NXT :: descendant of Bitcoin - Updated Information

[igmaca]

I dont know if this is relevant...but there is someone who is stealing nxtcoins from "bad-protected" accounts.

I've just created an account with the pass: "mtvraps" to check and play. I made the nxtra.org faucet and they sent me 2nxt to this account "14345877598619007537". One minute after, someone sent these 2nxtcoins to other account (of course it was not me). The account was: "1413811113623034318".  I suppose there is a bot checking all the possible weak passwords...

It could be funny but......TAKE CARE!

I'm not a coder and I have no knowledge of softwaresecurity....but is there an option to use a 2w-factor-verification? Securityweakness could be the most dangerous problem to NXT mass adaption.

I agree
would be necessary to encourage any client developer to implement 2 factor authentication


Two-step verification is a process involving two stages to verify the identity of an entity trying to access services in a computer or in a network. This is a special case of a multi-factor authentication which might involve only one of the three authentication factors (a knowledge factor, a possession factor, and an inherence factor) for both steps.[1][2][3] If each step involves a different authentication factor then the two-step authentication is additionally two-factor authentication.
Contents  [hide]

1 Example
2 Google's two-step verification process
3 Other sites offering two-step verification service
4 References
Example[edit]

To provide an everyday example: an automated teller machine (ATM) typically requires two-factor verification. To prove that users are who they claim to be, the system requires two items: an ATM smartcard (application of the possession factor) and the personal identification number (PIN) (application of the knowledge factor). In the case of a lost ATM card, the user's accounts are still safe; anyone who finds the card cannot withdraw money as they do not know the PIN. The same is true if the attacker has only knowledge of the PIN and does not have the card. This is what makes two-factor verification more secure: there are two factors required in order to authenticate.
Note that if the ATM smartcard is merely a magnetic-stripe card it is copyable then the process is only two-step authentication but not two-factor authentication since the ATM is only verifying that the user knows the data encoded on the magnetic stripe (knowledge factor) and presented it in magnetic-stripe form. A smartcard with a chip performs a challenge/response authentication; the information transmitted from the card to the ATM is not the information required to duplicate the card's abilities.
Google's two-step verification process[edit]

Google was one of the first Internet companies which introduced a two-step verification process.[4] To access a Google service using the two-step verification process, a user has to go through the following two stages:[5][6]
The first step is to log in using the username and password. This is an application of the knowledge factor.


The implementation of the second step requires a mobile phone or the Google Authenticator application, which is an application of the knowledge factor. If the user opts to use a mobile phone, he/she has to register his/her phone number with Google. When one attempts to authenticate with username and password, Google will send via SMS a new, unique code to the phone. Receiving the SMS demonstrates that the user knows the phone's IMEI, which is sufficient to convince the phone network to direct the SMS to the attacker.

If the user opts to use the Google Authenticator (or another supported code generator application),[7] he/she simply opens the application, which generates a new code every 30 seconds. This code is to be entered to complete the log in process. As a backup option in case the registered mobile phone or device running Google Authenticator is lost, stolen, or otherwise unavailable, the user can print a set of static single-use backup codes (also the knowledge factor) and store them in a safe place.

[1715165619]

1715165619

[1715165619]

1715165619

[1715165619]

1715165619

[mcjavar]

CFB, are you the only one communicating with BCNext? Who will be in touch with him when you depart in 3 1/2 weeks?

He had left the day before Nxt source code became public. Went for good to work on other things. I'll get 3rd part of the plan in April but I can't contact him anymore.

this explaines why he also stopped logging to his original 3 years old account 3 days before release of the source

Well, disappearing is the easiest way. We made him rich, now, where we need a leader he just disappers. Great. Anyway, I will try to get things together and organize things where I can. Let´s see where this evolves.

[zorke]

We will have one soon!

I hope so and thanks!!  

Re: NXT for Dummies

Ok Pinarello, 'we will have one soon'. Good. So, when I tell new investors to go to nxtcrypto.org and download the client, will this be it?

At the moment it's NRS 0.8.3, which got updated again 5 minutes ago.   This is where we are stumbling. New investors will NOT put up with this?

NRS is not for newbies and this should be taken off the main site as soon as we have a working client. And people will post that we do have working clients but there is always something that puts people off like updates.

Can you promise me that nxtcrypto.org will have a NXT Client for Dummies (99% humans) as soon as possible??

