Each machine runs their own services. Each VM will have a web server, sql, etc or whatever else the operator wants. This depends on the setup. I derped a little. But it is exceptionally hard to get past the hypervisor to access other customers. |
|
|
|
You also place an inordinate amount of trust on the jail system of the OS -- making sure that the various virtual machines can't see each other across the harddrive(s) they share.
They don't share any hard drives. In fact each virtual machine has their own install of an OS and they can't mount other volumes from the host machine. And lastly, you'd be sharing SQL database access with everyone else on the virtual machine. That could open up vulnerabilities if permissions are not exactly right.
No. Each machine runs their own services. Each VM will have a web server, sql, etc or whatever else the operator wants. |
|
|
|
|
If you are using phoenix with guiminer I don't think it supports listing the accepted/rejected in the interface.
|
|
|
|
If you successfully compiled or uploaded a packet sniffer on virtual machine #1, it will sniff packets for every other virtual machine on that box.
Each virtual machine is bound to their own IP address so you can't listen to other machines on the same box. You however could listen to any broadcasts on the local network, or anything else a bare metal server could do. |
|
|
|
Yes, but I don't enter my password on my phone. So the hacker would still need to get that. <3
I am not disputing that the security levels are different with different methods, and one has to assess what level would be acceptable in a given context. What I am disputing is your bizarre claim that PGP/GPG signing/verification of a unique token isn't a valid second factor authentication. Cheers, For the same reason email tokens don't work. If they hacker compromises your system "what you know" is no longer a valid form of authentication. And since they have access to your system they can also nab your private key. <3 |
|
|
|
You are entering it with a keyboard no? Then software can log it. Given enough time and resources your solution falls if the hacker gains access to your machine.
Again: come on, dude — there could be malicious apps on your phone, too. This doesn't make it less a 2-factor authentication method, it just implies a different security level with different methods. Cheers, Yes, but I don't enter my password on my phone. So the hacker would still need to get that. <3 |
|
|
|
You are entering it with a keyboard no? Then software can log it. Given enough time and resources your solution falls if the hacker gains access to your machine.
I could use a virtual keyboard to enter the passphrase with e.g. the mouse. I can agree that using PGP/GPG as the second factor is probably less secure than e.g. a mobile app, and if you think it doesn't meet your security level requirements, you shouldn't use it, but I strongly disgree that it cannot be used as a second factor in authentication. Cheers, Most "software" keyboards send the same signals to the OS as if you were using a hardware device, hence it will be logged. |
|
|
|
And if the hacker has your phone, he also pwns your OATH app == 2nd factor requirement not met, using your logic.
Then he has to get past a 3rd factor, my pin. Come on, dude. My GPG private key is protected by a long passphrase that I haven't stored anywhere except in my brain circuits. There's no way an intruder could sign a unique challenge with my private key (except threatening me physically to disclose it, but he could do the same with your PIN). Cheers, You are entering it with a keyboard no? Then software can log it. Given enough time and resources your solution falls if the hacker gains access to your machine. |
|
|
|
In a compromised machine the hacker has access to both factors (password + private key)
(I don't store passwords on disk, so a hacker wouldn't have access to my password.) And if the hacker has your phone, he also pwns your OATH app == 2nd factor requirement not met, using your logic.
Then he has to get past a 3rd factor, my pin. |
|
|
|
Another possibility is GPG/PGP authentication, […]
That sounds entirely complicated and doesn't meet the 2nd factor requirement. I never said it was simple, just that it is a possibility. How come you think it doesn't meet “the 2nd factor requirement”?. The steps I see are: 1. First you log in using the usual username/password combo. 2. Before you're let into the account, the exchange presents you with a unqiue token. 3. You sign the token with the previously agreed on key. 4. The exchange verifies the signature and the token. Cheers, In a compromised machine the hacker has access to both factors (password + private key) |
|
|
|
Another possibility is GPG/PGP authentication, much the way we do it on the #bitcoin-otc IRC channel. When you enable 2-factor auth on an exchange you could upload the pubkey you wish to use. When you have to authenticate yourself you have to sign and upload a unique challenge string that the exchange creates for the session.
Cheers,
That sounds entirely complicated and doesn't meet the 2nd factor requirement. |
|
|
|
|
