[ANN] CIYAM Open - Put your "dibs" on tasks for BTC!

[CIYAM]

CIYAM Open is now ready for Contributors and Project Managers to join in creating a new kind of digital workforce.

The first 10 Project Managers to join (6 places are still left) will be able to have one Project in CIYAM Open "fee free for life".

Developers need to make a "dib" for each task that they wish to work on - understand that a dib is not to do with funds but with *time*. By submitting your dib you are committing yourself to providing a git pull request by the date and time you entered in your dib. The funds allotted will be paid out in entirety to the Contributor whose dib was accepted and whose git pull request was merged by (one of) the git repository owner(s).

Note that only the Contributor whose dib is Accepted would ever be expected to work on the task and understand also that each task includes one or more "skills" for which "skill points" will be awarded or deducted from the Contributor (depending upon whether an Accepted dib is finally Completed after a git pull request merged or is instead Rejected). Also understand that the acceptance of any particular dib is entirely up to the Project Manager (guidelines and further software will be developed to help with this down the track).

http://ciyam.org

(includes links to CIYAM Open as well as the CIYAM Safe distro which is used by the CIYAM project for 100% air-gapped offline transaction signing and the CIYAM github repository)

[1715151929]

1715151929

[1715151929]

1715151929

[1715151929]

1715151929

[1715151929]

1715151929

[CIYAM]

(reserved)

[gweedo]

Looks like it still needs some work... shouldn't be happening on 12800 X 800 screen.

[CIYAM]

Looks like it still needs some work... shouldn't be happening on 12800 X 800 screen.

I assume you mean 1280 x 800 but in any case I did have the Tab rotated - is your screen rotated to landscape?

(indeed if not rotated to landscape it won't look so good and UI is one of the main areas I will be allocating BTC tasks towards improving)

Actually even in portrait it looks fine on my Tab - what device are you using?

[CIYAM]

No device, just my laptop, Chrome.

Interesting - well the issue has now been duly noted (the problem being in the way that a .gif has been used for the table header as it shouldn't really matter how many lines it needs to flow in to) - also thanks for taking the time to look at the site.

[CIYAM]

An important part of the CIYAM Open funding model is that it is 100% open - that is every single tx that takes place in the project will be able to be audited via the blockchain by anybody (this is achieved through the use of raw tx's that move funds from one specific donation address to either another or to the final developer's destination).

Another important part is the safety of the private keys that are generated for use with every Project Area and Project Task - a detailed explanation of how this is achieved (and the source for the tools used) will be coming soon.

[CIYAM]

Well in case you haven't noticed the "challenge" I put up (to crack an encrypted password that I created using a simple script and very unsafe starting password) seems to be heating up.

A more sophisticated and secure version (along with a USB installable Live OS) with instructions will soon be coming.

[CIYAM]

Nearly there now (the "Memory Key" topic was another step along the way) - just ironing out the rough edges for safely and reasonably easily moving data between the "online" and "offline" computers now (have gone for air-gap via QR).

[CIYAM]

Having a problem with SUSEStudio (after some sort of weird error the Build button for my distro become disabled) - if anyone knows how to fix this I'd appreciate a "heads up".



EDIT: never mind it has come good now - seems their website has had some problems today (distro will be coming soon)

[CIYAM]

Whilst preparing the CIYAM Safe distro I would like to explain the way that CIYAM Open encrypts all session data *without* SSL.

When you join CIYAM Open you will need to supply a GPG public key and you will be sent an encrypted message that contains your initial password. Next you open your browser to http://ciyam.org/open and to get an idea about exactly how this has been designed do a "View Page Source" and looking at the body tag you will see the following:

Code:

<body onload="load( )">
<noscript><meta http-equiv="refresh" content="0; requirements.html"/></noscript>

<div id="content">
</div>

<div id="auto_progress" class="invisible"><img src="auto_progress.gif"/></div>
<div id="load_progress" class="invisible"><img src="load_progress.gif"/></div>

<iframe src="javascript:false;" name="hidden_frame" frameborder="0" width="1" height="1" marginheight="0" marginwidth="0">
</iframe>

</body>
</html>

So as you can see there basically is no static content at all (and this never changes - so non-anonymous content will never even be seen by a search engine making this approach suitable for building a "diaspora" type of system that works over HTTP).

How then is non-anonymous content safely encrypted?

This is where the password that was sent to you GPG encrypted comes in - when you type in your user id and password it is hashed together with a "serverId" and then hashed again with a "uniqueId" (which is unique to your session) and then sent along with your user id (in the clear) to the FCGI interface.

As your original password is known when the FCGI receives your user id and the hash value it can verify whether it is correct by hashing the value stored in the DB (which is the serverId + password hashed and encrypted) with the uniqueId it knew it sent to your session (this is done via a simple IP address mapping currently).

Now as the 'uniqueId' will never be used again a 'replay' attack is simply not possible. To be cont'd...

[CIYAM]

Also as the hashed 'serverId' + password was never broadcast (as it was hashed again along with the 'uniqueId') there is a safe "secret" that both the client .js and FCGI server know.

This is what the server and the .js client will both use in order to construct a OTP that is the length of each request/response.

Code:

OTP = hash(serverId + password); // simplified as it is actually hashed with multiple rounds

and to extend for the entire length of a request/response:

Code:

OTP += hash (OTP);

So what is returned from the AJAX request to the .js client from the FCGI server is encrypted with the OTP and decrypted before assigning it to the "content div" and all information (apart from some state information that is seen in the URL) sent to the server by further AJAX requests is also thus encrypted.

Questions and comments about this technique are welcomed.

[CIYAM]

As well as giving the CIYAM Safe a workout before I begin to fund tasks for CIYAM Open I will be adding some support in the next few days for automatically being able to register users (although if anyone is interested to join up now just send me a GPG encrypted message with your preferred user id and an initial password).

[CIYAM]

For my 1,000th post apart from the profile name change (I still am the Director of CIYAM Pty. Ltd. but now think that its future role in CIYAM Open is most likely only going to be one of sponsorship) I'd like to start to introduce people to the project that had initially began as a part-time hobby and has turned out to now be a full-time obsession (for the last few years in particular) to improving the way that software is developed at a very fundamental level.

