Yes, looks like SROs need to get organized ASAP.

https://www.sec.gov/news/public-statement/enforcement-tm-statement-potentially-unlawful-online-platforms-trading

Hi cryptokangaroo,

Thank you very much for your support.  We're focused on building a great organization and are looking forward to working with a wide spectrum of the ecosystem to advance our shared goals.

Best regards,
Ben

My organization is working on a good set of objective standards that can be applied to rating a variety of ICO/ITO offerings as well as the quality of other crypto-related projects such as non-ICO cryptocurrencies, exchanges, payment gateway code, etc.  All of these have some overlap in evaluation criteria but also some criterions that are specific to the type of project/entity being evaluated.

These standards will be fully public and open-source (code)/open-license (documents).  It's important to have voluntary, baseline standards, it will help both new businesses demonstrate a level of competency in their projects, as well as existing businesses ensure they are following best-practices.

I've seen way too many hacks and scams.  My organization is an incubator for projects to help them emerge as first-class businesses. While considering how to quantify the various factors that go into a successful project launch, we decided on standards development.  Then it was pretty easy to decide that the industry as a whole could really make good use of these standards, which would evolve and be updated over time, with participation by any parties that want to be a part of the process.

Best regards,
Ben

I agree that the change to IRC Section 1031 sucks.  It certainly increases the recordkeeping burden, one thing that you may want to discuss with a tax advisor is looking at how different methods of determining cost basis can change your capital gains.  The optimal basis is very specific to a person's trading patterns, so it's something that you'd need to seek individualized advice on.  One thing I am pretty sure of is that cost basis can be specified on a transaction by transaction basis.  This makes that burden previously mentioned even more but could result in significant savings.

Eventually, we need IRS to recognize cryptocurrency as currency.

We will get there.

Best regards,
Ben

Thank you very much for your response. Yes, I had reviewed the BIP and I was thrown off by one of the examples of invalid addresses:


I see now in the spec it states that if there's multiple separator "1" characters, the last one is considered the separator.  But for Bitcoin the addresses will begin with "bc" pre-separator.  If I'm reading the spec correctly, I think in the above example, besides the HRP length being exceeded, the data area must also be missing, as the "569pvx" is the checksum.

I am very impressed with the considerations that went into this address specification.  I've worked with DOD projects (IUID/UID) that did not take into account all of the real-world factors that have been addressed in this BIP.

I am going to clone Nullius' code and mess around with it.

Thanks again!

Ben

My comment when I saw this is that they should really have the QR code point to a redirectable URL.  If their address was compromised for some reason, it'd be a pain in the ass (perhaps literally) to have it changed.

Hey, realsteve, here's a pic for you:


Enjoy,
Ben

As far as I'm concerned, lazy developers that overlap their address space with Bitcoin are demonstrating a lack of concern about the funds that will eventually be conveyed on their blockchain.  But you're right, they'll do the absolute minimum. (sed -i 's/Bitcoin/Shitcoin/g' *)

Hey while I'm thinking of it, I had a question about the prefix on a bech32 address that wasn't apparent when I read the BIP.  Does the prefix have to exactly match, i.e. "bc1" or "tb1", for example?  Would either of these prefixes pass muster: "bc1xyzabc1" or "xyzabc1bc1"?  If so, which one is the proper one if you were to include additional human-readable information in the prefix?

If anyone knows the answer to that, I'd appreciate it.  Otherwise, I'll check out the code.

Best regards,
Ben

Yes, you are absolutely right.  I don't know what I was thinking, the only way you could exclude from CloudFlare is with a subdomain.  Anything else would terminate SSL on their side, even if there's another SSL connection between CF and BCT.

I thought that potentially BCT's IP was known/listed somewhere since it was known by all of our DNS resolvers before CF came into the picture, but a quick Google search didn't turn up anything, so perhaps not.

I had no idea they were doing what I assume is some sort of browser fingerprinting with javascript.  That makes it even worse.  I remember reading last summer, in connection with some white supremacist website that was being shut down by hosters, CF, even the domain registrars, that CF made a claim that they provide service to some high percentage of all global web traffic.

I can't find the number now, and while I certainly am not supporting that website or that sort of hate, I also don't believe that an entity should have such a high percentage of control over internet traffic.  With very little exception, anytime there is high concentrations of power in the hands of a few, the power is abused.

Which of course 99.9% of the people reading this are well aware, considering we are on the Bitcoin Forum.


