* [Bitcoin-development] MtGox blames bitcoin
@ 2014-02-10 11:28 Drak
2014-02-10 11:54 ` sickpig
` (2 more replies)
0 siblings, 3 replies; 18+ messages in thread
From: Drak @ 2014-02-10 11:28 UTC (permalink / raw)
To: Bitcoin Dev
[-- Attachment #1: Type: text/plain, Size: 293 bytes --]
What is the official response from the Bitcoin Core developers about
MtGox's assertion that their problems are due to a fault of bitcoin, as
opposed to a fault of their own?
The technical analysis preluding this mess, was that MtGox was at fault for
their faulty wallet implementation.
Drak
[-- Attachment #2: Type: text/html, Size: 375 bytes --]
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 11:28 [Bitcoin-development] MtGox blames bitcoin Drak @ 2014-02-10 11:54 ` sickpig 2014-02-10 12:25 ` Gregory Maxwell 2014-02-10 14:40 ` Isidor Zeuner 2 siblings, 0 replies; 18+ messages in thread From: sickpig @ 2014-02-10 11:54 UTC (permalink / raw) To: Drak; +Cc: Bitcoin Dev Hi, On Mon, Feb 10, 2014 at 12:28 PM, Drak <drak@zikula•org> wrote: > What is the official response from the Bitcoin Core developers about MtGox's > assertion that their problems are due to a fault of bitcoin, as opposed to a > fault of their own? > > The technical analysis preluding this mess, was that MtGox was at fault for > their faulty wallet implementation. this seems a fair explanation of what happened: http://www.reddit.com/r/Bitcoin/comments/1x93tf/some_irc_chatter_about_what_is_going_on_at_mtgox/cf99yac ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 11:28 [Bitcoin-development] MtGox blames bitcoin Drak 2014-02-10 11:54 ` sickpig @ 2014-02-10 12:25 ` Gregory Maxwell 2014-02-10 14:40 ` Isidor Zeuner 2 siblings, 0 replies; 18+ messages in thread From: Gregory Maxwell @ 2014-02-10 12:25 UTC (permalink / raw) To: Drak; +Cc: Bitcoin Dev On Mon, Feb 10, 2014 at 3:28 AM, Drak <drak@zikula•org> wrote: > What is the official response from the Bitcoin Core developers about MtGox's > assertion that their problems are due to a fault of bitcoin, as opposed to a > fault of their own? > > The technical analysis preluding this mess, was that MtGox was at fault for > their faulty wallet implementation. In the real world fault seldom falls in a single place. Bitcoin is at fault— in many places— for making it harder for implementers to get things right. MtGox is at fault for not implementing in a way that copes with behaviors in the Bitcoin protocol which have been known since at least 2011. (https://en.bitcoin.it/wiki/Transaction_Malleability). Not that Bitcoin-QT handles Malleability fantastically— but because it tracks inputs it will still detect the mutant transactions. An interesting point which I haven't pointed out elsewhere is that for the question of basic funds safety in re-issuing a transaction mallablity is basically irrelevant. Say you pay someone and it doesn't go through (or it does and you don't see it because its been mutated and your software can't detect that), and they ask you to reissue.... if you reissue without double-spending any of the original inputs you are at risk of getting robbed. This is true with or without malleability. Without the double-spend of at least one input the original transaction could just go through in addition to your reissue. Say that you do make sure to double spend at least one input— then the result is funds safe safe, regardless of if a mutation happened. Say you want to support _canceling_ a payment (send me the goat instead!) rather than reissue you still must double-spend the attempted payment to cancel it, since it still might go through if you don't. And the double spend works to protect this case regardless of if the transaction was mutated. For support and accounting purposes you absolutely do need tools to identify mutated transactions, so long as mutation exists... so we ought to provide some better tools there. But I can't think a case where mutation handling is necessary or sufficient for cancellation security, but— rather— input tracking appears to be both necessary and sufficient in all cancellation cases. This helps explain why Bitcoin-QT— whos mutation handling kinda stinks— doesn't ever end up in a really bad situation with mutants: it tracks inputs pretty well. In any case, I've always been happy to help out Mtgox with technical issues. Having some specs for a stable transaction ID would probably be helpful to many applications, even if it isn't the critical key you need for cancellation security. Removing mallability entirely has been a soft long term goal, and there were recently (as in today) some posts about it— look at the list archives... though it won't happen fast since all signers/wallets will need to be updated. