android wallet 

Sounds like a good plan  Lets hope no more security holes happen (though those that happened came from outside YOUR code - my perfect Evan [I'm getting creepy now aren't I?  LOL])  Oh boy, I better rein in my sense of humor....

Anyone notice we're on the first page of r/Bitcoin right now?

http://www.reddit.com/r/Bitcoin/

LOL at the irony of that post hitting the front page. I really like the answer to the master node question, I had no idea what the answer was.

All hail our hero, FT_clox_metoo.

wooo wooo!!! gents...lets keep it civil.  Evan will certainly be letting you know whats up.  There where 3 devs...Evan as the main, Kyle and Ape back when I first started here as I understood.

Hello everyone,

I'm trying to understand this stratum exploit better, and something is confusing me.

The lowest difficulty is defined by the biggest target. So if we look at the nBits of the genesis block, we then convert to hex (from the compact representation) to get the diff 1 targets.

In BTC, genesis.nBits    = 0x1d00ffff;

https://en.bitcoin.it/wiki/Difficulty suggests we convert to a hex representation like:

so the hex target is
0x00ffff * 2**(8*(0x1d - 3))
or
0000 0000 ffff 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

Which matches https://github.com/Crypto-Expert/stratum-mining/blob/master/lib/template_registry.py where for sha256

diff1 = 0x00000000ffff0000000000000000000000000000000000000000000000000000

Now looking at a scrypt coin, eg LTC:

0x1e0ffff0 is the genesis block nbits

so the hex target is

0x0ffff0 * 2**(8*(0x1e - 3))
or
0000 0fff f000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

Which doesn't match stratum-mining

 if settings.COINDAEMON_ALGO == 'scrypt' or 'scrypt-jane':
            diff1 = 0x0000ffff00000000000000000000000000000000000000000000000000000000

ie. the stratum-mining code has 4 leading zeros in the 64 byte hex representation of the target, wheras I get 5 leading zeros when doing the conversion from the compact to the full hex representation of the max difficulty.

I'm sure stratum-mining must be correct  - where am I going wrong?

The kgw exploit is real.

The problem is that the software will accept blocks that are timestamped earlier than previous blocks, (for good reasons) up to the median timestamp of the previous 11.  

Kgw counts these as very fast blocks and adjusts the difficulty up by its 20% maximum.  Once.   But you can use that once to roll the timestamp back after five blocks that are long enough to drive the difficulty 20%lower each.  

So the exploit is to start mining your own block chain, time stamping several blocks into the future far enough to get the maximum downward adjustment of difficulty each time.  Then jump backwards in time getting the maximum upward difficulty once.  Rinse, repeat,  and your chain gets ridiculous low difficulty and you mine a whole lot of blocks while advancing your timestamp not much further than the main chain.

When the time in the main block chain catches up, you release your own chain and force a reorganization, which allocates to you all the coins mined for the last umpty ump blocks.

Don't forget, people, that we have a wonderful forum where you can ask questions in an organized fashion.  Subjects can be kept under their own headers, and information can be easily searched, instead of like here where it could be anywhere in 420 + pages.  Please come join us on https://www.darkcointalk.org !

To be honest, I'm a little ticked that this started out as "Bounty pool for marketing and branding" and now it's just "Darkcoin bounties" including bug reports etc.  I'm fine with that for now, if that's what the funds are most needed for at this point.  

But at some point, we need a REAL marketing pool, and it shouldn't be just spent on these incremental increases in value.  It should be spent on something AWESOME.  Marketing is an art, you don't just pay out a couple hundred bucks to make a slightly better website or translate to an additional language.  At least, that's not ultimately the best use of funds when you're ready for mass adoption.  Right now, this thread has ~171,000 page views.  That's great for now.  A liberal estimate means maybe 200,000 people have heard of Darkcoin.  All it takes is one good marketing play... one single thing that stands out, and you get over 10 million people that have now heard about your coin.  Doge has no technical use whatsoever and is far less interesting than DRK, but a brilliant marketing idea like donating $30k to the jamaiican bobsled team generates over 10 million views.  We need to find our own crazy marketing idea.  I'm not sure what exactly that is, but something that fits DRK and will get 10 million views based just on one single marketing effort.  This doesn't have to cost much, but it will take a decent chunk of any marketing pool and be worth way more than the sum of all of these incremental updates.  It could be something like a billboard.  You can rent out a billboard for a month that displays digital ads in a high traffic area along the freeway for under $1000/month.  This probably isn't the best fit for DRK, but someone has to get creative and figure out what that is.  

I'd be willing to donate 5 to 10x my previous contribution to a marketing pool with a real marketing idea like this.

Thank you, this is excellent critcism. Unfortunately I have a day job and only so much time to coordinate these bounties and write up detailed conditions for security testing. Hmm, maybe I can make a bounty for that...

So on that note: who wants to help define these bounties in more detail, answer queries & validate submissions? I could definitely use the help.

Hi Evan...is this an official fundraiser wallet authorized by you and Ape?  Not questioning LimLims...just want to have an official OK and green light from our devs that this approved by them as the approved wallet address.  If this wallet is...can we have the official wallet address listed on the website and at the beginning of this forum thread so that no one can alter this wallet address and have the funds go to someones private wallet.  Thanks.

Yes, I am way too busy to do it myself. However, I put LimLims incharge of management of the project awhile back.

Hi Evan...is this an official fundraiser wallet authorized by you and Ape?  Not questioning LimLims...just want to have an official OK and green light from our devs that this approved by them as the approved wallet address.  If this wallet is...can we have the official wallet address listed on the website and at the beginning of this forum thread so that no one can alter this wallet address and have the funds go to someones private wallet.  Thanks.