I agree with each of theymos's statements here.  The need for large sites to use one of just a few services that provide high-capacity DDoS mitigation is just another point of control.  I don't know if the "intelligence" agencies own Cloudflare or not (would not be surprised), but I'm betting they have a nice convenient backdoor regardless.

HTTPS as a centralized protocol will hopefully be obsoleted by better, decentralized ways of propagating HTML.  I look to IPFS as an interesting approach that may be part of that solution.  Also, considering that multicast in IPv6 might actually properly function instead of crap implementations from ISP to ISP, that could be a great way to save on needless duplicative packets for broadcast data (such as Bitcoin blocks, for example).

The cost that Protonmail incurs for independent DDoS mitigation is ridiculous.  It's almost a form of extortion.  Watch it turn out that these companies are behind the DDoS attacks themselves, nothing suprises me anymore as to the lengths that greedy people will go to.

---

I don't support ICOs for everything under the sun, nor are distributed ledgers code that solve all problems of humanity.  Both of these things are tools that have proper uses and, unfortunately, many attempts at applying them well beyond their competencies.  If I had a spare 10 or 50 BTC I would certainly donate it to this forum because it has taught me so much over the years and remains one of the few gems that remains free from moderation for political reasons.  Despite many complaints I've read, I believe the new merit system will make big impacts on the number of crap posts and improve the fidelity of the forum.

Personally, I would never want this forum to be closed or behind a paywall of some sort.  I believe that community communication benefits all those that pursue truth.  When it comes to information, such as the discussion that takes place on this forum, everyone should be able to openly share their views.  This is a big part of the reason that the world is increasingly being seen as the huge corrupt racket that it is, and has been for many decades, even centuries.  We just couldn't share our findings with each other easily before.  Because we can now, we've been able to build off of each others knowledge, as a collective, that can be expanded upon.  This is the power of the Internet, the ability to communicate your message to the world instantly.  Next phase, to pull that corruption down and rebuild it with better, more fair and transparent constructs.  Bitcoin being the very first of those, and arguably the most impactful as it goes straight to the core of the corruption, the banksters.

Best regards,
Ben

Here's a link to report phishing websites.  I just reported them, but potentially more reports would push this site to the top of the list to be reviewed.  I assume if they get enough reports, it will become one of those "red page" warning screens.  I also looked and it appears that Firefox and Chrome both use Google's list:

https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

Best regards,
Ben

For the downloads problem, if the downloads do not require you to be logged in, accessing the BCT server by its direct IP address and/or a DNS record that resolves to the IP should make it accessible, provided BCT hasn't blacklisted all non-CF IPs.

For the website issue, how about 2FA, that could help the situation?  As you know, anytime a CDN has your certificate, they can intercept your traffic if they choose.

You could also make a login URL that is not routed through CF.  I don't know how much hacking of SMF it would take to implement that.  Actually, cloudflare might have a way to direct certain URLs to directly point to the backend (BCT) servers.  I haven't messed with them in a while, since before they started doing their shared SSL service, so I'm not positive about this.

On the other hand, this might not address the problem that putting in a CDN was designed to prevent.  If the DDOS attacks were directed to the login URL it would then be vulnerable again.

I have an inherent distrust of infrastructure services that I don't control, which is why I try to avoid CDNs.  However, I have no website with as much traffic as BCT, so have never had to deal with that situation.

Best regards,
Ben

Hi all,

I try to, as much as possible, avoid the dumb, repetitive posts that really contribute nothing to the discourse here.  In so doing, I run across posts that I feel deserve merit but I don't have any to give, so I've begun to bookmark them to revisit and merit when I can.

One potential idea that might be considered by those that decide (theymos) on such things, a little down the road after the merit system has matured some, is to consider giving some amount of "bonus" sMerits to accounts at the time that they level up (excluding the levels with 0 merit requirements).  For example, if achieving Full Member level gives a person, idk say 10 sMerits, it could help to improve sMerit distribution.  This "bonus" should not accrue to an accounts Merits, only their sMerit count.

Best regards,
Ben

I've ALMOST done the same, after Googling something.  Beware, it is just a way for them to take your password.  They don't actually have the passwords for accounts on Bitcointalk.org, so it's an elaborate mirror phishing scam.  Some of these sites can steal your password even if you don't press the submit form, as they have AJAX code that runs in the browser that will send what you're typing to their server (similar to how autocomplete works on google.com, for example).  So it's a good idea to change your password if you've ever been tricked into even beginning to type this sites password.  I use KeePass for this reason, I don't know many of the passwords I use, KeePass does.

