[XMR] Monero - A secure, private, untraceable cryptocurrency

[cAPSLOCK]

Interesting news in the privacy sector.  However, I kinda wish VB would fall off a freaking cliff..  I am tired of that clown.

https://cointelegraph.com/news/researcher-breaks-grins-privacy-spending-just-60-per-week

[1713516607]

1713516607

[1713516607]

1713516607

[1713516607]

1713516607

[Hueristic]

Interesting news in the privacy sector.  However, I kinda wish VB would fall off a freaking cliff..  I am tired of that clown.

https://cointelegraph.com/news/researcher-breaks-grins-privacy-spending-just-60-per-week

Last time I was a picture of him he looked like a MethHead with Aids.

[Deathwing]

So I have been looking around but wasn't able to find an answer for it on Reddit and some other site on the internet. When exactly does the fork happen for the RandomX (RX) mining algorithm? I read it is coming with the v0.15 update but considering that the CLI has already released and the only thing required is a GUI update, does this mean that the algorithm will switch when the GUI update is released?

[smooth]

So I have been looking around but wasn't able to find an answer for it on Reddit and some other site on the internet. When exactly does the fork happen for the RandomX (RX) mining algorithm? I read it is coming with the v0.15 update but considering that the CLI has already released and the only thing required is a GUI update, does this mean that the algorithm will switch when the GUI update is released?

The fork to RandomX will happen around November 30, block height 1978433

[akhjob]

Looks like the CLI binaries available at getmonero.org has been compromised and the users are advised to check the integrity of the binaries they download.

Some users noticed the hash of the binaries they downloaded did not match the expected one: https://github.com/monero-project/monero/issues/6151
It appears the box has been indeed compromised and different CLI binaries served for 35 minutes. Downloads are now served from a safe fallback source.

Always check the integrity of the binaries you download!

If you downloaded binaries in the last 24h, and did not check the integrity of the files, do it immediately. If the hashes do not match, do NOT run what you downloaded. If you have already run them, transfer the funds out of all wallets that you opened with the (probably malicious) executables immediately, using a safe version of the Monero wallet (the one online as we speak is safe -- but check the hashes).

More information will be posted as several people are currently investigating to get to the bottom of this.

Correct hashes are available here (check the signature): https://web.getmonero.org/downloads/hashes.txt

source: https://amp.reddit.com/r/Monero/comments/dyfozs/security_warning_cli_binaries_available_on/

[MATHReX]

Looks like the CLI binaries available at getmonero.org has been compromised and the users are advised to check the integrity of the binaries they download.

source: https://amp.reddit.com/r/Monero/comments/dyfozs/security_warning_cli_binaries_available_on/

Oh, that is crazy! Thank you for the update.
How is something like this even possible?
I downloaded the wallet a while ago in my PC with Ryzen 7 1700 to be ready for RandomX.
Anyway, the checksum matches as I downloaded directly from the GitHub releases.

[Hueristic]

As far I can see, it doesn't seem to create any additional files or folders - it simply steals your seed and attempts to exfiltrate funds from your wallet.

https://bartblaze.blogspot.com/2019/11/monero-project-compromised.html

[StonerStanley]

which vulnerability has been used to hack the website ?

[dEBRUYNE]

GUI v0.15.0.1 'Carbon Chamaeleon' released!

https://www.reddit.com/r/Monero/comments/e0j98n/gui_v01501_carbon_chamaeleon_released/


CLI v0.15.0.1 'Carbon Chamaeleon' released!

https://www.reddit.com/r/Monero/comments/e0j5s1/cli_v01501_carbon_chamaeleon_released/

[Millionero]

I use linux 64 bit cli only.
Going through the ridiculously complicated verification procedure now.
Just finished section 3.2 of these instructions:
https://src.getmonero.org/resources/user-guides/verification-allos-advanced.html
Section 4, download and verify binary, directs you to get the file via command line

Code:

wget -O monero-linux-x64-v0.12.0.0.tar.bz2 https://downloads.getmonero.org/cli/linux64

But after executing the command, I notice it's version 12.0.0.  So is the correct command actually

Code:

wget -O monero-linux-x64-v0.15.0.1.tar.bz2 https://downloads.getmonero.org/cli/linux64

?
And where did the file go, if it's not in the downloads folder?
I just did the point-and-click download of the cli file from the getmonero.org website
and monero-linux-x64-v0.15.0.1.tar.bz2 appears in the downloads folder.
So I am going to go back and do the command

Code:

wget -O monero-linux-x64-v0.15.0.1.tar.bz2 https://downloads.getmonero.org/cli/linux64

continue following the instructions, and hope for the best I suppose.

