Steem pyramid scheme revealed

[smooth]

Steemit is down right now, but Steemlt.com is available now:

https://www.reddit.com/r/steemit/comments/4vevdt/this_is_a_clone_of_steemitcom_fully_functionnal/

Just replace i with l in your urls.

As I noted on reddit:

Bear in mind that any such web site could be malicious, or become compromised, and steal your keys. I'm not making any accusation here, just a comment on general principles

Personally I wouldn't trust a "replica" site...

I would if I ran it myself.

[iamnotback]

smooth can you help me understand how the 19 witnesses on the Steem blockchain can avoid a flood bandwidth DDoS attack?

I read a claim that the worst of such attacks have exceeded 1 Tbps. Since the P2P network has to know the IP addresses of these 19 witnesses, then these IP addresses are public. So doesn't the DDoS attack need only to flood the incoming bandwidth of those 19 witnesses in order to stall the blockchain?

Filtering by IP address won't protect against a bandwidth flood attack that overwhelms the incoming bandwidth, e.g. the cost of 10 Gbps unmetered port is $2000+ per month. Afaics, each witness would need to spend $200,000 monthly to be able to absorb the maximum attack (presuming some DDoS protection service doesn't charge less for sharing the infrastructure since attacks may not be continuous).

In Bitcoin where any node is fungible with any other node, the DDoS any one (or 19) node(s) doesn't stall the network.

Am I missing something?

Btw, I glanced at the Graphene source code on Github and its seems the graphene/app and graphene/witness folders are missing? These are referenced in the source code but I don't see them in repository.



Edit: do each of these witnesses own multiple IP addresses and then carefully select their first level peers and give each one a different IP address and then discover which peer has given any IP address to an attacker?

Those first level peers then need to remain reasonably permanent, so then the DDoS problem shifts to them, but perhaps they can be more numerous say a couple hundred (if each witness selects a different set and each witness has say 10+ IP addresses), so each one only needs say on unmetered 10 Gbps connectivity.

[iamnotback]

Steemit is down right now, but Steemlt.com is available now:

https://www.reddit.com/r/steemit/comments/4vevdt/this_is_a_clone_of_steemitcom_fully_functionnal/

Just replace i with l in your urls.

As I noted on reddit:

Bear in mind that any such web site could be malicious, or become compromised, and steal your keys. I'm not making any accusation here, just a comment on general principles

Personally I wouldn't trust a "replica" site...

I would if I ran it myself.

He took it down to remove the login feature. It is back up now.

[smooth]

Since the P2P network has to know the IP addresses of these 19 witnesses, then these IP addresses are public. So doesn't the DDoS attack need only to flood the incoming bandwidth of those 19 witnesses in order to stall the blockchain?

The IP addresses and physical locations of the witnesses are well-guarded secrets. The witnesses use different, mostly undisclosed, measures to protect their nodes. Most if not all witnesses have dedicated backup nodes at different locations. An attacker would need to identify and bring down a majority of the existing witnesses simultaneously, including backups, to prevent block production. If the attack only succeeds in bringing down a minority, then then those successfully attacked can easily be voted out and replaced by backup witnesses.

I'm not going to say this is an impossible scenario but it doesn't really seem to rank highly on the list of realistic concerns.

[iamnotback]

Since the P2P network has to know the IP addresses of these 19 witnesses, then these IP addresses are public. So doesn't the DDoS attack need only to flood the incoming bandwidth of those 19 witnesses in order to stall the blockchain?

The IP addresses and physical locations of the witnesses are well-guarded secrets. The witnesses use different, mostly undisclosed, measures to protect their nodes. Most if not all witnesses have dedicated backup nodes at different locations. An attacker would need to identify and bring down a majority of the existing witnesses simultaneously, including backups, to prevent block production. If the attack only succeeds in bringing down a minority, then then those successfully attacked can easily be voted out and replaced by backup witnesses.

I'm not going to say this is an impossible scenario but it doesn't really seem to rank highly on the list of realistic concerns.

But that doesn't entirely answer my question. How can any other non-witness nodes communicate with the witnesses if they don't know the IP addresses of the witnesses?

Had you seen my edit:

Edit: do each of these witnesses own multiple IP addresses and then carefully select their first level peers and give each one a different IP address and then discover which peer has given any IP address to an attacker?

Those first level peers then need to remain reasonably permanent, so then the DDoS problem shifts to them, but perhaps they can be more numerous say a couple hundred (if each witness selects a different set and each witness has say 10+ IP addresses), so each one only needs say on unmetered 10 Gbps connectivity.

