BTCpay Server: A Real e-Commerce Game Changer?

[DaveF]

Since my last post in this thread it seems FixedFloat has been hacked on more than one occasion and add to that the piling up of scam accusations against them.

I would once again advise you to never use the FixedFloat plugin for your BTCPay Server or even their website as a stand alone tool to exchange your crypto because you cannot be guaranteed to receive the funds and in that case the safest thing to do would be to use an alternative.

I would avoid using any plugins with BTCPay or anything doing any kind of crypto processing. Just my view but once you start moving funds or dealing with anything like that unless you are willing do deal with any other issues that might come up the little extra revenue you are going to make is not going to be worth it.

As always just my opinion, but why go adding risk and complexity.

-Dave

[JollyGood]

This seems a reasonable approach as a precaution simply because there is a risk factor (especially after recent news of hacks at FixedFloat) but to be honest there is very complexity involved, it is a fairly simple and seamless process. Where is becomes a pain is if a customer makes a payment to a merchant using another crypto to BTC via FixedFloat/SideShift but it gets suspended until KYC is handed over or a similar scenario.

Those plugins are supposed to make life easier but sometimes they cause far more problems instead.

I would avoid using any plugins with BTCPay or anything doing any kind of crypto processing. Just my view but once you start moving funds or dealing with anything like that unless you are willing do deal with any other issues that might come up the little extra revenue you are going to make is not going to be worth it.

As always just my opinion, but why go adding risk and complexity.

-Dave

[OgNasty]

Reports that BTCPay servers are being swept by attackers. They are advising you to shut down your server if you are running BTCPay until the investigation is completed…

Stay safe!

https://x.com/btcpayserver/status/2117020340815819262?a=j4iLtBp6RRnzQXBRFSE&s=46

[RGBTC]

^^
Their identification revealed that the versions targeted in this attack are 2.4.1 and older. https://x.com/BtcpayServer/status/2117106238123123008
It seems they should make automatic updates the default for future versions.

Still, I’m curious about the total losses so far.

[NotATether]

Reports that BTCPay servers are being swept by attackers. They are advising you to shut down your server if you are running BTCPay until the investigation is completed…

Stay safe!

https://x.com/btcpayserver/status/2117020340815819262?a=j4iLtBp6RRnzQXBRFSE&s=46

There is no need to shut down the server if your store is set up with watch-only addresses, since they can't sweep cold wallets.


I did not lose any funds to this attack.

[JollyGood]

If losing funds is something that will not happen if set to watch-only then I suppose many of those operating servers will probably not feel under threat. At most, they might (and definitely should) upgrade to the latest version.

Keeping that aside, how long have you been running a server and what has been the overall experience been for you? Is there a reason why you decided to run your own BTCpay server rather than maybe a different solution?

There is no need to shut down the server if your store is set up with watch-only addresses, since they can't sweep cold wallets.


I did not lose any funds to this attack.

[NotATether]

Keeping that aside, how long have you been running a server and what has been the overall experience been for you? Is there a reason why you decided to run your own BTCpay server rather than maybe a different solution?

Yeah I didn't want to do KYC to use some other payment processor for BitMixList.

BTCPay Server works just fine for this, for alts I have the Trocador widget to let people automatically convert them to BTC and they can also pay direct XMR with the Monero plugin.

[satscraper]

Reports that BTCPay servers are being swept by attackers. They are advising you to shut down your server if you are running BTCPay until the investigation is completed…

Stay safe!

https://x.com/btcpayserver/status/2117020340815819262?a=j4iLtBp6RRnzQXBRFSE&s=46

^^
Their identification revealed that the versions targeted in this attack are 2.4.1 and older. https://x.com/BtcpayServer/status/2117106238123123008
It seems they should make automatic updates the default for future versions.

Still, I’m curious about the total losses so far.

Yesterday, I couldn’t top up either of my two crypto cards by swapping USDC to EUR. The apps showed the warning that something was wrong with the basic service. I was wondering why ^{because it was strange for me to see such warnings on two independent apps} , but now it’s clear where the shoe pinches. The card apps are now fully functional and my funds are safe. However ^{in my view} card operators reacted too late as vulnerability was discovered three days earlier.  

[JollyGood]

I remember reading about the widgets, apparently they are quite popular with those that offer multiple options to customer. Add to that the peace of mind to customers that there will be no KYC issues, it makes a viable solution for those that some technical knowledge to install it.

If you are colocating your server, do you have any reservations about engineers accessing the server? Or if you have purchased your hosting, do you have any concerns about hosting it on a third-party server?

Yeah I didn't want to do KYC to use some other payment processor for BitMixList.

BTCPay Server works just fine for this, for alts I have the Trocador widget to let people automatically convert them to BTC and they can also pay direct XMR with the Monero plugin.

[NotATether]

If you are colocating your server, do you have any reservations about engineers accessing the server? Or if you have purchased your hosting, do you have any concerns about hosting it on a third-party server?

My server is on bare metal in some data center. I do not own the data center or the server outright.

So yes, obviously the amount of information that can be obtained from a break-in is quite high, but it would be mainly source code and trade secrets - absolutely no funds are on that server.