[ANN][DASH] Dash (dash.org) | First Self-Funding Self-Governing Crypto Currency

[reda]

hello there is a a backdoor in the version 10.8.8 i have been stolen 999 dark coin from my master node
here is my wallet address http://chainz.cryptoid.info/drk/address.dws?XfNfxwfQpVKccGprG6PdRWT2UtMGoM9gCL.htm

it has been moved to this wallet XwKx3mWB9ncJo5ZudqyEZ1MoQWMSmE3CwP

it seems either the devs or someone who gave the version given on darkcoin.io got a backdoor


here is the log of my masternode server
 st login : from 192.162.103.175

Can you give a little more info, did you have the wallet encrypted? How was your darkcoin.conf setup?

the wallet was encrypted by  a hard password
the wallet was started as use and not root
i have changed the ssh port from 22 to another
installed fail2ban
did all security thing and still got hacked
the starge thing is that it has been sent only 999 and not all of the darks which is 1000.6
the walet that received the dark is XwKx3mWB9ncJo5ZudqyEZ1MoQWMSmE3CwP
is there anything to do to block that wallet adress? before he move it somewhere else and sell ?

 The ONLY way I can see that someone could do that is if you left the RPC port open in firewall and the rpcuser and rpcpassword was really easy. Even then they would have to know the password that you encrypted the wallet with. Did you maybe use the same password for rpcuser and the password you used to encrypt the wallet? Are you running apache on the server and maybe the user that you started apache with has read access to the directory where you conf file is? Need more info

thank you very much for the help over skype, it seems that the hacker could enter my vps, don't know how exactly but he did
he will post on darkcointalk some advice and tips to not have the same issue as me

if someone can help me in any way please send some tip on my darkcoin wallet
XhGwaKJPMdqEyMU85QBReNNMzVGKDW2EPz

[camosoul]

If someone had their masternode coins stolen it was probably due to poor security on their box.

With almost 400 masternodes I'd be shocked if someone didn't have their coins stolen.

For people's peace of mind, I still think the private keys should never need to touch the masternode. All thats needed to validate ownership of coins is a signed message. The user should be able to sign a message using Darkcoin QT on an offline computer and then transfer the signed message to the masternode using a USB drive. This signed message contains all the proof that the network needs for authorizing the masternode to receive dividends and process darksends.

The point of doing masternodes this way is to weed out people who have no business supporting a mission-critical targeted service... If you don't know how to protect your box, then you shouldn't be doing it. But, greeds drives people to do stupid things they haven't the skills to handle... It's rampant in corporate IT. NEver want to spend money to do it right, just spend enough to make it barely work...

[camosoul]

So why 20% fees for masternode payments? This essentially will create twice as many nodes and create a much higher cost to spy on the network. It also creates a larger feedback loop for the price (because as darkcoin is taken out of the supply, it drives the price up), which is good for all of the investors and security of DarkSend. Miners will get less coin, but it's been proven time and time again that when you decrease the coins generated the price will just go up to meet the cost of mining.

Avoid multiple tickets for masternodes. It will reduce number of nodes making the system less resilient.

No! Forcing people to manage over 2 dozen separate boxes only generates orders of magnitude more opportunities for human error. Too much of a good thing. I'd rather have one node hardened as hell becasue it's holding a million in DRK. Watch to see how often a node gets elected to know how much is in it.. Only adds that much more incentive to make sure people are securing the nodes and thus securing the network. We've already got somebody who was sloppy enough to get robbed... Maybe they'll start taking it more seriously when they can put 50,000 drk in one node, eh?

Most importantly, miltu-entry to vote pool doesn't mean you're REQUIRED to go that way... You can still do all the VMs you want with 1000DRK each. This just creates the option to consolidate, it doesn't require it.

There have also been concerns levied about there being too many masternodes. Too many chiefs and not enough indians.

[Propulsion]

That is not what I mean. I edited my previous post to be more clear.

As I currently understand Evan's plan:

Network pays pool 100% of reward - pool must split reward 80/20 - 80% to miners, 20% to masternode

Are you are saying a dishonest pool can't break this system?  Or I am misunderstanding what Evan proposed.

There were originally two strategies for masternode payments. One requires a hardfork and one doesn't. I originally decided to do the one that does, because you can't cheat as a pool operator. But, that comes with a price. The code must reject cheating blocks and that's what caused the forking issue.

The other way is to setup the client to pay nodes in a provably fair way. If the pool doesn't pay the correct amount to the correct node, we'll know and we'll shame them. We'll get miners to move to honest pools.

