Invoices/Payments/Receipts proposal discussion

[dillpicklechips]

Gavin did you catch my question about colored coin support?

Is there plans for adding colored coins support? As a merchant I could ask the customer if they support colored coins and ask for an address where to send them. I could then send the colored coins with along with label for what they are. This could allow the merchant to do a rewards or points system that the customer could redeem later as a reward for using BTC.

[1714854111]

1714854111

[1714854111]

1714854111

[1714854111]

1714854111

[CIYAM]

With the amount of hostility (often accompanied by as much ignorance) being posted it's perhaps not surprising that Gavin isn't responding (although his shouting really didn't do him much credit either - guess he just found it a bit much and exploded a little).

As the Foundation pays his salary one would expect that it's at their behest that one of his major recent focuses has been the "payment" system (more than him deciding himself that it is the most interesting thing to be working on - especially after other devs have pointed out that it really isn't a hugely exciting part of Bitcoin).

Perhaps if this topic could "get back on topic" it might serve more purpose.

[piotr_n]

With the amount of hostility (often accompanied by as much ignorance) being posted it's perhaps not surprising that Gavin isn't responding

Hostility can have many faces.

There can surely be an open active hostility; e.g. when the bitcoin community accuses core devs of corruption (or at least a conflict of interest) and they demand an explanation. (which never comes, which makes them even more openly hostile)

But there can also be a hidden passive hostility; e.g. core devs intentionally sabotaging development of the project's original principles, by developing it in the opposite directions.

I totally get it, that Gavin and others perceive us as a bunch of assholes who don't even deserve an explanation - they are obviously too important piece of the bitcoin elite to explain anything to us, an average users from some bitcointalk forum. But since we have already established this position, and it's pretty clear who we are for them, we (just like them) still do the best we can to help the community in building a prosperous future of this project. And that (among other things that we do, which the bitcoin elite also doesn't give a shit about) is today, unfortunately warning people to be careful with trusting the cartel that took over the development of the satoshi client and to be careful with using the new incoming features.
You call it hostility - I call it sincerity.

[Carlton Banks]

Having now scrutinised BIP 70 (the written proposal for the Payments Protocol), it appears that a hash of the message data contained in the Payment Request is signed by the CA. Depending on which information the merchant chooses to include in that message, an obfuscated form of data you may prefer not to share with the holders of a merchants certificate, both legitimate and illegitimate, is in fact shared.

Can anyone make a clear statement as to whether the hashed data in the merchant's message can be read by the certificate holder(s)? (I do realise I might be asking a question akin to "is SHA broken?", I understand this not to be the case, but I also don't know the cryptographic relationship between the merchants PKI key, the corresponding certificate and the signature created used to authenticate the payments request as a whole)

[piotr_n]

Can anyone make a clear statement as to whether the hashed data in the merchant's message can be read by the certificate holder(s)?

I would not expect it.
Some posts ago I asked another silly question: can anyone make a clear statement as to whether my PC will connect to the CA server to check if a certificate has not been revoked?
No answer whatsoever.
And that leaves us with three possible explanations:
1) They don't know - meaning: they don't know what they are doing adding these SSL stuff into bitcoin
2) Yes, my PC might connect to CA each time I do a payment - meaning: our IP gets exposed each time we pay, but they don't want to worry us
3) I don't deserve their answer - meaning: who besides me cares about such a minor concerns?
Since we don't know the correct number, maybe we should make a poll?

[CIYAM]

Since we don't know the correct number, maybe we should make a poll?

A "poll" - I hope you aren't being serious (you did put a smiley after that so I guess not).

How does a CA signature actually *change* anything at all?

Doesn't it just add something (that you can ignore if you want)?

The private key of the cert is still private isn't it (and how do you propose to do something better)?

[piotr_n]

A "poll" - I hope you aren't being serious (you did put a smiley after that so I guess not).

Of course I wasn't serious.
But my concern is a really serious one.

It is a known fact that SSL certificates have a built in mechanism to be revoked by their CA.
And it is also a known fact that today SSL certificates are essentially validated by an OS, since the OS has the root certificates.
Maybe not in case of Firefox, but definitely in case of Chrome, and since we have a Google employee putting it into Bitcoin, it seems natural to assume that he would use the Chrome approach.

So once again: how can we be sure that our OS does not report each transaction we send, along with our IP, to the CA?