Code:

a@galliumos:~$ shasum -a 256 monero-linux-x64-v0.15.0.1.tar.bz2
8d61f992a7e2dbc3d753470b4928b5bb9134ea14cf6f2973ba11d1600c0ce9ad  monero-linux-x64-v0.15.0.1.tar.bz2
a@galliumos:~$ 

And now the instructions say
Your SHA256 hash should match the one listed in the hashes.txt file for your binary file.

 Where is this file?  Yeah, I'm going to look for it, but I shouldn't have to.
Ok, scrolling back, I see that in step 3.1 I downloaded hashest.txt
It's not in downloads.  Where is it, or is somebody going to imply that I'm simply stupid for not having the answer?
I'm starting to get annoyed, and I've been involved with this coin since the very beginning, spring 2014.
Somebody needs to make monero usable or nobody's ever going to adopt this coin except total freaking nerdheads who live in bubbles.

Okay, since I don't know where my hashes.txt file is, I go to getmonero.org to see the hash for 15.0.1 linux cli only.  It matches the result of the shasum command, so I guess it's safe to continue.
Just one little problem.  The zip in downloads is the one I downloaded from getmonero.org through the browser.  Where is the binary that I downloaded through the cli?
Ah, I see it's in the home directory (along with 12.0.0 that I downloaded as a result of naively copy-pasting the command in the instructions, and which a less alert person might have installed unthinkingly LOL).  
And of course another stupid mistake I could make would be to use the zip which is in the downloads folder, and isn't actually verified.

So there you have a narrative of what happens when a normal human being attempts to RTFM and use monero properly.  It's not a pretty picture.

[gembitz]

I use linux 64 bit cli only.
Going through the ridiculously complicated verification procedure now.
Just finished section 3.2 of these instructions:
https://src.getmonero.org/resources/user-guides/verification-allos-advanced.html
Section 4, download and verify binary, directs you to get the file via command line

Code:

wget -O monero-linux-x64-v0.12.0.0.tar.bz2 https://downloads.getmonero.org/cli/linux64

But after executing the command, I notice it's version 12.0.0.  So is the correct command actually

Code:

wget -O monero-linux-x64-v0.15.0.1.tar.bz2 https://downloads.getmonero.org/cli/linux64

?
And where did the file go, if it's not in the downloads folder?
I just did the point-and-click download of the cli file from the getmonero.org website
and monero-linux-x64-v0.15.0.1.tar.bz2 appears in the downloads folder.
So I am going to go back and do the command

Code:

wget -O monero-linux-x64-v0.15.0.1.tar.bz2 https://downloads.getmonero.org/cli/linux64

continue following the instructions, and hope for the best I suppose.

Code:

a@galliumos:~$ shasum -a 256 monero-linux-x64-v0.15.0.1.tar.bz2
8d61f992a7e2dbc3d753470b4928b5bb9134ea14cf6f2973ba11d1600c0ce9ad  monero-linux-x64-v0.15.0.1.tar.bz2
a@galliumos:~$ 

And now the instructions say
Your SHA256 hash should match the one listed in the hashes.txt file for your binary file.

 Where is this file?  Yeah, I'm going to look for it, but I shouldn't have to.
Ok, scrolling back, I see that in step 3.1 I downloaded hashest.txt
It's not in downloads.  Where is it, or is somebody going to imply that I'm simply stupid for not having the answer?
I'm starting to get annoyed, and I've been involved with this coin since the very beginning, spring 2014.
Somebody needs to make monero usable or nobody's ever going to adopt this coin except total freaking nerdheads who live in bubbles.

Okay, since I don't know where my hashes.txt file is, I go to getmonero.org to see the hash for 15.0.1 linux cli only.  It matches the result of the shasum command, so I guess it's safe to continue.
Just one little problem.  The zip in downloads is the one I downloaded from getmonero.org through the browser.  Where is the binary that I downloaded through the cli?
Ah, I see it's in the home directory (along with 12.0.0 that I downloaded as a result of naively copy-pasting the command in the instructions, and which a less alert person might have installed unthinkingly LOL).  
And of course another stupid mistake I could make would be to use the zip which is in the downloads folder, and isn't actually verified.

So there you have a narrative of what happens when a normal human being attempts to RTFM and use monero properly.  It's not a pretty picture.

WHAT PART OF "BREACHED BINARIES" ARE YOU FUCKED UP ABOUT?    LEL REEEEEE

[Millionero]

Holy God.  Is there no escaping this demented creature?

