Bitcoin Forum
June 21, 2024, 12:35:23 AM *
News: Voting for pizza day contest
 
  Home Help Search Login Register More  
  Show Posts
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 [47] 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 ... 165 »
921  Other / CPU/GPU Bitcoin mining hardware / Re: No mining hardware is worth buying on: October 13, 2013, 11:51:12 PM
It's true that if say price of XBT doubles or triples, currently unprofitable mining operations can suddenly become profitable.

This is a fallacy. If you buy a 1 BTC miner and it will make you 0.8 BTC over it's lifetime, your profit is -0.2 BTC. If you buy 1 BTC now, your profit is 0 BTC. Future cryptocoin value doesn't affect your calculation of whether to buy mining hardware or buy the currency itself, only the calculation of if the hardware will earn you more in a reasonable time than it costs.

If you are in possession of hardware, it may have some resale value that could help you get back into the black, but if it becomes obsolete, a mere fraction of it's original price should be expected. Look at resale of BFL FPGA singles, the first dedicated mining-only hardware: https://bitcointalk.org/index.php?topic=305242.0 or http://www.ebay.com/itm/141079903811
922  Bitcoin / Pools / Re: [65Th]Ozcoin Pooled Mining |DGM 1%|PoT 2%|Stratum+VarDiff port 80|0.01 threshold on: October 13, 2013, 11:35:41 PM
I won't worry about updating my possible balance, it'll just be a donation of shares to the pool.
923  Bitcoin / Bitcoin Discussion / Re: [ANN] Bitcoin blockchain data torrent on: October 13, 2013, 11:30:01 PM
For some reason I can't get this to work.
Can someone kind explain the steps I need to take from that I download the file to that I import the block into the wallet?
So far it doesn't seem to recognize the file until I shut the wallet off and then I get an error message.
//DeaDTerra

Well, I've made a symlink at .bitcoin directory to bootstrap.dat, but you can just paste the file into your bitcoin config files directory.

If linux: ~/.bitcoin

Edit: Check here: https://en.bitcoin.it/wiki/Data_directory
Where do I want to paste it,
The database directory?

Nop, paste it in the main directory, then start Bitcoin-QT it should detect the file and start importing.

Nope, copy the bootstrap.dat file into the Bitcoin database directory, the same directory that contains your wallet.dat file. When you restart Bitcoin-qt, it will import all blocks from the bootstrap.dat that weren't previously downloaded.
924  Other / Beginners & Help / Re: Need plugin bought with Paypal ! I have only BTC ! on: October 10, 2013, 09:48:05 AM
Quote
HOW TO INSTALL?
You have to click on the "Completed order" receipt link for download. This receipt you would have received via e-mail. Then once clicked, a download will begin so just and save the file and remember where you saved it.
You should buy the plugin yourself and just buy the PayPal funds (unless you have no Paypal or are blocked/frozed/banned). You want to not only have a valid license for the software in your name, but also would want to be eligible for support and continuing upgrades. You are likely to get some scammer who will send you a pirated copy otherwise.

This is an opportunity to contact the developer and tell them you would pay them in Bitcoins for their plugin if they would only take them. Show that many already use woocommerce for Bitcoin: http://wordpress.org/plugins/bitcoin-payments-for-woocommerce/
925  Other / Beginners & Help / Re: What is the average Bitcoin transaction in Bitcoins and in USD? on: October 08, 2013, 09:58:44 AM
This question cannot be answered even though the transaction ledger is public. Most Bitcoin transactions have the actual recipient obfuscated by change. You cannot determine with certainty or automation which part of a transaction is the actual payment and which is the change payment that sends the remainder of bitcoins back to the sender's wallet.

You can pitch your inability to answer this question as one reason to use Bitcoin.
926  Other / Meta / Re: Since attack on bitcointalk, email trouble. Anyone else? on: October 08, 2013, 09:31:10 AM
Not a single email. I use a unique email address for this forum.
927  Other / Meta / Re: About the recent attack on: October 07, 2013, 08:10:36 PM
I think it unlikely that if there was a two-year backdoor, it was placed by the recent defacer.