[CIYAM]

So once again: how can we be sure that our OS does not report each transaction we send, along with our IP, to the CA?

Okay - now we are getting more into the "bread and butter" - is the major concern about privacy?

All my BTC bills that are done through BitPay are already recorded with even more details than just my IP (it includes address details) so how exactly is this going to be any worse than what is already *standard*?

[piotr_n]

All my BTC bills that are done through BitPay are already recorded with even more details than just my IP (it includes address details) so how exactly is this going to be any worse than what is already *standard*?

Well, IMHO the question you should be asking is: how is it going to be any better than what is already *standard*?

And this question I can even answer myself: it isn't.

[CIYAM]

So my question to you is "what do you expect?".

Do you really think that major corporations who pay their taxes and make profits are suddenly going to want to try and stop paying their taxes?

This is simply a question of what is sensible - no-one is stopping the Bitcoin protocol with these new options - they are simply making something that will be more palatable to the companies that already are happy with the way things are.

The revolution is not going to come from the corporations.

[piotr_n]

Eeee...
Sorry, but what my unwillingness to broadcast each of my bitcoin transactions to a CA has to do with anyone paying taxes?

And once again: I really don't care about "major corporations".
If they all fucked off and died today - that would have been the best day of my life
Bitcoin is for people - not for corporations.

[CIYAM]

Sorry, but what my unwillingness to broadcast each of my bitcoin transactions to a CA has to do with anyone paying taxes?

That is an issue - but already if you pay BTC using BitPay or other equivalents you are *already* doing this - have I missed something?

(also I don't see how your tx is broadcast to the CA as they only *sign* the cert - unless they own the private key how exactly do they *see* your tx?)

[piotr_n]

Sorry, but what my unwillingness to broadcast each of my bitcoin transactions to a CA has to do with anyone paying taxes?

That is an issue - but already if you pay BTC using BitPay or other equivalents you are *already* doing this - have I missed something?

No, you get it all right. That is exactly why I cleverly never pay BTC using BitPay.

[CIYAM]

No, you get it all right. That is exactly why I cleverly never pay BTC using BitPay.

So then how does this new stuff affect you at all then?

[piotr_n]

No, you get it all right. That is exactly why I cleverly never pay BTC using BitPay.

So then how does this new stuff affect you at all then?

It doesn't.
But it does affect bitcoin-qt.
There are millions of people using this s/w and ever since the new payment protocol is introduced they will be using it, unconsciously ignoring the fact that each time they make a "secured payment", they likely log it along with their IP, at the CA server that issued the recipient's cert.

[CIYAM]

There are millions of people using this s/w and ever since the new payment protocol is introduced they will be using it, unconsciously ignoring the fact that each time they make a "secured payment", they are probably log it, along with their IP, at the CA server.

Sure - but those same people would be using BitPay or some other equivalent and doing exactly the same thing.

I just don't see the fuss - it's not as though *more* information is being gathered that already is.

[gweedo]

Lets face it the Payment protocol only helps a hand few of companies and people, at the expense of privacy. PKIs are broken, and because of the payment protocol I have looked into starting a CA. The software to do that is a mess. Also to have this in a 0.9 release when even Gavin himself has said they are in need of developers to do things, doesn't make sense. I want to know when the blockchain will be worked on, this is an area that needs a lot of work and so far one developer is actually doing all the work. So I pose this question does Gavin know how to manage his time or is he just scamming us for a paycheck by saying this is important when it is clearly isn't.

[CIYAM]

The problem is creating a serious way of developing software - I have set up http://ciyam.org/open and even offered free listing of projects (for life) so it is not as though there is no platform do get things done but finding the people to do it is another thing (as I have found).

If you want to really get things done then I am more than happy to help!
 

[piotr_n]

IMHO there is no lack of developers who would like to help with bitcoin.
What there is though, is a cartel controlling the development of the reference client, not letting in anyone who would try to invent anything that would have made bitcoin even a bigger threat to the establishment.

This is the only way I can explain the past 2 years of essentially no useful progress in this project.
Despite of the fact that the price of bitcoin went up tens of times fold.

[CIYAM]

IMHO there is no lack of developers who would like to help with bitcoin.

Well - I'd have to disagree with this - I've offered very reasonable bounties (actually unreasonable in terms of the payee) and still found no-one willing to write any source code at all.

If you really think the guys are out there then please create a project on CIYAM Open (for free) and let's get something done!