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 11:28 [Bitcoin-development] MtGox blames bitcoin Drak 2014-02-10 11:54 ` sickpig 2014-02-10 12:25 ` Gregory Maxwell @ 2014-02-10 14:40 ` Isidor Zeuner 2014-02-10 16:30 ` Troy Benjegerdes 2014-02-10 16:49 ` Drak 2 siblings, 2 replies; 18+ messages in thread From: Isidor Zeuner @ 2014-02-10 14:40 UTC (permalink / raw) To: Bitcoin Dev > > What is the official response from the Bitcoin Core developers about > MtGox's assertion that their problems are due to a fault of bitcoin, as > opposed to a fault of their own? > > The technical analysis preluding this mess, was that MtGox was at fault for > their faulty wallet implementation. > I'm not a core developer, but I would certainly hope that those who have commit access to the Bitcoin repository don't let themselves be pressured by a company holding back user funds in order to get a patch included into the Bitcoin source code. I think this is less a matter of whose fault it is if a company running a custom wallet implementation has problems peering with a network mostly running another, community-based wallet implementation. It is a matter of common sense that it's just not practical to try to quickly apply an update to a distributed network, which may possibly cause problems with peering and consensus finding. When working with a protocol based on mutual agreement of a large user base, a single entity like MtGox would be better off trying to have their preferred changes implemented slowly if at all, while solving their immediate issues on their side. Problems with transactions being accepted can often be solved by changing the wallet client's way of peering with other nodes, without changing the protocol at all. Thinking this further, I am kind of surprised that something like this can even become an issue worth discussing. I never heard of a bank which would try to create pressure by suspending money withdrawals until the TCP/IP protocol is changed to match their preferences. Best regards, Isidor Zeuner ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 14:40 ` Isidor Zeuner @ 2014-02-10 16:30 ` Troy Benjegerdes 2014-02-10 16:45 ` Gregory Maxwell 2014-02-10 16:49 ` Drak 1 sibling, 1 reply; 18+ messages in thread From: Troy Benjegerdes @ 2014-02-10 16:30 UTC (permalink / raw) To: Isidor Zeuner; +Cc: Bitcoin Dev On Mon, Feb 10, 2014 at 03:40:03PM +0100, Isidor Zeuner wrote: > > > > What is the official response from the Bitcoin Core developers about > > MtGox's assertion that their problems are due to a fault of bitcoin, as > > opposed to a fault of their own? > > > > The technical analysis preluding this mess, was that MtGox was at fault for > > their faulty wallet implementation. > > > > I'm not a core developer, but I would certainly hope that those > who have commit access to the Bitcoin repository don't let > themselves be pressured by a company holding back user funds in order > to get a patch included into the Bitcoin source code. This isn't about developers. This is about venture capitalists taking lots of money from unsuspecting investors, and MtGox is in a psy-ops PR-war with multiple other exchanges and lots of places that would like to take their market share and money. Why do you want the 'official' PR-spin-war response approved by the official bitcoin developer PR-firm, who's probably being paid by competitors to MtGox? Name me one single person with commit access to the bitcoin github repository who is *independent* of any venture capital or other 'investment' connections. Fortunately for the rest of us, any dumb farmer can create a copycatcoin Hell, if MtGox hosted their *own* fork of bitcoin I'd run that in a heartbeat. And for full disclosure, I am available for consulting if anyone would like assistance setting up and hosting an independent source code repository that includes good automated regression tests. -- Troy ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 16:30 ` Troy Benjegerdes @ 2014-02-10 16:45 ` Gregory Maxwell 2014-02-10 18:25 ` Troy Benjegerdes 0 siblings, 1 reply; 18+ messages in thread From: Gregory Maxwell @ 2014-02-10 16:45 UTC (permalink / raw) To: Troy Benjegerdes; +Cc: Isidor Zeuner On Mon, Feb 10, 2014 at 8:30 AM, Troy Benjegerdes <hozer@hozed•org> wrote: > Name me one single person with commit access to the bitcoin github repository > who is *independent* of any venture capital or other 'investment' connections. I am, unless you count the fact that I own some Bitcoin and some mining hardware as "'investment' connections" (and that case your comments are worthless). (By not naming anyone else I don't mean to imply there are no others, but I don't want to speak for anyone else. Nor would I necessarily expect the other part(ies|y) to step forward, since this mostly appears to be an invitation to step up and be attacked.) ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 16:45 ` Gregory Maxwell @ 2014-02-10 18:25 ` Troy Benjegerdes 2014-02-10 18:45 ` Jameson Lopp 0 siblings, 1 reply; 18+ messages in thread From: Troy Benjegerdes @ 2014-02-10 18:25 UTC (permalink / raw) To: Gregory Maxwell; +Cc: bitcoin-development On Mon, Feb 10, 2014 at 08:45:03AM -0800, Gregory Maxwell wrote: > On Mon, Feb 10, 2014 at 8:30 AM, Troy Benjegerdes <hozer@hozed•org> wrote: > > Name me one single person with commit access to the bitcoin github repository > > who is *independent* of any venture capital or other 'investment' connections. > > I am, unless you count the fact that I own some Bitcoin and some > mining hardware as "'investment' connections" (and that case your > comments are worthless). > > (By not naming anyone else I don't mean to imply there are no others, > but I don't want to speak for anyone else. Nor would I necessarily > expect the other part(ies|y) to step forward, since this mostly > appears to be an invitation to step up and be attacked.) Thank you. I also appreciate your commentary[1], and willingness to list your investment position. What I'm concerned about are people who have signed non-disclosure agreements or who's salary/equity/whatever depend on people who are experts at manipulating markets to take naive investors money. Independent is also a state of mind as much as it is about financial connections. What pisses me off here is that a huge amount of wealth just changed hands based on MtGox's press release, and it stinks of insider trading. I still maintain the best outcome would be for MtGox to AGPLv3 release their code, and then those of us that understand it would be able to have a public technical discussion about how to fix it, and MtGox would still maintain their intellectual property ownership position. This, however, cuts off a significant revenue stream for people who take money making market bets 5 minutes before the information goes public, so I expect the likelyhood of such an outbreak of sanity is quite low. [1] http://www.cryptocoinsnews.com/2014/02/10/mt-gox-blames-bitcoin-core-developer-greg-maxwell-responds/ DISCLAIMER: I have a significant emotional investment in copyleft/viral copyright development models, and I expect to take a lot of money charging people to write code I give away for free. I also occasionally make money from cryptocurrency mining, but only when I can sell it in functional and transparent markets. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 18:25 ` Troy Benjegerdes @ 2014-02-10 18:45 ` Jameson Lopp 2014-02-10 18:53 ` Gavin Andresen 2014-02-10 19:07 ` Troy Benjegerdes 0 siblings, 2 replies; 18+ messages in thread From: Jameson Lopp @ 2014-02-10 18:45 UTC (permalink / raw) To: bitcoin-development You have plenty of good points, but they are not relevant to this mailing list. I suggest you take them elsewhere. -- Jameson Lopp Software Engineer Bronto Software, Inc On 02/10/2014 01:25 PM, Troy Benjegerdes wrote: > On Mon, Feb 10, 2014 at 08:45:03AM -0800, Gregory Maxwell wrote: >> On Mon, Feb 10, 2014 at 8:30 AM, Troy Benjegerdes <hozer@hozed•org> wrote: >>> Name me one single person with commit access to the bitcoin github repository >>> who is *independent* of any venture capital or other 'investment' connections. >> >> I am, unless you count the fact that I own some Bitcoin and some >> mining hardware as "'investment' connections" (and that case your >> comments are worthless). >> >> (By not naming anyone else I don't mean to imply there are no others, >> but I don't want to speak for anyone else. Nor would I necessarily >> expect the other part(ies|y) to step forward, since this mostly >> appears to be an invitation to step up and be attacked.) > > Thank you. > > I also appreciate your commentary[1], and willingness to list your investment > position. What I'm concerned about are people who have signed non-disclosure > agreements or who's salary/equity/whatever depend on people who are experts > at manipulating markets to take naive investors money. > > Independent is also a state of