Bitcoin Core 0.16.3 Released

[Icon]

what i thought had happen is they compile the file do a sha256 hash on it to verify the file integrity and post the file and the sha256 hash on the same site, we download the file and re run the same sha256 hash on and verify the hash to make sure they match is what i thought was happening. Meaning any hacker could do the same. Hack the file rehash output and post on the site.

That is why i was saying don't place the key/file in same location.

Icon

[1715379823]

1715379823

[1715379823]

1715379823

[1715379823]

1715379823

[1715379823]

1715379823

[1715379823]

1715379823

[1715379823]

1715379823

[Rabinovitch]

Virustotal says:



 

Dr.Web on my Windows PC swears too on this file...

So as 360 Total Security does not like "bitcoin-0.16.3-win64-setup.exe" file. It found 2 viruses after installation of this new version.

SHA-256 checksums are OK in both cases.

[Lauda]

-snip-
It found 2 viruses after installation of this new version.

Those are not viruses, those are false positives. Most AV programs are essentially scams FYI.

[achow101]

Virustotal says:

-snip-

 

Dr.Web on my Windows PC swears too on this file...

So as 360 Total Security does not like "bitcoin-0.16.3-win64-setup.exe" file. It found 2 viruses after installation of this new version.

SHA-256 checksums are OK in both cases.

It's a false positive. Antivirus software frequently false positive on Bitcoin Core because it contains code that is found in malware. Namely, it looks for and opens a wallet.dat file (because it is the thing that makes it in the first place and uses it for your wallet), and it contains bitcoin mining code (it does, but that can only be used on regtest). However, many coin stealing malware look for a wallet.dat file. And other malware will mine cryptocurrencies without you knowing. Since Bitcoin Core can do both of those things, it is usually flagged as being malware when it really is not.

[gmaxwell]

Please report the malware false positive.  False positives have also happened because there have been several public campaigns in an altcoin forum to report the bitcoin software as malware.

[achow101]

There was actually more to the bug than just a DoS vulnerability. It allowed for inflation. Users MUST upgrade now.

Full disclosure is available here: https://bitcoincore.org/en/2018/09/20/notice/

The reason this has been disclosed after such a short notice is because someone has independently discovered these vulnerabilities and posted about them publicly on Hacker News.

[vit05]

There was actually more to the bug than just a DoS vulnerability. It allowed for inflation. Users MUST upgrade now.

Full disclosure is available here: https://bitcoincore.org/en/2018/09/20/notice/

The reason this has been disclosed after such a short notice is because someone has independently discovered these vulnerabilities and posted about them publicly on Hacker News.

This ?

There appears to be a workaround to bypass the assert check in Bitcoin Core 0.16 that allows one to mint new coins by using an input multiple times and it be accepted by the network without crashing. Probably will be waiting until the dust settles on this before publishing that test case though, since it's clearly much more severe than a DoS

[achow101]

This ?

There appears to be a workaround to bypass the assert check in Bitcoin Core 0.16 that allows one to mint new coins by using an input multiple times and it be accepted by the network without crashing. Probably will be waiting until the dust settles on this before publishing that test case though, since it's clearly much more severe than a DoS

Yes

[achow101]

Sorry I don't understand, I'm having trouble updating to bitcoin core version 0.16.3. what if I don't update to that version?

Then you are at risk of being attacked and could possibly accept an invalid block. You could be made to believe that some coins exist which do not actually exist. You are at risk of being defrauded if you perform any transactions. You are at risk of being forked onto a different blockchain than the rest of the Bitcoin network.

does it affect my comments?

This question does not make sense.

[franky1]

can all core fans now admit core are not perfect and diverse teams of multiple code bases all on the network as a consensual level playing field would have been beneficial than the monarchy core has became

expect drama similar to last years assert() but this time core being on the receiving end
and may core react as the opposite side of the argument of last years assert() drama last year

its time the community admit, its time to diversify the network and release core from a leadership(reference) position

diversity + distribution = decentralised network
distribution alone does not = decentralisation

(expect my post to get deleted as its not core friendly)

[HostFat]

Awemany - Discovery and disclosure author (Bitcoin Cash developer)
https://medium.com/@awemany/600-microseconds-b70f87b0b2a6

[Lauda]

Awemany - Discovery and disclosure author (Bitcoin Cash developer)
https://medium.com/@awemany/600-microseconds-b70f87b0b2a6

And it is already being used by this idiot to spread propaganda:

I have consistently and repeatedly criticized hubris and arrogance in the most prominent Core developers, and done so since 2013, when the bullshitting around the 1MB block size limit started. Here we have an optimization that talks about avoiding “duplicate” validation like validation is nothing to worry about, an afterthought in Bitcoin almost.

The fact that I could have gone and rented hash power and shorted BTC and exploited this. But also the fact that I did not!