It seems to me the way to do this is the witnesses will expose disposable IP addresses to the non-witness nodes, which I presume can be obtained from cloud hosting services. And those of these disposable IP addresses which are DDoS attacked, are then discarded and replaced with new IP addresses. Some cloud services can bring up a new node in less than a minute. So these cloud nodes are operated by the witnesses and thus they know the secret IP addresses of the witness. Am I correct this is how it is done? And if a hacker breaks into the cloud service, then the witness will need to replace its secret IP addresses (and also physical locations) with the backup ones?

And those IPs can be dynamic because clients can be seeded via DNS:

https://en.bitcoin.it/wiki/Satoshi_Client_Node_Discovery#DNS_Addresses
http://bitcoin.stackexchange.com/questions/3536/how-do-bitcoin-clients-find-each-other#answer-11273

[iamnotback]

I haven't studied the recently open sourced Steemit.com (the UI) source code in great detail yet, but I presume it is for example downloading the entire blog content again even when it has not been edited, i.e. caching might be fairly unsophisticated. This could be another reason to open source it, so that others can try to optimize so that massive scaling of usership can be accomodated. Note that users have a bandwidth limit according to their stake, but I don't know how fine-grained this accounted. There are lots of details like this lurking, so naive investors should not just assume they can scale technically (not to mention the economic and feature hurdles that I think may limit adoption).

In short, the devil is in the details and you can't extrapolate from 1000 simultaneous users to millions. You don't just add servers. There are complex issues.

[AlexGR]

Can the curation rewards be diminished through fake upvote bots so as to render curation unprofitable?

My theoretical attack scenario, which may or may not work (I don't know what the code does), is the following:

An article is posted. One launches 500 upvotes through a bot of theirs after 15m, and another 500 after 30m. These upvotes are minimal value and even with very low voting power (because they are bots and do the same all over the place in other posts). So when rewards are calculated, and a guy is now the 1030th voter, his weight (due to being 1030) is very very low - thus when his reward is multiplied with his weight, he gets almost nothing. But the bots get nothing either due to no SP and very low voting power - it's just done to disrupt curation rewards.

Is it possible?

[smooth]

Can the curation rewards be diminished through fake upvote bots so as to render curation unprofitable?

No, the curation reward is a pool. It has to be paid to someone.

Some strategies might be more profitable than others. I don't understand the last round of changes to the reward algorithm well enough to say whether number of votes is completely irrelevant or not (it should be imo, but they don't ask me). But either way, someone will be getting rewarded.

Also, there is no such thing as a "fake" upvote bot. If a vote transaction makes it to the blockchain, it is real.

[AlexGR]

Ok...

edit: I just noticed BTC @ 630something... SDs just got cheaper, lol...

[AlexGR]

https://steemit.com/steemit/@derekareith/how-steemit-scammed-me-out-of-usd0

[iamnotback]

Hilarious and predictable - politically correct woman tries teaching in "the hood".  Students assault her and destroy her car.  She's told to discriminate against white people to make the students happy, then after she leaves the school in fear, says it was a great and wonderful experience!

https://steemit.com/introduceyourself/@melek/punish-a-white-kid-first-the-rule-i-didn-t-follow

r0ach I must say that I found your comment there to be a curmudgeon and very closed-minded:

https://steemit.com/introduceyourself/@melek/punish-a-white-kid-first-the-rule-i-didn-t-follow#@anonymint/re-melek-re-r0achtheunsavory-re-melek-punish-a-white-kid-first-the-rule-i-didn-t-follow-20160731t123450322z

[generalizethis]

Special thanks to smooth, risto, fluffypony and Shelby. Thank you guys, didn't  plan on joining the cc community, but people like yourself is why I stay (please don't take that as sentimental and sappy--IE awkward).

https://steemit.com/poetry/@generalizethis/meltdown-part-1

(Not sure if the last DNA-swirl section being off center was my subconscious forcing people to goto the recording to hear it read [they should] or just my computer's way of saying, "you know I can't let you do that")

[r0ach]

r0ach I must say that I found your comment there to be a curmudgeon and very closed-minded:

https://steemit.com/introduceyourself/@melek/punish-a-white-kid-first-the-rule-i-didn-t-follow#@anonymint/re-melek-re-r0achtheunsavory-re-melek-punish-a-white-kid-first-the-rule-i-didn-t-follow-20160731t123450322z

What about this one?  

Zero Sum Game: SJWs will all die because the function of natural selection is to cull the weak and stupid

http://steemit.com/politics/@r0achtheunsavory/zero-sum-game-sjws-will-all-die-because-the-function-of-natural-selection-is-to-cull-the-weak-and-stupid

[iamnotback]

I've lost all interest to compose blog posts on Steemit, because I know that only if one of the 50 whales votes for my blog post will it earn anything worth my time to compose content. And I don't expect any whales to vote for my posts given I have stated I am developing a competing product.

This indicates how closed the Steemit ecosystem is. It is impossible to get around the 50 whales and the horrendously fucked distribution of the money supply. Thanks to smooth for the charity. I needed a little boost of cash (about $4000 earned).