mind as much as it is about financial connections. > > What pisses me off here is that a huge amount of wealth just changed hands based > on MtGox's press release, and it stinks of insider trading. I still maintain the > best outcome would be for MtGox to AGPLv3 release their code, and then those of > us that understand it would be able to have a public technical discussion about > how to fix it, and MtGox would still maintain their intellectual property > ownership position. > > This, however, cuts off a significant revenue stream for people who take money > making market bets 5 minutes before the information goes public, so I expect > the likelyhood of such an outbreak of sanity is quite low. > > [1] http://www.cryptocoinsnews.com/2014/02/10/mt-gox-blames-bitcoin-core-developer-greg-maxwell-responds/ > > > DISCLAIMER: I have a significant emotional investment in copyleft/viral copyright > development models, and I expect to take a lot of money charging people to write > code I give away for free. I also occasionally make money from cryptocurrency > mining, but only when I can sell it in functional and transparent markets. > > ------------------------------------------------------------------------------ > Android™ apps run on BlackBerry®10 > Introducing the new BlackBerry 10.2.1 Runtime for Android apps. > Now with support for Jelly Bean, Bluetooth, Mapview and more. > Get your Android app in front of a whole new audience. Start now. > http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge.net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 18:45 ` Jameson Lopp @ 2014-02-10 18:53 ` Gavin Andresen 2014-02-10 19:07 ` Troy Benjegerdes 1 sibling, 0 replies; 18+ messages in thread From: Gavin Andresen @ 2014-02-10 18:53 UTC (permalink / raw) To: Jameson Lopp; +Cc: Bitcoin Dev [-- Attachment #1: Type: text/plain, Size: 225 bytes --] RE: taking discussion elsewhere: Yes, please, the purpose of this mailing list is technical discussions to encourage interoperability of Bitcoin implementations, improve ease-of-use and security, etc. -- -- Gavin Andresen [-- Attachment #2: Type: text/html, Size: 400 bytes --] ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 18:45 ` Jameson Lopp 2014-02-10 18:53 ` Gavin Andresen @ 2014-02-10 19:07 ` Troy Benjegerdes 2014-02-10 19:23 ` Peter Todd 1 sibling, 1 reply; 18+ messages in thread From: Troy Benjegerdes @ 2014-02-10 19:07 UTC (permalink / raw) To: Jameson Lopp; +Cc: bitcoin-development If you've got any ideas for a better forum, let me know. MtGox is one of the largest public faces of the code being developed here. If the public perception is that this is a bitcoin protocol flaw, then we need some damned strong and compelling public arguments about why it ain't so. But after some thought, that's not the critical issue I want to raise on this list. If something about the implementation, the protocol, of bitcoin-qt or bitcoind makes it easy for an attacker to mutate transactions and hard for an 'end-user' such as MtGox to confirm payments, then we've got a fundamental user-interface flaw. We can get all indignant about RTFM or telling the users they are idiots, but that's not really going to be good for long-term adoption and use. My opinion is part of the development process should be to react to public perceptions of how the code is being used (and mis-used), and how the market is being manipulated, and try to improve it so the whole system is stable, predictable, and friendly to users. On Mon, Feb 10, 2014 at 01:45:58PM -0500, Jameson Lopp wrote: > You have plenty of good points, but they are not relevant to this mailing list. I suggest you take them elsewhere. > -- > Jameson Lopp > Software Engineer > Bronto Software, Inc > > On 02/10/2014 01:25 PM, Troy Benjegerdes wrote: > > On Mon, Feb 10, 2014 at 08:45:03AM -0800, Gregory Maxwell wrote: > >> On Mon, Feb 10, 2014 at 8:30 AM, Troy Benjegerdes <hozer@hozed•org> wrote: > >>> Name me one single person with commit access to the bitcoin github repository > >>> who is *independent* of any venture capital or other 'investment' connections. > >> > >> I am, unless you count the fact that I own some Bitcoin and some > >> mining hardware as "'investment' connections" (and that case your > >> comments are worthless). > >> > >> (By not naming anyone else I don't mean to imply there are no others, > >> but I don't want to speak for anyone else. Nor would I necessarily > >> expect the other part(ies|y) to step forward, since this mostly > >> appears to be an invitation to step up and be