[GLBSE] BDK.BND (1%/week) *IN DEFAULT*

[Kluge]

KLUDGE ITS YOUR LUCKY DAY!

Yes... spies told me of your IRC posts.

I'll admit what's happened with GLBSE is pretty convenient for me. My account was hacked months ago wiping out all securities I held on there, and the last thing I did on there was make a large-ish dividend payment on BDK.BND, so all I had in there was maybe 4 or 5 coins.

It wasn't hacked.  It was Nefario helping himself.   

There were many accounts that were "hacked" on GLBSE that were managed by very safe and competent people. I honestly think Nefario was helping himself.

While it's possible, I definitely didn't have up-to-par security practices at the time. My LastPass account was compromised first. This was not long after Bitcoinica was hacked, which is what I first suspected the culprit, but believe I found I used a randomly-generated password for that.

After LastPass was compromised, the person next tried to get into my Gmail account. I don't believe there was anything compromising (well - plenty which could've humiliated me, but nothing financial, and I'm not sure why anyone would think I'd keep financial docs in my email account), though given this wasn't long after the JRO/Hermes drama, it's possible the person may've been looking for correspondence were they particularly paranoid. Were that the case, the person probably would've realized I didn't correspond with JRO & company with that address, or any address on LastPass. However, after the person got into the Gmail account, there was an activity lull for hours. It was not until I mentioned my GLBSE account hadn't been emptied, hours later, and was kind of curious about why, that it was actually compromised and emptied. I had changed my passwords far prior to it being emptied, but GLBSE didn't have login sessions expire back then, and sessions weren't logged out when I changed the password, which is just bad.

Now, while it likely wasn't Bitcoinica which had the same pw as on LastPass, I was cycling through a set of passwords back then. Sensitive financial sites usually shared one of two passwords, and though I had LastPass, only started using that recently, and didn't go through and randomize all previous passwords. It is very possible my GLBSE pw and LastPass pw were the same at that time.

I filed a complaint against the person with Amazon EC2, which I had an IP/time log of through Gmail, because the attacker originally tried to use Tor, which was blocked. Amazon EC2 Abuse got back with me indicating the user had some type of mobile service website, but didn't go into detail, and refused to unless I got the police involved or could get Gmail to verify. I tried pressing more, but they quit responding to me. I knew someone relevant in Gmail (through this forum, as it happens) who looked into whether or not he could verify the log as accurate, but it turned out that policy was to refuse assistance without a police report, which I didn't want to file because I wasn't sure how receptive they'd be to "someone stole a bunch of digital currency and securities on an questionably-legal exchange," nor what other investigations into me might result from me opening up. I did mention to Nefario that I may need logs from him in order to file with the police (which I was still internally arguing about), to which I don't believe he responded. He didn't present himself suspiciously to me, though I certainly would've appreciated him responding to calls/emails made to him before my account was emptied. Whoever did compromise the GLBSE account, however, was either exceptionally uncaring, or hateful, as they sold tons of securities for next-to-nothing, which I almost had to recognize as legitimate. However, Nefario took it upon himself to immediately lock the securities affected and reverse the transactions.

No reason to speculate on my behalf, though. It'd "fit" well in some aspects, but I certainly have no evidence. The attack was really queer for someone I'd assume would want to act quickly and quietly, so I still don't really know what to make of it. It'd be nice to have closure, if nothing else, because it still bothers me that I still have absolutely no idea why the attacker waited many hours between when he compromised the LastPass account to when he emptied my GLBSE account, and also appeared to wait for me to acknowledge he didn't empty it (or maybe he didn't realize I had an account? I never did get the logs from Nef on that, so dunno times).

[Kluge]

Working on work-arounds if I either do not receive or cannot legally act on db furnished by GLBSE. I don't know if my work-around will work, and relies on a third-party who I do not intend to discuss.

I do not intend to act on claims sent to me without me being given a current db (which I trust) of unit-holders noting a username and how many units they hold.