No, I verified its existence using my old forum backups.
I'm not doubting it's existence, I'm saying that unless there is specific evidence, it was likely not placed by the same entity that uploaded dancing javascript.


Maybe Theymos is an NSA plant putting back doors from the 1990's into the forum?

http://www.nsa.gov/ia/_files/app/Reducing_the_Effectiveness_of_Pass-the-Hash.pdf

We at the NSA thank you for your contribution to our signals intelligence efforts:

69.249.73.204 - - [07/Oct/2013:05:02:10 -0400] "GET www.nsa.gov/ia/_files/app/Reducing_the_Effectiveness_of_Pass-the-Hash.pdf HTTP/1.1" 200 79951 "https://bitcointalk.org/index.php?topic=306878.40" "Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0"
928  Bitcoin / Development & Technical Discussion / Re: Vanitygen: Vanity bitcoin address generator/miner [v0.22] on: October 07, 2013, 07:45:57 PM
Prohibited in base58 for Bitcoin: and 1l - thats the only two pairs.  o and L are allowed though.

O + 0 is now
929  Other / Meta / Re: Change username? on: October 07, 2013, 07:42:12 PM
Yeah, what he said.. a year ago.

Theymos can change your name for free upon request, but if you plan on changing it often you should become a donator.
930  Other / Meta / Re: Alt forum URL - will it be available again? on: October 07, 2013, 07:28:08 PM
https://109.201.133.195 avoids the 301 redirect to the secure site that uses the domain name. Note the S in https.
931  Other / Meta / Re: About the recent attack on: October 07, 2013, 07:24:09 PM
I believe that this is how the attack was done: After the 2011 hack of the forum, the attacker inserted some backdoors. These were removed by Mark Karpelles in his post-hack code audit, but a short time later, the attacker used the password hashes he obtained from the database in order to take control of an admin account and insert the backdoors back in. (There is a flaw in stock SMF allowing you to login as someone using only their password hash. No bruteforcing is required. This was fixed on this forum when the password system was overhauled over a year ago.) The backdoors were in obscure locations, so they weren't noticed until I did a complete code audit yesterday.

Because the backdoors were first planted in late 2011, the database could have been secretly accessed any time since then.

Welcome back forum!

Login with only the hash? That basically allows any admin to impersonate another user. How could SMF think that was a good idea??

I think it unlikely that if there was a two-year backdoor, it was placed by the recent defacer. It was most likely used by someone with the discipline to occasionally do a db pull and crack a hash and bring back an old account from the dead for scamming, or employ re-used passwords to make bitcoins mysteriously disappear from an exchange. It also could be used in a way that would never be learned, such as to retrieve IP addresses logs of a suspect account and use account information against a user, while "parallel construction" prevents any revelation of the backdoor.

My last post on this forum before it went down, about a rooted Bitcoin casino. How novel:

You are lucky that the hacker couldn't think of anything interesting to do; however that machine is not 100% secure unless it can be image-restored or reloaded. An intrusion detection system would have alerted to any system changes or the downtime. The hacker's goal may not have been to steal Bitcoins, it may have been to discover the site owner's identity or that of players or to log credentials.
932  Economy / Gambling / Re: We thwarted a hacking attempt on Bitcoin Video Casino and learned a lot. on: October 01, 2013, 10:23:30 PM
We thwarted a hacking attempt on Bitcoin Video Casino and learned a lot. We wanted to share our experience so that other site operators can be prepared.

On Monday Sep 9th, an attempt to hack into Bitcoin Video Casino was made. We initially noticed something was amiss because our server had become unreachable for several hours. When our server eventually came back online again, we noticed that the machine had been restarted. Our server has had a 100% uptime since we launched (~185 days ago) and this is the first time it was restarted.

We snooped around a bit and found an open login by a user on /dev/tty1, a local controlling terminal. That's very bad. All logins should only be from psuedo-terminals (ptyX). More looking around found a script hiding in /etc called "bitcoin.sh" and a crontab entry meant to constantly restart the script. The script was nothing but a phone home to this intruder's Amazon EC2 instance and wasn't very clever, but it did the job it was intended to. Unfortunately for the hacker, he left his private key on our servers.