I am confident that professional bloggers don't want to be beholden to the preferences and whims 50 nerd whales and their derivative orca gfs and surrogates. We want to be able to speak directly to the masses and be rewarded for it. Don't tell me that each minnow is only worth $8. The economics of Steem's distribution are whacko.

Therefor I am cashing out and will not participate further in Steemit. I have no choice now but to try to compete with it, since there is no future for me on the Steemit platform.

[adhitthana]

Where are the devs telling us what to do?

The only directions I received from the devs is to change my passwords so they are harder to brute force.

It's hard to say with the amount of sockpuppets they own.

Lol

[r0ach]

I've lost all interest to compose blog posts on Steemit, because I know that only if one of the 50 whales votes for my blog post will it earn anything worth my time to compose content.

Not bad odds compared to the normal lottery.

And I don't expect any whales to vote for my posts given I have stated I am developing a competing product.

If forced to place a life or death binary option trade on whether Anonymintcoin is ever released, most people are probably going to choose no if you hold a gun to their head and threaten to kill them if they get it wrong, so I wouldn't worry about that part.

It is impossible to get around the 50 whales and the horrendously fucked distribution of the money supply.

I first thought the Nash equilibrium of this system is for all whales to either not vote at all (prevent dilution), or only vote for themselves or their Sybil accounts.  Then I noticed while not having a ton of SP myself, some of my votes would make posts go up like $50 instead of a few cents.  It seems like there is *some* built-in vote weighting to prevent that, where it kind of encourages them to vote for posts that they think will enhance the content value of the site to raise their SP higher.  Although I still seem to think the best option of the largest whales might be to not vote at all unless the president of China or Obama himself signs on the site.

[iamnotback]

I first thought the Nash equilibrium of this system is for all whales to either not vote at all (prevent dilution), or only vote for themselves or their Sybil accounts.

My understanding is the same amount of debasement occurs even if only 1 minnow votes. Whales not voting does not diminish the debasement.

But please note, that SP holders are not likely being debased (or not by much).The debasement is on the STEEM holders (probably the STEEM on the exchanges).

[generalizethis]

  https://steemit.com/bitcoin/@generalizethis/steemit-forums-the-value-of-content-pools

*had to come back to it.

[smooth]

I first thought the Nash equilibrium of this system is for all whales to either not vote at all (prevent dilution), or only vote for themselves or their Sybil accounts.

My understanding is the same amount of debasement occurs even if only 1 minnow votes. Whales not voting does not diminish the debasement.

But please note, that SP holders are not likely being debased (or not by much).The debasement is on the STEEM holders (probably the STEEM on the exchanges).

SP holders are being debased. The vesting fund is currently 96.7% of the total supply, well over the 90% that would make the SP debasement rate zero. Also note that the 100% per year inflation is only reached at some point in the future. As with all coins with a relatively flat distribution schedule (fixed amount distributed per block), the inflation rate is reduced over time as the total supply increases. For now it is well over 100%, meaning the SP debasement is also higher. I read 300% recently but I don't know if that is correct.

I first thought the Nash equilibrium of this system is for all whales to either not vote at all (prevent dilution), or only vote for themselves or their Sybil accounts.  Then I noticed while not having a ton of SP myself, some of my votes would make posts go up like $50 instead of a few cents.  It seems like there is *some* built-in vote weighting to prevent that, where it kind of encourages them to vote for posts that they think will enhance the content value of the site to raise their SP higher.  Although I still seem to think the best option of the largest whales might be to not vote at all unless the president of China or Obama himself signs on the site.

iamnotback was correct about not voting not reducing dilution. The reward fund grows whether you vote or not and it will all be paid out one way or another.

The system is designed to ensure that voting for all your own posts is not generally a good strategy (unless you are a popular author and also draw votes from others). Waiting for the most mega of mega posts doesn't work either because voting power expires if unused in 5 days. Use it lose it.

[r0ach]

LOL, OK, this Steemit thing is now a complete joke to me.  I had a post with politics tag that was at $0.04 with 12 upvotes or so.  There were no downvotes and no "down flags" on the post, then all of a sudden a mysterious force comes out of nowhere and censors the post to make it invisible to everyone.  You can tell because it displayed a picture next to it and now the picture is gone and the $0.04 cent reward is also gone.  It does not even list anyone having downvoted or flagged it.  

You can no longer find the post under any of the tags it was posted under.  It's just gone and censored without using the direct link!  What is the purpose of using this site over something like Reddit if it's centrally moderated exactly the same way if not worse?  It's not even a spam post.  It's a 100% completely legit politics post.

https://steemit.com/politics/@r0achtheunsavory/zero-sum-game-sjws-will-all-die-because-the-function-of-natural-selection-is-to-cull-the-weak-and-stupid