New to bitcointalk! A few questions...

[r3illy80]

Hey guys,

Started actively following bitcoin only a few months back but am totally hooked, bought my first coin and have enjoyed the rollercoaster ride so far!

I've got a few dev related questions - but unfortunately I couldn't make this post in the dev section as I'm only new to the forums.

Mods: hopefully this finds it's way to the right people

--

As a developer (PHP) - I'd love to build out a few ideas but am a little stuck on a couple of things.  Any help (or links to helpful info!) would be great.

I was planning to use the blockchain.info API to carry out transactions - however now am considering using the PHP_RPC api using my own bitcoind server ... can anyone point out any compelling reasons to choose one over the other...

Also..

1. How long does it take for a 0 (1?) confirmation transaction to fully propagate the network -

ie/ what the absolute shortest time we can find out a deposit has been made to an address (dis-regarding the double-spend problem)

2. I have a bitcoind server running - my blockchain is up-to-date - how can I discover the current BTC at an address?   Are there any scripts available to easily determine this?  Or better self hosted API's??

Is there a way to easily determine the latest inputs/deposits and their amount to an address?

3/ Re: private key security - In bitcoin games which allow users to withdraw BTC from their personal deposit address - what is the best strategy to store/secure the private key for that public address.




Thanks!

[Ondoma]

Hi r3illy80,

I was planning to use the blockchain.info API to carry out transactions - however now am considering using the PHP_RPC api using my own bitcoind server ... can anyone point out any compelling reasons to choose one over the other...

Sure.

For one Blockchain.info can sometimes be unavailable as we saw a few days ago which would affect your service, but the main reason would be when you use the blockchain.info API to make automated payments, they have control of your private key. This is very bad, as should an attacker compromise blockchain.info's server they could steal your Bitcoins, or a greedy Admin.

If your service does not make automated payments but uses the API to check if it has received payments at addresses, an attacker that compromised the blockchain.info server could "fake" transactions.

This is why it is recommended that you do not use any API's and run your own copy of Bitcoind.

1. How long does it take for a 0 (1?) confirmation transaction to fully propagate the network -

It takes as long as the miners take to solve the mathematical puzzle.

The Bitcoin network adjusts so that on average this takes 10 minutes, but it could take anywhere from milliseconds to possibly even weeks - although that would be highly unlikely.

ie/ what the absolute shortest time we can find out a deposit has been made to an address (dis-regarding the double-spend problem)

When a transaction is made it is broadcasted as an unconfirmed transaction across the network. Depending on how well your node is connected, this should normally take a few seconds, but usually it takes around a minute for an unconfirmed transaction to propagate the network fully.

So the answer is a few seconds to a minute, but the transaction may never confirm if it is double-spent or does not have enough of a transaction fee.

2. I have a bitcoind server running - my blockchain is up-to-date - how can I discover the current BTC at an address?   Are there any scripts available to easily determine this?  Or better self hosted API's??

Take a look at this:
https://en.bitcoin.it/wiki/Original_Bitcoin_client/API_Calls_list

You can use the getreceivedbyaddress API command to find the amount that has been "received" by an address, but not the amount sent.

Is there a way to easily determine the latest inputs/deposits and their amount to an address?

You can use gettxout to do this but it can be tricky, you usually do not need to do this though.

3/ Re: private key security - In bitcoin games which allow users to withdraw BTC from their personal deposit address - what is the best strategy to store/secure the private key for that public address.

What you should do is have a hot wallet - https://en.bitcoin.it/wiki/Hot_wallet which is on your server that deposits are received into and a cold wallet - https://en.bitcoin.it/wiki/Cold_storage that you keep on your personal computer or preferrably on paper.

Your server would only keep a small amount of Bitcoins in the hot wallet that can cover the amount of withdrawals you expect to get on a given day. When it goes over this amount it sends the excess Bitcoin to your cold storage, keeping it safe.

[r3illy80]

Great thanks for all the helpful info Ondoma.

Was leaning towards my own bitcoind implementation - this confirms pretty much what I suspected. Thanks for the confirmation.

When a transaction is made it is broadcasted as an unconfirmed transaction across the network.  ...  So the answer is a few seconds to a minute, but the transaction may never confirm if it is double-spent or does not have enough of a transaction fee.

Great I didn't realize the unconfirmed transaction was propagated immediately.

My reasoning here is I can let a user start playing almost immediately.  It's more important to to me to give a better user experience and allow instant access.

I understand the concept of a hot wallet and cold wallet - but thanks for pointing this out.

What I was interested in was more around some strategies for secure storage of private keys server side in regards to encryption/locking down bitcoind wallet.dat etc.....