attacked.) > > > > Thank you. > > > > I also appreciate your commentary[1], and willingness to list your investment > > position. What I'm concerned about are people who have signed non-disclosure > > agreements or who's salary/equity/whatever depend on people who are experts > > at manipulating markets to take naive investors money. > > > > Independent is also a state of mind as much as it is about financial connections. > > > > What pisses me off here is that a huge amount of wealth just changed hands based > > on MtGox's press release, and it stinks of insider trading. I still maintain the > > best outcome would be for MtGox to AGPLv3 release their code, and then those of > > us that understand it would be able to have a public technical discussion about > > how to fix it, and MtGox would still maintain their intellectual property > > ownership position. > > > > This, however, cuts off a significant revenue stream for people who take money > > making market bets 5 minutes before the information goes public, so I expect > > the likelyhood of such an outbreak of sanity is quite low. > > > > [1] http://www.cryptocoinsnews.com/2014/02/10/mt-gox-blames-bitcoin-core-developer-greg-maxwell-responds/ > > > > > > DISCLAIMER: I have a significant emotional investment in copyleft/viral copyright > > development models, and I expect to take a lot of money charging people to write > > code I give away for free. I also occasionally make money from cryptocurrency > > mining, but only when I can sell it in functional and transparent markets. > > > > ------------------------------------------------------------------------------ > > Android™ apps run on BlackBerry®10 > > Introducing the new BlackBerry 10.2.1 Runtime for Android apps. > > Now with support for Jelly Bean, Bluetooth, Mapview and more. > > Get your Android app in front of a whole new audience. Start now. > > http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk > > _______________________________________________ > > Bitcoin-development mailing list > > Bitcoin-development@lists•sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > > ------------------------------------------------------------------------------ > Androi apps run on BlackBerry 10 > Introducing the new BlackBerry 10.2.1 Runtime for Android apps. > Now with support for Jelly Bean, Bluetooth, Mapview and more. > Get your Android app in front of a whole new audience. Start now. > http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge.net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 19:07 ` Troy Benjegerdes @ 2014-02-10 19:23 ` Peter Todd 2014-02-10 19:30 ` naman naman 0 siblings, 1 reply; 18+ messages in thread From: Peter Todd @ 2014-02-10 19:23 UTC (permalink / raw) To: Troy Benjegerdes; +Cc: bitcoin-development [-- Attachment #1: Type: text/plain, Size: 322 bytes --] On Mon, Feb 10, 2014 at 01:07:03PM -0600, Troy Benjegerdes wrote: > If you've got any ideas for a better forum, let me know. Your political conversations would be welcome at unsystem@lists•dyne.org See you there. -- 'peter'[:-1]@petertodd.org 0000000077ddbd0b6faa6d6fe50cdc7808dea5db5b538f85b736ede8515c54c7 [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 685 bytes --] ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 19:23 ` Peter Todd @ 2014-02-10 19:30 ` naman naman 2014-02-10 19:40 ` Peter Todd 0 siblings, 1 reply; 18+ messages in thread From: naman naman @ 2014-02-10 19:30 UTC (permalink / raw) To: Peter Todd; +Cc: bitcoin-development [-- Attachment #1: Type: text/plain, Size: 1199 bytes --] Hi guys, Please check this thread https://bitcointalk.org/index.php?topic=458608.0for a possible attack scenario. Already mailed Gavin, Mike Hearn and Adam about this : See if it makes sense. On Tue, Feb 11, 2014 at 12:53 AM, Peter Todd <pete@petertodd•org> wrote: > On Mon, Feb 10, 2014 at 01:07:03PM -0600, Troy Benjegerdes wrote: > > If you've got any ideas for a better forum, let me know. > > Your political conversations would be welcome at unsystem@lists•dyne.org > > See you there. > > -- > 'peter'[:-1]@petertodd.org > 0000000077ddbd0b6faa6d6fe50cdc7808dea5db5b538f85b736ede8515c54c7 > > > ------------------------------------------------------------------------------ > Androi apps run on BlackBerry 10 > Introducing the new BlackBerry 10.2.1 Runtime for Android apps. > Now with support for Jelly Bean, Bluetooth, Mapview and more. > Get your Android app in front of a whole new audience. Start now. > > http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge.net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > [-- Attachment #2: Type: text/html, Size: 2157 bytes --] ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 19:30 ` naman naman @ 2014-02-10 19:40 ` Peter Todd [not found] ` <52F9377D.9010405@gmail.com> 0 siblings, 1 reply; 18+ messages in thread From: Peter Todd @ 2014-02-10 19:40 UTC (permalink / raw) To: naman naman; +Cc: bitcoin-development [-- Attachment #1: Type: text/plain, Size: 1512 bytes --] On Tue, Feb 11, 2014 at 01:00:21AM +0530, naman naman wrote: > Hi guys, > > Please check this thread > https://bitcointalk.org/index.php?topic=458608.0for a possible attack > scenario. > > Already mailed Gavin, Mike Hearn and Adam about this : > > See if it makes sense. That's basically what appears to have happened with Mt. Gox. Preventing the attack is as simple as training your customer service people to ask the customer if their wallet software shows a payment to a specific address of a specific amount at some approximate time. Making exact payment amounts unique - add a few satoshis - is a trivial if slightly ugly way of making sure payments can be identified uniquely over the phone. That the procedure at Mt. Gox let front-line customer service reps manually send funds to customers without a proper investigation of why the funds didn't arrive was a serious mistake on their part. Ultimately this is more of a social engineering attack than a technical one, and a good example of why well-thought-out payment protocols are helpful. Though the BIP70 payment protocol doesn't yet handle busines to individual, or individual to indivudal, payments a future iteration can and this kind of problem will be less of an issue. Similarly stealth addresses have an inherent per-tx unique identifier, the derived pubkey, which a UI might be able to take advantage of. -- 'peter'[:-1]@petertodd.org 0000000076654614e7bf72ac80d47c57bca12503989f4d602538d3cd7892ca7d [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 685 bytes --] ^ permalink raw reply [flat|nested] 18+ messages in thread
[parent not found: <52F9377D.9010405@gmail.com>]
* Re: [Bitcoin-development] MtGox blames bitcoin [not found] ` <52F9377D.9010405@gmail.com> @ 2014-02-11 20:42 ` naman naman 2014-02-11 20:49 ` Gregory Maxwell 0 siblings, 1 reply; 18+ messages in thread From: naman naman @ 2014-02-11 20:42 UTC (permalink / raw) To: Vocatus Gate; +Cc: bitcoin-development [-- Attachment #1: Type: text/plain, Size: 3717 bytes --] I was talking about a DOS attack in https://bitcointalk.org/index.php?topic=458608.0 (ofcourse only applicable to entitys doing the tracking with txids). Amazing how I did not get a response from any of the devs (except Greg's response https://bitcointalk.org/index.php?topic=458608.msg5063789#msg5063789 but that too was short and not concerning the attack scenario plausibiity as I replied to him). Today they are apparently at work here https://github.com/bitcoin/bitcoin/pull/3651 Amazing how nobody acknowledges it until later when the attack already happens. The devs need to show some greater level of responsibility. Don't get me wrong - I am not trying to claim credit for the attack scheme described (though I do not know of any other place where this was mentioned earlier as an attack scheme), but I am trying to make the point that people should just be around and at least make others feel that their concerns are being read. Now putting this on some place like reddit will only give the community a bad name. On a lighter note I messaged some of the devs (as my previous mail says) saying the attack should be called "thenoblebot" attack (after my handle, which would inspire me to pursue crypto studies further). It was meant to be a lame joke. But I had no idea how it would start causing so much disruption in the ecosystem. Regards thenoblebot On Tue, Feb 11, 2014 at 2:03 AM, Vocatus Gate <vocatus.gate@gmail•com>wrote: > It's quite simple, really: > > Unique transaction == (Inputs+Outputs+ReceivingAddress) > > Problem solved. Simply don't rely on TxID for tracking. Can we put this > issue to rest and move on? > > > > > On 2014-02-10 12:40 PM, Peter Todd wrote: > > On Tue, Feb 11, 2014 at 01:00:21AM +0530, naman naman wrote: > > Hi guys, > > Please check this threadhttps://bitcointalk.org/index.php?topic=458608.0for a possible attack > scenario. > > Already mailed Gavin, Mike Hearn and Adam about this : > > See if it makes sense. > > That's basically what appears to have happened with Mt. Gox. > > Preventing the attack is as simple as training your customer service > people