|
I have not dug into this enough to really comment on it, but and this is just me, certain misspellings may be from copy - paste - accept in browser spell check when you see the underlines.
Not saying yes or no about anything here specifically just that I am in the been there done that part of life with this. Not in the crypto world but in real life work.
Added asomething to auto correct that was not correct and then it kept correcting it to the wrong thing.
Admittedly not one of my finer moments, but still worth pointing out that it may be unintentional with some users.
That is unless everyone gets together and starts using processers instead of processors. Good thing someone caught it, but I can at least kind of relate.
Using the example above I think we can all agree that Lauda is not an alt but still used "Rodger Ver"
-Dave
|
|
|
|
.... The randomness falls on the OS's ability to gather these, not the CPU.
Minor nitpick but it should be 'The randomness falls on the OS's ability to gather these AND USE THEM PROPERLY, not the CPUThere have been a few times when programmers screwed it up and took totally random, non duplicate entropy and gave bad randomness but to bad programming. We have to trust that they did it right, but have seen many times though the decades of computing that they did non. https://www.wired.com/2017/02/russians-engineer-brilliant-slot-machine-cheat-casinos-no-fix/-Dave |
|
|
|
...So , if you use them sporadically i dont see any problem, but like all if you abuse them, well maybe someone can start to look from where you have that cards, etc....
That does come back to the question of 'what is abuse'? Different places are going to have different levels and you will probably not know what they are till you hit them. Using what I posted above, if you keep getting $50 Target gift cards and paying for the rest of your order in cash, then it's a non issue since they will never rally be able to find you or do anything about it. If you add it to your target app and go though enough gift cards to take care of a small town that will probably raise some questions. Where between those two things is where Target security goes in and takes a look? You can obviously substitute Target for just about any physical store. With online it's a different world since they do know where their products are being shipped and who is ordering them. -Dave |
|
|
|
|
That is always going to depend on the exact country where you live. Sometimes sometimes it won't be taxed other times it will. You're going to have to consult a local tax advisor for a definitive answer.
Part of the question would also be is it worth worrying about? Without knowing what they got into Bitcoin at does it really matter. If you're sitting on a few hundred coins that you paid a dollar a piece for them back in 2010 does it really matter what you sell it for at the next ATH? It's going to be such a ridiculous amount of profit it doesn't matter.
The other things to keep in mind is even perfectly valid 100% correct tax advice today may or may not be correct a year from now as rules regulations and laws change.
-Dave
|
|
|
|
Cool, but your phone has to be eSIM compatible, and unfortunately most cheap smartphones are not. If you click on "compatible devices" you will mostly see iPhones, newest Samsung phones and Google pixels.
A time is coming that almost all phones will be able to use e-sim, or at least the mid range phones. Hopefully it's soon, because I've checked the list and at this point it's only the newest edition. I have a 2 year old phone and it's not on the list and the few ones that I've checked cost at least $500. My target is usually below that because I buy a phone for everyday use outside, which means that it can fall to the ground, get scratched and all that. If they can add this option to your average $300 phone, I might be interested, especially since I've used Bitrefill a few times and never had any issues with them. It works with the Pixel 6A which is $349.99 MSRP but is routinely on sale for $299 you just have to wait and catch it at that price. You can also wipe the OS and install Graphine https://bitcointalk.org/index.php?topic=5416327.0The 6A seems to be a much better phone then the 6 that I had. At least from the discussions out there.
Also, I tried it with a phone that supports esim that was not listed and it DID work. But, obviously YMMV with that. (razr 2019) At a *guess* any device that supports the esim standard should work.That's why they call it a standard. But, if whatever service they are using didn't test it they don't want to support it. And I really don't blame that on that. -Dave |
|
|
|
In light of recent events, I think we may have an idea as to what happened.After libbitcoin explorer was found to have an extremely insecure seed generation command called bx seed, it must be concluded that the OP used bx seed to create the mnemonic. Particularly after following instructions from the Mastering Bitcoin book (which has instructions for using bx seed). Personally, if I was a normal user, I would not had suspected anything wrong with using that. The real scummy part was that in 2016 (probably after the book was publish since A.A. would have done his due diligence before publishing anything), the devs changed the secure random generator to a Mersenne Twister pseudorandom generator, which is no better than ordinary Python random numbers - and according to source code comments, they were considering even using rand(3) and srand(3), only backing out because the functions were not thread safe! (hurr durr so cryptographic safety is not as important then.  ) The OP's July 12 theft date coincides with what is shown on the MilkSad homepage. It must be concluded that the attacker was using libbitcoin command-line software in order to carry out the theft. How they managed to use that software is incredulous, because building libbitcoin is an arse. But anyway, this must be what happened.
