I think where you might have a misunderstanding is thinking of the miners and the clients as separate, but it absolutely requires both mechanisms for the bitcoin network to function.  And as I pointed out, they where one in the same software originally.  It is technically feasible to create and sign a transaction without doing any mining.  It is also feasible to send it "out of network" by printing it on a piece of paper and mailing it to someone for example.  At any point in time that transaction could be transmitted to the network and then be validated as long as the original bitcoins had not moved. But until the transaction is actually incorporated into the block chain it has no meaning to the network at all.  

In terms of implementation there is a pool of transactions that each miner keeps that it hears about from other nodes.  At each miners desecration (based on fees or other criteria) the miner can choose to incorporate any or all of the transactions it has in it's pool of unconfirmed transactions into the next block it attempts to solve.  These pools are more or less unique to each miner, there isn't a "big pool in the sky" of unconfirmed transitions.  Once a miner confirms a transaction in it's own pool, or receives a confirmed block that has that transaction the minor removes the transaction from it's pool of unconfirmed transactions, and continues on with the next set of unconfirmed transactions.

Is that perhaps more helpful?  Sorry if I came across a snippy, but you can't ask technical questions and then immediately restrain people from giving you the correct answer.

Oh, so what you're saying is "if I intentionally don't use bitcoin as designed who will confirm transitions?"  Also a self evident and nonsensical question. Using a non-mining client alone, does not a bitcoin network make.

Originally the client did mine on your local cpu (not gpu).  To operate bitcoin AT ALL, with only two "clients", at least one of them would have to be also mining.  Any other scenario is breaking the system on purpose. Any hypothetical questions about how an intentionally broken implementation would function is just silly.

This is like asking who would use the internet if all the computers where off.   It's a nonsensical question.  If all miners shut down, there is no bitcoin network to send transactions on, and no one to receive the transition.

If you mean just me and my buddy who is receiving the transaction are the only two nodes on the network then those will also be the only two nodes mining, and you've just undone your all miners are shut down premise.

While I disagree that this constitutes legitimate journalism, as pointed out by the ethics violations I've posted elsewhere.  I absolutely agree that retaliation (of any kind) is completely inappropriate. People will lose respect for her, and/or it will negatively effect her career, or perhaps it will just be a slap on the wrist that will help her be a better reporter in the future, but no one here has any right to attack or harass her.

Her life should not be threatened, and her privacy should not be attacked! What argument could you possibly have against her in the first place if you're willing to do that?

I would suggest that no one buy or subscribe to Newsweek, and cancel if you already have a membership.  

http://www.spj.org/ethicscode.asp
SPJ Code of Ethics
Download a printable copy [http://www.spj.org/pdf/ethicscode.pdf]

Preamble
Members of the Society of Professional Journalists believe that public enlightenment is the forerunner of justice and the foundation of democracy. The duty of the journalist is to further those ends by seeking truth and providing a fair and comprehensive account of events and issues. Conscientious journalists from all media and specialties strive to serve the public with thoroughness and honesty. Professional integrity is the cornerstone of a journalist's credibility. Members of the Society share a dedication to ethical behavior and adopt this code to declare the Society's principles and standards of practice.

The SPJ Code of Ethics is voluntarily embraced by thousands of journalists, regardless of place or platform, and is widely used in newsrooms and classrooms as a guide for ethical behavior. The code is intended not as a set of "rules" but as a resource for ethical decision-making. It is not — nor can it be under the First Amendment — legally enforceable.

For an expanded explanation, please follow this link.
Seek Truth and
Report It
Journalists should be honest, fair and courageous in gathering, reporting and interpreting information.

Journalists should:

— Test the accuracy of information from all sources and exercise care to avoid inadvertent error. Deliberate distortion is never permissible.
— Diligently seek out subjects of news stories to give them the opportunity to respond to allegations of wrongdoing.
— Identify sources whenever feasible. The public is entitled to as much information as possible on sources' reliability.
— Always question sources’ motives before promising anonymity. Clarify conditions attached to any promise made in exchange for information. Keep promises.
— Make certain that headlines, news teases and promotional material, photos, video, audio, graphics, sound bites and quotations do not misrepresent. They should not oversimplify or highlight incidents out of context.
— Never distort the content of news photos or video. Image enhancement for technical clarity is always permissible. Label montages and photo illustrations.
— Avoid misleading re-enactments or staged news events. If re-enactment is necessary to tell a story, label it.
— Avoid undercover or other surreptitious methods of gathering information except when traditional open methods will not yield information vital to the public. Use of such methods should be explained as part of the story
— Never plagiarize.
— Tell the story of the diversity and magnitude of the human experience boldly, even when it is unpopular to do so.
— Examine their own cultural values and avoid imposing those values on others.
— Avoid stereotyping by race, gender, age, religion, ethnicity, geography, sexual orientation, disability, physical appearance or social status.
— Support the open exchange of views, even views they find repugnant.
— Give voice to the voiceless; official and unofficial sources of information can be equally valid.
— Distinguish between advocacy and news reporting. Analysis and commentary should be labeled and not misrepresent fact or context.
— Distinguish news from advertising and shun hybrids that blur the lines between the two.
— Recognize a special obligation to ensure that the public's business is conducted in the open and that government records are open to inspection.