If you have a spare 5 minutes please take a look at the following:

http://ciyam.org/open/?cmd=view&data=20121221010507352000_P&ident=M100V112&chksum=d36e9a6a

I haven't rushed into creating this software platform as it is actually the culmination of design ideas, patterns and algorithms that I had begun developing as way back as 2000.

By far the hardest thing about Software Manufacturing has been convincing people it actually works and I don't expect the audience on Bitcointalk to be anything but skeptical but I am patient and will be happy to answer questions about any aspect of the system (and yes I know the documentation at this stage is rather minimal).

I have already created a CIYAM Safe for handling the transactions for CIYAM Open that will be performed in an externally audit-able manner (effectively "opening" the organisation's General Ledger for scrutiny by anyone that has access to the blockchain).

I look forward to getting younger (and fresher) minds involved in this project and pledge that except for some unforeseen circumstance arriving I will be working on this project full-time (and without remittance) for at least the next few years.

[CIYAM]

(casually opens the door to a new way of working - updated the OP with details)

[Xenland]

I can't wait to get my P2P Crypt project funded, I just need to find time to get all the tasks listed (perhaps in a couple of weeks I'll have more time), Keep up the good work with the project; I like it, everything is super simple and silky smooth, Cheers mate!

[Ente]

Thank you for your project, Ian!
You are both dedicated with the project itself as with keeping us updated here, thank you! :-)

Now there is somewhat low resonance..
I believe you started with details too quick. Sure, I enjoy talking about "shall we use ssl- or gpg-encryption?" as much as everyone else around here.. But somehow, in my view, you missed to state what exactly your project does, and in what points it does better than what we have now. That is, in a few, simple, totally non-tech sentences. A "conclusion" for executive level decision.
Like, you know, people first decide if a tool seems useful, and then have a second look if it is safe and sane ;-)

..keep rollin! :-)

Ente

[CIYAM]

Now there is somewhat low resonance..
I believe you started with details too quick. Sure, I enjoy talking about "shall we use ssl- or gpg-encryption?" as much as everyone else around here.. But somehow, in my view, you missed to state what exactly your project does, and in what points it does better than what we have now. That is, in a few, simple, totally non-tech sentences. A "conclusion" for executive level decision.
Like, you know, people first decide if a tool seems useful, and then have a second look if it is safe and sane ;-)

Thanks Ente and yes unfortunately I am 100% "no salesman" (too interested in the tech and software).

Let me try and describe "in a nutshell" what CIYAM Open is:

"It's a way of organising, funding and paying for contributions of tasks for projects (be they open source software projects or even say NGO's) that is 100% open and audit-able by the general public".

(yes still too many words - any Marketing gurus want to trim that down for me?)

I believe this is actually a first of it's kind (but am not trying to make too "bold a claim" and am happy to be corrected if wrong).

The rest (and there is a lot) I will try and communicate in small chunks in the coming weeks and months (it took literally years to create this system and will probably take me at least a whole year to fully describe it unfortunately - but don't worry I will be dedicating all my working days and nights to doing this from now on).

[John (John K.)]

Now there is somewhat low resonance..
I believe you started with details too quick. Sure, I enjoy talking about "shall we use ssl- or gpg-encryption?" as much as everyone else around here.. But somehow, in my view, you missed to state what exactly your project does, and in what points it does better than what we have now. That is, in a few, simple, totally non-tech sentences. A "conclusion" for executive level decision.
Like, you know, people first decide if a tool seems useful, and then have a second look if it is safe and sane ;-)

Thanks Ente and yes unfortunately I am 100% "no salesman" (too interested in the tech and software).

Let me try and describe "in a nutshell" what CIYAM Open is:

"It's a way of organising, funding and paying for contributions of tasks for projects (be they open source software projects or even say NGO's) that is 100% open and audit-able by the general public".

(yes still too many words - any Marketing gurus want to trim that down for me?)

I believe this is actually a first of it's kind (but am not trying to make too "bold a claim" and am happy to be corrected if wrong).

The rest (and there is a lot) I will try and communicate in small chunks in the coming weeks and months (it took literally years to create this system and will probably take me at least a whole year to fully describe it unfortunately - but don't worry I will be dedicating all my working days and nights to doing this from now on).

You could try comparing it with indiegogo and other crowdfunding site, and state your advantages/focuses as compared to them. I'm no marketing guru, but a simple comparison with another existing service might be the easiest way to introduce it to someone new.

PS: I'm still working out on CIYAM Open's details though, so my analogue above might be way off.

[CIYAM]

You could try comparing it with indiegogo and other crowdfunding site, and state your advantages/focuses as compared to them. I'm no marketing guru, but a simple comparison with another existing service might be the easiest way to introduce it to someone new.

Okay - first major differences are:

1) CIYAM Open funds are not "returnable donations" (although an escrow address per task will be being added for those wanting that)

2) Stemming from the above a task that fails to be completed on time does not *end* but can continue with a *new delivery date* (with another bid now being chosen for acceptance)

3) Developers get (and can lose) *skill points* per task allowing them to build a rep for the things they are good at (making it more likely that their bids will be accepted vs those with no or low points)

4) You can donate to either the whole project, a project area (which can be nested) or to an individual task within the project.

I think this makes the CIYAM Open concept more of a "long-term development model" than a "kickstarting model" (especially when you look at the "sklls" side).

Hope that helps make it a bit clearer.

[CIYAM]

Also - consider an NGO that wants to be as "open" as humanly possible:

with CIYAM Open they can:

1) create their top level donation address as their Project

2) create Project Areas for say "Charity Drives", "Marketing", "Accounting" and "Development" (each with a donation address)

3) create specific Project Tasks tasks for every single Charity Drive, Marketing task, accounting task, etc. all of which can be individually donated to

By using the mechanism that CIYAM Open itself uses (raw tx's) or by simply creating separate wallets for the Project and each of its Project Area addresses the Project Manager can move the BTC from the *top* to the *bottom* giving you a 100% publicly audit-able organisation (verifiable via the block chain).

As a case in point CIYAM Open itself is 100% publicly audit-able (and always will be) and any "fees" that I may charge for listing other Projects down the track will actually be in the form of "donations" made to the CIYAM Open project itself or other projects that I see fit to promote (so that *zero* profit will ever go directly to myself and that can be verified by anyone with access to the block chain and the list of relevant addresses which are kept on CIYAM Open even after tasks are "completed").