We took all of the standard precautions when building our website: offline cold storage of most Bitcoins, closing down open ports, disabling password logins (ssh keys only!), but most importantly we decided to use full disk encryption, with the disk decryption key encrypted with GPG.

The downside to full disk encryption is that our site cannot come up automatically after a reboot. That's fine, really, we never reboot the machine anyway. So once the would-be hacker restarted the machine, he had no way to access our database, our hot wallet, or our game source code as they reside on the encrypted disk. The hacker couldn't even mount the encrypted disks, as the decryption key isn't stored on the server.

We had a long talk with our hosting provider on how this happened. Nobody should be able to log into our machine locally (the /dev/tty1 part). We thought that someone local to our hosting provider's data center was trying to break in, but as we pressed for answers, we learned that a KVM device was installed that allowed remote access into our machine one day prior to the hack. The evidence that the device was plugged in was present in the kernel log ('dmesg'). While the machine was rebooted, the hacker modified /etc/sudoers and changed an account password so that he could have access after the reboot. Later, auth.log would verify his activity.

So why did someone working at the datacenter install a KVM on our machine when we didn't request it? It turns out that our hosting provider's billing software was actually where the hack began. An order was fraudulently placed on our account to install the KVM through his hacking of HostBill, the software our hosting provider uses. It's a particularly popular piece of software, so it's likely other hosting providers could be vulnerable.

Anyway, the long story short is that we didn't lose any of our Bitcoins or our game software because of one smart move: full disk encryption. We highly recommend to all you developers out there to use full disk encryption if you have sensitive data to protect on remote servers. Full disk encryption doesn't help thwart hot attacks while the site is live, but it does help tremendously when hackers could possibly get physical control of your remote-hosted machine.

Note: We also posted this to Reddit, so all of the redditors on here can see the post at http://www.reddit.com/r/Bitcoin/comments/1nicl9/we_thwarted_a_hacking_attempt_on_bitcoin_video/

Let me rearrange this so it is readable:
1. Hosting service uses software package "HostBill"
2. Hacker hacks that software and places an order for a remote access device to be installed.
3. A remote access device installed by ISP allows hacker to see the machine console and reboot
4. rebooting allows single-user mode, where files can be edited and a new user account or password inserted
5. hacker now has root, but the gaming platform is on encrypted media without a password the hacker knows.

You are lucky that the hacker couldn't think of anything interesting to do; however that machine is not 100% secure unless it can be image-restored or reloaded. An intrusion detection system would have alerted to any system changes or the downtime. The hacker's goal may not have been to steal Bitcoins, it may have been to discover the site owner's identity or that of players or to log credentials.
933  Bitcoin / Pools / Re: [65Th]Ozcoin Pooled Mining |DGM 1%|PoT 2%|Stratum+VarDiff port 80|0.01 threshold on: October 01, 2013, 10:08:24 PM
I know this idea has lots of holes in it but,
(there is always a 'but')

Could a DEFENSIVE only Low Orbit Satoshi Cannon be developed to fight back against ddos on pools?
No. The first D is distributed. DDoS is from thousands of bot computers, typically grandma's Windows XP that is infected and under the control of the hacker. You need to discover the bot commander and destroy them.
934  Other / Off-topic / Re: US National parks closing from shutdown on: October 01, 2013, 06:42:27 AM
http://www.cnn.com/2013/09/30/politics/government-shutdown-up-to-speed/index.html

http://www.mercurynews.com/science/ci_24209569/government-shutdown-closing-national-parks-could-spark-public


Quote
With a federal government shutdown, padlocks are expected to begin going up Tuesday at the gates of hundreds of national parks across the United States from Alcatraz Island in San Francisco Bay to the Washington Monument. Thousands of visitors will be sent home, and local businesses will suffer.

During the last government shutdown, for 28 days in 1995, national park closures sparked waves of angry calls to Congress and the White House.

"Once the shutdowns began, the reaction from people who wanted access to the parks was absolutely incredible," Bruce Babbitt, who was U.S. Interior Secretary
at the time, said in an interview Monday.