That client will be Wesleysh client integrated in NRS java, mistafreeze will create the installer.

Wesley delivers the client to J-L tomorrow, dont know how long integration will take but I hope they can do it before friday coz J-L is leaving till sunday

in short when wesleys client is integrated mistafreeze one click installer installs all without any hustle.

THIS will be the standard NXT client

OK great and if this client works and does a good job in what is supposed to be doing than Wesley should get some bounty from unclaimed coins since an official client will do us lot of good, maybe more good than some other things on which we will be spending these funds. Of course this is just my opinion.

[salsacz]

mcjavar: good

[jl777]

@jean-luc:

Could you change lines 124 and 125 of nxt / src / java / nxt / http / TransferAsset.java

from:

        Attachment attachment = new Attachment.ColoredCoinsAssetTransfer(asset, quantity);
to:
        String comment = req.getParameter("comment");
        if ( comment != null )
                Attachment attachment = new Attachment.ColoredCoinsAssetTransfer(asset, quantity, comment);
        else  Attachment attachment = new Attachment.ColoredCoinsAssetTransfer(asset, quantity);

I believe the above change will allow an optional comment to be added to the transferAsset API
If this is not the case, please let me know.

James

@All

The code is open source. So, fork it, hack it and make pull requests.

Since its just a few lines change, i was hoping I could get some personal feedback on it

[Damelon]

Instead of whining about the big holders not footing the bill for all the work that needs to be done, maybe we should see how much the community at large is willing to invest in developing a client, then ask if one or 2 whales would be willing to match funds? For example, if a bunch of participants in this thread make pledges totaling, say, 500,000 NXT, one of the 50Mil holders could match that, making for a total of 1 million to go to the person or persons who can deliver a working, user-friendly client. I, for one, would be willing to contribute 500 NXT

There are already a ton of clients, are you saying they are all bad?..

wesleyh, I didn't at all mean to imply that currently available clients are bad, and I greatly appreciate the work you've done on developing clients. I'm fairly new to NXT and so far have only used the standard client. So I really can't speak to the quality of the other currently available ones. I was just going by a consensus that seems to exist here that there remains a need for an extremely simple "1-click" client in order to get the less tech-savy folks involved with NXT.

In any case, the point I was making applies to dev work in general, not just work on the client. People around here are always complaining about the big holders not giving away more of their NXT for development projects. While I think there is some validity to these complaints, I think the rest of us should be willing to pull some of the weight to. I wish people would talk more about what THEY are willing to do and less about what they think others are obligated to do.

I agree. It's no use wishing and crying over spilt milk.
Of course we need to keep trying to get the whales involved, but otherwise, it's up to us.
And if I look at the thread today, that is going well. We did tons today again, and do so everyday.
Tons of Nxt to spend would be nice, but we are getting things together even without the tons, which is admirable!
I mean that not in a fluffy way, but in a "christ, these people can get shit together, if needed!" way.

[whyenot]

RE: forging pools

If the problem is the security issues associated with forging with a hot wallet, maybe implementing something like Sunny King's cold-locked transaction proposal for Peercoin could be a solution.

The beauty of this approach is that it avoids centralization while greatly increasing the security of forging (minting) with a hot wallet because coins in the hot wallet can only be moved to a previously designated address and this restriction is enforced by protocol.

Abstract: A proposal to relieve stake minter the risk of running online hot wallet.

Description: This proposal is simpler than the previous dual-key proposal [1]. A special transaction type called cold-locked transaction is introduced so that a designated spending address is specified in its first output. Protocol enforces that, spending of any of the outputs in the transaction must be sent to this designated address, or to itself (for stake generation purpose). When stake is generated, the stake transaction is also cold-locked and the designated key in stake must match all designated keys where all the inputs come from.

How hot wallet is protected:

By providing a cold-wallet address as the designated spending address in cold-locked transactions, stake minter can now run their entire balance online in a hot wallet to earn 1% annual interest with minimum risk, while providing maximum security to the entire network. This would allow even the exchanges, pools, and other online wallet providers to participate in network protection without risking public assets, and reduce fees or even pay interest to its users.

https://bitcointalk.org/index.php?topic=194054.0

[zorke]

Is anyone knowing what we paid for?

Yes. Refactoring, consulting, some extra functionality like API calls.

how do we know you actually delivered what BCNext has paid for is better formulated.

how do we know you did all what he asked?