to ask the customer if their wallet software shows a payment to a > specific address of a specific amount at some approximate time. Making > exact payment amounts unique - add a few satoshis - is a trivial if > slightly ugly way of making sure payments can be identified uniquely > over the phone. That the procedure at Mt. Gox let front-line customer > service reps manually send funds to customers without a proper > investigation of why the funds didn't arrive was a serious mistake on > their part. > > Ultimately this is more of a social engineering attack than a technical > one, and a good example of why well-thought-out payment protocols are > helpful. Though the BIP70 payment protocol doesn't yet handle busines to > individual, or individual to indivudal, payments a future iteration can > and this kind of problem will be less of an issue. > > Similarly stealth addresses have an inherent per-tx unique identifier, > the derived pubkey, which a UI might be able to take advantage of. > > > > > ------------------------------------------------------------------------------ > Androi apps run on BlackBerry 10 > Introducing the new BlackBerry 10.2.1 Runtime for Android apps. > Now with support for Jelly Bean, Bluetooth, Mapview and more. > Get your Android app in front of a whole new audience. Start now.http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk > > > > _______________________________________________ > Bitcoin-development mailing listBitcoin-development@lists•sourceforge.nethttps://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > [-- Attachment #2: Type: text/html, Size: 5315 bytes --] ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-11 20:42 ` naman naman @ 2014-02-11 20:49 ` Gregory Maxwell 2014-02-11 20:56 ` naman naman 0 siblings, 1 reply; 18+ messages in thread From: Gregory Maxwell @ 2014-02-11 20:49 UTC (permalink / raw) To: naman naman; +Cc: Bitcoin Development, Vocatus Gate On Tue, Feb 11, 2014 at 12:42 PM, naman naman <namanhd@gmail•com> wrote: > I was talking about a DOS attack in > https://bitcointalk.org/index.php?topic=458608.0 (ofcourse only applicable > to entitys doing the tracking with txids). > > Amazing how I did not get a response from any of the devs (except Greg's > response > https://bitcointalk.org/index.php?topic=458608.msg5063789#msg5063789 but > that too was short and not concerning the attack scenario plausibiity as I > replied to him). Try paying a consultant if your ego demands that you have a technical expert to entertain your musing with immediate response. My response was absolutely relevant. If you reissue a transaction without respending the prior transactions coins, you will end up double paying. Only spending the inputs in question can prevent the prior transaction (itself or in other form) from going through. Once you respend the inputs there is no risk of actually losing funds due to an issue regardless of how you track coins in your higher level application. ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-11 20:49 ` Gregory Maxwell @ 2014-02-11 20:56 ` naman naman 2014-02-13 12:20 ` naman naman 0 siblings, 1 reply; 18+ messages in thread From: naman naman @ 2014-02-11 20:56 UTC (permalink / raw) To: Gregory Maxwell; +Cc: Bitcoin Development, Vocatus Gate [-- Attachment #1: Type: text/plain, Size: 1910 bytes --] Gregory Maxwell says : "Try paying a consultant if your ego demands that you have a technical expert to entertain your musing with immediate response." I don't know why your resorting to such an adhominem. But I have already said that you were the only one who responded. Your response was correct as is reflected in the conversation on the forums. No doubting that. But it does not address the full scope of the attack where a small pool would intentionally (or out of whatever reason) make the hash invalid for the txs they recieve. So that leaves a whole lot of businesses in the lurch who have relied on txid (albeit wrongly that) for their tracking purposes. Thats all I'm trying to say, without blaming anyone. Hope it makes sense. On Wed, Feb 12, 2014 at 2:19 AM, Gregory Maxwell <gmaxwell@gmail•com> wrote: > On Tue, Feb 11, 2014 at 12:42 PM, naman naman <namanhd@gmail•com> wrote: > > I was talking about a DOS attack in > > https://bitcointalk.org/index.php?topic=458608.0 (ofcourse only > applicable > > to entitys doing the tracking with txids). > > > > Amazing how I did not get a response from any of the devs (except Greg's > > response > > https://bitcointalk.org/index.php?topic=458608.msg5063789#msg5063789 