Note: OP says they used bitcore libraries to generate the mnemonic, but from this: https://milksad.info/disclosure.html it says the researchers confirmed that that mnemonic was somehow generated using bx seed or at least a pseudorandom generator (mt19937). Bitcore also has insecure pseudorandom key generators, but I could not verify whether any of them are actually called when making the mnemonic. Although what you said is more likely then what I posted about, keep in mind some of the server vulnerabilities I pointed out, and some others that are also out there allow for reading of memory outside of what should be your private VM. If you got a dump of what was in the OPs machine you might not have gotten all the keys just the ones that were doing something at the time. And without knowing more about the physical hosting setup, it's all a guess. A lot of the time it's not the OS / software but the people involved. In theory I have no access to a lot of what my clients have stored on their machines. In reality, it's amazing how much they just give to me when they are having an issue and need help with an issue. -Dave |
|
|
|
Well fuckballs.....
MSFT had their monthly patches yesterday and the PC running Fulcrum decided to install them and reboot and did not cleanly exit fulcrum before doing that.
And now it's saying that the database is corrupt and it's trying to redo it. I'm too busy to do a deep look, is there a way to check / repair the fulcrum DB instead of having it redo everything.
And, yes I know to ask in github but I figure this might be quicker.
-Dave
Unfortunately I can't help you but I wonder how it rebooted without asking you. I *thought* I had it set to install but not reboot, after it happened in May, I either did not apply it or something else changed. Actually not going to deal with the re-sync on the spinning drive at this point a 1TB SSD m.2 is under $40 with tax, going to put that in. While it was working I had no issues. Due to the fact that both my umberl and mynodebtc are offline at the moment I was using this as my go-to electrum server. -Dave |
|
|
|
|
Well fuckballs.....
MSFT had their monthly patches yesterday and the PC running Fulcrum decided to install them and reboot and did not cleanly exit fulcrum before doing that.
And now it's saying that the database is corrupt and it's trying to redo it. I'm too busy to do a deep look, is there a way to check / repair the fulcrum DB instead of having it redo everything.
And, yes I know to ask in github but I figure this might be quicker.
-Dave
|
|
|
|
I just the last few minutes reading through the entire article from the source link, but I seems to be missing something which is how the E-sim is going to be installed and the network being tap into the mobile device, and talking about wifi connection in other to make the purchase, will one always need a wifi connection for the sim to work? Or when it comes to data purchases and all of that, will one use the same way he got the SIM to top up the data? Pardon my silly questions. I have not really made use of E-SIM, and as such, I don't know how it works, adding to the fact that this one is crypto-related. An esim is nothing more then an embedded digitally programmable sim. T-Mobile explains it well: https://www.t-mobile.com/resources/what-is-an-esim-cardWhat is nice about them is you can buy one, scan a QR code and have an active phone in another country in less time then it took me to type this. https://travel.orange.com/en/all-inclusive/orhldeur20gb/-Dave |
|
|
|
What is interesting is that there are a lot more phones & devices that support esim. Take a look at https://silent.link/faq and clock on the which compatible devices support esim What I don't know and can't seem to find an answer to is do different esim providers support different devices, or did bitrefill who I use a lot, just give a list of the more popular ones. For $3.50 for the 1GB 7 Day one I might just try using a device that is not listed as compatible to see what happens. The flip side is all that means is THAT device works, who knows if another not listed one would. -Dave |
|
|
|
|
Would not call it the wild west, most like a project in it's early development.
Lots of things within the protocol have matured over time and things that would work / could happen back then no longer can.
So long as things keep changing we will keep seeing things like this. In 15 years there will probably be a post about something that happened in block 802360 with someone trying to figure out how that happened, not knowing that it was changed in a BIP that was implemented in 2030
-Dave
|
|
|
|
|
The big thing is that unlike a lot of other stablecoin issuers PayPal is a single public company that does have a lot of audits, and a lot to loose if they try and scam.
They also have KYC for just about everyone who has ever used them. So, although a lot of people who would not want to give their docs to other places already gave it to PP decades ago.
Still not going to use it, but I can see it's appeal.
As for the ability to block things, other stablecoins do it too so not much different then the others.
-Dave
|
|
|
|
|
As with many scam projects they are using the attitude of: If it ain't broke don't fix it.
From the top
1) They have been scamming for years and people still use them
2) They are closed source and people still use them
3) There are 100s perhaps 1000s of big name crypto people telling people not to use them and yet, people still use them.
Why should they change?