Here is the form I'd appreciate unit-holders sending to the email address associated with the public key:

**ENCRYPT USING GPG! PLEASE DO NOT SEND ME "NAKED" INFORMATION!! See bottom of message for public key to use.**

Code:

GLBSE username:
# of BDK units you own:
# of BDK.BND units you own:
GPG Public Key (if not signed): 
Non-Throwaway Email Address (if not associated with key and you used a throwaway address to send from): 
BTC Address to Receive Payouts: 

**ENCRYPT USING GPG! PLEASE DO NOT SEND ME "NAKED" INFORMATION!! See bottom of message for public key to use.**

Additional notes, mostly for legal reasons:
*I will not be reimbursing any dividends you may have lost on GLBSE. It is your responsibility to reclaim anything I've paid on GLBSE, not mine.
*I will be filing for a scammer tag if you write me to say you own units, and it turns out you have never owned any.
*I will pay out when I have a usable db. I am making no guarantees as to when this may be. Payouts may begin as early as tomorrow, or as late as January, 2025. I am not even necessarily guaranteeing payout -- it relies on me being provided a trusted db I can legally use.
*BDK.BND is still in default and I still do not have enough to pay everyone out in full. For "soft debt" to begin accumulating interest again, I both need to be furnished a trusted db of unit-holders, and I need unit-holders to individually verify their holdings with me. BOTH of those conditions must be met both for payout and for "soft debt" to begin accruing.
*I will publicly note when I have received a trusted db.
EDIT: If GLBSE sends me a db which already includes the information I've asked for AND I can legally act on it, I will use that, and assuming you checked that you want Issuers to receive the email & payout address you provided, it would not be necessary to also send me identical information. Basically, give info for me and hope I'm provided a db by a third party, or give info to GLBSE and hope they provide me a db, or do both and pat yourself on the back for being aggressively diligent.

Use this to encrypt messages:
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.17 (MingW32)

mQENBFB2TfYBCADNLBAjzBH0CChkaNawrDgDXK1B0RPAqK/59DAu1u/lESlL940b
kX2co0j6AwRuoy54XSWHJntIoOn0nqn2e90YKh6ysmNwORA1bzhzqktF+aMdPqBs
l6AZkXh+hcFbRO5V2ROahWJPlNf5m0IfjLbStTFPuo0OVOZq8GpRKKV0AOVWad85
oKTBFt8EwlSIWwGwuilTxGf6fPiSNKzn7mhDrf2OOANRq81pM3kg2Rhz2cK7//jw
2MWdGzVWHdFa66IZc1sK95gsBiEszP2+AyvAXxdE5CDl04FBUGItM3DHoEjXLCfZ
CLczkOMvbxlCEFLKxlCiiGIXQKx1LygRFeOVABEBAAG0GUtsdWdlIDxCZW5qbTAw
QGdtYWlsLmNvbT6JATgEEwECACIFAlB2TfYCGwMGCwkIBwMCBhUIAgkKCwQWAgMB
Ah4BAheAAAoJEDiJsITZ4Ws+Ym0H/jgBY1JA6BOg2eLc26Tg3FKdyBtOHlcLuDOZ
aLTHQtQb9ZvcA1tH8YaU/YKaf2eArQoUt5Ua3oW7kFhz4xEhwZz3xqbrVeBaehvV
86iiDowG0w8Qvy8fPTjSBrIlTzM00o5CmIQvKsRStLsOag6jzY+FK+CWcGemhocg
bIlXDAqU7RQR1TmSj6t1PJVGzBksVJeH+xmzE4sWn1jMewjGPPAcf9GARt/7cvmc
OLLYPkytOezGW+zN6jKYwfVaZg7LlxeanloqsE+nk0u7DdnwUzeZNUiuHgxH+npG
nrrqjUsbdL/MSJXrRtnlRoymKmuAqAtc8r+ZdJws2EWo2ck8Q5a5AQ0EUHZN9gEI
ALAQ326GSXHowLGuxx/cvw/VQvGK2vJI8+hTjiMIWGO6k46UMiWnRwTPCUkhlHbs
XpUzm67mDvsIkNR4iCLB4KI0XG8WbbkiLwuLcNzTIGylsC6tkfdevpFajbBP2cI8
t1SyNvMZTr4Q76ohXMrpbUY/dLekhpL3RsENTXqzBACV3R9Wa7I437YLpJgouOAf
crOT7Bo5f9UHdjUMkFdy4hYJf2U+4wWrJIJ7yPZf8nQFgmple3/ou7pqekITAHON
hqEy3krYGALcW/jV2njIjSOF9ZDppzs6ALjr8OAeJoabpJDatupDSEbr6cKZVl8P
ZiggJJmK14WWSQjOZ8kruAcAEQEAAYkBHwQYAQIACQUCUHZN9gIbDAAKCRA4ibCE
2eFrPpOiB/46uQ+eoTIczr7EzSs4FV3NNKRVJb0ouJj03vFtx/BZJbgrwAYb/NTR
wRXlfrm7/QKNuRo1Me0PRddEfVSngkZbS/wTOiqlNLCogA45wJ6cBQuUK0krGFUW
A7mJeM1uNkqC4SSzbdB4GxOPhLitk2BCe4013n5od6u5ebKfZiPhBLBi3mdGTiX/
Gw8n2tRRoAza20yRIA0XEa9p4cU2a7EQ5ebugmkndY+DUgDF/JU9kHBHzgz6G6h6
YE1tXh7rT1QzjAPNKTGihhypPdxYt9nvLaJiYNGFzo6HShb0g7lqXcX4/hc6CT99
bwL0FdeOGXTcASqpP6iQVsLPH/aww8YK
=WpYQ
-----END PGP PUBLIC KEY BLOCK-----

