The way how I understand the current approaches for pruning of transactions is that those approaches:

• Allow a node that already stored the full blockchain to prune fully spent transactions
• Still require the full unpruned blockchain to be initially transfered if the node should be able to validate transactions by itself

Are these assumptions correct?

If yes: Why can't each block also contain an additional checksum over the unpruned data in preceding blocks? So let's assume during runtime the client implementation dynamically generates a checksum over the unpruned data in every single block. Every new generated block contains an additional hash over all of those checksums in the preceding blocks, at the time when the block was generated. In addition, for every new transactions clients immediately prune old fully spent transactions and recalculate the checksum of the particular block. For every new block miners verify the hash over the checksums and only accept blocks if the hash corresponds with their locally calculated hash. This would allow a new validating client to only obtain the pruned blockchain and still be able to find out if its data is correct.

Are there any drawbacks of this approach that I overlooked? Or is this (or something similar) already implemented in clients (or planned for newer clients)?

So the first reddit links provides a very dubious calculation based on some Javascript calculator that's on some random website. And the second link discusses Scrypt as key-deriviation function, where it provides considerable benefits over other function. But as proof-of-work requirements are considerable different from key-derivation requirements those benefits don't really apply to Litecoin.


Bugs with the software? Litecoin isn't some new software, but just an outdated Bitcoin client. Look at the source code.

I'm not holding crypto-currencies because I'm investing, but because I think they're a good idea to conduct transactions over the internet. I bought a set of such currencies (Bitcoins, Litecoins) a long time before all of the hype (see the creation date of my user account, started buying Bitcoins well before I created the account) and I didn't really expect them to rise in value that much. "Investing" in currencies is just stupid, because that's basically a Ponzi-scheme. That's even true for Bitcoin to a given degree now, but at least there you have actual usage of the protocol to offset the speculation. If you want to "invest" in something invest in Bitcoin/Litecoin related companies instead of bubbles.


That's only a very temporary advantage. While Scrypt has the advantage that it is "memory-hard", technology changes still have the same effect on Litecoin as on Bitcoin (and other cryptocurrencies). Once ASICs are the primary hashing technology in the Bitcoin world it's hard for adversaries to come up with more effective solutions (unless they can spend lots of energy). With Scrypt on the other hand you'll be facing the same problems, but just at a later time. And the attack described by you above would also be possible against Scrypt, as you could use a Botnet instead of an ASIC for this. OTOH, once ASICs are the standard in the Bitcoin world Botnet attacks aren't feasible at all, as the hashing rate that can be reached with them is much lower than what a few ASICs deliver.


Visa and Mastercard are different technologies, but they still use a commonly agreed on currency. You already have that in the Bitcoin world: A common currency and dozens of different client implementations. You don't have that in the Litecoin world - there you can only choose one from two outdated and unmaintained clients.


Waiting for 6 transactions (or whatever) is just an arbitrary number. You correctly noticed that the same transaction amount for Litecoins is less secure than for Bitcoins. So why not just wait for less transactions when using Bitcoins?


The only reason why the community grows is because previous Bitcoin miners find out that there equipment is suddenly useless and therefore try to earn money with Litecoins instead. The fallacy here is that miners don't really matter much when it comes to the utility of a currency. The community that would need to grow are the actual users conducting transactions via Litecoin and this community is still extremely tiny.


So you say that Litecoin is a classical bubble? People just buy it because they assume that its value will rise?


The exchange rate is just an arbitrary number and doesn't affect real-life utility. The Zimbabwean dollar is not a better currency than the US dollar, just because you need billions of them in your pocket to buy a breakfast. But if there's really a psychological reason behind this it might be time for the Bitcoin community to switch to mBTC or all the way to Satoshis as currency unit.


In practice (if you look at the source code) Litecoin is basically a copy of an old Bitcoin version and has not been updated for a very long time. In other words: Almost all of the attacks applicable against Bitcoin are also applicable against Litecoin. In addition, all the security issues that have been long fixed in the Bitcoin have been mostly ignored by Litecoin (so Litecoin is still vulnerable to them). Litecoin users are claiming that Litecoin is "more modern" than Bitcoin, but the truth is that it is basically outdated and unmaintained.