Minimize Harm
Ethical journalists treat sources, subjects and colleagues as human beings deserving of respect.

Journalists should:

— Show compassion for those who may be affected adversely by news coverage. Use special sensitivity when dealing with children and inexperienced sources or subjects.
— Be sensitive when seeking or using interviews or photographs of those affected by tragedy or grief.
— Recognize that gathering and reporting information may cause harm or discomfort. Pursuit of the news is not a license for arrogance.
— Recognize that private people have a greater right to control information about themselves than do public officials and others who seek power, influence or attention. Only an overriding public need can justify intrusion into anyone’s privacy.
— Show good taste. Avoid pandering to lurid curiosity.
— Be cautious about identifying juvenile suspects or victims of sex crimes.
— Be judicious about naming criminal suspects before the formal filing of charges.
— Balance a criminal suspect’s fair trial rights with the public’s right to be informed.

Act Independently
Journalists should be free of obligation to any interest other than the public's right to know.

Journalists should:

— Avoid conflicts of interest, real or perceived.
— Remain free of associations and activities that may compromise integrity or damage credibility.
— Refuse gifts, favors, fees, free travel and special treatment, and shun secondary employment, political involvement, public office and service in community organizations if they compromise journalistic integrity.
— Disclose unavoidable conflicts.
— Be vigilant and courageous about holding those with power accountable.
— Deny favored treatment to advertisers and special interests and resist their pressure to influence news coverage.
— Be wary of sources offering information for favors or money; avoid bidding for news.

Be Accountable
Journalists are accountable to their readers, listeners, viewers and each other.

Journalists should:

— Clarify and explain news coverage and invite dialogue with the public over journalistic conduct.
— Encourage the public to voice grievances against the news media.
— Admit mistakes and correct them promptly.
— Expose unethical practices of journalists and the news media.
— Abide by the same high standards to which they hold others.

I would suggest that no one buy or subscribe to Newsweek, and cancel if you already have a membership.  

http://www.spj.org/ethicscode.asp
SPJ Code of Ethics
Download a printable copy [http://www.spj.org/pdf/ethicscode.pdf]

Preamble
Members of the Society of Professional Journalists believe that public enlightenment is the forerunner of justice and the foundation of democracy. The duty of the journalist is to further those ends by seeking truth and providing a fair and comprehensive account of events and issues. Conscientious journalists from all media and specialties strive to serve the public with thoroughness and honesty. Professional integrity is the cornerstone of a journalist's credibility. Members of the Society share a dedication to ethical behavior and adopt this code to declare the Society's principles and standards of practice.

The SPJ Code of Ethics is voluntarily embraced by thousands of journalists, regardless of place or platform, and is widely used in newsrooms and classrooms as a guide for ethical behavior. The code is intended not as a set of "rules" but as a resource for ethical decision-making. It is not — nor can it be under the First Amendment — legally enforceable.

For an expanded explanation, please follow this link.
Seek Truth and
Report It
Journalists should be honest, fair and courageous in gathering, reporting and interpreting information.

Journalists should:

— Test the accuracy of information from all sources and exercise care to avoid inadvertent error. Deliberate distortion is never permissible.
— Diligently seek out subjects of news stories to give them the opportunity to respond to allegations of wrongdoing.
— Identify sources whenever feasible. The public is entitled to as much information as possible on sources' reliability.
— Always question sources’ motives before promising anonymity. Clarify conditions attached to any promise made in exchange for information. Keep promises.
— Make certain that headlines, news teases and promotional material, photos, video, audio, graphics, sound bites and quotations do not misrepresent. They should not oversimplify or highlight incidents out of context.
— Never distort the content of news photos or video. Image enhancement for technical clarity is always permissible. Label montages and photo illustrations.
— Avoid misleading re-enactments or staged news events. If re-enactment is necessary to tell a story, label it.
— Avoid undercover or other surreptitious methods of gathering information except when traditional open methods will not yield information vital to the public. Use of such methods should be explained as part of the story
— Never plagiarize.
— Tell the story of the diversity and magnitude of the human experience boldly, even when it is unpopular to do so.
— Examine their own cultural values and avoid imposing those values on others.
— Avoid stereotyping by race, gender, age, religion, ethnicity, geography, sexual orientation, disability, physical appearance or social status.
— Support the open exchange of views, even views they find repugnant.
— Give voice to the voiceless; official and unofficial sources of information can be equally valid.
— Distinguish between advocacy and news reporting. Analysis and commentary should be labeled and not misrepresent fact or context.
— Distinguish news from advertising and shun hybrids that blur the lines between the two.
— Recognize a special obligation to ensure that the public's business is conducted in the open and that government records are open to inspection.