[CIYAM]

For those more interested in the "hardcore tech" side of things I whipped up a script to turn the .txt documentation into .html and have put it here:

http://ciyam.org/docs

(and yes I have a bit of OCD when it comes to the way I like to format the text in full justification without adding extra spaces)

[CIYAM]

I think it might be helpful for both potential Developers and Project Managers if I create a new slideshow that steps through the process of bidding for a task (as a Developer), accepting a bid (as a Project Manager) through to the final completion of a task.

This should hopefully be completed and up on the main page (http://ciyam.org) by tomorrow (editing the screen snapshots from the Tab does take a bit of time unfortunately).

[CIYAM]

Am only about 1/4 way through creating the new slideshow so far (much faster when I create software than when I create slideshows).

BTW if anyone knows any "marketing" people that might be interested to contact me please let them know that I would be interested in getting help (am willing to pay either $ or BTC for materials created by someone with a proven track record).

[CIYAM]

Okay - the new slideshow is up at http://ciyam.org (you will need to force a page refresh to see the new stuff).

I do hope that this will help make it clearer just what CIYAM Open is all about - questions and feedback welcomed.

Also as an easy first task for someone to work on I've decided to outsource changing the copyright dates in the non-generated source code (1 BTC for that and I'm guessing anyone who is familiar with awk/sed/grep could probably get it done in a few minutes).

[K1773R]

Also as an easy first task for someone to work on I've decided to outsource changing the copyright dates in the non-generated source code (1 BTC for that and I'm guessing anyone who is familiar with awk/sed/grep could probably get it done in a few minutes).

done by me
https://github.com/ciyam/ciyam/pull/7

PS: posting this for reference.

[CIYAM]

Also as an easy first task for someone to work on I've decided to outsource changing the copyright dates in the non-generated source code (1 BTC for that and I'm guessing anyone who is familiar with awk/sed/grep could probably get it done in a few minutes).

done by me
https://github.com/ciyam/ciyam/pull/7

PS: posting this for reference.

It's nearly there (just another minor tweak to the script and it should be done) - this task is now reserved for your completion (so no point in others "bidding" on it).

[CIYAM]

Looks like it still needs some work... shouldn't be happening on 12800 X 800 screen.

I have enlarged "header_row.gif" so hopefully that looks a bit nicer (am running some "browsershots" now but nothing that looks like your snapshot has come up yet).

[K1773R]

Also as an easy first task for someone to work on I've decided to outsource changing the copyright dates in the non-generated source code (1 BTC for that and I'm guessing anyone who is familiar with awk/sed/grep could probably get it done in a few minutes).

done by me
https://github.com/ciyam/ciyam/pull/7

PS: posting this for reference.

It's nearly there (just another minor tweak to the script and it should be done) - this task is now reserved for your completion (so no point in others "bidding" on it).

seems like i completed the first task @ CIYAM Open, looking forward ty!

[CIYAM]

Congratulations!

Pull request merged: https://github.com/ciyam/ciyam/commit/47ddeba035702edf28f74eeaecabbbc47fc2a0a7

and Bitcoin tx confirmed: http://blockchain.info/tx-index/44876826/e386ae72ce5c630ceaedd6b5a5d1c639095db56497889034258e7f2498ab23fd

and now this task appears in the "Recent Project Tasks" list: http://ciyam.org/open/?cmd=list&ident=M100L152&chksum=a8a9a22c
(which can be used as a way to find "tipping" addresses for recently completed tasks that were very much appreciated)

Still some easy tasks available and more tasks (and whole projects) will be coming soon!

[CIYAM]

I've now added a Topic explaining the "task bidding" system that CIYAM Open uses:

http://ciyam.org/open/?cmd=view&data=20130120042331411000&ident=M100V120&chksum=45258c8d

Queries, comments and suggestions all welcome.

[CIYAM]

Kudos to Kim Dotcom's new Mega and interestingly enough client side encryption (a major part of his new system) has been in use for over a week on CIYAM Open.

Although some better marketing will be on its way we are patiently and slowly going to assemble the "workforce of the future" in which one doesn't work "one or two jobs" per year but maybe "100-200 different tasks" (which could be spread over numerous different projects).

A web page to help "join up" will be coming soon - and there is still 2 BTC available to write some rather trivial installation scripts.

KD: You know, I mean I am a fighter and I am going to fight this thing. I feel confident I am going to win because at the end of the day I know, my family knows, and everybody around me knows that I am no criminal and I have done nothing wrong. So I will fight it. It’s all I can do.

Keep up the fight Kim!

Screw Hollywood and screw copyright!
(hmm... almost forgot - screw patents too!!)

[yogi]

Hi Ian,

Love the site, very exciting!

I wish BitcoinTalk had the same funding model as CIYAM, it's much better being able to contribute to the features you want rather than making a blind site wide donation.

I was going to post a bid on a task, but got a little confused regarding the 'delivery date'. The 'delivery date' I assume is the latest the task must be completed by? If I place a bid on a task and it is not accepted until the day before the 'delivery date', does this mean I only have one day to complete the task?

(P.S. Congratulations on beating Kim Dotcom to the post with the client side encryption )

[CIYAM]

I was going to post a bid on a task, but got a little confused regarding the 'delivery date'. The 'delivery date' I assume is the latest the task must be completed by? If I place a bid on a task and it is not accepted until the day before the 'delivery date', does this mean I only have one day to complete the task?

I have replaced the 5th slideshow image as it was actually not correct at all (sorry for the misunderstanding).

Let me clarify that the rule (enforced by the code) is actually that your bid cannot be *sooner* that the 'delivery' date and time (so can be as much as you like later) thus rather than putting the *same* 'delivery' date and time as was put on the task you should actually put the 'listed delivery date and time + how much time you think you need' (although if the task gets Accepted earlier and it can be completed earlier then all well and good for both sides).

So if the delivery date and time was initially set to say 2013-01-13 09:00 and you think you need 2 days to get the task completed, reviewed and the pull request merged then you should put 2013-01-15 09:00 as your 'delivery bid'.

