A new incident has affected General Bytes bitcoin ATMs these past couple of days. On this occasion, hackers managed to make away with around 1,5M $ in crypto. In order to do so, they managed to upload their own java software using a video uploading interface to the system, and execute it using the atm’s privileges. The malware has so far allowed the hackers to move funds from some bitcoin ATM installations, as well as to scan the logs in search for client private keys (not sure what precise functionality resorts to customers providing private keys, but that’s what the info states). See the complete details in the second link below. The incident has afected both GB Cloud services, and some standalone servers from other operators. GB seems to have closed-down their cloud service (no indication on how long for), and is prompting their customers (companies) using their bitcoin ATMs to run their own standalone servers. See: https://www.cryptopolitan.com/general-bytes-atm-suffers-a-massive-hack/https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023Now they are not just prompting but FORCING people to run the back end themselves. This will keep them from getting massively hacked again, but at a guess a lot of the small BTAM operators that only have 1 or 2 machines are not going to stay in the game if they now have to run the server themselves. There is a baseline of knowledge and skill needed and it's now an additional unknown expense. I wonder if some other operator will start offering the service. Not something I would even want to think about doing considering the security implications. -Dave |
|
|
|
What are you looking to do? There are web interfaces [Ride the lightning] that allow access thought the web. They have also written a REST API https://github.com/Ride-The-Lightning/c-lightning-REST If you search there are more but RTL tends to be the most popular which means if you have an issue there are more places to look. -Dave |
|
|
|
|
I miss the S3 / R4 quiet Bitmain miners.
And, although it pains me to say this, I made a lot of BTC getting 2nd (and 3rd) hand Butterfly Labs stuff.
For a while there so many people overpaid for it, got it delivered late and were so disgusted with it all that you could pick them up lightly used for 1/10 the price that they paid.
At that point even with them being 1 or 2 gens out and not efficient, you could mine on razor thin margins at the time and still come out ahead since the $1500 miner cost you $175 delivered to your door.
And when you were really done with them you could still sell them for a few bucks.
The old innosilicon were also workhorses, not the best efficiency but they just kept on mining and mining with no issues. At least for me.
-Dave
|
|
|
|
The problem is mental conditioning. From a few pages up in this thread: ...Writing down any type of 'secrets' and storing the paper holding them securely (for decades) is very natural to humans, even going back hundreds and thousands of years, so I don't see why the 2022 human should be too stupid to accomplish it....
Leaving out all the other comments as to why I don't like this device, I will actually give them a small pass on this. For 20+ years now businesses have been conditioning people not to write down passwords for security reasons and that if you forget your password to your bank or whatever there is a way to recover it. So on one hand we have 2+ decades of oh you lost information, here it is. On the other side we now have sorry you lost a few words out of 24 word seed, sucks to be you your BTC is gone forever. Many other reasons not to like them, this is one of the smaller ones. -Dave There are people out there in their 20s who have never even stepped foot inside a bank. They have a checking account and savings account and so on and never interacted with another human about it. All online and all usernames and passwords recoverable. Same with brokerage accounts that could have hundreds of thousands of dollars. Never met a human who worked there. How do you convince them that they have to do that? They are creating what people like not what is good for the people. -Dave |
|
|
|
Even now you can install and try to donload the blockchain on too small a drive, it has the pruned check box on by default
It only checks it by default when the free space check determines that the drive doesn't have enough free space for the full blockchain. but does not even mention what may happen if you un-check it.
When you uncheck it, it shows a warning that says the entire blockchain will be redownloaded. This isn't "no mention of what may happen". How about a warning that says that it will not work. That you cannot fit a 500+GB blockchain in 400GB free space and that more then likely things are going to go poorly. I run a lot of things on very marginal hardware, but I know what I am getting into. It's not your job as a developer to hold peoples hand and stop them from doing something they should not. BUT a bit more warning is also not a bad thing. And unless you do this properly it's going to be worse. Now the user can start using his wallet sooner, and then BAM no more drive space. That is the point I have been (poorly) trying to make. -Dave |
|
|
|
|
Sort of, you have control of the full bitcoin node using the web front end that they give you or by SSH into the box and running things at the command line.
You don't get the front end that you see when running the GUI like you would in Windows.
Personally, I use the desktop version when I just need a BTC node.
And the bundled / nodes in a box stuff when I need a LN node, or want to demo things to people who don't want to know how it works, just that it does work.
-Dave
|
|
|
|
|
Yes they all need core. The 'nodes in a box' install core and then everything else.
They do run on a RPi4, well perhaps not run but walk really fast :-)
I have a few of them running on Rpi and they are fine, but a 4th gen i5 with 8gb RAM and a 1tb SSD blows it out of the water in terms of performance.
Once again, US pricing but the used PC the extra stick of RAM and a new 1tb SSD were under $150 all in.
