Bitcoin Forum
May 24, 2024, 01:51:22 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
  Home Help Search Login Register More  
  Show Posts
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 [31] 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 »
601  Local / Альтернативные криптовалюты / Re: [NXT] Nxt crypto - немного инфы, и самих NXT. on: January 05, 2014, 09:48:59 AM
Это ж главное в мире маркетинга!
Такое ощущение, что кто-то так на курсе играется. Биржа умирает - курс падает. Биржа поднимается - курс растет.
Дык. Всегда ж так. Бтц-е вон чуть что - сразу "ддосят". И кто его знает, то ли действительно, то ли они мутят что.
602  Local / Альтернативные криптовалюты / Re: [NXT] Nxt crypto - немного инфы, и самих NXT. on: January 05, 2014, 09:38:57 AM
А что опять  с dgex.com случилось? Опять лежит.
Да опять что-нибудь чинят или дезигн меняют.
ахах опять первую страничку изменят?  Grin Grin
Это ж главное в мире маркетинга!
603  Alternate cryptocurrencies / Announcements (Altcoins) / Re: Nxt :: descendant of Bitcoin - Updated Information on: January 05, 2014, 09:38:17 AM
Hm.. crypto_girl sent me 1 nxt today, and by looking at his/her account though the block chain explorer she is sending 1 nxt to high volume accounts.
http://87.230.14.1/nxt/nxt.cgi?action=3000&acc=2176239447854173275&offset=1&filter=1
I can't imagine this being benevolence on her part.

I feel like moving my money to another account, and stop forging all together. Can someone comment on the security on this matter?

Check out this account's Aliases:
http://87.230.14.1/nxt/nxt.cgi?action=4000&acc=2176239447854173275

it's just a form of begging I guess Smiley
Social engineering Smiley But it does't work.
604  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code flaw reports on: January 05, 2014, 09:35:13 AM
Code:
if (secretPhrase.length() < 30) {

    response.put("secretPhraseStrength", 1);

} else {

    response.put("secretPhraseStrength", 5);

}

The only thing that gets checked at the moment is the length of the password. Wouldn't it be appropriate to check for other things? Everyone will agree that "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" (31 x a) is not more secure than "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" (30 x a). When the software finds distribution and DAUs will use it, we need to tell them how a secure password has to look like. So we need at least a check that upper/lower-case letters, numbers and special characters are part of the password.

Wouldn't it be nice to have additional a password generator implemented in NXT? On the other hand that could become a problem, if users just generate a password and don't remember it afterwards.
This is the function of client software. I do not think that developers of NRS (reference software) will do anything regarding password generation for users. Btw, it was discussed a lot of times.
605  Local / Альтернативные криптовалюты / Re: [NXT] Nxt crypto - немного инфы, и самих NXT. on: January 05, 2014, 09:20:39 AM
О, знакомые лица Smiley

По теме - набирает обороты запасная любительская биржа 3го дивизиона - nxtchg.com
Да скорее бы уже. Может, хоть это заставило бы шевелиться dgex.
606  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code flaw reports on: January 05, 2014, 09:11:59 AM
Shouldn't there be an || account.getEffectiveBalance() < 0 in the code above?

Does the Genesis account forge when unlocked without this restriction?


Imagine that... a situation where generating a block would not be desirable!!!   Wink

Target for genesis account will be negative, but it's still a good idea to use "<=" instead of "==".

This is not the flaw.
Target is negative, hit is negative to. Comparision will be still "hit<target". Absolute value of target will be very big, so probability of forging will be very low. Omnipotence paradox Cheesy
607  Local / Альтернативные криптовалюты / Re: [NXT] Nxt crypto - немного инфы, и самих NXT. on: January 05, 2014, 09:05:51 AM
А что опять  с dgex.com случилось? Опять лежит.
Да опять что-нибудь чинят или дезигн меняют.
608  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code analysis (QA) on: January 05, 2014, 09:04:20 AM
Also maybe not the place for it, but a suggestion, what if say 1% of all the transaction fees went into a specific wallet to be used for paying people to develop the code?
Developers interested theirself to develop Nxt software and rise interest to Nxt because it rises cost ot their existing Nxt funds.
I don't think that any additional fee is needed. Donations are welcome as usual, but no more.
609  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code analysis (QA) on: January 05, 2014, 08:58:21 AM
ImmortAlex deserves a flood of donations for his work Smiley