Basically a Project Manager will choose a bid according to two main criteria:

1) When can this be delivered? (the earlier the better as a general rule but also...)
2) How good are the relevant Project Skills of the bidder? (one always would like to have the most skilled person for the task)

I hope that clarifies things and am looking forward to working with you on CIYAM Open.

[CIYAM]

Okay - the "sign up" dialog is almost completed (still testing things thoroughly before I go live with it).

You can get a "sneak peak" here: http://ciyam.org/sign_up_example.png

To open an account you need only two things: a User Id and a GPG Public Key

Your account credentials will then be encrypted and emailed to you (for those who don't want to use email just create a GPG key with the email address anon@ciyam.org and instead of emailing you the GPG encrypted credentials will appear on your screen ready for you to copy and paste).

For those who are even more paranoid you can use the User Id "anon" and you'll actually end up with a User Id more like anon912c8334b0 (this will be in the encrypted message along with your "initial password").

Will hopefully have this "live" by tomorrow - any questions/feedback based upon the piccy are welcome.

[yogi]

OK, I've placed a bid on the openWYSIWYG task.

So, I assume I now wait to see if it get accepted?

If my bid is accepted, do I then make a pull request from Git and then push the changes when I'm done?

I set the delivery date to three weeks time, but what happens if I over run the delivery date?

[CIYAM]

OK, I've placed a bid on the openWYSIWYG task.

So, I assume I now wait to see if it get accepted?

If my bid is accepted, do I then make a pull request from Git and then push the changes when I'm done?

I set the delivery date to three weeks time, but what happens if I over run the delivery date?

Not quite there yet - go to your bid (after you log in click on My Project Task Bids) and you'll see that you're bid is still Pending. To "open" your bid you need to first click on it and click the "Check Funds" button (which will confirm the current balance of the BTC address you put in there so you are sure you didn't get it wrong) then Open your bid (this could have been done immediately after you *saved* the bid but you might not have noticed the buttons then).

After that I will accept it (as at this early stage I am happy enough to take first come first served) then you will have "secured" the bid - you then have until that date and time you put in to complete the task (and I'll be lenient even after that if we are making good progress - this system is intended for Project Managers and Developers to work towards getting negotiated results rather than just enforcing arbitrary rules).

Understand that the reason that a final "delivery date" is required is to simply stop bidders from "getting tasks" but then "never completing" them (it is not at all intended at all to be some sort of unfair way to "rob" you of your just rewards and if any other Project Managers are not being "fair" to Developers then I will be happy to act as a moderator and would also be more than happy to accept a trusted member of Bitcointalk to act as my own such moderator).

[yogi]

Not quite there yet - go to your bid (after you log in click on My Project Task Bids) and you'll see that you're bid is still Pending. To "open" your bid you need to first click on it and click the "Check Funds" button (which will confirm the current balance of the BTC address you put in there so you are sure you didn't get it wrong) then Open your bid (this could have been done immediately after you *saved* the bid but you might not have noticed the buttons then).

Ah, 'Check Balance' then 'Open Bid', got it. I had assumed 'Pending' meant waiting for a project manager to accept the bid.

Understand that the reason that a final "delivery date" is required is to simply stop bidders from "getting tasks" but then "never completing" them (it is not at all intended at all to be some sort of unfair way to "rob" you of your just rewards and if any other Project Managers are not being "fair" to Developers then I will be happy to act as a moderator and would also be more than happy to accept a trusted member of Bitcointalk to act as my own such moderator).

That's reassuring to know, thanks Ian 

[CIYAM]

You've nailed it - and your bid has now been Accepted (hopefully you got an email also).

[CIYAM]

Update - CIYAM has now started working on preparing for a facelift and other marketing activities before the "sign up" dialog is going to be integrated.

For those who had hoped it would be up already we can only say "have patience" as after many years of development we are not going to rush things now (but this project is here for the long haul and is being worked on tirelessly to get everything right).

[CIYAM]

An improved privacy version of our client-side encryption has now been rolled out!

To illustrate here's a simplified illustration of it in action:

Let's take a user (called 'user') and then we'll take a simple SHA256 of their
initial password and store that in the DB before sending out the GPG encrypted
password to the user "signing up".

Let's assume that someone is able to do "packet sniffing" on their connection.
In the reply to the initial AJAX style POST request (at page load) they will
see something like this:

[page load]
unique_id = 5368b7c79ff959c63dae359aaf26e8685db102ea1614601b974fcab7369879e5

Next in the AJAX style POST that occurs when you click the "login" button the
"spy" will now see something like this:

[login post]
userhash = 7e0f28b7d56cb3095d9936e9c05caf5d6b12f7eb7c527fb86e56cc9163701bbf
password = 703bd74c7145aa2f6777a2d7437d03e2ff3ff2c90ecc3f28d2a01b4561c43c68

Let's say that the user then logs out and back in:

[page load]
unique_id = e8b2a06adbebb87f65a5d26b1ff379a05952157fe1a8d3f00e2cd847e0814e7f

[login post]
userhash = 7e0f28b7d56cb3095d9936e9c05caf5d6b12f7eb7c527fb86e56cc9163701bbf
password = 79dc9389a98cc693a1c53748c454610a8c808ba6baf39c7c949d2383e69de05d

Now we can see from this that the "password" value is actually a completely
different value at each login only the "userhash" remains constant.

How does this work?

Because the original hash of the password (which is *never* transmitted) is
known to the "server" and to your browser (from the password you typed in
it generates it with Javascript) then it can be easily combined with the "unique"
hash (which is a UUID generated by the server) and then hashed again (which is
the "password" that is being finally transmitted and observed by our "spy").

Without knowing the original password hash it is simply not possible to work
out either the actual "user id" (it is a hash of the actual "user id" value
combined with the original password hash) or of course the "password" (being sent).

This technique is also "replay proof" as the "unique" value should never ever
be a repeat (unless there is something with your server's random generator).

[Matthew N. Wright]

I really wish every website had something like this. Many websites are still sending login information in the clear, especially small bitcoin websites.

[Xenland]

Hmm I think I have a great resource for everyone to help understand where CIYAM is getting at, the following article explains in "everyday language" to help describe the mechanisms involved here and why hashing "correctly" is important to be implmented in the websites you browse, Do you remember the "LinkedIn" passwords that were Leaked out all becuase nobody on the LinkedIn development team cared to hash their passwords or even care about security for that matter.