[bitcoinbear]

Here is the form I'd appreciate unit-holders sending to the email address associated with the public key:

How do we know which email address is associated with that public key?

[MPOE-PR]

It was not until I mentioned my GLBSE account hadn't been emptied, hours later, and was kind of curious about why, that it was actually compromised and emptied. I had changed my passwords far prior to it being emptied, but GLBSE didn't have login sessions expire back then, and sessions weren't logged out when I changed the password, which is just bad.

That's funny, because back when this was discussed Nefario wouldn't admit any wrongdoing.

How do we know which email address is associated with that public key?

http://pool.sks-keyservers.net:11371/pks/lookup?op=vindex&search=0x6160E1CAC8A3C52966FD76998A736F0E2FB7B452 <<< replace with key that interests you.

[Kluge]

Here is the form I'd appreciate unit-holders sending to the email address associated with the public key:

How do we know which email address is associated with that public key?

If using GPA, create a .txt file, enter my public key in there, save it. Open up GPA, goto "Keys"->"Import Keys" and navigate to the txt file you saved. Click "OK" on the popup and the associated email address will be displayed in your keyring.

Idunno for other clients.

[Kluge]

Monday check-in.

Have about 5% of all BDK.BND units accounted for from claim forms, 0% of BDK units, so... long while to go. Still don't have a db verifying unit-holders, so interest won't be accruing for anyone today -- it's looking unlikely that I'll receive a .csv before any other Issuers. On my repayment front, it's looking moderately possible I'll have my JRO debt purchased by Saint Anonymous in 2-3 weeks, which'd provide enough to pay back all BDK.BND-holders in one go, pay off BDK-holders in a more favorable manner than under the negative equity provision, and even pay off debts taken out to pay off debts. Wouldn't be debt-free, but at least the remaining debt wouldn't have a crushing interest rate and'd be denominated in something which consistently loses value instead of being at risk of 10% swings day-to-day.

[bitcoinbear]

Still don't have a db verifying unit-holders, so interest won't be accruing for anyone today

Why does it matter wether unit-holders have been validated? You know how many shares are out and how much you owe to each of those shares, the interest should still be accruing. It should not matter who owns the shares, they should still be earning interest until this is all sorted out.

[Rygon]

Monday check-in.

Have about 5% of all BDK.BND units accounted for from claim forms, 0% of BDK units, so... long while to go. Still don't have a db verifying unit-holders, so interest won't be accruing for anyone today -- it's looking unlikely that I'll receive a .csv before any other Issuers. On my repayment front, it's looking moderately possible I'll have my JRO debt purchased by Saint Anonymous in 2-3 weeks, which'd provide enough to pay back all BDK.BND-holders in one go, pay off BDK-holders in a more favorable manner than under the negative equity provision, and even pay off debts taken out to pay off debts. Wouldn't be debt-free, but at least the remaining debt wouldn't have a crushing interest rate and'd be denominated in something which consistently loses value instead of being at risk of 10% swings day-to-day.

