[ANN][Pool][Profit-Switch][Optional Auto-Exchange per Coin][Vardiff] ~ Hashcows

[socket]

Hey all.  Just wanted to say a little bit about dealing with nearmiss.

I have pm's to and from him all the way back to May.  He has always been quick to reply when there was any problem with one of his pools.  He may be delayed some, but what would you rather have, him spending time posting here or off working on the problem?

I am glad that nearmiss and aTriz found what the problem was and are fixing it.  Replacing lost funds is great and a lot more than some have done in the past.

The negative "trade" trust given to nearmiss is just wrong.  Operating a pool is not the same as making a trade with you.  So they had problems with a pool.  Why give them a negative trade trust.  But alas, there is always abuse to the systems that we have here.

I am still mining with hashco.ws and have been throughout this ordeal.

Thanks nearmiss and aTriz.

These guys are basically setting the standard on how you handle this kind of situation correctly.  Yet, there are going to be butt hurt assclowns here that will beat up on them (likely due to deep seeded emotional problems because their daddy never told them he loved them).  If you had more then 7 days worth of coins sitting around your account that's a bit crazy.  I'm sure the board admins will fix their trade reps.. there is no reason for stupid nonsense like that.

[jedimstr]

This thread is starting to sound like this:

1. The color is red.
2. Official Admin Post - Yeah the color is red. We're looking into it after Xmas.
3. Hey, did anyone know the color is red?
4. Just wanted to check here, did anyone notice the color is red.
5. I hate that the color is red.
6. Does anyone know what color it is?
7. *Bangs Head on table* - don't you all read, the color is red dammit!!!
8. Hey, I read every post and couldn't find the answer... Is the color red?
...snip...
10003029. Read my blog post: " the color red vs the color blue, a retrospective"
10003030. You know what, I think... Yes.. It seems the color is red.
10003031. Can someone tell me if the color is red or not?

10003032. I can't register, is it because it's red?

I think we'll see at least one question per page now asking why they can't login, register, or withdraw.  The chances are even higher if the post is right after an official post /update on the hack.

We should make a drinking game out of this.   Each post asking about logins, registration, withdrawals, etc gets a shot.

[Elmojo]

Looks like the Trust numbers for both nearmiss and aTriz have been reset to zero.
Is this what you guys are seeing, or am I looking in the wrong place?

[hardergamer]

Looks like the Trust numbers for both nearmiss and aTriz have been reset to zero.
Is this what you guys are seeing, or am I looking in the wrong place?

You need to click on the blue trust bit to see it all 

[g0re79]

I did know that You guys will not dissapoint us, but this is far behind my expectations. I vote for creating separate BTC adress for donations to at least partially cover losses and put it om HC website.

I'm hoping you meant "beyond" expectations, since behind would imply that you expected more.

I agree! I for one would be happy to donate to the Admins to help offset the reimbursement fees.
I personally didn't lose anything, since I always (as has been suggested multiple times) remove my coins on a daily basis.
The Devs offering to reimburse lost coins is a HUGE goodwill gesture, and one that I hope everyone truly appreciates.
Great job Cows!

Yes yes, of course. Sorry - I am not native English speaker so my skills are quite bad (but I am getting better and better I hope)

[Elmojo]

You need to click on the blue trust bit to see it all 

Ah, gotcha!
I never even noticed that feature before.
Hopefully the mods will get it sorted, nearmiss and aTriz deserve our support, not browbeating.

[mattopia]

Well done, gentlemen.  You're good people.

I only lost about .015 btc - it was below my payout threshold and I had been mining elsewhere for a couple of days so a payout never triggered.  I think it's older than 7 days, but if it's not and I get some back, I'd like to donate it back to you.

[hardergamer]

You need to click on the blue trust bit to see it all 

Ah, gotcha!
I never even noticed that feature before.
Hopefully the mods will get it sorted, nearmiss and aTriz deserve our support, not browbeating.

I completely agree with you there, and i only just found it my self 

[AlvaroB]

They also stole me!! The thief send all my bitcoins to this address 13R87ropkDKzDEuVeQoX64kkcLvPWVdTKH --> This is the thief address, not mine. I'm very angry, because it was only around 0.002, but it was 1 full month mining! Maybe is a security error on the web, because I'm not the only one with this problem. Please, you would be so kind if you refund me

0.002 bitcoin in 1 month?
How the hell pays the power bill? Your parents?

That really doesn't make sense to mine for 0.002 bitcoins per month (that's 1.4$!!!).