Here is the link to the article I hope it sheds some light on this "nerd" talk to peeps.
http://www.p2pcrypt.com/blog/single_post.php?id=10

[CIYAM]

Minimum browser requirements for using CIYAM Open's "client side encryption over plain HTTP" and *why*

From another thread I gather there is still a bit of confusion about why .js support and some newer DOM features (sessionStorage and localStorage in particular) are necessary.

CIYAM Open is *not* using "https" (although of course this can be added if people really want it in which case the client side encryption would simply not occur as encrypting *twice* is of course going to slow everything down as has already been noticed with Mega's approach) and so one cannot put anything "important" in a cookie as it can be "spied" upon (in the clear).

Now also in order for the client to be able to generate the OTP it needs to do *crypto* which you're not going to be doing without Javascript (am not interested in doing such things in Java for various reasons - perhaps the most obvious the recent warnings about trusting it) so you *need* Javascript support (and you *need* it to be switched on).

You also *need* to have the sessionStorage and localStorage DOM objects available. The sessionStorage is where your "password secret hash" (that is *never* transmitted) is stored (after you type in your password to log in). Later when I add in the ability to "stay logged in" the localStorage object is required in order to persist this hash (and yes - things are less secure if you elect to use that feature).

Hope that helps clarify things.

[CIYAM]

In order to help the non-GPG potential workforce to easily "join in" we are now working on OpenID "sign ups" (so you will be able to use your Google or Facebook account, etc.) - this is still "under wraps" for the "public launch" so stay tuned!

[greBit]

Hi Ian,

Ive been reading through this thread to learn more about your CIYAM project. The crypto side I find especially interesting and could be very useful for a toy project im working on.

But I am struggling to see the value proposition of your service.  Software manufacturing? You generate c++ web apps?

Please forgive the question, but why would I want to have a c++ web app? I have not seen one of those in a long time

How does the manufacturing happen? Do you have any docs that explains the process?

Could your technology target other web frameworks, such as creating me a web app in a more popular web language / framework?


Kind regards

[K1773R]

Hi Ian,

Ive been reading through this thread to learn more about your CIYAM project. The crypto side I find especially interesting and could be very useful for a toy project im working on.

But I am struggling to see the value proposition of your service.  Software manufacturing? You generate c++ web apps?

Please forgive the question, but why would I want to have a c++ web app? I have not seen one of those in a long time

How does the manufacturing happen? Do you have any docs that explains the process?

Could your technology target other web frameworks, such as creating me a web app in a more popular web language / framework?


Kind regards

take a look at ciyam @ github: https://github.com/ciyam/ciyam

[CIYAM]

But I am struggling to see the value proposition of your service.  Software manufacturing? You generate c++ web apps?

Please forgive the question, but why would I want to have a c++ web app? I have not seen one of those in a long time

Sure - I understand that a C++ web app generator must seem a bit like some sort of Analytical Engine (http://en.wikipedia.org/wiki/Charles_Babbage#Analytical_Engine) to many on this forum.

But understand that by using C++ you can create *faster* and *more secure* web apps than nearly anyone else can (and by doing Software Manufacturing you aren't writing a single line of C++ nor do you have to even look at the source code if you aren't interested in that)!

How does the manufacturing happen? Do you have any docs that explains the process?

There is not a large amount of docco yet (when I get more time I will be doing a lot more work on this) but I have put what is currently there up on the website (http://ciyam.org/docs/) and in particular regarding "Software Manufacturing" you should read this one: http://ciyam.org/docs/methodology.html.

Could your technology target other web frameworks, such as creating me a web app in a more popular web language / framework?

That could be done but would be a rather huge task (the system took 10+ years to build) - if anyone wants to devote the time and effort towards doing that then they would be more than welcome to.

[CIYAM]

Second task completed by K1773R:

https://github.com/ciyam/ciyam/commit/2287caff6d4328f75b28aabfc2426d1fc065cd70

and

http://blockchain.info/tx/f39b95b266ca9b48c79de235810800810fda0ca90efa6c63fe968e740c6d90ea

Congratulations to K1773R!

[CIYAM]

Third task completed by yogi:

https://github.com/ciyam/ciyam/commit/377493d1bb51e21c5db777d768949acff920b645

and

http://blockchain.info/tx/ddfcc430782ac67620819fd1c2ea86ff72bb514dba43f58266b9dc0eedc6caee

Well done yogi - a nice improvement for all the Chrome web browser users that I will be getting integrated with the CIYAM Open website itself very soon!

Although things may have seemed to have gone very quiet recently there is a *lot* of work happening under the covers and although the CIYAM approach is much more that of the "tortoise" than the "hare" I can assure all potential contributors that this only the very start of opening up a project that has had many years in development and this process will be continuing and expanding throughout the year.

[yogi]

Thanks Ian,

It was very interesting working in the CIYAM environment and will be encouraging other developer and project managers to do the same.

Looking forward to bidding on more tasks in the future.

[CIYAM]

Well I am surprised that this task has not been taken: http://ciyam.org/open/?cmd=view&data=20121223024638595000&ident=M100V131&chksum=06d7fdb4

If no takers before the end of this month then I think the funds (now over 400 USD) will have to be re-allocated.

For those wondering what has been happening with the project we are currently testing the OpenID implementation and are preparing to give the site a facelift.

[CIYAM]

Well the facelift is taking much longer than expected and as we have just recently had fellowtraveler (from Open Transactions) create a Moneychanger project (also known on this forum as the Holy Grail) I have decided to implement the Sign Up anyway.

You'll now notice a gold "key" in the top left of the screen (when you are not logged in) and next to it an icon for Google and other OpenID accounts.

So you can sign up in 1 of 3 different ways:

1) Navigate to https://ciyam.org/open (note the HTTPS) and click on the key to create a "traditional account" (requires an email confirmation).

2) Click on the Google/OpenID icon to sign up with an existing Google/OpenID account (requires a "user name" to be provided).

or

3) Navigate to http://ciyam.org/open (note the HTTP) and click on the key icon to do a GPG sign up (will send you a GPG encrypted email).