During the last weeks I've read dozens of forum posts from people suggesting to use Litecoins instead of Bitcoins. Several of them also here on bitcointalk, but none of them provides technical evidence of why Litecoin should be better (or even comparable) to Bitcoins. My personal opinion is that Litecoin is inferior from a protocol and implementation point of view and that other alt-currencies (such as PPCoin) would be a much better alternative than Litecoin. I've listed my reasons for this assumptions below. I'd be interested in counter-arguments to my points and in a discussion about the benefits of Litecoins.

In my opinion those are the main disadvantages of Litecoin:

• Litecoin doesn't provide significant technological advantages in comparison to Bitcoin. My first question when seeing an alt-currency is "Why should I use this?". Some alt-currencies have good answers to this question. For example, PPCoin's proof-of-stake mining looks extremely innovative making PPCoin a possible candidate for a Bitcoin 2.0 network. Litecoin, in comparison, is just a relatively straightforward copy of the Bitcoin code. (I know about Scrypt and the shorter confirmation times. However, those are just minor changes and neither of them provides any major advantages.)
• The client code is essentially unmaintained and based on an outdated Bitcoin version. In one of the most recent Litecoin commits the authors even had to remove a warning from the source code, preventing the client from reporting that it is obsolete. None of the newer security and performance improvements of the Bitcoin code made it into Litecoin.
• The price is purely driven by speculation. There are currently next to zero applications for Litecoins. The only thing one can do with them is buying them on an exchange and hoping that they can be sold for more money at some later point. If I'd felt like gambling I'd rather use Satoshi Dice with Bitcoins instead.
• The fact that Mtgox announced it will support Litecoins sounds like a red herring. If they support one alt-currency they are likely to also support some other alt-currencies. So why invest in overpriced Litecoins, when there are other alt-currencies that are cheaper and provide real technological advantages?

So for the Litecoin supporters: Which advantages does Litecoin have? And is there any client software that's actually maintained?

rB5mEnapSe63th61aUb8QEcX1h6TteZn2K

So are you paying the devs for developing the Bitcoin software? And why didn't YOU test the code in testnet before it was released as 0.8?

The local bitcoind uses HTTP basic authentication. So usually I need to enter a username/password in my browser if I send HTTP requests to the bitcoind. However, image tags allow to embed authentication information within the URL, for example: <img src="username:password@http://localhost:1234/" />. Furthermore, if this authentication is successful username and password are cached by the browser and automatically used on subsequent requests.

So if you have a list of common usernames and passwords you can just:

• Take a username and password from the list and dynamically inject an <img /> tag in your page that loads this resource.
• Create a client-side HTTP POST request that uses this cached authentication data to send a request to your bitcoind. For example by using Flash (as discussed in my first post) or by using a HTTP form submit in an iframe.
• Repeat in a loop with many different combinations for usernames and passwords.

Basically that's very similar to a standard CSRF attack (https://en.wikipedia.org/wiki/Cross-site_request_forgery) and the password is the only protection against it. So if your password is just "password" (or word that's likely to be on a wordlist) this attack would succeed.

It seems like this won't work with current Chrome development versions, because they prevent embedding username/passwords inside URLs (https://code.google.com/p/chromium/issues/detail?id=123150). However, this should still work with the current stable Chrome version and other browsers such as Firefox.

That's exactly the misconception I've pointed out: Your firewall does not protect you, as the connection is not established by the remote attacker, but by your Web browser. This should work with any browser that has Flash installed. It does not work without Flash (e.g., with Javascript), as Javascript applies the same-origin policy to the request, instead of the response.

I've heard from several people now that they don't need a secure password for their local bitcoind, as "it's only listening on localhost" or as "the local network is secured by a firewall". Just a friendly reminder that neither of those protects you. If you have a bitcoind running on localhost and you use a weak password, it's trivial for an attacker to steal your bitcoins.

For example, a potential attack that uses the user's webbrowser might look like the following:

• Create an <img /> tag that loads a URL with a username:password given in the img tag. This gets you get around the HTTP basic authentication of the bitcoind.
• Use Flash to send a HTTP request to the bitcoind that transfers the coins to another address. Same-origin policies don't protect you here, as Flash applies those policies to the response instead of the request. So the Flash applet can't read bitcoind's reply, but can still send the request.
• Repeat in a loop with a large number of potential passwords.

Just a friendly reminder:

We are not a nation, but a global community. Mt. Gox is sitting in Japan, there are traders in Europa, Asia, Africa, Australia, and also some in the US.