I'm guessing its only a single GPU? or a hobbiest miner... i started on 1 GPU - maybe thats all theyre mining on - maybe they hope that 0.002 somehow becomes $2000 in the future?

2 out of 3! Single GPU, mining by hobbie, but i don't know why i put 1 full month hahaha it worked about 1 week or less. I don't expect 0.002BTC worths $2000 in the future, i know thats $1.4. Electricity is free for me.

[Mattchu]

We are in the process of making some decisions and such, expect an official release from us tonight.

I've been unable to log into the site since yesterday, are accounts being locked down? I did have some bitcoin in there which got frozen. It wasn't much but it's been hard earned. Are we SOL? Hoping for the best but it looks like the worst.

Logins have been disabled, hopefully the update will provide some insight

Yeah I thought they were but it was interesting that I was able to login last night. Now I'm back to being unable to login again. I think the response of the team running hashcows is exactly what an excellent pool would do! Talk about going above and beyond! I'm very happy with that response and I even didn't have any coins stolen. Superb effort!

[Elmojo]

Did the pool just go down, or has something busted on my end?

[captainbluff]

Hashcows Official Update

We've been working since this time, both in determining the cause of the attack, and its potential scope, including an external audit of the source code by a trusted 3rd party. At this time the belief is still sql injection, based on the nature of the attack and how it was carried out. However, regardless of the technical results of ongoing audits, 2 things are confirmed. #1 The web instance and the mining/stratum instances are physically seperate. The mining instance remains unnafected by the web based lockdown, which is why mining continues to function as usual. #2 The web front-end is undergoing a rebuild from scratch as we speak, by both myself and another developer, utilizing different technologies, improved security features, and new hardware. We hope to have a basic version of this up in the coming days.
 

Thanks for the update, I have a question regarding the improvement on security. If you are running your web server and database on virtual servers via linode.com, how are you are you going to improve security?  Obviously it cannot be done by installing an IPS since you are in renting a VM. An IPS may have prevented the sql attack, you may have to work directly with Linode to see what kind of network security they can offer.

[biohack]

Registration still closed?

[jedimstr]

This thread is starting to sound like this:

1. The color is red.
2. Official Admin Post - Yeah the color is red. We're looking into it after Xmas.
3. Hey, did anyone know the color is red?
4. Just wanted to check here, did anyone notice the color is red.
5. I hate that the color is red.
6. Does anyone know what color it is?
7. *Bangs Head on table* - don't you all read, the color is red dammit!!!
8. Hey, I read every post and couldn't find the answer... Is the color red?
...snip...
10003029. Read my blog post: " the color red vs the color blue, a retrospective"
10003030. You know what, I think... Yes.. It seems the color is red.
10003031. Can someone tell me if the color is red or not?

10003032. I can't register, is it because it's red?

I think we'll see at least one question per page now asking why they can't login, register, or withdraw.  The chances are even higher if the post is right after an official post /update on the hack.

We should make a drinking game out of this.   Each post asking about logins, registration, withdrawals, etc gets a shot.

Yay, that's a shot!
Drink up Cows.... Moooooo

Registration still closed?

[Elmojo]

Yay, that's a shot!
Drink up Cows.... Moooooo

Registration still closed?

Hahaha Awesome!
Too bad it's only lunchtime here, and I'm still working...
Maybe I'll keep track of the shots, and take them all at once this evening! lol

[GoldBit89]

Hashcows Official Update

As has been mentioned in an earlier update, on December 24th 2013 someone was able to modify the Bitcoin payout addresses of many users of Hashcows, and trigger a manual cashout of current balances. 754 total users (out of a total of 8,142 registered users, 5,000+ of which have a BTC balance > 0) had BTC removed from their accounts, accounting for approximately 14.2% of users who held BTC on Hashcows. A total of 40.7815 BTC was removed and sent to address 13R87ropkDKzDEuVeQoX64kkcLvPWVdTKH. Hashcows staff have followed up with all major exchanges and a number of other large pools to confirm if they had any trace of this address in their systems, which as of this time has not turned up any useful results.

Since the attack was noticed on the 24th, we've placed the site in a locked down read-only mode, and disabled all payouts. While we understand this has caused some frustration among users, not being able to see if their accounts were affected, we felt it was the responsible course of action to take, given we knew we were unable to dedicate the time required to diagnose and address the security issues on Christmas Eve and Christmas Day.