Link to the Moneychanger project:

http://ciyam.org/open/?cmd=view&data=20130606055250338000&ident=M100V137&chksum=a2a9d6d5

Note there have been a couple of minor hiccups with the system (too many changes and not enough testing in recent weeks - sorry) so please be patient (I will respond to messages generally within 12 hours).

[Matthew N. Wright]

Looking really good. Can't wait for the facelift.

[CIYAM]

Well the budget for Moneychanger now "hotting up" to over 75 BTC so I am guessing more interested devs are going to start consider joining.

I would *please* recommend people to take the time to watch the top "slideshow" at http://ciyam.org so they can get a real understanding of the workflow.

This is designed as a "serious" system for Project Management - so when you Open a task bid you can't *change your mind* and if your task bid is *rejected* by the Project Manager or you yourself *cancel* it then that is also *final*.

Think of it as a bit like Bitcoin tx's - in the same way that they are not reversible neither are CIYAM Open "commitments" (so check, re-check and then re-re-check before you click buttons like Open, Accept, Reject and Cancel).

[lexxus]

Well the budget for Moneychanger now "hotting up" to over 75 BTC so I am guessing more interested devs are going to start consider joining.

I would *please* recommend people to take the time to watch the top "slideshow" at http://ciyam.org so they can get a real understanding of the workflow.

This is designed as a "serious" system for Project Management - so when you Open a task bid you can't *change your mind* and if your task bid is *rejected* by the Project Manager or you yourself *cancel* it then that is also *final*.

Think of it as a bit like Bitcoin tx's - in the same way that they are not reversible neither are CIYAM Open "commitments" (so check, re-check and then re-re-check before you click buttons like Open, Accept, Reject and Cancel).

I know it's probably the most minor issue but this is really the first thing I see and it makes me want to close your website asap:

Please raise the quality of your JPEG logo. Or better make this picture PNG and not JPG.

http://ciyam.org/CIYAM_Open.jpg

[CIYAM]

So in a nutshell - a Project Manager will create a new Project Area (which should be something general like "Client", "Server" or "Scripts") and after giving the Project Area a (real) BTC address and any relevant Notes then Save it - after reviewing all details are correct then the Project Area can be set to Open (allowing it to be seen below the Project).

New Project Tasks are created in a similar way below a Project Area - most importantly for Project Managers to pay attention to is that the Review date and time for the Project Tasks is when they will review the bids (so not when the task must be delivered by but when it must be delivered on or after).

When a contributor makes a Bid on a Project Task then their Delivery date and time is when they are promising to have everything completed (including allowing enough time for review and changes) remembering that the Project Task *owner* does not have to *accept* their bid *before* the initial Review date and time (so if you think it would take you a week you should make it the Review date and time + 1 week at a minimum).

Also note that after you "save" your bid there are 2 more steps - 1st step is to "Check Balance" (to make sure you didn't put in a BTC address you didn't mean to) and assuming no surprises then you have the "Open Bid" button. DO NOT press this button unless you are 100% certain everything is correct (i.e. the BTC address and most importantly the date and time you have *promised* to deliver after all reviews and changes).

[CIYAM]

I know it's probably the most minor issue but this is really the first thing I see and it makes me want to close your website asap:

Please raise the quality of your JPEG logo. Or better make this picture PNG and not JPG.

http://ciyam.org/CIYAM_Open.jpg

Yup - if you would like to help out then maybe I could offer you something to do so (plenty of critics but very few doers on this website).

BTW - a new design is coming (eventually) so please just *bear with it* for now (I am a programmer not a graphic designer).

[CIYAM]

For those new to CIYAM Open one of its key differences is its *workflow* and here is a step by step example to help clarify how this works:

1) The Project Manager creates a new Project Task and after putting on all necessary information "opens" this task up to the public.

2) One or more Contributors seeing the new task create a Task Bid for this task (setting the Delivery date and time accordingly to what they believe they can achieve including plenty of time for review and rework). Once the Task Bid is created and the BTC balance checked (should be 0 if you used a new address) then they will "open" their bids (once the bid has been opened its details cannot be changed).

3) The Project Manager (having been notified of the new bids) will sometime around the task's Review date and time check all open bids and assuming they are happy with one of these bids will Accept that particular bid.

4) The Contributor whose bid was accepted will now begin work in earnest. When they are ready to complete their task they will create a "git pull request" for the Project Manager to consider.

5) The Project Manager decides to reject the initial pull request due to some identified issues but encourages the Contributor to create another pull request with the required changes for consideration.

6) The Contributor creates a second pull request and this time the Project Manager decides to merge in the changes.

7) Funds are transferred to the Contributor and the task is then "closed".

[lexxus]

I know it's probably the most minor issue but this is really the first thing I see and it makes me want to close your website asap:

Please raise the quality of your JPEG logo. Or better make this picture PNG and not JPG.

http://ciyam.org/CIYAM_Open.jpg

Yup - if you would like to help out then maybe I could offer you something to do so (plenty of critics but very few doers on this website).

BTW - a new design is coming (eventually) so please just *bear with it* for now (I am a programmer not a graphic designer).

I'm not a designer either but maybe this will be a bit better:

[CIYAM]

I'm not a designer either but maybe this will be a bit better:

Hmm... well if you wouldn't mind putting the "I" back into CIYAM and just a bit more of a gap between CIYAM and Open (they are two separate words) then I would be happy to use it for now (assuming the width and height is an exact match with the original image).

Although it is only going to be a temporary banner (as the redesign is underway) I will pay 0.1 BTC for the cleaned up (per above) version assuming that you have created it under a CC license or equivalent.

[lexxus]

Hmm... well if you wouldn't mind putting the "I" back into CIYAM and just a bit more of a gap between CIYAM and Open (they are two separate words) then I would be happy to use it for now (assuming the width and height is an exact match with the original image).

Although it is only going to be a temporary banner (as the redesign is underway) I will pay 0.1 BTC for the cleaned up (per above) version assuming that you have created it under a CC license or equivalent.

Fixed. The size is exactly the same as the original banner on the site.
Let it be CC. No payment needed as it took me 2 mins.

[CIYAM]

Fixed. The size is exactly the same as the original banner on the site.
Let it be CC. No payment needed as it took me 2 mins.

