Alternative Block Chains : be safe!

[grod]

http://en.wikipedia.org/wiki/Trojan_horse_%28computing%29

Software trojans are definitely not a myth.  Has there been a bitcoin related one yet?  Absolutely!  I forget the name, but there was some wallet stealer Windows .exe that promised vastly higher hash rates.   It uploaded wallets to an FTP site instead.

[Lolcust]

http://en.wikipedia.org/wiki/Trojan_horse_%28computing%29

Software trojans are definitely not a myth.  Has there been a bitcoin related one yet?  Absolutely!  I forget the name, but there was some wallet stealer Windows .exe that promised vastly higher hash rates.   It uploaded wallets to an FTP site instead.

No, I mean a documented case of malware propagating through distribution of alt-chains specifically ?

[grod]

AFAIK, the closest we have is that fake miner.  If you think of it as mining a bogus, non-existent vapor coin chain then yes, it qualifies.

If a technological feat is possible, man will do it. Almost as if it's wired into the core of our being.  And an alt chain mining trojan feat is not just possible but borderline trivial.  Not having happened in the 4 or 5 alt chains so far is just pure luck.

[Lolcust]

If a technological feat is possible, man will do it.  Almost as if it's wired into the core of our being.

touche

I like your style.

And an alt chain mining trojan feat is not just possible but borderline trivial.  Not having happened in the 4 or 5 alt chains so far is just pure luck.

Nah, more like this entire funny hobby of making funny alt chains  is just a really small hobby which srz bzns hackers just overlook.

[grod]

Are you sure about that?  What's a network of a few thousand high end machines with great network connectivity, on 24x7, insensitive to CPU or GPU load worth?  Doubly so with some having the keys to a few hundred to a few thousand dollars of electronic currency?

I'd say quite a bit.  It's only a matter of time -- if a big enough % of the bitcoin community is willing to download and run windows exes for every alt currency that comes along all you need is a hijacked forum account of a regular to pull it off.

[Lolcust]

Mayhaps, mayhaps.

[P4man]

Some people only have one computer and that must suck.

Fortunately a few decades ago they invented virtual machines. Now anyone can have as many computers and OSs as he likes

[d.james]

vmware is so hard to use

[DavinciJ15]

vmware is so hard to use

No it's not it's the easiest product unless you are talking about VSphere.

[P4man]

vmware is so hard to use

Virtualbox is pretty easy and works great. Its also free.

[P4man]

GPU virtualization is still pretty experimental. Most VMs virtualize some old crap GPU by default. To get hardware access to your actual GPU, in Virtualbox there is an option to do that and it works, sometimes, somewhat. TBH, I havent tried GPU mining in a VM yet, I have used it for CPU mining and then VMs are trivial. Anyone got GPU mining to work in a VM?

[DavinciJ15]

GPU virtualization is still pretty experimental. Most VMs virtualize some old crap GPU by default. To get hardware access to your actual GPU, in Virtualbox there is an option to do that and it works, sometimes, somewhat. TBH, I havent tried GPU mining in a VM yet, I have used it for CPU mining and then VMs are trivial. Anyone got GPU mining to work in a VM?

Working on it in vSphere 5, I feel I am close to getting it to work.

[mrb]

Guys, there is no point in GPU-mining in VMs!

Alternative chains with GPU-based miners are compatible with standard (trusted) miners that don't need to be virtualized. This means you only need to run the (untrusted) alternative chain app in a VM, and expose its RPC port to the network where the physical miners are running...

[chmod755]

Thanks Mr. Andresen, but I'm only running alternative clients in VMs (I'm basically selling all alt. coins for BTC asap  )

[Spacy]

BitcoinEXpress has 100.000+ of BTC. Everybody should consider this when reading BCX's comments about alt-chains 

[kano]

LOL linus - now that would be funny

Try Melbourne - Aus ...

[mystery2048]

Were really supposed the build the entire thing from source, not use windows and run it in a VM just to use an alt-coin safely? Are we supposed to audit the code ourselves too?

I dont think many people are going to do that just to use an alt-chain, and I think many of the alt-chains are safe enough, ie... Litecoin and Namecoin... I wouldnt bother...

[NASDAQEnema]

I haven't seen anybody post about what would be my biggest worry if I were trying out alternative block chains. I realize this may be perceived as "Gavin is FUD'ding anything that isn't bitcoin!"  (FUD == Fear, Uncertainty and Doubt)  But I think some of you might be forgetting some basic computer security fundamentals in the excitement to be early adopters.

When I first heard about bitcoin, my questions were:

1) Can it possibly work (do the ideas for how it works make sense)?
2) Is it a scam?
3) If it is not a scam, could it open my computer up to viruses/trojans if I run it?

LOL. Paranoid. First of all that has nothing to do with 'fear of bitcoin/altcoin/jokecoin/scamcoin'. That's standard Inner Tube safety.
If you have to mention those issues, your audience isn't tall enough for this ride.

I answered those questions by:

1) Reading and understanding Satoshi's whitepaper.  Then thinking about it for a day or two and reading it again.
2) Finding out everything I could about the project.  I read every forum thread here (there were probably under a hundred threads back then) and read Satoshi's initial postings on the crypto mailing list.
3) Downloaded and skimmed the source code to see if it looked vulnerable to buffer overflow or other remotely exploitable attacks.

That sounds like a procedure for both evaluating and IMPROVING. I still fail to see the need to mention of the 'fear factor'. Not calling you FUDmonkey, but this is kind of standard isn't it or should we require an internet driver's license?

If I were going to experiment with an alternative block-chain, I'd go through the same process again. But I'm an old conservative fuddy-duddy.

This is where we're playing games with psychology or at least it can seem so. There's a lot of ppl with internet war stories talking about scams without context (exception silly coin from the hunter of the RealSilly).

If you want to take a risk on a brand-new alternative block-chain, I'd strongly suggest that you:

1) Run the software in a virtual machine or on a machine that doesn't contain anything valuable.
2) Don't invest more money or time than you can afford to lose.
3) Use a different passphrase at every exchange site.

More boilerplate advice. It's good stuff for noobs, but come on are we still in 1990?

[kano]

Was there one except LTC that wasn't a pure scam?

[cunicula]

Was there one except LTC that wasn't a pure scam?

LTC was either scam or folly. Remember, undisclosed ability to mine with GPUs... No other additional features except the one surrounding the scam/folly.

As acknowledged by insane critics such as LukeJr, The only legitimate altcoin is PPCoin.