Like others have suggested, all of the groundwork has been laid. I have implemented the masternodes, the election system for payments and it's compatible with this soft fork.

So why 20% fees for masternode payments? This essentially will create twice as many nodes and create a much higher cost to spy on the network. It also creates a larger feedback loop for the price (because as darkcoin is taken out of the supply, it drives the price up), which is good for all of the investors and security of DarkSend. Miners will get less coin, but it's been proven time and time again that when you decrease the coins generated the price will just go up to meet the cost of mining.

My goal with Darkcoin has always been to take the #2 spot from Litecoin. I believe we have the best chance we've ever had now and these changes will actually help realize that goal.

As for my communication? Lately I've just had my nose to the grindstone, coding all of the time. I intend to be much more involved with the community in the future. This will include getting a team of software developers and managing the vision of the project. I think my time might be better spent in the future doing interviews, speaking at conferences and being Darkcoin's figurehead.

With a non hard fork for the time being yes it would be possible for a pool to cheat.

[camosoul]

I'm getting an odd problem with my client.

Every time I try to send, it alters the amount to 0 and erases the address, calls it a send to self of 0DRK and still shows confirms... Damn strange.

Restarted client. Now different effect...

Only applies to using darksend. regular send works fine.

Waiting for entries 1/3. Stays that way until a block pops, then says idle and poof, like the darksend attempt never happened... Absolutely no log output in regard to it.

I'm not even sure where to look... Fuckin' weird...

Now spontaneously back to "payment to yourself" shit... Address is definitely not mine...

Darksend is just plain broken.

It just timed out while waiting for other inputs. Nothing ended up being sent anywhere, that's all. Working as intended within beta limitations.

I suspected as much. But, every single attempt times out. Even when I start immediately after a block pops. It enver gets done by the time the next block comes. Just not enough people using it with the 10DRK limit.

The reversion to the oddball self send thing after failing several times is odd tho. Hope it's just an odd uncaught exception, not resulting in some crazy stack failure granting root...

[camosoul]

If someone had their masternode coins stolen it was probably due to poor security on their box.

With almost 400 masternodes I'd be shocked if someone didn't have their coins stolen.

For people's peace of mind, I still think the private keys should never need to touch the masternode. All thats needed to validate ownership of coins is a signed message. The user should be able to sign a message using Darkcoin QT on an offline computer and then transfer the signed message to the masternode using a USB drive. This signed message contains all the proof that the network needs for authorizing the masternode to receive dividends and process darksends.

That's a really good point.  Excuse my ignorance though, doesn't this run into the issue of "proving" that the 1000 DRK existed at that address at the moment in time that the node is being used?  Otherwise I could just sign a message for an address, transfer to a new address, rinse and repeat.

I'd like to see masternodes simply use proof of stake on an address. Send 1000DRK to an address. Tie masternode approval to that address. If that address has 4000DRK, it gets 4 entries into voting pool. If it has 3999, it gets 3. This way the node can be managed on chain instead of on [key/VM/SSH/RPC/some guy at the datacenter grabs the hard drive], and you can still spend off of it or add to it and it will update the entry count on the fly without typing any passwords. Uses existing blockchain transaction security. Prove private key for the matching public address once. After that, remove it from the server. network watches to see if that address changes and gives it the appropriate number of votes.

I think that's very close to how it's shaping up already...

[JGCMiner]

That is not what I mean. I edited my previous post to be more clear.

As I currently understand Evan's plan:

Network pays pool 100% of reward - pool must split reward 80/20 - 80% to miners, 20% to masternode

Are you are saying a dishonest pool can't break this system?  Or I am misunderstanding what Evan proposed.

There were originally two strategies for masternode payments. One requires a hardfork and one doesn't. I originally decided to do the one that does, because you can't cheat as a pool operator. But, that comes with a price. The code must reject cheating blocks and that's what caused the forking issue.

The other way is to setup the client to pay nodes in a provably fair way. If the pool doesn't pay the correct amount to the correct node, we'll know and we'll shame them. We'll get miners to move to honest pools.

Like others have suggested, all of the groundwork has been laid. I have implemented the masternodes, the election system for payments and it's compatible with this soft fork.

So why 20% fees for masternode payments? This essentially will create twice as many nodes and create a much higher cost to spy on the network. It also creates a larger feedback loop for the price (because as darkcoin is taken out of the supply, it drives the price up), which is good for all of the investors and security of DarkSend. Miners will get less coin, but it's been proven time and time again that when you decrease the coins generated the price will just go up to meet the cost of mining.