Just for clarification, if this JRO debt purchase goes through, you'll be able to pay off the remaining balance of BDK.BND bonds? Assuming, of course, that you get a Database from GLBSE with bondholders who have decided to share their receiving addresses? That sounds like pretty awesome news for BDK.BND holders!

[Kluge]

Still don't have a db verifying unit-holders, so interest won't be accruing for anyone today

Why does it matter wether unit-holders have been validated? You know how many shares are out and how much you owe to each of those shares, the interest should still be accruing. It should not matter who owns the shares, they should still be earning interest until this is all sorted out.

I am unable to pay off debt due to circumstances outside my control, increasing the interest I have to pay out as I'd otherwise be paying off principal. I'm not taking the liability of interest payments due to GLBSE's failure to give me a db immediately after or prior to shutdown as any reasonable company would do. Someone may successfully sue me for lost interest, and I'll use that as a basis to sue GLBSE. Otherwise, I'm not willing to negotiate this... unless the JRO debt is purchased and I'm feeling a bit less like a wroth, selfish asshole.

@Rygon: That's right. It could be good news. It's something to hope for, but probably not to expect. It could be possible that only a portion of the debt is purchased, which'd still likely give me the ability to buy out BDK.BND as soon as GLBSE gives me the means to do so. It'd be great for everyone involved. JRO'd get a debt-holder who isn't losing his shit and sending out demand letters, I'd get back thousands of coins, BDK.BND and BDK holders get repayment relatively quick, and nobody has to touch the US "justice" system.

[bitcoinbear]

Still don't have a db verifying unit-holders, so interest won't be accruing for anyone today

Why does it matter wether unit-holders have been validated? You know how many shares are out and how much you owe to each of those shares, the interest should still be accruing. It should not matter who owns the shares, they should still be earning interest until this is all sorted out.

I am unable to pay off debt due to circumstances outside my control, increasing the interest I have to pay out as I'd otherwise be paying off principal. I'm not taking the liability of interest payments due to GLBSE's failure to give me a db immediately after or prior to shutdown as any reasonable company would do. Someone may successfully sue me for lost interest, and I'll use that as a basis to sue GLBSE. Otherwise, I'm not willing to negotiate this... unless the JRO debt is purchased and I'm feeling a bit less like a wroth, selfish asshole.

OK, that makes sense. Have you received any communication from GLBSE as an asset issuer?

[Kluge]

Still don't have a db verifying unit-holders, so interest won't be accruing for anyone today

Why does it matter wether unit-holders have been validated? You know how many shares are out and how much you owe to each of those shares, the interest should still be accruing. It should not matter who owns the shares, they should still be earning interest until this is all sorted out.

I am unable to pay off debt due to circumstances outside my control, increasing the interest I have to pay out as I'd otherwise be paying off principal. I'm not taking the liability of interest payments due to GLBSE's failure to give me a db immediately after or prior to shutdown as any reasonable company would do. Someone may successfully sue me for lost interest, and I'll use that as a basis to sue GLBSE. Otherwise, I'm not willing to negotiate this... unless the JRO debt is purchased and I'm feeling a bit less like a wroth, selfish asshole.

OK, that makes sense. Have you received any communication from GLBSE as an asset issuer?

Nothing at all. I haven't received the few coins in there, either, though I submitted a claim soon after the AML requirement came down. I've heard other Issuers saying they haven't had coins in sub-accounts (when you create an asset, it creates a "sub-account" to keep funds from mixing) refunded, and that's the only place my coins were, so it'll probably be worked out soon.

Earlier, I tried to reach Nef at a personal email address asking for a .csv of who owns what, since Issuers will have to do their own claims process anyway (unless they move to another exchange). As long as usernames match up, I really don't need any claim code scheme... It'd be more polished and smooth, but not any more useful (aside from being absolutely sure of ownership) than having everyone communicate directly with me given I have no intent to "re-issue" BDK.BND on another exchange, just pay directly to addresses until the debt's clear.

[Tittiez]

His name is Nefario.  How could you people not see this coming?  How did you not learn your lesson after getting scammed by a guy named pirate?

My name is Tittiez, so does that mean after I rob you I'll smother you with my teets?