Thanks - I have now updated the title image with this .png so hopefully no more sore eyes from the horrible .jpg that has now been relegated to /dev/null.

It is nice to see we have people who are keen to contribute to things just for the sake of making them better (but I do hope a more substantial task for payment comes up that you might consider bidding for).

[CIYAM]

Although quite a few of the Moneychanger tasks have been bid on and many of the bids have now been "accepted" (so work has commenced) there is still over 25 BTC worth of tasks for the project that have not received bids.

http://ciyam.org/open/?cmd=list&ident=M100L151&chksum=eaeccf9d&special=%40skey1&listextra=find&hashval=5d1cfbb7&findinfo=AM100C129F107%3D20130606055250338000&scrollx=0&scrolly=0

(the HTTP Interface task does have bids, however, the others at this stage do not)

[CIYAM]

Progress towards the new website design

We now have an image of what the new design will look like:

http://ciyam.org/docs/home_page_design_h.png

the next step is to get it coded into HTML/CSS and then making the necessary changes to the FCGI UI.

Hopefully it should be completed before the end of August - I have also recently made some changes to the session handling code (you may need to force a browser refresh) that should reduce the incidence of "session timeouts" as well as "Invalid URL" errors.

[CIYAM]

Well I decided to complete T00003 myself as even with 2 BTC allotted it had not been bid on (actually it turned out to be very little work as you can see here: https://github.com/ciyam/ciyam/commit/7121cabd261a5371f842e1886a824a78fd36074a).

To make things easier for those interested in doing some work but who are worried their programming skills are not good enough I will be adding quite a few "house cleaning" type tasks such as http://ciyam.org/open/?cmd=view&data=20130728062354623000&ident=M100V131&chksum=0416c96c (there are always small improvements like this that I simply don't have time to work on myself).

At this stage I haven't funded this new task as I am going to create several such tasks and then work out a budget for each.

[CIYAM]

CIYAM Open now supports Google Authenticator 2FA

Now before you go all anti-Google please understand that the Authenticator is actually an implementation of the RFC 6238 TOTP algorithm (and does not involve even accessing google.com).

Although the actual Google version of the Android app wants Network permission (to periodically update the clock) it is not necessary for it to do so and so if you prefer you can use a version that requires no special permissions from CIYAM here:

http://ciyam.org/Google_Authenticator.apk

Source code for this version of Google Authenticator can be found here:

https://github.com/kactech/otp-authenticator-android

To set up your account for 2FA do the following:

1) Download and install Google Authenticator on your Android device.

2) Log in to CIYAM Open as you normally do from your PC.

3) Click on your user name (near where the Logout link is).

4) Click on the little window blind cord icon to "show more" details (yes got to get a better pair of icons for that).

5) Click Edit Details and then click on the Use Authentication checkbox (now a QR code that contains the Google Authenticator URI should appear).

6) In your Android device start the Google Authenticator app select the Add Account menu item (if it doesn't do that part for you automatically).

7) Click the "Scan barcode" button and then scan the QR code from your PC screen (if that doesn't work for you then the account will have to be added manually - the "secret" key is shown below the QR code and PIN fields for that purpose).

Type in the 6 digit PIN that the Google Authenticator app displays (you may need to make sure your clock has been updated to network time recently if it doesn't match the expected value).

9) Hit Enter or click on Save Details (and don't worry without the correct PIN it will not allow the record to be saved).

10) To test Logout then Login (you should be prompted to enter the PIN after the initial password login).

The 2FA implementation is applicable to all types of CIYAM Open accounts (i.e. standard, OpenID or GPG) and to switch it off repeat steps 3 to 5 (this time "unchecking" Use Authentication) and Save Details.

[Cyberdyne]

Contructing a complex web application in under 5 minutes.

Contructing a lowercase s in over 9000 minutes


How's the new site design coming along?

[CIYAM]

A lot of work is going on "underneath the covers" - support for international time zones will be rolled out shortly (making it easy for a project manager to correctly set their due date and times even with "daylight savings").

Further work on the UI is also underway - a new look and feel can be expected before the end of the year.

[Sothh]

Hey,

I am unable to create an account, for some reason.  When I first tried to sign up, I entered a username and my pgp key, and the page said it had sent me an email, but I never entered my email address .

Then I used the annon key, and a different user name, and I decrypted the username and password, but the username is my old username, and the password does not work.  (For either user names.)

[CIYAM]

I am unable to create an account, for some reason.  When I first tried to sign up, I entered a username and my pgp key, and the page said it had sent me an email, but I never entered my email address .

Your PGP/GPG public key *contains* an email address (although it may not be a real one) - so an email should have been sent to whatever email address is in your PGP/GPG public key (in this case it was a tormail.org address - could the recent problems with tormail be the issue?)

Then I used the annon key, and a different user name, and I decrypted the username and password, but the username is my old username, and the password does not work.  (For either user names.)

The original username and password would be displayed only if the original PGP/GPG public was used. If you could contact me via PM then I will sort this out for you.

Also please note the user names are case sensitive in CIYAM Open (so if you signed up as Sothh you cannot login using sothh as your user id).

BTW - I just tested creating a new anonymous account with no difficulty at all so I am not sure what has happened in this case.

[CIYAM]

What's the time?

Unfortunately what seems like a very simple question can become rather tricky when you start to consider "daylight savings" adjustments that are made twice a year in many countries.

CIYAM Open can tell your current UTC offset through .js (and does) but doing this is not always what a user might want. For a start there is the problem of specifying future date and times (as they may occur after a transition in or out of daylight savings) and then there is also the fact that you may actually be using a computer that is not your own or your computer might have temporarily changed timezone due to being on a trip.

To help make this less of a problem you can now select a Timezone (from your user settings which you find by clicking on your username towards to the top right when you are logged in) and whether or not you want to use daylight savings.

The time (which now appears towards the top left of the screen when you are logged in) will then change according to the selected timezone and will be followed by the commonly used abbreviation (such as EST for Eastern Standard Time or EDT for Eastern Daylight Time).

After that you don't need to think about what date and time it will be in the future - it will be simply what you select (any adjustment required for DST will happen under the covers).

[Sothh]

Sorry, yeah I have not been using tormail lately, after its problems.

I am having some problems creating a bid on the CIYAM project.  Whenever I try to create a bid, it just takes me back to the forum page.