Agree. 10K sent to the account in his signature.
Спасибо большое! Пригодится.
610  Alternate cryptocurrencies / Announcements (Altcoins) / Re: Nxt :: descendant of Bitcoin - Updated Information on: January 05, 2014, 06:36:33 AM
Would u be available for a skype or google hangout interview to discuss the source code n ur findings in a non technical manner like andreas antonopoulus so myself n other non tech folks can understand what has been written?
In a non technical manner:
- there're no known flaws that cannot be fixed;
- most of flaws found in source is already fixed in 0.5.0 (source is 0.4.7);
- code is not perfect, but is not ugly; it requires refactorings mostly, not a full rewrite;
- code is simple and understandable for those who work with java and familiar with cryptocurrencies, so analysis will continue.

Thats's all.
611  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code analysis (QA) on: January 05, 2014, 06:17:29 AM
Kind of Post Scriptum to previous analysis.

1. Java and it's unpredictable object's size, nice article in russian (sorry, guys Smiley ).
2. For those who don't look deeper: 10000 blocks is just 10 days in current rate (AFAIK, we're still not getting desired 1440 blocks per day). Ten days to kill big part of our decentralized network. And ten days more to kill the rest.
3. There will be short-time paradise for miners Smiley 255 coins every minute. Wow.
4. I believe that if such kind of attack will start, devs fix the problem in one or two day, so it is actually not a reason to sell you coins. Just some funsy math. Do you remember how fast C-f-B redo NRS from self-written http code to Jetty? Moving blockchain to DBMS is the same, more or less.
612  Local / Альтернативные криптовалюты / Re: Leprocoin [LPC] - Попытка - первый шаг к провалу, %username%! on: January 05, 2014, 05:04:13 AM
Как вы это делаете?
Всегда правой!
613  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code flaw reports on: January 05, 2014, 04:59:08 AM
byte[] generationSignatureHash = MessageDigest.getInstance("SHA-256").digest(generationSignature); seems should be
byte[] generationSignatureHash = MessageDigest.getInstance("SHA-256").digest(previousBlock.generationSignature);
No. This is hash of signature. Look at famous line 288, and you will see usage of last block gen sig.
614  Local / Альтернативные криптовалюты / Re: [NXT] Nxt crypto - немного инфы, и самих NXT. on: January 05, 2014, 04:55:21 AM
Вот откопал сообщение с того года, но тогда ничего не приходило.
Quote
Завтра исполняется неделя как я зарегистрирован.
...
Мой кошелёк: 12289803099507259354
а как же вот эта транзакция: http://87.230.14.1/nxt/nxt.cgi?action=2000&tra=4843135494239978509 ?
Ага, и попытка заныкаться? Wink
615  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code flaw reports on: January 05, 2014, 04:51:04 AM
My observations about memory usage for keeping blockchain.
616  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code analysis (QA) on: January 05, 2014, 04:47:52 AM
Okey, let's talk about one more TODO in you list Smiley
The blocks, transactions and accounts cache, and how much it will cost to kill our RPi nodes.

As we know since the beginning, blocks.nxt and transactions.nxt is just a result of standard ObjectInputStream work.
At startup they are fully loaded to memory and are there till the end.
So, NRS keeps full blockchain in memory all the time.

Let's do rough calculations. Class Block:
Code:
        int version;
        int timestamp;
        long previousBlock;
        int numberOfTransactions;
        int totalAmount, totalFee;
        int payloadLength;
        byte[] payloadHash;
        byte[] generatorPublicKey;
        byte[] generationSignature;
        byte[] blockSignature;
        byte[] previousBlockHash;
        int index;
        long[] transactions;
        long baseTarget;
        int height;
        long nextBlock;
        BigInteger cumulativeDifficulty;
This is from 0.5.0 actually (sorry for decompilation), but there's almost no difference with 0.4.7.
With 32-bit pointers and no alignment this gives us about 320 bytes for block without transactions, plus 8 byte for each transaction. 64-bit JRE with memory alignment can easily expand this to ~400 bytes. I can't tell you exact numbers, because it heavily depends on JRE implementation, operating system and so on.
Right now we have about 33000 block, which occupies about 11Mb of memory. I think, I should speak "at least 11Mb". Without accounting of long[] transactions...