[dEBRUYNE]

I use linux 64 bit cli only.
Going through the ridiculously complicated verification procedure now.
Just finished section 3.2 of these instructions:
https://src.getmonero.org/resources/user-guides/verification-allos-advanced.html
Section 4, download and verify binary, directs you to get the file via command line

Code:

wget -O monero-linux-x64-v0.12.0.0.tar.bz2 https://downloads.getmonero.org/cli/linux64

But after executing the command, I notice it's version 12.0.0.  So is the correct command actually

Code:

wget -O monero-linux-x64-v0.15.0.1.tar.bz2 https://downloads.getmonero.org/cli/linux64

?
And where did the file go, if it's not in the downloads folder?
I just did the point-and-click download of the cli file from the getmonero.org website
and monero-linux-x64-v0.15.0.1.tar.bz2 appears in the downloads folder.
So I am going to go back and do the command

Code:

wget -O monero-linux-x64-v0.15.0.1.tar.bz2 https://downloads.getmonero.org/cli/linux64

continue following the instructions, and hope for the best I suppose.

Code:

a@galliumos:~$ shasum -a 256 monero-linux-x64-v0.15.0.1.tar.bz2
8d61f992a7e2dbc3d753470b4928b5bb9134ea14cf6f2973ba11d1600c0ce9ad  monero-linux-x64-v0.15.0.1.tar.bz2
a@galliumos:~$ 

And now the instructions say
Your SHA256 hash should match the one listed in the hashes.txt file for your binary file.

 Where is this file?  Yeah, I'm going to look for it, but I shouldn't have to.
Ok, scrolling back, I see that in step 3.1 I downloaded hashest.txt
It's not in downloads.  Where is it, or is somebody going to imply that I'm simply stupid for not having the answer?
I'm starting to get annoyed, and I've been involved with this coin since the very beginning, spring 2014.
Somebody needs to make monero usable or nobody's ever going to adopt this coin except total freaking nerdheads who live in bubbles.

Okay, since I don't know where my hashes.txt file is, I go to getmonero.org to see the hash for 15.0.1 linux cli only.  It matches the result of the shasum command, so I guess it's safe to continue.
Just one little problem.  The zip in downloads is the one I downloaded from getmonero.org through the browser.  Where is the binary that I downloaded through the cli?
Ah, I see it's in the home directory (along with 12.0.0 that I downloaded as a result of naively copy-pasting the command in the instructions, and which a less alert person might have installed unthinkingly LOL).  
And of course another stupid mistake I could make would be to use the zip which is in the downloads folder, and isn't actually verified.

So there you have a narrative of what happens when a normal human being attempts to RTFM and use monero properly.  It's not a pretty picture.

You don't necessarily have to use wget to download the binaries. Put differently, you can simply download the file (.tar.bz2 for Linux 64-bit in your case) from the website.

The hashes.txt file is present on the downloads page. You need to save the content to a text file on your local system.

You should check the hashes.txt file against Fluffypony's GPG key. Merely checking the SHA256 hash is not sufficient, as an adversary could replace that.

Admittedly, the guide could use an update. That being said, there is a limit to how easy verifying the GPG signed hashes can be made. However, moneromooo is working on a secure updater/installer for Monero, see:

https://github.com/moneromooo-monero/monero-update

[Millionero]

The hashes.txt file is present on the downloads page.

"Page" sounds like a website.
Again, where exactly is this hashes.txt file?

[Hueristic]

The hashes.txt file is present on the downloads page.

"Page" sounds like a website.
Again, where exactly is this hashes.txt file?

I think he means you have to grab the text and create the text file yourself. It's easy.

Dos command for n00bs on winblows:
Copy con hashes.txt [entr]
paste text here
[f6 key]


Are you trying to make it look complicated?
They can also just paste in notepad (or any "Basic text editor like TED for Dos) and save but not anything like wordpad that adds control characters.

Doesn't everyone know this stuff?


Why make it easy for n00bs when we can just shovel up a tough to check binary that's infected?
Its not like someone profited from that right?

Holy God.  Is there no escaping this demented creature?

Ignore Button?
You can also use the report button for trolling.

[Millionero]

Not helpful.

[elrippos friend]

Not helpful.

https://src.getmonero.org/resources/user-guides/verification-allos-advanced.html

Point 3.1. Get hash file

wget -O hashes.txt https://getmonero.org/downloads/hashes.txt

[Globb0]

If the file can be compromised then presumably they could compromise the hash too.

[dEBRUYNE]

The hashes.txt file is present on the downloads page.

"Page" sounds like a website.
Again, where exactly is this hashes.txt file?

See the link elrippos friend posted. The link is displayed on the downloads page.

[dEBRUYNE]

If the file can be compromised then presumably they could compromise the hash too.

Verification of the file against Fluffypony's GPG key would fail though.