Minimize Harm
Ethical journalists treat sources, subjects and colleagues as human beings deserving of respect.

Journalists should:

— Show compassion for those who may be affected adversely by news coverage. Use special sensitivity when dealing with children and inexperienced sources or subjects.
— Be sensitive when seeking or using interviews or photographs of those affected by tragedy or grief.
— Recognize that gathering and reporting information may cause harm or discomfort. Pursuit of the news is not a license for arrogance.
— Recognize that private people have a greater right to control information about themselves than do public officials and others who seek power, influence or attention. Only an overriding public need can justify intrusion into anyone’s privacy.
— Show good taste. Avoid pandering to lurid curiosity.
— Be cautious about identifying juvenile suspects or victims of sex crimes.
— Be judicious about naming criminal suspects before the formal filing of charges.
— Balance a criminal suspect’s fair trial rights with the public’s right to be informed.

Act Independently
Journalists should be free of obligation to any interest other than the public's right to know.

Journalists should:

— Avoid conflicts of interest, real or perceived.
— Remain free of associations and activities that may compromise integrity or damage credibility.
— Refuse gifts, favors, fees, free travel and special treatment, and shun secondary employment, political involvement, public office and service in community organizations if they compromise journalistic integrity.
— Disclose unavoidable conflicts.
— Be vigilant and courageous about holding those with power accountable.
— Deny favored treatment to advertisers and special interests and resist their pressure to influence news coverage.
— Be wary of sources offering information for favors or money; avoid bidding for news.

Be Accountable
Journalists are accountable to their readers, listeners, viewers and each other.

Journalists should:

— Clarify and explain news coverage and invite dialogue with the public over journalistic conduct.
— Encourage the public to voice grievances against the news media.
— Admit mistakes and correct them promptly.
— Expose unethical practices of journalists and the news media.
— Abide by the same high standards to which they hold others.

I'm in LA, and would like to go, but it's hard to see these types of announcements at the Bitcoin Forum through all the noise.  Could you maybe post a group event at bitcoinlocator?

j

Exactly the same way you would dispute a cash transaction.

Hey, casascius I'm a big fan.  I think we are the two first people to have bitcoins in our head.  I have a question though.

How is the public key displayed?

j

Okay, so everyone's happy with treadmill being THE bitcoin.com company.  Great.  But remember when they do something you don't like on their site you can't say jack shit about it.

I do hope it all works out I'm just bring up the issue.

j

I'll be honest I have mixed feelings about this.  Bitcoin is an open source project.  I like TradeHill, but I'm no more happy about trade hill controlling bitcoin.com then I would be if RedHad got Linux.com or Apple got w3c.org. I'm looking forward to new well designed bitcoin services, but I think they should all compete in the field with their own corporate identity and without the implied community endorsement of the open source project domain name.

j

Oh doesn't it?  That was my understanding, as posted above, and no one has corrected me on that yet.

j

I'm hoping that this thread goes to show, that 3rd party services have security flaws, even when they say they don't. It is always you're own responsibility to verify the security of your money. You can't trust a sales pitch, however well intentioned.

I am surprised to discover that you can't check payments to random addresses remotely at the moment, so I've tried to give the dev team some encouragement to integrate that feature (which is already available in a patch).

You can use bitocind on a server and manage the funds entirely yourself. This is as easy as any web service using the json interface.  You can have a duplicate of the server's wallet on your own machine, and you can manually or procedurally sweep funds from the online wallet to a more secure wallet at any time.

3rd party solutions are NEVER going to be an easier way to bitcoin security. It is not possible to know all the security issues with a 3rd party solution, without access to their entire server/software stack, and significant knowledge of possible weakness (like IP masquerading). Which is of course harder then securing your own server.  You can always make your server at least as secure as any 3rd party server, and because unix security is a known problem you have lots of resources for improving it.