Who will communicate with BCNext in April after CFB departs?

Uncertainty about the core dev team isn't instilling much confidence in investors and current holders. Investors will stay away until this confusion and uncertainty disappears.

Friends of mine have no idea which client to download so are keeping their NXT on exchanges. They won't do anything until there is a one click install that works. They ask me which one is the 'main' website. All they want is to Send/Receive and not lose any NXT. No messing around with batch files, firewall settings, testnet and having to update twice a week. They don't even want to know about forging.

I'm sure it wouldn't be difficult to promote one simple client that works and isn't going to freak out newbies. Can someone design a simple, safe, client that just sends and receives? I can assure you that would make so many people happy. Most newcomers aren't going to use all the other features they don't even understand, at least not yet. Forging is not an issue for them and don't care about that because they own 5k to 10k. None of their other coin wallets make any money and they don't expect NXT to either. They just want to send and receive and know their wallet is safe (secure password of course) It's that simple.

Does this make sense to anyone and does anyone have any ideas about how we arrive at one website and one simple client.

All my friends asks the same

I agree completely with all of the above.. 5-6 people that I got into NXT are asking me the same question. For 3 of them I am holding NXT because they are freaked out they will mess up something since and lose their investment. Problem with a client exist. i mean we are launching an AE and we still don't have a go to client. And one might say how we have several clients out there, but they are all half working or if I am wrong than we should just choose the best one and offer it to the people..

Nexern client I won't even mention anymore. I doubt we will ever see it.

I really do not understand where the problem lies? The whales could easily support two developers FULLTIME to finish a client within a month.

With this I agree and this should have already be done, with or without the whales. We have unclaimed coins funds and the client is the money best spent.
I might be wrong but didn't Nexern already get a bounty for his client?

[Fern]

Where are the clients here?

http://wiki.nxtcrypto.org/wiki/Main_Page

Wesley's client is going to be the primary download available next week from nxtcrypo.org. So NRS will be replaced with this.

This will make life a lot easier for current and future NXT users. This client will be promoted as the primary client on WIKI as well, but all other client options will be available with a short description about them.

That's how I understand it will work out.

[ChuckOne]

@jean-luc:

Could you change lines 124 and 125 of nxt / src / java / nxt / http / TransferAsset.java

from:

        Attachment attachment = new Attachment.ColoredCoinsAssetTransfer(asset, quantity);
to:
        String comment = req.getParameter("comment");
        if ( comment != null )
                Attachment attachment = new Attachment.ColoredCoinsAssetTransfer(asset, quantity, comment);
        else  Attachment attachment = new Attachment.ColoredCoinsAssetTransfer(asset, quantity);

I believe the above change will allow an optional comment to be added to the transferAsset API
If this is not the case, please let me know.

James

@All

The code is open source. So, fork it, hack it and make pull requests.

Since its just a few lines change, i was hoping I could get some personal feedback on it

Is there no discussion associated when issuing a pull request on bitbucket?

[Come-from-Beyond]

Since its just a few lines change, i was hoping I could get some personal feedback on it

Ur lines is not enough. Changes in other parts r necessary.

[LemonAndFries]

It's times like this I wish I knew about NXT in October and bought in. I was late to the cryptocoin world.

If I was a whale, for sure I would have been funding several projects, creating giveaways/contests/promotions for the good of the community.

It doesn't take a genius to figure out that ultimately it lies with the people if this coin will have any real world value or not.
Basic economic knowledge (very basic and logic) is needed (or should be taught).

But alas, I am not a whale and as much as I'd like to I cannot afford such things.

[ChuckOne]

Where are the clients here?

http://wiki.nxtcrypto.org/wiki/Main_Page

Wesley's client is going to be the primary download available next week from nxtcrypo.org. So NRS will be replaced with this.

This will make life a lot easier for current and future NXT users. This client will be promoted as the primary client on WIKI as well, but all other client options will be available with a short description about them.

That's how I understand it will work out.

+1440

His client looks amazing.