Also, I was going to do the HTML and CSS task, but I don't know where to find the design markup of the site.

[CIYAM]

I am having some problems creating a bid on the CIYAM project.  Whenever I try to create a bid, it just takes me back to the forum page.

Hmm... haven't heard of that occurring before - but I was just rolling out changes so it could possibly be due to that. Please try it again now.

Also, I was going to do the HTML and CSS task, but I don't know where to find the design markup of the site.

Actually if you are referring to the "Home Page Implementation" task unfortunately I have already agreed to let another contributor work on that (their bid hasn't been created yet as I only just opened up the task).

There will be other upcoming tasks for those with HTML/CSS skills so please check for such tasks in the near future (very likely to be in either September or October depending on how long it takes for the "Home Page Implementation" to be completed).

[CIYAM]

The Moneychanger tasks have all been re-opened but before others create bids they should consider that although once your bid has been accepted you are not competing with any other developer you are competing against the clock with the Delivery date and time that you provided.

Also if your bid ends up being rejected due to not having a deliverable or only having partially completed it you will end up losing Project Skill points.

So carefully consider a task before "trying to get dibs on it" and only bid on tasks that you are sure you can complete and the Delivery date and time should be carefully chosen (hint: don't just use the default value).

[CIYAM]

Congratulations to Jan Tenner on completing the CIYAM logo (http://ciyam.org/open/?cmd=view&data=20130131141145457000&ident=M100V131&chksum=3607d735).

The result looks at first glance as though it might be just a great font choice (clean and comfortable on the eyes) but if you take the time to look at it closely you will end up working out that it matches no existing font and is instead a minimalist work of precise angles, curves and spacing.

Work on the new design is progressing well and we are expecting to go live with the new look by October 1st.

[deslok]

Congratulations to Jan Tenner on completing the CIYAM logo (http://ciyam.org/open/?cmd=view&data=20130131141145457000&ident=M100V131&chksum=3607d735).

The result looks at first glance as though it might be just a great font choice (clean and comfortable on the eyes) but if you take the time to look at it closely you will end up working out that it matches no existing font and is instead a minimalist work of precise angles, curves and spacing.

Work on the new design is progressing well and we are expecting to go live with the new look by October 1st.

Very nice looking, for anyone interested in that close look

[CIYAM]

Next time open contest preferably somewhere on this forum so that more people who are willing to work for bitcoins can participate, thanks.

Wow - seems like someone "got out of the wrong side of the bed this morning" - understand that the logo was created according my specific instructions after going through quite a few other ideas and quite a lot of different iterations.

You also don't understand that in fact the designer who came up with the original idea for this logo was in fact Enej Pungercar (the guy who designed BitStamp).

Also understand I don't do "bounties" as I don't believe in people wasting their time for zero reward in competition against others.

Yes it *looks* like a font - but I can assure you that it isn't and although initially I had thought I wanted something that looked more "logoish" I ended up coming to the conclusion that this was indeed what I preferred.

And finally anyone on this forum that wants to work for Bitcoins is more than welcome to sign up.

[CIYAM]

New design now completed!


Thanks to the vision of Enej Pungerčar and the efforts of the CIYAM Developers we now have a new look which we think everyone will find much easier on the eyes.

It starts from http://ciyam.org and extends from there into CIYAM Open where you'll find a Sign In/Up that supports either OpenID, Standard (SSL) or our own Client Crypto (which requires GPG for signing up).

[deslok]

wow big changes, Welcome to the modern era!

[charleshoskinson]

CIYAM is one of the most revolutionary ideas I've seen in the Bitcoin space and I'd highly recommend checking it out.

[jantenner81]

Its a pleasure to work with CIYAM Open and BTW the new clean minimal design is really good - i like

[CIYAM]

Password Security Upgrade - Step 1

For those users who have "password" accounts (i.e. you use Standard or Client Crypto to sign in) you will need to sign in and click a link (such as your own user name) sometime in the next week to be sure that your current password will still work after a security upgrade is implemented (the upgrade changes your password hash).

There has been no security compromise (so no need to panic about your password hash being leaked) but instead this is just a "hardening" of the current password security (more rounds and future DB password encryption bumped up from AES128 to AES256). It is also being used as an experiment to see how smoothly such changes can be rolled out.

If you haven't changed your password since you signed up or are using OpenID then there is no need for you to do anything.

Once the actual security upgrade has been performed (I will post when this has occurred) then you'll need to refresh the webpage (as ciyam_interface.js needs to be updated) and after you successfully then sign in you might want to use the Change Password dialog (even if keeping the same password) to force the DB encryption improvement.

[Cyberdyne]

ciyam_interface.js needs to be updated

If that's the case, I'd suggest putting a version number on it like ciyam_interface_v2.js so that people are less likely to have caching issues.

[CIYAM]

ciyam_interface.js needs to be updated

If that's the case, I'd suggest putting a version number on it like ciyam_interface_v2.js so that people are less likely to have caching issues.

Must have read my mind - actually what I've done is now put a version # in the .js file that can be checked on the server side.

[CIYAM]

Password Security Upgrade - Step 2 (final)

Okay so the upgrade has now been completed. If you see the message "This UI is out of date - please refresh your browser page." then you need to force a page refresh.

If you find that you can no longer log in then PM me.

[CIYAM]

I'd like to welcome aboard the WebCoinKit project http://ciyam.org/open/?cmd=view&data=20140414134634671001&ident=M100V137&chksum=8982ef7f and wish @killerstorm all the best with the project.

Also for those who may not already be aware http://ciyam.org/open/?cmd=view&data=20140220164742097000&ident=M100V137&chksum=065ecf7d a project to create "Turing complete" transactions for Nxt and is well underway.

[jantenner81]

I'd like to welcome aboard the WebCoinKit project http://ciyam.org/open/?cmd=view&data=20140414134634671001&ident=M100V137&chksum=8982ef7f and wish @killerstorm all the best with the project.

Also for those who may not already be aware http://ciyam.org/open/?cmd=view&data=20140220164742097000&ident=M100V137&chksum=065ecf7d a project to create "Turing complete" transactions for Nxt is well underway.

wow nice :-  i'll look from time to time if they will offer a graphic task also