15 GMT works fine: Most people in the US are already awake, while most people in Japan aren't already asleep. And of course it's also daytime in Europe. So for most people 15 GMT is at some point during the morning/day/evening, and only few people need to trade during the(ir) night.

In addition, it's Sunday, so many people don't need to work today (except for some middle-eastern countries, where Friday takes the role of our Sunday).

So I'd say that Sunday 15 GTM is one of the fairest solutions for everybody. If this doesn't work for you just don't go to church. Or buy a 3G SIM card and take your laptop with you.

Look at the way how Bitmarket works:

The (Bitcoin) seller sends his Bitcoins to the Bitmarket escrow service
The buyer directly wires the Bitcoins to the seller
The seller releases the coins in the escrow

So you don't have to deal with any real money at all.

Another nice thing is that you can operate such an exchange 100% anonymous over Tor - you just need to somehow gain the trust of the community.

From https://www.mybitcoin.com/contact-us.php :

MyBitcoin LLC
Main Street, Box 556
Charlestown
Nevis, West Indies

So good luck with suing them! You will need it.


So let me get this straight:

1) There were no security problems at mybitcoin.com
2) mtgox was cracked
3) Some users were so f***ing stupid to use the same username and password on both sites

And you claim 3) is the fault of mybitcoin.com? I don't see any reason why they should reset any passwords due to the Mt. Gox issue. To be honest, as a user of Mt. Gox I was really annoyed that I had to reset my password at some other sites, just because some users were too stupid to take minimal security precautions.

Being just stupid is one thing, suing others for your own stupidness is another thing - and not acceptable to me.

Let's say I have a fork of the blockchain into chains A and B. My client currently only sees A and I submit a transaction.

Would it now be possible that someone else also applies the same transaction to B? Or is the transaction somehow bound to the chain (e.g. by specifying the hash of a chain block that must exist before the transaction is considered valid), so that a transaction submitted for fork A is invalid for fork B.

The reason why I'm asking is that some "Bitcoin banks" seem to only credit received coins after a given number of blocks have passed. If it would be possible to bind a transaction to a specific block chain (e.g., by specifying a required "previous" block) one could avoid this problem, by instantly crediting received coins, but by binding newly sent coins to the same fork of the chain where the previous coins have been received.

Why create one central decentralized exchange, when you can just create many decentralized independent exchanges?

As an individual just don't use the monopoly (where the Lemmings go), but one of the other exchanges.

While I have a Mt. Gox account I did all my recent trades over Bitmarket and so I did not have to care about the Mt. Gox problems at all.

Unfortunately it seems that all the Lemmings are moving now to TradeHill. Instead of learning something from the Mt. Gox fail everyone switches to the same exchange waiting for the next crash.

The high prices on Ebay are almost certainly due to the fraud risk that the sellers have. If they are, e.g., paid with Paypal, the buyer can reverse the transaction after receiving the Bitcoins. Therefore, every seller will charge a premium to cover that risk.

On the other hand, the buyers also get an advantage for paying more: They don't need to trust platforms like MtGox, but can buy there coins on a more reputable platform. If the seller does not send them the Bitcoins they can be sure that they will get there money back.

Yes - because right now there's a high volatility on individual markets and some of the listed markets only have a very low volume.

This will change. You see arbitrage on all types of financial markets and Bitcoins are no exception.

Not really. As soon as you see price differences between the markets you can make money with arbitrage: Buy cheap on one market, sell expensive on the other markets. So the people who do this balance the prices between the individual markets.

So even if your market closes during the night: If there are crashes on other major markets during this time people on your market will sell (or buy) as soon as your market opens again.

And again: Which solution do you propose? Bitcoin is a _global_ community. There is no day and no night. In addition, Bitcoin is decentralized - everyone can open an exchange and you can't prevent this.

These are like to rules of physics: Even if you wanted to - you can't change them. Better learn to live with them.

Yes, the same way how people in the US trade at European exchanges, even though it's night in the US. And in practice, one of those reasons is that the exchanges aren't open 24/7: If I can't get a trade through at an European exchange because they are already closed, I'll just buy the stuff at an US-based exchange instead, if this one is still open.

But to be honest, the whole question is irrelevant. Let's consider all major exchanges are based in the US (which they aren't!) and all of them close during the night. How long do you think would it take for a new exchange to open in Europe or Japan that does not abide to those closing times? And in reality even existing exchanges won't abide to this: MtGox is based in Japan, Bitmarket is based in Europe, etc. So why should they abide to US timezones?