Seriously, until they get hit with real legal repercussions nothing is going to happen.
Same with Atomic wallet, people are loosing money and yet their wallet is still getting downloaded and used.
We can report them to Google to see if they can get removed from listings.
We can report them to their web hosts to see if we can get their sites taken down.
We can report them to the various AV companies to get their sites flagged as malware.
But if they keep making money by scamming / stealing they are going to keep doing it because they can.
-Dave
|
|
|
|
|
There is no way to make something like that profitable.
To give you fixed returns you are looking at a PPS payout. X TH gives you Y BTC
Y BTC either covers your cost of electric and gives you a little profit or it does not.
Taking that all off the table if they are willing to give you Z BTC which would HAVE to be a lot less then Y because they are giving you a fixed amount. Why would you mine there as opposed to a regular PPS pool?
-Dave
|
|
|
|
|
Just imagine the difficulty if every time you wanted to send someone BTC you would have to verify that their IP did not change and that their node was online. For a bunch of tech people playing around with BTC when it was new that's fine. As adoption grew, there really was no reason to keep that feature since most people would be sending to addresses anyway.
Would it be nice to still have? Possibly, but not really worth putting in the time and effort to develop it more.
And as IPv6 replaces IPv4 the addresses become so much longer.
192.168.1.100 is somewhat easy
2001:db8:3333:4444:5555:6666:7777:8888 is a lot longer to deal with.
-Dave
|
|
|
|
|
I know nobody wants to hear this, but do you trust everyone who has / had access to that computer?
If you eliminate hack / virus and come back to they didn't take everything it might just be friend / relative that did it.
Also, is the machine OS fully patched & updated? AV software can only do so much if the OS itself has issues:https://bitcointalk.org/index.php?topic=5462160
Yes, it's about a Mac virus but the post it still there.
-Dave
|
|
|
|
|
Side note, since Phil bumped this the other day one of the DCs we have server equipment / routers in sent out an email overnight that they have lost backup cooling in one of the suites.
They have n+2 cooling, so sometime in the last few hours they lost 2 units. Not sure what happened, the last email was they have repair coming but no ETA.
It was more of an advisory since as of now there is no effect on us. This has happened once before in a different location. But the point remains the same. As you get more and more units, the odds go up that sooner or later one of them will have an issue. Every once in a great while, 2 will have issues. So if you really have no wiggle room be prepared for this.
This is a multi story DC built with all kinds of other backup plans it's not a big deal, and because suite we are in is about 20% empty it means even less, but if it was at 100% packed to the walls it would be different.
-Dave
|
|
|
|
|
Using Amazon as an example, if you are using giftcards there you also must provide a 'back up' funding source in case the giftcard turns out to be fraudulent.
There are plenty of cards you can use from Bitrefill that you can stay anonymous with.
But if you are going to have something shipped to you, no matter what you are giving up that.
If you are using Amazon, you would have to give up a bit more since they do want that 2nd payment method.
Walking into Burger King or Taco Bell or Home Depot or Target or a host of other places and using a gift card from them you are still mostly anonymous.
So long as you pay for the rest of your order in cash.
Adding it to their app so you can order ahead...well then you have no privacy anyway.
-Dave
|
|
|
|
From the article linked: The HVNC tool only works on Macs running macOS Venture 13.2 or older software So, you would have to be using a version of the OS that at this point is close to 6 months and 5 updates old. 13.2.1 was released on Feb 13th (which fixed this vulnerability at least according to the article and Apple) 13.3 was released on March 27 13.3.1 was released on April 7th 13.4 was released on May 14th 13.4.1 was released on June 21st 13.5 was released on July 24th What the hell are people doing storing funds on unpatched & unupdated machines. If this happened in late Feb to early April then OK, you wanted others to be sure that there were no major issues happening with the new OS builds. But now, sorry that's just being lazy. macOS is becoming a better target for criminals since so many people buy into the hype 'macs can't be hacked' and that just makes them a nice easy target for criminals. -Dave |
|
|
|
I cant even find the data file, yet my drive shows that there is roughly 500Gb data floating around somewhere!
Try following the section in here on how to find large folders: https://mackeeper.com/blog/find-delete-large-files-on-mac/Once you locate that then the conf file should be in a folder near there. Keep in mind Apple / MacOS likes to hide as much as possible from the user since 'they know better' so you might have to jump through a few hoops to find things. Obligatory also, make sure the machine is fully updated and running the latest version of the OS there have been a couple of very severe vulnerabilities patched this year, and yet I still see people running older builds of the OS even as it's popping up the 'update now' warning. -Dave |
|
|
|
|
Show Posts