My goal with Darkcoin has always been to take the #2 spot from Litecoin. I believe we have the best chance we've ever had now and these changes will actually help realize that goal.

As for my communication? Lately I've just had my nose to the grindstone, coding all of the time. I intend to be much more involved with the community in the future. This will include getting a team of software developers and managing the vision of the project. I think my time might be better spent in the future doing interviews, speaking at conferences and being Darkcoin's figurehead.

With a non hard fork for the time being yes it would be possible for a pool to cheat.

Ok. Well my understanding is correct then. Not the biggest fan of this solution and its compromise... let's hope that this is just temporary as his most resent post suggests.

[Kai Proctor]

That part:

If the pool doesn't pay the correct amount to the correct node, we'll know and we'll shame them. We'll get miners to move to honest pools.

...won't work. We couldn't even get the miners of coinmine to switch when they were >51% because they were getting consistency and low variance (compared to the official which was DOS'ed).

The days of 2-3 pools also seem to be over: http://drk.poolhash.org/poolhash.html

The pie chart is revealing.

Just use hard fork and another system of election/payment that doesn't affect network stability. "Honest pools" won't work. Guaranteed.

They can even offer bigger rewards (the non distributed DRK) to make the miners stay.

[Propulsion]

That part:

If the pool doesn't pay the correct amount to the correct node, we'll know and we'll shame them. We'll get miners to move to honest pools.

...won't work. We couldn't even get the miners of coinmine to switch when they were >51% because they were getting consistency and low variance (compared to the official which was DOS'ed).

The days of 2-3 pools also seem to be over: http://drk.poolhash.org/poolhash.html

The pie chart is revealing.

Just use hard fork and another system of election/payment that doesn't affect network stability. "Honest pools" won't work. Guaranteed.

They can even offer bigger rewards (the non distributed DRK) to make the miners stay.

Right. Shaming them might actually achieve the reverse effect and make the pool bigger.

If it's only hurting others indirectly, aka the MN users, then as a miner, I would go where the largest block reward is.

[AlexGR]

So why 20% fees for masternode payments? This essentially will create twice as many nodes and create a much higher cost to spy on the network. It also creates a larger feedback loop for the price (because as darkcoin is taken out of the supply, it drives the price up), which is good for all of the investors and security of DarkSend. Miners will get less coin, but it's been proven time and time again that when you decrease the coins generated the price will just go up to meet the cost of mining.

Avoid multiple tickets for masternodes. It will reduce number of nodes making the system less resilient.

No! Forcing people to manage over 2 dozen separate boxes only generates orders of magnitude more opportunities for human error. Too much of a good thing. I'd rather have one node hardened as hell becasue it's holding a million in DRK. Watch to see how often a node gets elected to know how much is in it.. Only adds that much more incentive to make sure people are securing the nodes and thus securing the network. We've already got somebody who was sloppy enough to get robbed... Maybe they'll start taking it more seriously when they can put 50,000 drk in one node, eh?

Maintenance-wise it's a no brainer. 1 beats 50 every day. But for network centralization and resilience, no. You can't have both. It's binary. Either one or the other. And 50 is always more decentralized than 1.

Think of the DDOS vector: If someone wanted to take all the payments to their nodes, they'd only have to DDOS a very few number of multi-ticket masternodes. And fuck the payments, if they wanted to map transactions, they'd only have to bring down the honest nodes and keep online the bad actors. Their job is far easier in this way.

[Propulsion]

So why 20% fees for masternode payments? This essentially will create twice as many nodes and create a much higher cost to spy on the network. It also creates a larger feedback loop for the price (because as darkcoin is taken out of the supply, it drives the price up), which is good for all of the investors and security of DarkSend. Miners will get less coin, but it's been proven time and time again that when you decrease the coins generated the price will just go up to meet the cost of mining.

Avoid multiple tickets for masternodes. It will reduce number of nodes making the system less resilient.

No! Forcing people to manage over 2 dozen separate boxes only generates orders of magnitude more opportunities for human error. Too much of a good thing. I'd rather have one node hardened as hell becasue it's holding a million in DRK. Watch to see how often a node gets elected to know how much is in it.. Only adds that much more incentive to make sure people are securing the nodes and thus securing the network. We've already got somebody who was sloppy enough to get robbed... Maybe they'll start taking it more seriously when they can put 50,000 drk in one node, eh?