We should thank him for not breaking the law?
He can't face the fact that he is significantly less competent than even the least competent Core developers. That's his problem. He's a sad, bitter and definitely pathetic, developer (based off of this article) who got a little lucky.

[HostFat]

We should thank him for not breaking the law?

No, because code is law on cryptocurrencies.

[franky1]

firstly some do not wish to protect and defend the network, some only wishes to protect a team of developers
i find it funny in that regard as the proof is clear when you look at some attitudes about the assert ddos bug of yesteryear compared to the block ddos assert bug this year.

neither of which did some sound like network defending arguments.. but sounded like arguments to why some want to hug a core dev and smother them with affection

one day, its been 3 years so far some will learn about the the network concepts of consensus and decentralisation that have become lost, and hopefully learn that when devs retire the network should live on and that caring about a certain dev is a meaningless pursuit as it does not help the network

if people cared for the network more than a certain dev. they too would actually want
diversified codebases in consensus and decentralised
instead of a
monarchy 'reference' codebase and distribution.
as the two concepts are vastly different


but hey. some has a long way to go yet. and many have tried reminding them to learn about the network and code protocols but stil see some only reply protecting developers


*i removed names in replacement for 'some' to avoid the auto reply of the ad-hom buzzword, of which has been a over utilised defensive argument to avoid addressing the content about caring for the network more than a developer point of my post. if anyone feels that 'some' equals them. than do not reply just realise that they have just confirmed to themselves that they care more about a developer than the network and thus no point trying to reply to sway that argument. as replying is just confirming it more. i also greyed out this statement to ensure some really concentrate on the care of the network content of which we should all want diverse codebases instead of a monarchy codebase. rather than have some reply only to rply with persona attack defense posts that distract the point about the network

[Wind_FURY]

if people cared for the network more than a certain dev. they too would actually want
diversified codebases in consensus and decentralised
instead of a
monarchy 'reference' codebase and distribution.
as the two concepts are vastly different

but hey. some has a long way to go yet. and many have tried reminding them to learn about the network and code protocols but stil see some only reply protecting developers

Then why don't you start developing your own implementation or start running one of the other implementations available? I heard Mircea Popescu's "The Real Bitcoin" is the closest to "Satoshi's Bitcoin".

Plus we care enough for the network to support the best developers. But they are human, and maybe they also deserve some criticism for leaving a bug unseen for that long. It should also be taken as a sign that smart developers like you, franky1, should keep an eye on the code.

Please report the malware false positive.  False positives have also happened because there have been several public campaigns in an altcoin forum to report the bitcoin software as malware.

[franky1]

Or at least actively support/promote another implementation/client

that has been tried for years by other teams that wanted a united network of multiple implementations (not altcoins)
all using real consensus to activate their proposals or just plodding along.. using current consensus rules if no majority preference is seen... not using mandatory bilateral split bips

end result were endless REKT campaigns and 'go F**k off, and "your not wanted here" statements
(ill let you decide if ** = UC or OR)

having the mindset that xt, classic, bu and (as theymos shows in other topic) btcd and other implementations should not run on the network.. shows how defensive and core cuddling some people are.

i did find it funny that theymos in the midst or a core bug was still saying other nodes that did not have the bug, were buggy..

[franky1]

i did try to keep this topic away from certain people replying. but that certain kitty in sunglasses must not have read the grey writing

anyway, moving on

if people cared for the network more than a certain dev. they too would actually want
diversified codebases in consensus and decentralised
instead of a
monarchy 'reference' codebase and distribution.
as the two concepts are vastly different

but hey. some has a long way to go yet. and many have tried reminding them to learn about the network and code protocols but stil see some only reply protecting developers

Then why don't you start developing your own implementation or start running one of the other implementations available?
Plus we care enough for the network to support the best developers. But they are human, and maybe they also deserve some criticism for leaving a bug unseen for that long. It should also be taken as a sign that smart developers like you, franky1, should keep an eye on the code.

i do read and review their code. but my interest is more in looking for issues that change the bitcoin networks purpose. not to debug a codebase i do not use

i have though informed them of bugs before. i can even remember achowe and myself arguing for months about the 'anyone can spend' issue pre segwit if using segwit transactions before activation
and eventually and funnily enough. core eventually without admission succumbed to the realisation and they done a work around by not letting people actually make a segwit formatted tx until weeks after it was activated. to ensure the issue i addressed would not occur. (though he will not admit remembering such conversations nor my input had any impact on that workaround yet forum post dates and quotes can be found)
its also why segwit would have only worked with 100% segwit compliance instead of their weak 35% flag.. but thats been discussed endlessly in other topics about their methods of getting 100% compliance

