I have a payment of 1h and 45min ago that is still not confimed (I have receive confirmed paymet later that this ) for 0.00832 BTC, do you know why ?

the blockchain is https://blockchain.info/tx-index/6be5d41a8dd762b8861893c189e26ef816aede31b6204ebbbd8ab92b0234fccb

It's still processing payouts. The thing is that only 1 payout is processed every 60 seconds, then another payout in another 60 seconds. Theyre not all at once. I'm working on the code to make it so that every minute it sends more than 1 payout.

Thanks,

This is not 130% 

What happened to your v1 (https://bitcointalk.org/index.php?topic=492142.0) and v2 (https://bitcointalk.org/index.php?topic=585185.0) ponzi thread and bitcointalk account lol?

So to payout the 0.015 BTC , someone gotta send the same amount or more right ?

It's nice if it's really auto, atleast there's a timer.

.1

How can a Ponzi be trusted? You are talking about the liars we can trust. that's ridiculous.

The Ponzi that pays you is always run away with your money at the end,maybe you would benefit from the Ponzi,but the later investors pays for this.

very nice sum up
i'd like to add: bitcoind which has access to funds should not run on the same machine as the webserver.
and if you use a salt dont reuse it

Yup, in the interim you could always change the port numbers as well until you can upgrade your infrastructure. A quick fix would be to filter our the input characters: " ; ' - / * xp_ \ and %.  In addition to that, you can redirect all your 40x error pages back to your login page. You usualy have to create the pages and then tell the webserver that you have those pages.

You might also want to capture the login ip address and then for x amount of failed logins, lockout that IP address by adding to the firewall as a block. This will help prevent against someone running a dictionary attack on your login code. You might want to add a timer or captcha after a failed login as well.  In the error messages, don't distinguish between a failed username or password, I think you just display a generic error message which is good. If you decide on a password reset function, whether the email address exists or not, don't display an error message if someone submits a bad email address.

Netnames has a bad history of having some lax security for social engineering, if someone figures out your real name, they may attempt to contact them and social engineer a password reset on your vps account. What I usually tell people is to contact them in advance and tell them to deny all password and email change resets over the phone and call you back on your mobile phone. They have a notes field in their customer management systems (I think they use salesforce) so that your request gets honored. You might have to ask for a supervisor, but they will do it.

Lastly, you might want to throw in what I call a fake breadcrumb trail or Chum in your php/html. In the comments section of your login page, deposit, or withdrawal page, something that goes like this:

It won't fool everyone, but you can at least redirect some of the snooping elsewhere. I would also create a fake directory in the php directory called wallet and put a wallet.dat file in there with 0 btc in it or dust. That way if someone breaks in, they'll go for the easy target. You can then monitor the file for access or the wallet balance to see if it gets nabbed.

In your database, don't call the password field password, call it something else like indexing, etc and then dump in fake unencrypted passwords into the password field. I often create fake user, password, and email tables for my applications. That way, if someone steals the password database, they'll go for the low hanging fruit to buy yourself some time. Also, avoid MD5 and SHA1 for encryption, I'm sure you already know this, but just putting it out there. When you salt your passwords, don't store the salt in the config files. You can also write a function to scan for a specific account in there, like Admin and P@ssw0rd, so if someone uses them, you'll get some type of an alert and then a shutdown function so you know your username and password table has been compromised and powers down (or disables) the services preventing additional loss.

Was I accepted?