[Kluge]

Almost-Monday check-in (figured I should be early since I forgot to check in last week).

Nothing to report. I've tried poking the person who may've been interested in buying the JRO debt, but've heard nothing. He may still be meeting with JRO, postponed his semi-regular trip to 20M, or had no interest. Still not a single word from Nefario. I snagged a mostly-at-home job as a technical writer (manuals) for a family business in Jackson, which wouldn't pay living expenses were I to rely on it, so while I'm still hunting... Free escrow is back on. Reciprocating tips for bdk.bnd holders...   

https://bitcointalk.org/index.php?topic=120218.0

[Kluge]

Just in case it isn't obvious, I only recently noted this from the GLBSE blog:
"To clarify, if you have not approved to have your payment address and contact details shared with your issuers, you are essentially terminating any contract you have with them."

That is false and nonsensical. Issuers have no need for GLBSE to have contact information go through a middleman (GLBSE). We merely need a sheet of names tied to amounts of units held sent directly to us and nobody else. There's no reason we can't handle claims ourselves, and were Issuers to claim due diligence in salvaging this situation, there is no alternative to handling claims ourselves. It's almost certain some people will not send information to GLBSE, whether it's because they haven't been paying attention (sending users an email update would probably be a good idea...), are paranoid a government agency is waiting for people to claim accounts before prosecuting, or for whatever other reason.

To clarify, there is no logical reason why a GLBSE unit-holder needs to pass on information to Nefario to pass on to us when a user could just pass on information directly to the person they have a contract with, and the idea that a user's contract will be void simply because the user didn't send information to a defunct exchange is completely wrong. His claim is ridiculous, and cannot be taken as evidence that he should continue stalling the release of information to Issuers. They're OUR contracts, not his.

[bitcoinbear]

There are so many ways in which the GLBSE shutdown could have been handled better.  I just hope they get around to wraping this up soon.

[Kluge]

Another Monday goes by. I managed to get in contact with the potential debt-buyer of JRO's, and it's a definite "no." The "Anon" debt you probably aren't aware of unless you saved my public sheets while they were up is being settled with a penalty rate we agreed on. However, I'll likely only receive discounted equity in a registered company I'd have to try to sell unless I misunderstood the weird situation. This should eventually bring in an extra 200-500BTC. Have had trouble getting a hold of imsaguy, but I've heard he is still settling debts with interest. Given I have much more use of money now than later, would be okay with waiving interest in favor of expedited repayment, and that should bring in another 200-350BTC, depending on negotiations. I have another ~35BTC in my wallet from mining and some other small earnings, ~5BTC being held hostage at GLBSE, another 8BTC Nef agreed to pay for canceling the Kronos IPO way back, and that should put me at ~440-900BTC I can pay back by early 2013, and can possibly pay the rest back by converting USD to BTC, depending on repay by Imsa and "Anon."

The other big wildcard, of course, is still GLBSE. I'll give it four more Mondays, then consider getting a .csv a lost cause and implement a best-guess claims system. I've received a couple new claims, but the vast majority of BDK.BND units have not been claimed. I thought I saved the sheet for BDK->BDK.BND conversion which happened ~3 months ago, but I can't find it. Will look for it again... would give a much higher confidence in divvying out many of the BDK.BND units.