so moving on

 i personally do run my own node and it has not crashed and does not have that bug and it's my own code. because i did not use c++, thus i did not just copy and paste it from core.
it was wrote from scratch and does validate transactions and does validate blocks and relays transactions and blocks but i say this
(pre-empting  standard core defence replies)
 it is not xt,classic,bu, abc based either. nor am i part of the cash group.
i am independent and believe in a diverse network of multiple teams that use consensus as it should be used
certain some who again are defending core by thinking diverse codebases being on the same network are the enemy. will not tolerate such sacrilegious code. so i just use it for myself, happily

again lets keep this about the network diversity and not the picking of names and insulting (i know, they poked the bear and i bit. but lets get back to concentrating on the matter at hand)
edit to avoid spam but address the comment below ill repeat whats already been said:
certain some who again are defending core by thinking diverse codebases being on the same network are the enemy. will not tolerate such sacrilegious code. so i just use it for myself, happily

that has been tried for years by other teams that wanted a united network of multiple implementations (not altcoins)
all using real consensus to activate their proposals or just plodding along.. using current consensus rules if no majority preference is seen... not using mandatory bilateral split bips

end result were endless REKT campaigns and 'go F**k off, and "your not wanted here" statements
(ill let you decide if ** = UC or OR)

having the mindset that xt, classic, bu and (as theymos shows in other topic) btcd and other implementations should not run on the network.. shows how defensive and core cuddling some people are.

[Lauda]

i personally do run my own node and it has not crashed and does not have that bug and it's my own code. because i did not use c++, thus i did not just copy and paste it from core.
it was wrote from scratch and does validate transactions and does validate blocks and relays transactions and blocks but i say this

If it was based on any newer Core version it would have the bug. Sounds like you are clearly lying. Where is this magical implementation? If you were pro-diversity, you'd publish the code. Hint: You aren't; you are just a pathetic troll.
Wind_FURY please stop indulging the idiot.

[franky1]

Bitcoin có được lưu trữ trong ví Core không?
Tôi có nghĩa là nâng cấp như thế nào là khẩn cấp, không ai có thể truy cập khóa riêng tư của tôi đúng không?

question translated:
Is Bitcoin stored in the Core wallet?
I mean how is the upgrade as urgent, no one can access my private key properly?

answer:
Bitcoin is stored on the blockchain. Your wallet is for your private key.
bitcoin-core is software that connects two parts

This error does not affect your wallet.

If people need to upgrade but not upgrade then. If a mining exploit block occurs, they will get it and send it to someone causing the problem to some people.

If no one is vulnerable to software attacks. Then an exploited block is ignored by everyone


If a block uses malicious exploits:
This error can cause any new transaction to appear as confirmation and then not confirmed.
As well as the ability to create more fake btc appear,
but only if someone can exploit a block and only lasts until the exploited blocks are deleted.

answer translated:
Bitcoin được lưu trữ trên blockchain. Ví của bạn là dành cho khóa riêng của bạn.
bitcoin-core là phần mềm kết nối hai phần

Lỗi này không ảnh hưởng đến ví của bạn.


Nếu mọi người cần nâng cấp nhưng không nâng cấp thì. Nếu một khối khai thác khai thác xảy ra, họ sẽ nhận được nó và gửi nó cho ai đó gây ra vấn đề cho một số người.

Nếu không ai dễ bị tấn công phần mềm. Sau đó, một khối bị khai thác bị bỏ qua bởi tất cả mọi người

Nếu một khối sử dụng khai thác độc hại:
Lỗi này có thể khiến bất kỳ giao dịch mới nào xuất hiện dưới dạng xác nhận và sau đó không được xác nhận.
Cũng như khả năng tạo thêm btc giả mạo xuất hiện,
nhưng chỉ khi ai đó có thể khai thác một khối và chỉ cho đến khi các khối bị khai thác bị xóa.

(excuse any broken vietnamese i speak english and used google translate to vietnamese)

[pooya87]

Or at least actively support/promote another implementation/client

that has been tried for years by other teams that wanted a united network of multiple implementations (not altcoins)
all using real consensus to activate their proposals or just plodding along.. using current consensus rules if no majority preference is seen... not using mandatory bilateral split bips

end result were endless REKT campaigns and 'go F**k off, and "your not wanted here" statements
(ill let you decide if ** = UC or OR)

having the mindset that xt, classic, bu and (as theymos shows in other topic) btcd and other implementations should not run on the network.. shows how defensive and core cuddling some people are.

i did find it funny that theymos in the midst or a core bug was still saying other nodes that did not have the bug, were buggy..

these two are completely different arguments though.
implementations such as XT, classic,... were planning on enforcing (eventually) different consensus rules and they were created because certain people didn't want SegWit and wanted bigger blocks. if there were no SegWit or bigger blocks then these implementations wouldn't have existed at all. that is one thing. not to mention that they were forks (copies) of bitcoin core so that is not even related to this discussion because technically since they copied the code they would have had the same bugs.

another thing which is what @ETFbitcoin is talking about is having other clients that do enforce and continue to enforce the same consensus rules. there currently are other implementations. it is not like they don't exist at all but not many use them.