Here's something you can do to make sure you never reach that site, redirect bitcointalk.to to 127.0.0.1 (localhost).  In Windows this is done as follows:

1. Open Notepad or another text editor AS ADMINISTRATOR.  If you open it as a normal user, it won't allow you to write to your hosts file.

2. Use File | Open to open this file: C:\Windows\system32\Drivers\etc\hosts (Note, the file has no extension. This is proper.)

3. Add the following, on a line by itself, to the end of your hosts file:

4. Save the file.

Now, any time your browser does a DNS lookup for "bitcointalk.to", it will resolve to the loopback/localhost IP and you'll get a timeout, since you're not running a web server.

You may have to reboot for this to take effect, but I don't think so.  If you want you can do a command prompt and "ipconfig /flushdns" should take care of it.

Hope this helps, that site should really come up redlisted in browsers.  Not sure why it doesn't.  Maybe I'll report it today.

Best regards,
Ben

I think if an entity was created for the sole purpose of evading U.S. securities law that they would absolutely be out to get you.

So the question can better be framed as, how do you not violate U.S. securities law but create a structure that U.S. persons or businesses could participate in?

Most of the securities laws are designed to protect investors from fraudulent investments, not the other way around.

As a U.S. person, I can buy shares of a foreign corporation, for example.  Provided I do not evade taxes, and I make an FBAR filing to FinCEN and the form 8938 to IRS, this is perfectly legal (except with respect to entities that are subject to U.S. economic sanctions, of course).

This is a tricky legal area and you should really seek expert advice of competent legal counsel before attempting something that could expose people to civil and potentially even criminal liability.

Best regards,
Ben

Good luck recovering your wallet, I hope you can get it.

After though, I suggest that you implement a better solution for secure storage than just throwing a wallet.dat file on a VPS.  Businesses that host VPSs, even reputable ones, have curious techs that can look through VPS filesystems, oh you know, maybe for a file that has the name wallet.dat.

I don't know what you use Bitcoin for on a VPS but depending on the application you should move backend systems either internally (my choice) or in some other way into a much more secure setting than a VPS.

Best regards,
Ben

I recommend you use this before considering an outside service. It is pretty easy to install and run.

I'm sure you know this, but absolutely do NOT give anyone your WALLET.DAT file for any reason.

Good luck with your wallet cracking!

Best regards,
Ben

nullius is the real Bitcoin.

I am not sure about all of my most recent 20 posts, at least a few in there are probably rather short posts as the context wasn't appropriate for a needlessly long and detailed post.  But I don't think I would be considered a spammer, I do try to share what I know or my thoughts on a given topic.  I try to contribute where I can, I think the merit system is a good approach to improving post quality. Of course, I recognize that any adjustment is something that takes time and often generates controversy.

Best regards,
Ben

Hello Maryann,

Thank you!  We know we're going to do great things.

We are working on some partnerships to announce next week.  Hope you have a great weekend.

Best regards,
Ben

I strongly disagree with my government acting this way.  They abuse their position of dominance and this is one of the things that attracts me to cryptoassets, overcoming these financial gatekeepers.  It's not immediate, and in the end I believe that the governments will see some advantage in doing the same, but only after they've tried everything else first.

This quote comes to mind:


Best regards,
Ben

The market has to demand that services and exchanges support the features/improvements that they want.  Service providers are not inclined to do any more work than their customers demand until they reach a point that they have to expand functionality in order to attract new ones.  It's unfortunate, but unless the business sees a direct benefit (ROI) to implement this or that, they have no incentive.

But, like the very careful and deliberative improvements in Bitcoin Core, they also need to be careful with deploying upgrades to their platform.  If I were an exchange, I'd hope I'd be able to have some staff engaged in the evolution of Bitcoin, at least aware of what is coming so that code to support potential PRs could be written and begin QA when it was still in pre-release.  I know there are extra costs involved in doing that, but I also see extra benefits and believe that key influencers in the market would also notice and that could be a benefit from a marketing perspective.  I think it's responsible for any major crypto business to figure in enough of a testnet infrastructure as well as a certain amount of payroll that would subsidize staff participation in the underlying open source projects.

That's my view, I don't believe that every business should wait until something is "in Core" before they begin planning for things that are very likely to be in the next release.

Best regards,
Ben