I think BitcoinNotify is probably a very good service that can help the bitcoin economy, and I want to see more bitcoin merchant related services. I'm glad they attempted to addressed one of the security issues quickly, but there is still the double spend attack which is quite a bit easer to exploit then IP masquerading (mybitcoin claims that is exactly what happened to them, losing more then 50% of all customers assets), and who knows how many other issues (how secure are their servers, are you really going to always check the sig on their POST request?). This may not be an issue for the OP because he can re-verify payments before shipping, but not all services have that window for additional verification. So please understand you ARE compromising your security by using a 3rd party, it is up to you to decide if the benefits out way the risk, and you must do so without a full knowledge of what risks that 3rd party is exposing you too.

As I said before, and everyone should know by now, there is no shortcut to security.

Understand first, trust second, and if you must trust someone trust a security professional who is working for you.

j

If I understand correctly this patch will allow web application servers running bticoind to confirm payments without an active receiving wallet.

I would like to reiterate that this is an important feature. Since the mybitcoin debacle there is now a deadlock for merchant services between the risk of a server side wallet, and the risk of 3rd party merchant services. I am shocked to find out that getreceivedbyaddress does not give a correct value for any address except those in your wallet. This means that a receiving wallet must be left on the server and it will receive ALL bitcoin income for the service. Even with code to regularly sweep the account, this is clearly an unacceptable security risk.  On the other hand all 3rd party solutions are even riskier.

Conscientious merchants simply can't move forward with bitcoin without this patch.

j

What I did when I stored bitcoins in my head was create a passphrase and a pin number.  The pin number represents the number of times to run SHA256.  I now only remember the "first bits" to the public address, the passphrase, and a pin.  I have my savings account now that I've confirmed it several times with different pass phrases and smaller amounts.  To avoid the change problem I always send the entire balance out, and send change back in manually.

I think it's pretty secure.  Nevertheless it is very easy to hack with a rubber hose... just saying.

Anyone know of a calculator for passphrase entropy?

j

bitcoind can monitor the blockchain without access to your receiving wallet just as easily as a third party service.



Do you see it now?

Considering how many people trusted mybitcoin, and a startling willingness to abandon a key security feature of bitcoin I think it's important that everyone understand that security is a multifaceted problem. You need to be very conscious when you are explicitly or implicitly trusting a 3rd party.  Bitcoin as a system is well designed, but you eliminate the value of that design if you start working around it buy using online wallets, merchant services etc.  

I'm not saying you can't use those things.  But why use them if the built in tools do almost exactly the same thing more securely? If you understand how to use bitcoin, and you have a specific need for a 3rd party service, then you should also understand as well as possible what risk you are absorbing.  A LOT of people on this list lost money because they failed to notice when that where circumventing their own security.  

Understand first. Trust second.

j

P.S. Note that I'm not saying this service is bad.  If you know a site is bad security questions are easy to answer.  I'm simply rebutting the assertion above that it is better to trust a 3rd party then the bitcoind and API.

P.P.S:

This just proves that neither of you are considering ALL of the security issues.  It's actually really hard to do. That's why you should just try to use the bitcoind system if you can.  It's vetted, peer reviewed open source, and well understood by a large community who could help you if you have trouble.

This is EXACTLY the kind of mistake I'm talking about. That service is not providing anything you can't easily do with a bitcoind. And it's opening you up to a HUGE security hole. Don't know that that hole is? Then that is exactly why you should not be using third party solutions.  At least one security hole on this site is easy to identify, but that is not true of most 3rd party sites.  You'll never know all the security liabilities.  With bitcoind you know what you're getting into, and it just isn't that much harder to do a json request then to get a post notification from a 3rd party site.

Tell me why are you trying to avoid using the proper API?  You just don't want to read the manual? Reading the manual and learning how bitcoin works is a small price to pay for the security and reliability it can offer if used properly.

Well unfortunately you are a bit biased.  After recent events the reliability of third parties to manage bitcoins must always be considered lower then managing your own wallets and security.  The entire point of bitcoin is to eliminate the need for third parties, that's a security feature you should not attempt to circumvent unless you thoroughly understand and can tolerate the risks involved.

Also, in point of fact. You do not need to keep a wallet that contains coins in it on the server if you are only receiving payments.  You can pre-generate a number of bitcoin addresses on a secure client and load them into a database table on your site.  Even if you do use a normal server side bitcoind you can also keep a local copy of the same wallet, so that you can regularly sweep money to your trading account of offline savings wallet.

The problem is the lack of site-able references.  The bitcoin wiki article doesn't explain why it exists, so until there is an article somewhere that explains the logic of base58 I fear we will never see it at wikipedia.

If you mean how do you implement shopping carts and such with bitcoins? Then you're looking for the json interface to bitcoind:


https://en.bitcoin.it/wiki/API_reference_(JSON-RPC)

Note the link may not work, so cut and paste.