-Dave
|
|
|
|
|
Core is enough to do what you want to do which is validate transactions.
Umbrel / Rapbiblitz / etc. Add a lot of stuff that you may or may not want to do but they give you the option.
Electrum server, Lightning node, pretty GUI for some things, block explorers, and so on.
Those are a bit more difficult to setup & configure so the nodes in a box take care of that for you.
-Dave
|
|
|
|
Didn't read the article, but from the snippet you've posted, it's simply incorrect.
Assumeutxo is neither a new type of node, nor a pruning. It's about making the software usable without having to wait multiple days for it to sync. It doesn't reduce the hardware requirements to run, in fact, using assumeutxo probably requires more resources than without it.
Assumeutxo allows a node to start with a preset UTXO set (provided by the user, and does not necessarily correspond to a hardcoded hash in the binary, this detail has not been worked out yet). This UTXO set is the state of the chain at a particular block hash and height. The node can then begin syncing from that particular block. The idea is that the block will be recent, so the node will be caught up to tip very quickly, thus allowing the user to make and receive transactions way faster than if they had to wait for the entire blockchain to sync.
The point is to make the software usable much faster. A major complaint that we've heard from users is that it takes ages to sync. Users often don't have the patience to wait and will start giving out addresses. Then they panic when they don't see incoming coins because they haven't synced yet and they come into this forum, or github, or reddit freaking out about losing money, all just because they haven't waited for the node to sync. Assumeutxo reduces that because it "syncs" faster.
Obviously there's a trust requirement in this - users have to trust that the UTXO set that they are using is correct. Assumeutxo mitigates this by actually syncing the full blockchain in the background. While the user is using the state provided by the UTXO set and the chain state extended from it, a second chain state is built in the background from syncing and validating the blockchain. Once that background validation reaches the preset UTXO set's height, it checks that the two states are the same (same UTXOs, same blocks), and will kill the software and give the user an error if they are not.
This is, in fact, not pruning, and unrelated to pruning. Of course, it should be possible to do it with pruning, but I don't know if that's been implemented yet. Furthermore, two chain states are being maintained in memory and on disk while the background validation is going. This means that the resource usage is actually higher, not lower.
Agree 100%. I have got to start pre-writing a lot of this stuff before posting and making an ass of myself because I left out a bunch. Anyway... What I wanted to start with, is although good in theory (still using the pruned node term. Is why do we want to have people use their nodes sooner. This is where the 3 step process I put in my post was about. Which was then supposed to comment on how people will start it with HW that can't handle it but it will work till it does not (extra memory and RAM) and will cause issues. What you can't read my mind about what I was thinking about posting. Tablet while remote accessing a PC to post here makes dave look dumb. Even now you can install and try to donload the blockchain on too small a drive, it has the pruned check box on by default but does not even mention what may happen if you un-check it. YES you can still do that now by installing on a 512 GB drive and running out of space, this just seems to encourage it. Once again IMO. If I go to an amusement park signs are posted that you must be this tall to get on some rides. Other software will not let you install on some systems that cannot support it. Core, says nah go ahead and put it on a 1st gen i3 with 2GB RAM and a 128 GB drive. This causes people grief, we have seen it here and on reddit and other places. Is it that hard to say NO don't do this? -Dave |
|
|
|
|
Yes. You can create a ASIC to do just about anything you want given enough funding.
But.....
Will off the shelf consumer hardware still be better? Even if it's a couple of orders of magnitude slower, the R&D and production and manufacturing and testing and so on might wind up being cheaper.
Even if tomorrow someone magically snapped their fingers and it came into being and millions of these units were produced the odds of finding a funded address are still so close to zero as to be zero.
-Dave
|
|
|
|
|
There is a also the 'real world' factor.
I would not say that my coldcard is particularity durable. Thin plastic not well sealed against the elements. But, it survived having a cup of coffee spilled all over it. I dried it off, rinsed it with some alcohol / contact cleaner and it still works fine. Had I dropped it on the floor and ran it over with my office chair, which was what I did to something else which was how the entire coffee thing started, I would probably have destroyed it.
-Dave
|
|
|
|
So you have a problem if there are more software to use for bitcoin? We shouldn't expect too much from them if we are not paying them for the job they do. Honestly I can't see the issue, maybe you know something I don't.
Apparently I know a lot that you don't. Spend some time in the support area here and in other online BTC discussions. People are continually coming around asking for help trying to run core on hardware that can't handle it. Or they are running some pruned node and wonder why they can't import some old private keys. And so on. Not saying that this should not be worked on, just that there are a lot of other things that cause people issues and this looks to be something that will cause more issues then it solves. Not saying there is never a reason to run a pruned node, just that there are very very few good ones. -Dave |
|
|
|
https://protos.com/bitcoin-core-developer-proposes-new-type-of-pruned-node/Rather than the status quo — setting a number of blocks and compressing historical blocks prior to that milestone — O’Beirne’s assumeUTXO is an experimental way for new Bitcoin full nodes to delay their need to verify historical transactions until the user receives recent transactions.
