I somehow managed to get into the second Beta rollout for Shift Payments, and my card hit my mailbox yesterday. So far, I'm very much impressed. I've used it at a national restaurant chain and at a local retailer, and both transactions went without issue.

The world is rapidly changing, and it's honestly just amazing to see how quickly cryptocurrency is being adopted. It's one thing to talk to other enthusiasts and stash away coins as you can - it's quite another to suddenly be able to use Bitcoin in your daily life.

Consider this - I have my bank account hooked to Coinbase, and I can buy Bitcoin instantly from my phone. Now I've got a Visa card that I can use to spend those same coins, even if the merchant I want to use has never heard of Bitcoin. Sitting in central Virginia, I can literally buy, sell and use Bitcoin more easily than I could Euros.

But, enough of the glowing praise and fanboi diatribe - let's talk limitations.

The card is issued in Japan, and doesn't have my name on it (it says "TAYTWO POINTMEMBER"). The numbers aren't raised. The back is in Japanese. Shift sent a letter with the card explaining these issues, and it's important to understand that it is a BETA PROGRAM. I'm frankly amazed that they've managed to get them out the door so quickly at all. They're working on issuing personalized card with their own design, but didn't want to hold up the Beta program. Awesome

The card costs money. I've honestly forgotten how much, but I want to say it was around $50. Their site says this is to help manage demand, and I have to say that I really like that they have come out and said this. A company charging more money to limit demand for their product, then acknowledging that they are doing so? That doesn't seem to happen often in the US, and I'm happy to support such a company.

Their settlement system leaves much to be desired. I have two transactions pending right now, and my Coinbase account has not yet been touched. The funds are spent from my Bitcoin account when the transaction settles 24-48 hours later. If I wanted, I could buy $500 worth of stuff then empty my Coinbase account, sticking Shift with the difference. It *is* a Beta, but this must be fixed before releasing to the public. If Shift is to survive, they must be able to effectively manage their exposure.

They ask for permission to spend unlimited funds from my Coinbase account. I don't generally keep funds in any hosted wallet like that (I use GreenAddress.it for my short-term savings), so it's not an issue for me - but it could be for others. There's no way I'd want to give them access to purchase Bitcoin on my behalf either, althought they have apparently considered it judging by past interviews I've read.

All in all, I'm happy. Bitcoin has come a long way since I got involved, and if Shift can pull this off on a large scale it will literally change the world. We live in exciting times.

Yeah, I know. 3 BTC.

Still, I was wondering - is there a new vulnerability out there I don't know about?

I'm trying to think of all the vectors that could have led to this. I have accessed my account from a PC at work, my personal Macbook Pro, and my Android tablet. The credentials are also stored with LastPass, with a >20-character pseudorandom passphrase protecting them.

My MtGox password was woefully weak, something I hadn't noticed because honestly, LastPass removed it from my line of sight. It consisted of 6 characters, the first four of which was an English word and the last 2 a number that looked like a recent year.  That has been corrected. It had been changed since the "big" MtGox break-in, though, so I don't think that was it.

I'm not really upset about this, but rather more interested to find out how it happened. I also don't blame MtGox, unless they did something stupid like allow my account to be bruteforced - but I have no indication this occurred.

Update - response from MtGox:

Hello,

Sorry for the inconvenience.Please change your email address password and Mt.Gox password immediately. Please do not use the same username and password on different services. You can use the Yubikey or Software Authentication on our Security Center to further secure your accounts.

Please file a police report in order for the police to investigate the case and make an effort to retrieve your funds and once filing a police report, please send a copy of the police report and the official ID document to Mt.Gox. We will cooperate with the police authority in providing the necessary information for the investigation, but we are unable to reimburse any stolen funds.

Thanks,

MtGox.com Team

Is there interest in this community to have a physical agent travel to the alleged location of pirateat40?

I would be willing to drive there and stay for up to a week, performing any legal service on behalf of those who might finance this. This could include knocking on doors of known business associates, friends, and family of Mr. Shavers; communication with local law enforcement; live status updates of my findings on a public and/or private site per the terms of my client(s); etc.

Again, any legal service - I know my rights and their limits. I don't mind being an ass to someone for pay, but I'm not willing to break any kneecaps.

Cost for this would be 100 BTC to travel there and back, plus 75 BTC per day. Each day would include 14 hours of tracked time working proportionally on behalf of my client(s), inclusive of travel time, dining, etc.

I believe I could do this as early as next week, but would need to move quickly to make the necessary arrangements.

Finally, respective of the nature of the events that may have made such a service necessary, I am willing to make myself personally known and accountable to anyone willing to contribute 50 BTC or more. Further, should a single client or a combination of several clients fund my visit in advance for 5 days, I will post a bond payable to them through a recognized insurance company in the state of Arkansas.



At this point, I'm just curious if there is interest. This sort of thing would involve not only substantial disruption of my life, but also a non-zero risk of retribution. 475 BTC for a week of work (minus expenses) seems like a bargain for that, to me - but it would also provide capital for some other projects I would like to be able to get off my plate.

I do a lot of internet marketing, and am a bit of a webmaster on the side. As a result, I have a couple of dozen Amazon t1.micro instances with very low CPU utilization that other people are paying me to keep running.

Since I'm already paying for the servers and CPU utilization is not metered, I'm looking for a linux cpuminer that I can use to more fully utilize the processing power at my disposal. It is important that this not overtax the CPU to the detriment of the webserver, though - are there any tools out there that will help me constrain resource utilization to under, say, 80% total across all processes?

I looked through the stickies, and it doesn't look like it will be an issue setting up the miners, I just need to be pointed in the right direction to learn how to keep it out of the way of the actual "work" being done on the systems.

It is *very* difficult to find out why a "new" user doesn't have rights to post in most forums. I have been registered for over six months, and only today finally found this section which explained why I couldn't post.

In my opinion, this is an onerous and counterproductive requirement that is severely limiting the growth of this forum, and by extension, the Bitcoin community.

I do understand why it's there - there should *at least* be a notice somewhere, though. Perhaps send new users a PM automatically explaining it, if nothing else?