Maintenance-wise it's a no brainer. 1 beats 50 every day. But for network centralization and resilience, no. You can't have both. It's binary. Either one or the other. And 50 is always more decentralized than 1.

Think of the DDOS vector: If someone wanted to take all the payments to their nodes, they'd only have to DDOS a very few number of multi-ticket masternodes. And fuck the payments, if they wanted to map transactions, they'd only have to bring down the honest nodes and keep online the bad actors. Their job is far easier in this way.

What about a trade off as in a cap of three MN's per address and/or IP.

[camosoul]

So why 20% fees for masternode payments? This essentially will create twice as many nodes and create a much higher cost to spy on the network. It also creates a larger feedback loop for the price (because as darkcoin is taken out of the supply, it drives the price up), which is good for all of the investors and security of DarkSend. Miners will get less coin, but it's been proven time and time again that when you decrease the coins generated the price will just go up to meet the cost of mining.

Avoid multiple tickets for masternodes. It will reduce number of nodes making the system less resilient.

No! Forcing people to manage over 2 dozen separate boxes only generates orders of magnitude more opportunities for human error. Too much of a good thing. I'd rather have one node hardened as hell becasue it's holding a million in DRK. Watch to see how often a node gets elected to know how much is in it.. Only adds that much more incentive to make sure people are securing the nodes and thus securing the network. We've already got somebody who was sloppy enough to get robbed... Maybe they'll start taking it more seriously when they can put 50,000 drk in one node, eh?

Maintenance-wise it's a no brainer. 1 beats 50 every day. But for network centralization and resilience, no. You can't have both. It's binary. Either one or the other. And 50 is always more decentralized than 1.

Think of the DDOS vector: If someone wanted to take all the payments to their nodes, they'd only have to DDOS a very few number of multi-ticket masternodes. And fuck the payments, if they wanted to map transactions, they'd only have to bring down the honest nodes and keep online the bad actors. Their job is far easier in this way.

Point taken. But we're not talking about consolidating holders. You and I will not pool our DRK and make a node. You'll run yours how you see fit and I'll run mine as I see fit. If my 50,000DRK node gets DDoSed, then that's 50 entries you don't have to contend with for an hour or so. Do I care when I'm getting 50 entries while I'm NOT getting DDoSed? My bigass node is just one node. The network will be glad to see me disappear for a while. ;-)

As with government scrutiny in other places, I love being the big shiny target they can't really hit. It lets all the other people scurry around unnoticed... If I'm pulling odds on 50 entries a block, and get DDoSed for an hour or so, I don't care, and that means everyone else can relax, while also getting better odds...

[Ozziecoin]

Anyone who wants to set up masternodes but doesn't know how, just post what youre doing in this thread, me and others will help you for free. Or go in the irc room and people will help you there to, its not hard.

Sleepyx and others happy to help people who want to set one up for free.  Good if you know linux. Else, I do it for you for 10 Drks.

If anyone wants me to setup a Masternode for them, PM me.

If you want more than 3 MNs, it will be 8 drks each. More than 10, I'll do for 5 Drks each. More than 25, we should do a deal.

If you're worried about security, you keep your own wallet encryption passphrase secret. I never need to know it.  The passphrase cannot be hacked if more than 15 strings.  

You then change your server password. And I'll show you how to lock down your server.  

We will NEVER EVER install a keylogger or any malware on your fresh Ubuntu server. We make an honest living. You can do checks after the install, to ensure no malware.

If you're truly paranoid, contact DyslexicZombei and he may be able to do further hardening steps (note: we do not warrant their work). MN count increased to 375 from 371 yesterday.

Why setup a Masternode you ask?

Now, with the new 20% of block reward payment to MNs (starting from June 14th), below are the new estimated ROIs, (Masternode count on left and ROI on right):

374 = 56% p.a. (current Masternode count)
500 = 42% p.a.
750 = 28% p.a.
1000 = 21% p.a.
1500 = 14% p.a.
2000 = 10.5% p.a.

This is based on the price in Darks (or the USD/BTC at the time you buy the Darks to setup the Masternodes and assumes the price in USD/BTC does not change). You need 1000 Darks per Masternode.

Therefore, in time the system could level out to between 2000 and 4000 MNs for a 5 to 10% annual return.  However, this implies 2 to 4 Million darks, which is 50 to 93% of current coin supply.  This also implies the price of Darks are likely to rise, if people kept trying to setup MNs.

So get your MN setup and get regular income starting June 14!  This is a solid opportunity in my view.  I've setup 5 MNs already.