[igmaca]

Windows Installer for Nxt 0.8.6 released.

https://nextcoin.org/index.php/topic,1902.0.html

If there is any interest I could throw together an installer with Wesley's interface set to testnet by default.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Release 0.8.6

http://download.nxtcrypto.org/nxt-client-0.8.6.zip

sha256: ecdce17e2d1cd704fce3b7e40d458c1c8b80a1cf064eb8f4f5e7f6593166dba8

Very good job!! .

it is very easy to install Nxt 0.8.6 released
would be fantastic to include client wesley

[pinarello]

Where are the clients here?

http://wiki.nxtcrypto.org/wiki/Main_Page

Wesley's client is going to be the primary download available next week from nxtcrypo.org. So NRS will be replaced with this.

This will make life a lot easier for current and future NXT users. This client will be promoted as the primary client on WIKI as well, but all other client options will be available with a short description about them.

That's how I understand it will work out.

+1440

His client looks amazing.

I think this is very clear now, so J-L, implement it please in place of NSR.

Wesleyh and mistafreeze should be paid from unclaimed coins NXTinfrastructurefund when delivered.

[jl777]

@jean-luc:

Could you change lines 124 and 125 of nxt / src / java / nxt / http / TransferAsset.java

from:

        Attachment attachment = new Attachment.ColoredCoinsAssetTransfer(asset, quantity);
to:
        String comment = req.getParameter("comment");
        if ( comment != null )
                Attachment attachment = new Attachment.ColoredCoinsAssetTransfer(asset, quantity, comment);
        else  Attachment attachment = new Attachment.ColoredCoinsAssetTransfer(asset, quantity);

I believe the above change will allow an optional comment to be added to the transferAsset API
If this is not the case, please let me know.

James

@All

The code is open source. So, fork it, hack it and make pull requests.

Since its just a few lines change, i was hoping I could get some personal feedback on it

Is there no discussion associated when issuing a pull request on bitbucket?

I dont know, I never did one.

Looking at making Assets support fractions, I think it is a matter of changing:

            quantity = Integer.parseInt(quantityValue); -> parseLong
            and making Nxt.MAX_ASSET_QUANTITY multiplied by 100000000

IssueAsset.java, PlaceBidOrder.java, PlaceAskOrder.java and TransferAsset.java seem to be the only places that needs to be changed other than Order.java lines 69 to 71:

    private volatile int quantity;
    private Order(Long id, Account account, Long assetId, int quantity, long price) {

just need to change the int to a long

There might be a few other places as I have only just now started looking at this code, but I dont think getting fractional assets will be that hard at all. We would need to change the client code to multiply everything by 100000000, but I think it is worth doing to get support for fractional assets in AE

James
  

[mcjavar]

CORE DEV TEAM

Some questions:

1, How could one join? Whom to contact?
2, Are there any candidates?
3, Do we have a bounty for them? Unclaimed coins or should we put together some Nxt for this?

My candidate for joining the dev team is CIYAM.

I have also contacted Jean-Luc and am now awaiting his answer.
When we know whom to contact in order to get the core dev team together and we have the candidates, I will contact them one by one asking them if they would be interested.

AFAIK there is only Jean-Luc actively working on the core. Am I right?

[Fern]

CFB, are you the only one communicating with BCNext? Who will be in touch with him when you depart in 3 1/2 weeks?

He had left the day before Nxt source code became public. Went for good to work on other things. I'll get 3rd part of the plan in April but I can't contact him anymore.

Thanks. I see this as a great opportunity for NXT as we move from a clandestine phase to more of a public one.

A far as I am aware, the remaining core dev team (jean-luc) will be built upon. This is obviously crucial. More devs are currently being sourced.

Wesley's client will become the primary one. It's looking great and will be much appreciated.

[Jean-Luc]

Since its just a few lines change, i was hoping I could get some personal feedback on it

Ur lines is not enough. Changes in other parts r necessary.

Yes. The byte representation of asset transfer attachment does not expect a comment at the end. If we decide asset transfer need comments, this will have to be added to all asset transfers, and existing ones invalidated, so blocks containing old asset transfers on test net will not be accepted by new code and a fork will form. This is testnet only, so it is doable, but wouldn't be possible if AE was already live.

[ChuckOne]

Since its just a few lines change, i was hoping I could get some personal feedback on it

Ur lines is not enough. Changes in other parts r necessary.

Yes. The byte representation of asset transfer attachment does not expect a comment at the end. If we decide asset transfer need comments, this will have to be added to all asset transfers, and existing ones invalidated, so blocks containing old asset transfers on test net will not be accepted by new code and a fork will form. This is testnet only, so it is doable, but wouldn't be possible if AE was already live.

So, we would need a new version for blocks?