AssumeUTXO-compatible node clients would contain a hard-coded hash of the conditions necessary to spend all bitcoin (the UTXO set) as of a safe, recent point in time (O’Beirne’s variant of the popular Bitcoin Core client, Bitcoin Core #25740, supports assumeUTXO). I'm not going to post the full article here. BUT WHY, JUST WHY. There are a lot of things to be spending time and effort developing, this should be so far on the bottom of the list that we can't even see it. It is only going to make things worse for people as they try to run more and more on less capable hardware. It's a 3 step process. 1) Install OS 2) Install core 3) Wait a couple of days for it to sync. OR Use a lite wallet. If you are running a node to secure the network, do it properly with enough hardware and time to do it. Sorry, this is just becoming an annoyance of mine. Used low hour 1TB drives are cheap / free from people getting rid of them new are just about free, 8 year old PCs that can run a full node with no issues are cheap / free. <--Yes this is a US / EU thing I can't speak to the rest of the world but still. -Dave
|
|
|
|
Bad news for the project. It looks like they're not going to be able to develop the project any further or even announce the next stage of the protocol until this is sorted out: Lightning Labs’ Taro Project Faces Halt as Judge Issues Temporary Injunction for Trademark Infringement
-snip-
On Wednesday, Judge William H. Orrick issued a temporary injunction forcing Lightning Labs to halt further development of Taro until the project has been sufficiently rebranded. In its complaint, Tari argued that it and Lightning “compete in the same digital blockchain ecosystem, provide similar, and in some instances identical, goods and services, market to similar developers and users, and appear on the same blockchain platforms.”
-snip-
This is ridiculous. Even though there's only 1 character difference (Tar i and Tar o), it has different spelling and reference (Taro refer to vegetable, while Tari refers to "newly minted coin"[1]). It's a shame both party (Tari Labs and Lightning Labs) works on open source, but Tari Labs decide to attack Lightning Labs. [1] https://tarilabs.com/faq/I do not see it as that big a deal, you can continue to develop and test and work on it, you just can't release market it. So development continues without public releases until they come up with a new name. Stupid, but this is why a lot of huge international mega corps spend more time working on naming and branding then they do on some products. Unless they have some other reason to stop development I don't see it being more then a waste of time and money. And having to give money to lawyers. Lawyers gotta lawyer, but there is a solution: https://www.youtube.com/watch?v=35rErQtJ6uA (warning some a lot bad words) -Dave |
|
|
|
This could end up being very messy for a lot of members in the forum that participated in their signature campaigns if the FBI and US justice department decide to force forum members to repay all the money they received from Chipmixer as signature campaign income.
How do those that participated in the Chipmixer signature campaign feel about this? Do you think you will be asked to repay all the money you received for promoting Chipmixer since the FBI and other international agencies have attributed them to money laundering?
Since a lot perhaps most people are not under FBI jurisdiction I don't think any are worried. As for paying back, there have been other mixers seized and nothing happened to the people wearing those sigs. There have been scam ICO / IEO and everything else shut down by authorities and nothing happened to the people wearing those sigs. There have been cases of casinos shut down by authorities and nothing happened to the people wearing those sigs. And so on. -Dave |
|
|
|
|
Going back to the stock market they have had some really good programmers working on things like this for years, perhaps decades.
Result has always been about the same, a small increase in profits but never covering the cost of doing the setup / programming.
What actually made them more money was faster connections to the markets so they could get their trades in 1st.
Better faster computers with better AI just means that all the big players get better faster info, and the rest of us are still traveling behind them seeing what happens.
-Dave
|
|
|
|
It won't generate a segwit timelocked address, no.
You are correct, I thought it would and then did not read fully. -Dave |
|
|
|
1) They can do segwit. https://coinb.in/#newSegWit BUT NOT FOR A TIME LOCKED.2) The TX are sent but the address you are sending to cannot send till the time / block has passed. <morbid thought> If you set it too far in the future, plan as to what happens / who has access if you are not around. Yeah, I know not a happy thought but something you do have to consider. -Dave |
|
|
|
... Can I send $10 every week to the locked wallet? Or it's just a one-time transaction?
At least I need to figure out the answer to this question for now. I have several questions spinning in my mind. Let's not ask everything at once. I will get more confused.
... Keep in mind that years in the future if you have been sending small amounts every weeks for years the fees could be a large amount. 50 +/- inputs a year trying to go out in a few TX are going to cost you especially if you are selling because the price has gone up. A bit of a clogged mempool and...ouch. You see that now and then now when people are moving a lot of small inputs that they accumulated over the years. -Dave |
|
|
|
|
Show Posts