We've been working since this time, both in determining the cause of the attack, and its potential scope, including an external audit of the source code by a trusted 3rd party. At this time the belief is still sql injection, based on the nature of the attack and how it was carried out. However, regardless of the technical results of ongoing audits, 2 things are confirmed. #1 The web instance and the mining/stratum instances are physically seperate. The mining instance remains unnafected by the web based lockdown, which is why mining continues to function as usual. #2 The web front-end is undergoing a rebuild from scratch as we speak, by both myself and another developer, utilizing different technologies, improved security features, and new hardware. We hope to have a basic version of this up in the coming days.

What does this mean in the immediate future? We'd prefer to not turn on write access for the website in its current form, but obviously understand people can't be expected to wait much longer for balances held up by the system (both old balances still intact, and earnings mined over the days since lockdown). We'll be posting a simple tool for people to use, allowing you to login with your credentials, at which point it will send out an email verification link, including your current balance and payment address the site has for you. Once clicked, your balance will be sent to the address specified. If you need to make changes to these details, instructions will be provided on the tool page. We hope to have this posted by tomorrow.

Last but not least, perhaps the question many have been waiting for an answer on. What does Hashcows plan to do about the missing 40 BTC? We've thought long and hard on this, and its obviously one of the most important decisions we'll have made in our short existence as a pool and community. Its a situation and decision that has hung over us throughout the last couple days spent with family and friends during the holiday.

Hascows will be re-imbursing every miner 100% of losses incurred on earnings made within the last 7 days prior to the incident (Dec 17th's payout inclusive). This means any funds you earned between Dec 17th and Dec 24th that were cashed out of your account by the attacker, will be re-added to your account at Hashcows expense. This payout will recover 100% of losses for 463 of the 754 affected users. For the remaining 291 users who are only partially covered by the above, we'll be offering reduced fees of 0.5% for at least the next 60 days to help with any shortfall.

In closing, both aTriz and I want to make a statement on more of a personal level, we have been absolutely stunned by the community that you have all created with this pool. There has been a tremendous amount of support and encouragement through these not so fortunate times and we would personally like to say Thank You. We look forward to the future of this pool while we begin the rebuilding stage which will continue to bring this wonderful community more features, more safety, more support, and more cows!

1) i didn't want to change anything on my account til you noted it as being one that was effected---i believe you have , so is it ok now for me to change my address back to one i had before and change my pin and other credentials now?

2)based off your quote" Hascows will be re-imbursing every miner 100% of losses incurred on earnings made within the last 7 days prior to the incident (Dec 17th's payout inclusive). This means any funds you earned between Dec 17th and Dec 24th that were cashed out of your account by the attacker, will be re-added to your account at Hashcows expense. This payout will recover 100% of losses for 463 of the 754 affected users. For the remaining 291 users who are only partially covered by the above, we'll be offering reduced fees of 0.5% for at least the next 60 days to help with any shortfall."

i had last requested a payout on , so im assuming i lost 100% of my payouts on 12/13(0.00012345)
 12/14(0.0000943000)
 12/15(0.00020599)
 12/16 (0.00012939)
and will get 12/17-12/24 full payouts. am i correct in assuming this?

[GoldBit89]

Did the pool just go down, or has something busted on my end?

my miners been down about 2 hours now even tho the website was showing the pool still mining--so not sure why my miner is failing to connect to pool.

[Elmojo]

my miners been down about 2 hours now even tho the website was showing the pool still mining--so not sure why my miner is failing to connect to pool.

Ok, not just me then, thanks.

[AlvaroB]

I also can't mine

[g0re79]

Hashcows Official Update
.....

1) i didn't want to change anything on my account til you noted it as being one that was effected---i believe you have , so is it ok now for me to change my address back to one i had before and change my pin and other credentials now?

2)based off your quote" Hascows will be re-imbursing every miner 100% of losses incurred on earnings made within the last 7 days prior to the incident (Dec 17th's payout inclusive). This means any funds you earned between Dec 17th and Dec 24th that were cashed out of your account by the attacker, will be re-added to your account at Hashcows expense. This payout will recover 100% of losses for 463 of the 754 affected users. For the remaining 291 users who are only partially covered by the above, we'll be offering reduced fees of 0.5% for at least the next 60 days to help with any shortfall."

i had last requested a payout on , so im assuming i lost 100% of my payouts on 12/13(0.00012345)
 12/14(0.0000943000)
 12/15(0.00020599)
 12/16 (0.00012939)
and will get 12/17-12/24 full payouts. am i correct in assuming this?

Yes, exactly. And for what You lost from 13-17 / 12 I can reimburse You personally, just send me Your BTC adress (Yours signature is so messy that its not showing correctly) and exact amount - I dont want to waste my time by counting theese tiny numbers (honestly it can´t cover Your electricity bill)