[Kai Proctor]

That part:

If the pool doesn't pay the correct amount to the correct node, we'll know and we'll shame them. We'll get miners to move to honest pools.

...won't work. We couldn't even get the miners of coinmine to switch when they were >51% because they were getting consistency and low variance (compared to the official which was DOS'ed).

The days of 2-3 pools also seem to be over: http://drk.poolhash.org/poolhash.html

The pie chart is revealing.

Just use hard fork and another system of election/payment that doesn't affect network stability. "Honest pools" won't work. Guaranteed.

They can even offer bigger rewards (the non distributed DRK) to make the miners stay.

Right. Shaming them might actually achieve the reverse effect and make the pool bigger.
If it's only hurting others indirectly, aka the MN users, then as a miner, I would go where the largest block reward is.

We may face a free-rider problem by expecting someone to pay voluntarily for a service, he let the others pay and benefits from it for free. That's why taxes exist.

[solo20]

question I download the new wallet and my coins are not showing up and my old addresses are gone how do I fix this I have my back up dat file but the wallet is not seeing it do I need to delete the block change

[camosoul]

Anyone who wants to set up masternodes but doesn't know how, just post what youre doing in this thread, me and others will help you for free. Or go in the irc room and people will help you there to, its not hard.

Good if you know linux. Else, I do it for you for 10 Drks.

Me no like! Pay the pain to NOT learn? No! No way am I spending money and still not know how to manage it myself. There is no substitute for learning.

An IP-Tables how-to and a ridiculous RPC password are all you really need. Even a noob should be able to sort that out if they apply themselves. If they don't it's essentially an unmanaged masternode... I don't want my Darksends passing on a clueless node...

[camosoul]

question I download the new wallet and my coins are not showing up and my old addresses are gone how do I fix this I have my back up dat file but the wallet is not seeing it do I need to delete the block change

Is the wallet.dat in the right folder? Did you delete EVERYTHING except your wallet.dat and darkcoin.conf from that folder first?

[AlexGR]

Point taken. But we're not talking about consolidating holders. You and I will not pool our DRK and make a node. You'll run yours how you see fit and I'll run mine as I see fit. If my 50,000DRK node gets DDoSed, then that's 50 entries you don't have to contend with for an hour or so. Do I care when I'm getting 50 entries while I'm NOT getting DDoSed? My bigass node is just one node. The network will be glad to see me disappear for a while. ;-)

As with government scrutiny in other places, I love being the big shiny target they can't really hit. It lets all the other people scurry around unnoticed... If I'm pulling odds on 50 entries a block, and get DDoSed for an hour or so, I don't care, and that means everyone else can relax, while also getting better odds...

If there are like 10 multi-ticket nodes of 20k dark each instead of 200x1k, it's not that you'll go down and I'll stay up to take the profit. We'll both be eliminated. The less nodes we are, the less force they require to take us all down.

What about a trade off as in a cap of three MN's per address and/or IP.

That could work.

[HiddenDark]

question I download the new wallet and my coins are not showing up and my old addresses are gone how do I fix this I have my back up dat file but the wallet is not seeing it do I need to delete the block change

You need to navigate to here C:\Users\USER\AppData\Roaming\DarkCoin (I'm assuming your on Windows) and re[[lace the wallet.dat with the one you backed up.

[camosoul]

Point taken. But we're not talking about consolidating holders. You and I will not pool our DRK and make a node. You'll run yours how you see fit and I'll run mine as I see fit. If my 50,000DRK node gets DDoSed, then that's 50 entries you don't have to contend with for an hour or so. Do I care when I'm getting 50 entries while I'm NOT getting DDoSed? My bigass node is just one node. The network will be glad to see me disappear for a while. ;-)

As with government scrutiny in other places, I love being the big shiny target they can't really hit. It lets all the other people scurry around unnoticed... If I'm pulling odds on 50 entries a block, and get DDoSed for an hour or so, I don't care, and that means everyone else can relax, while also getting better odds...

If there are like 10 multi-ticket nodes of 20k dark each instead of 200x1k, it's not that you'll go down and I'll stay up to take the profit. We'll both be eliminated. The less nodes we are, the less force they require to take us all down.

What about a trade off as in a cap of three MN's per address and/or IP.

That could work.

I refer back to; nobody is forcing you to consolidate your nodes. There are merits to both. Put all options on the table and let operators choose.

Aren't they supposed to be behind I2P at some point? The enables the opportunity to reverse proxy, like cloudflare does to banhammer DDoSers. I already know how to chain .onions like that.