On other fronts, planning to rent out house/property and move into a smaller apartment until we're on a more sound financial footing. This'd give roughly $100-300/mo income after factoring in rent to live somewhere else, utilities, insurance, and property taxes. We've alternately thought about doing some renovation on particularly bad parts of the house and listing it which'd get me debt-free and then some. Either way, moving'd give us a place to live with high-speed Internet access and be close to work -- I really was stunned to find out we can't even get DSL here. Given I have just about no money, I shelved the idea of a WISP. The 2.4GHz band was totally useless in this endeavor, too. We were thinking cut advertised range by 2/3 for NLoS considering it goes through trees but not earth, but it turns out we needed to cut advertised range by about 39/40 even when there's a LoS. The pro router with a fairly powerful external antenna did marginally better than cheap $15 wireless consumer routers on the same frequency, and using a 900MHz frequency would simply be economically non-viable given the dramatically lower throughput per $ spent on router/antenna and the additional money needed to buy a wireless modem for each house to use the 900MHz band (on top of a "normal" WLAN router to broadcast a 2.4GHz signal in their house). With that said, though.... It could still be a great option in relatively rural/suburban trailer parks, where ISP plans are often expensive for bandwidth they may not need (DSL is often a minimum of $20-25/mo + equipment, while cable is often $30-40/mo + equipment). $10/mo would be fine for a reliable 256kbps symmetric connection, $15/mo for 512kbps, which'd be fast enough for low-quality video, put/get photos relatively fast, and browse the web, of course. Dramatically superior to dial-up, and superior to DSL for those not needing much bandwidth. The population density, low building height, and thin building construction are ideal. I have identified a few parks as well as great areas to mount an antenna (for example, there's a subdivision about 35m higher than an adjacent trailer park - there's literally a cliff separating the subdivision from the trailer park).... ... but the idea's shelved, I swear.

[memvola]

The other big wildcard, of course, is still GLBSE. I'll give it four more Mondays, then consider getting a .csv a lost cause and implement a best-guess claims system.

I hope it doesn't come to this, but if you really suspect that there is a possibility that we might fall back to best-guess, you might want to start collecting the information now, while there is still a high probability that GLBSE will release the data. This should reduce the number of false claims and also save some time later.

[Kluge]

The other big wildcard, of course, is still GLBSE. I'll give it four more Mondays, then consider getting a .csv a lost cause and implement a best-guess claims system.

I hope it doesn't come to this, but if you really suspect that there is a possibility that we might fall back to best-guess, you might want to start collecting the information now, while there is still a high probability that GLBSE will release the data. This should reduce the number of false claims and also save some time later.

https://bitcointalk.org/index.php?topic=79923.msg1264078#msg1264078

[Kluge]

Update (counts as Monday check-in).

We've likely settled on selling the house with almost everything we moved into it a few months ago. Planning on heading over to Youngstown on Monday or Tuesday. There's a great building with relatively low rent which'd include two upstairs residential units and a downstairs commercial space for about $1k/mo with utilities included. Within walking distance of just about everything and we can actually get a high-speed Internet connection. Once we settle on somewhere to rent, we move the few things we're taking and list the house. Snag entry-level employment in Youngstown, wait for the house to sell, then pay everyone back.

Once listed, it might take 2-3 months to snag an offer on the house given it needs work and's in a very rural area, but it's in a fantastic school district and was bid on by quite a few people who were particularly interested in the horse barn and pasture, so hopefully it won't be some drawn-out six-month bullshit like with the house in Erie. Like the house in Erie, though, I'll make a forum post on here accepting payment in BTC should someone be interested. It might come with a couple FPGAs which you can use purposefully for.... another month? 

Still no word from Nefario. Probably safe to assume he will not be releasing information to Issuers at this point, so PLEASE file claims now. There will be a claims deadline set for January 28th, 2013. I will not honor claims made after that date, even if it's a .csv from Nefario he decides to send in 2016. I haven't decided on exactly what criteria must be met, so please include as much information as possible before I decide on requirements. As each day passes, I'm less confident about new claims, so just to make absolutely clear: FILE YOUR CLAIMS EARLIER THAN LATER! If Guy-I-Never-Heard-Of claims 5000 units today, and Guy-I-Never-Heard-Of claims 5000 units on January 10th when there are only 6000 unclaimed units, I'm almost certainly not going to honor Guy-I-Never-Heard-Of-Who-Filed-His-Claim-In-January's claim. Also keep in mind this applies to both BDK and BDK.BND. Should I not have full payment ready, semi-formal promissory notes will be sent out to unit-holders for their individual approval within a few days after the cut-off date for claims, converting BDK/BDK.BND units into a more standard debt note with binding payment schedules and late fees. See https://bitcointalk.org/index.php?topic=79923.msg1264078#msg1264078 on how to file a claims form.

I'll try to have a more cohesive claims process posted at the next Monday parole meeting. 

[Kluge]

Early Monday check-in. Should have some other news (likely good) for my debtors before the 26th. I'll post when I know instead of waiting. 

Claims notification & more info about that posted @ https://bitcointalk.org/index.php?topic=126404.0