Okey, take a look at class Transaction:
Code:
        byte type, subtype;
        int timestamp;
        short deadline;
        byte[] senderPublicKey;
        long recipient;
        int amount, fee;
        long referencedTransaction;
        byte[] signature;
        Attachment attachment;

        int index;
        long block;
        int height;
156 bytes without attachement (f.e. alias). Up to 200 in real world. 65000 transactions for now. More than 10Mb of memory. Plus 65000*8 = 0.5Mb of links from blocks to transactions (or we can assume that size of transaction is 164 bytes).

Actual things is even worse because blocks and transactions is not linear lists, but hash maps.
Actual things can be better, because of generatorPublicKey and senderPublicKey can be shared between blocks, transactions and accounts.

I'm bit tired and don't want to calculate size of accounts - it's too small comparing to blocks and transactions.

Next step is to calculate cost of attack.
Attacker can send 255 transactions in block. Let's use simple ordinary payment, 1 NXT amout, 1 NXT fee, 510 NXT for full block. 320+156*255 = 40100 bytes of memory.
According to guide, JRE in RPi can use up to 430Mb for heap. Okey, let's assume, that 401Mb is available for blocks and transactions. 401M / 40100 = 10000. Yes, just ten thousand blocks, and you RPi is dead. Or 5M NXT. F*ckin five million coins.

This is very rough calculations. Very. My intuition tell me, that things are worse actually. Cheeper. Faster.
And then, after RPi, this attack will kill cheap 2Gb VPS's. And then - 32-bit JRE's, which actually hardly can get 2Gb of heap.
And before that we will hear the song of death from our HDD/SSD, tired to save that .nxt files everytime you get new fat block.

Solution?
I think devs know it and has in TODO list Smiley We need to use some embedded DB and cache in memory only what we need right now: couple of last blocks.
617  Alternate cryptocurrencies / Announcements (Altcoins) / Re: Nxt :: descendant of Bitcoin - Updated Information on: January 05, 2014, 03:46:29 AM
everyone keeps talking about the 2 .nxt file but what is that blockchain.nrs for?
You don't need it anymore. At least in 0.5.0.
618  Alternate cryptocurrencies / Announcements (Altcoins) / Re: [ANN] BitLand - NEXT GENERATION CRYPTO ASSETS & CURRENCY on: January 05, 2014, 03:34:47 AM
you gonna wait to April in order to get the NXT final code?
or you already found the 3 implanted flaws in NXT?
He waiting for release of Nxt full sources Cheesy
619  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code flaw reports on: January 05, 2014, 03:10:17 AM
Can someone please point to the exact lines in the code where it is established that empty accounts cannot forge.
Block.verifyGenerationSignature(), line 1270:
Code:
                    if (account == null || account.getEffectiveBalance() == 0) {

                        return false;

                    }

But then...
Code:
https://localhost:7875/nxt?requestType=getBalance&account=1739068987193023818

Code:
{"balance":-99999798000,"effectiveBalance":-99999798000,"unconfirmedBalance":-99999798000}

So if genesis account is in memory cache, it can forge! I really donno, is it in cache or no.
Btw, seems like this check is not changed in 0.5.0.
620  Alternate cryptocurrencies / Altcoin Discussion / Re: Nxt source code flaw reports on: January 05, 2014, 03:05:17 AM
Obviously: Before typing this post, I tried the latter method on my local 0.5.0 client and it didn't work. So I guess this has been fixed by now.
Yes, pushBlock() has check. From decompiled code:
Code:
            if(payloadLength > 32640 || 224 + payloadLength != buffer.capacity())
                return false;
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 [31] 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 »
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!