"The first call I got was from the governor of Wyoming, who was having a fit. He was saying 'You have to open Yellowstone. This is an outrage. Do something!'"

The Republican governor of Arizona, Fife Symington, sent National Guard troops to the Grand Canyon in an attempt to keep the park open, rather than risk losing tourism. Eventually, Arizona officials paid the National Park Service through state funds and donations to keep famous sites along the South Rim open.

The Interior Department announced its shutdown plans last Friday, saying it would close all national parks and give guests at hotels in national parks two days to make other plans and leave. The park service will keep a small number of employees on the clock, according to its contingency plan.

http://www.doi.gov/shutdown/fy2014/upload/NPS-Fact-Sheet.pdf

Of course the congress critters are still paying themselves and the military that keeps them in power. It's the Republicans demonstrating that they are the bought-and-paid-for stooges of companies with over 50 employees who don't want to pay for healthcare for their employees.

"The one exception to the legislative futility was a bill to ensure that military service members would be paid during the shutdown. Obama signed it into law late Monday night."
935  Economy / Services / Re: Script for dice betting on: October 01, 2013, 03:31:40 AM
I just want to see how long it takes to bust when able to double your bet at least 15x.  

Math lets you keep your money:

http://bitchaos.com/

You will be busted after 15 loses in row.
Probability of lose 15 times in row in 15 executions is 0.0035429961%.
According to The Deep Magic, overall probability of bust within 50000 executions is 58.38%, and to end up with profit - 41.62%
If You'll keep winning for a longer time, amount of possible loses will raise, along with overall chance to make profit - however not a very much.
If You'll not bust, You'll end up with balance around 75250, so 25250 profit.
936  Economy / Services / Re: Script for dice betting on: October 01, 2013, 02:44:15 AM
I found this with 30 seconds of searching. No promises that the EXEs won't steal all your bitcoins though...

https://bitcointalk.org/index.php?topic=238613.msg3121784#msg3121784
937  Bitcoin / Bitcoin Discussion / Re: Create vanity bitcoin addresses four times as fast on: September 27, 2013, 12:51:54 PM
Old account that has come to life three days ago (maybe just deleted all the old posts), poster refers to himself as "we", and here's a binary exe that is basically a one line patch that was created by someone else... not trusting yet.
938  Other / Beginners & Help / Re: Does increased mining increase price of Bitcoin? on: September 27, 2013, 12:26:05 PM
You can't get 1 BTC a day by mining on your video card any more, more like 0.01 BTC a week. The cost of mining and electricity sets a reference price for Bitcoin for someone wishing to obtain it.

Over 11 million BTC are already mined and in private hands now, compared with the new 3600 BTC a day that are being created, so the market price is much more influenced by trading and demand than mining.
939  Bitcoin / Bitcoin Technical Support / Re: Bitcoin taking up 5.6gb on my computer on: September 21, 2013, 11:23:51 PM
This folder will be about 12GB currently, and is always growing in size as the blockchain grows from use.

There may be some files that can be removed if either:

1. You were previously using Bitcoin before 0.8.0
2. You used the bootstrap torrent to initialize the client.

Files that can be removed if they exist in the root directory (don't touch blocks, chainstate, or database subdirectories):

You can remove blk0001.dat, blk0002.dat, blk0003.dat and blkindex.dat from the root data directory after a reindex from installation of 0.8.0+ is complete and you are caught up with the blockchain (and you don't plan on going back to an older version).

You can remove any bootstrap.xxx file from this directory after it has been used.
940  Bitcoin / Bitcoin Technical Support / Re: Lost BTC question on: September 21, 2013, 11:13:38 PM
I'm just reading https://blockchain.info/wallet/new

Don't Forget Your Password!

WARNING: Forgotten passwords are UNRECOVERABLE and will results in LOSS of ALL of your bitcoins!


and

https://blockchain.info/wallet/login

Lost Identifier or Alias

If you have lost your wallet identifier first check the confirmation email you received during sign up. Can't find the email? Click the button below and we can send you a new one.
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 [47] 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 ... 165 »
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!