This vulnerability only exists in 5.3.9 -- not older versions. (5.3.9 itself contains a security fix, though of lesser severity.)

In order to collect more money for the creation of good forum software, the forum is selling ad space in the area beneath the first post of every topic page.

Ads this week will be allowed to contain any non-annoying HTML/CSS style. No images, JavaScript, or animation (no marquee or blinking). Ads must appear 3 or fewer lines tall in my browser. Ads will be prefixed with "Advertisement:". Ad text may not contain lies, misrepresentation, or inappropriate language. Ads may be rejected for other reasons.

There are 10 total ad slots which are randomly rotated. So one ad slot has a one in ten chance of appearing. Eight of the slots are for sale here.

The ad lasts 7 days starting from when I put it up.

Stats: On the 20^th of November, 2011, there were about 120,000 views of topics. So one slot would have appeared around 12,000 times per day. The ad doesn't appear on topic pages with only one post, though, and it only appears for people using the default theme. Total views per day on more recent days (in February):
- 1^st: 126744
- 2^nd: 122348
- 3^rd: 124688


Efficacy stats:
https://bitcointalk.org/index.php?topic=54182.0

Info about the current ad slots:
https://bitcointalk.org/adrotate.php?adinfo

Auction rules

Post your bids in this thread. Prices must be stated in BTC per slot. You must state the max number of slots you want. When the auction ends, the highest bidders will have their slots filled until all eight slots are filled.

So if someone bids for 8 slots @ 5 BTC and this is the highest bid, then he'll get all 8 slots. If the two highest bids are 8 slots @ 4 BTC and 1 slot @ 5 BTC, then the first person will get 7 slots and the second person will get 1 slot.

- When you bid, all of your previous bids are automatically canceled.
- All bid prices must be divisible by 0.5.
- The bidding starts at 0.5.
- The auction end time is 02:00:00 on February 13, UTC. Countdown. (The end time may be extended -- see below.)
- If two people bid at the same price, the person who bid first will have his slots filled first.
- Bids are considered invalid and will be ignored if they do not specify both a price and a max quantity, or if they could not possibly win any slots

If any valid bids occur less than 30 minutes before the auction end time, then the auction will be extended by 30 minutes. If any valid bids occur less than 30 minutes before the new end time, then the auction will be extended again, etc. The time will not extend beyond 6 hours total.

You must pay for your slots within 24 hours of receiving the payment address. Otherwise your slot may be sold to someone else.

Recently I've been reading many reports of problems with Paysafecards. Probably they are not much safer than PayPal.

He needs to PM me.

Limiting it technically is difficult and not worth my time. Anyone with a huge signature is just going to get banned.

I just recommended to someone in a PM that they create a 1-post locked thread to contain extra info that they didn't want to clutter up a main topic post with. I really think they are useful in some cases.

When they are annoying, mods should delete them. Report ones that you find annoying.

Locking your own topics in general is allowed so that OPs can disassociate themselves somewhat from topics that they no longer agree with. Otherwise their names would be attached to the active topics forever. It's also useful for trade topics that become closed.

Donators can do it themselves. PM me otherwise.

That could only be a problem in the event that <50% of the mining power upgrades. This is nearly impossible because miners know that they will eventually lose when fighting against the development group. The percentage of clients ignoring the disagreeing miners' blocks will grow forever because everyone downloads the client from bitcoin.org. The development group could also send out alerts and get like 95% of users to upgrade in days, though this will probably not be necessary.

I can only see "turbulence" happening if the largest pool ops totally disregard their profitability in order to fight against the new rules. Hopefully no proposal bad enough to elicit this response would make it through the process.

Those are mostly spam accounts.

I'd guess 20:1.

Non-miners can reject blocks. If enough clients do this, the coins miners mine will become worthless.

I prefer traditional iteration-based hashing. Its properties are better-known. I'd probably just use crypt(). (With a modern hash algorithm and many rounds, of course.)

Miners (as a group) should not be given any say over issues like this. They do not necessarily know what the best option is. The issue should be decided by people very familiar with the protocol and the proposals.

I suggest that we compile a list of everyone who knows a lot about the Bitcoin protocol, invite them to a two-week discussion via email, and have those who participate in the discussion vote on the issue at the end of the two weeks. If one proposal gets enough votes (two-thirds, say), then Bitcoin clients will be programmed to apply the new restrictions ~3 months in the future. Miners will have to upgrade by then or their blocks will not be recognized by most clients. If there aren't enough votes for any proposal to pass, the issue will be shelved for a while.

I don't have a problem with them unless they get annoying. Sometimes they are useful for announcements.

That stuff is totally unrelated to BIP 16. It was removed because 2112 was using that BIP number without having it assigned to him.

In order to collect more money for the creation of good forum software, the forum is selling ad space in the area beneath the first post of every topic page.

Ads this week will be allowed to contain any non-annoying HTML/CSS style. No images, JavaScript, or animation (no marquee or blinking). Ads must appear 3 or fewer lines tall in my browser. Ads will be prefixed with "Advertisement:". Ad text may not contain lies, misrepresentation, or inappropriate language. Ads may be rejected for other reasons.

There are 10 total ad slots which are randomly rotated. So one ad slot has a one in ten chance of appearing. Eight of the slots are for sale here.

The ad lasts 7 days starting from when I put it up.

Stats: On the 20^th of November, 2011, there were about 120,000 views of topics. So one slot would have appeared around 12,000 times per day. The ad doesn't appear on topic pages with only one post, though, and it only appears for people using the default theme. Total views per day on more recent days (in January):
- 19^th: 127552
- 20^th: 125483
- 21^st: 120847
- 22^nd: 119003
- 23^rd: 125836


Efficacy stats:
https://bitcointalk.org/index.php?topic=54182.0

Info about the current ad slots:
https://bitcointalk.org/adrotate.php?adinfo

Auction rules

Post your bids in this thread. Prices must be stated in BTC per slot. You must state the max number of slots you want. When the auction ends, the highest bidders will have their slots filled until all eight slots are filled.

So if someone bids for 8 slots @ 5 BTC and this is the highest bid, then he'll get all 8 slots. If the two highest bids are 8 slots @ 4 BTC and 1 slot @ 5 BTC, then the first person will get 7 slots and the second person will get 1 slot.

- When you bid, all of your previous bids are automatically canceled.
- All bid prices must be divisible by 0.5.
- The bidding starts at 0.5.
- The auction end time is 02:00:00 on February 5, UTC. Countdown. (The end time may be extended -- see below.)
- If two people bid at the same price, the person who bid first will have his slots filled first.
- Bids are considered invalid and will be ignored if they do not specify both a price and a max quantity, or if they could not possibly win any slots

If any valid bids occur less than 30 minutes before the auction end time, then the auction will be extended by 30 minutes. If any valid bids occur less than 30 minutes before the new end time, then the auction will be extended again, etc. The time will not extend beyond 6 hours total.

You must pay for your slots within 24 hours of receiving the payment address. Otherwise your slot may be sold to someone else.

He was given a 3-day ban on January 10. He's not banned now.

Two of the people with compromised accounts report that they were using the same password they used on MtGox, so it seems likely that the MtGox list is the source.

You were right about epii. I found another IP and set of users taken by the attacker:
50.30.33.111
darvil, epii, Clarithium, borito4, tachi641, pharno, Iyeman

Montico == account-stolen

I'm pretty sure these accounts were compromised, so I've marked them all as scammers:
bitbetter
Gluskab
brunoshady
killer2021
kuba_10
Sjalq
madload

It looks like the attacker is just trying a few super common passwords on a bunch of user accounts.


He's using very different IP ranges, at least.