but > > that too was short and not concerning the attack scenario plausibiity as > I > > replied to him). > > Try paying a consultant if your ego demands that you have a technical > expert to entertain your musing with immediate response. > > My response was absolutely relevant. > > If you reissue a transaction without respending the prior transactions > coins, you will end up double paying. Only spending the inputs in > question can prevent the prior transaction (itself or in other form) > from going through. > > Once you respend the inputs there is no risk of actually losing funds > due to an issue regardless of how you track coins in your higher level > application. > [-- Attachment #2: Type: text/html, Size: 3070 bytes --] ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-11 20:56 ` naman naman @ 2014-02-13 12:20 ` naman naman 0 siblings, 0 replies; 18+ messages in thread From: naman naman @ 2014-02-13 12:20 UTC (permalink / raw) To: Gregory Maxwell; +Cc: Bitcoin Development, Vocatus Gate [-- Attachment #1: Type: text/plain, Size: 2517 bytes --] Hi guys, I with all thats happening now I think (yea no hard proof) most of it is being done on purpose (transaction mutation) by some pool/entity. I have posted here https://bitcointalk.org/index.php?topic=463350.0 of how to go about finding out if its some pool doing it. This does in no way solve "fix" the malleability issue BUT IMHO it might help "alleviate" the problem we are facing at a network level. Please have a look if possible. Kind Regards, thenoblebot On Wed, Feb 12, 2014 at 2:26 AM, naman naman <namanhd@gmail•com> wrote: > Gregory Maxwell says : "Try paying a consultant if your ego demands that > you have a technical > > expert to entertain your musing with immediate response." > > I don't know why your resorting to such an adhominem. But I have already > said that you were the only one who responded. Your response was correct as > is reflected in the conversation on the forums. No doubting that. But it > does not address the full scope of the attack where a small pool would > intentionally (or out of whatever reason) make the hash invalid for the txs > they recieve. So that leaves a whole lot of businesses in the lurch who > have relied on txid (albeit wrongly that) for their tracking purposes. > Thats all I'm trying to say, without blaming anyone. > > Hope it makes sense. > > > On Wed, Feb 12, 2014 at 2:19 AM, Gregory Maxwell <gmaxwell@gmail•com>wrote: > >> On Tue, Feb 11, 2014 at 12:42 PM, naman naman <namanhd@gmail•com> wrote: >> > I was talking about a DOS attack in >> > https://bitcointalk.org/index.php?topic=458608.0 (ofcourse only >> applicable >> > to entitys doing the tracking with txids). >> > >> > Amazing how I did not get a response from any of the devs (except Greg's >> > response >> > https://bitcointalk.org/index.php?topic=458608.msg5063789#msg5063789but >> > that too was short and not concerning the attack scenario plausibiity >> as I >> > replied to him). >> >> Try paying a consultant if your ego demands that you have a technical >> expert to entertain your musing with immediate response. >> >> My response was absolutely relevant. >> >> If you reissue a transaction without respending the prior transactions >> coins, you will end up double paying. Only spending the inputs in >> question can prevent the prior transaction (itself or in other form) >> from going through. >> >> Once you respend the inputs there is no risk of actually losing funds >> due to an issue regardless of how you track coins in your higher level >> application. >> > > [-- Attachment #2: Type: text/html, Size: 4158 bytes --] ^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [Bitcoin-development] MtGox blames bitcoin 2014-02-10 14:40 ` Isidor Zeuner 2014-02-10 16:30 ` Troy Benjegerdes @ 2014-02-10 16:49 ` Drak 1 sibling, 0 replies; 18+ messages in thread From: Drak @ 2014-02-10 16:49 UTC (permalink / raw) To: Isidor Zeuner [-- Attachment #1: Type: text/plain, Size: 571 bytes --] Well done Gavin for quickly setting the record straight[1] officially as project lead. MtGox tried to blame their issues by throwing Bitcoin under a bus and I am glad there has been a public rebuttal showing up their incompetence which is doing harm to the bitcoin eco system. Basically, yes there are issues, but MtGox should have worked around it. Also thanks to Gregory for also writing[2] about the matter. Drak [1] https://bitcoinfoundation.org/blog/?p=418 [2] http://www.cryptocoinsnews.com/2014/02/10/mt-gox-blames-bitcoin-core-developer-greg-maxwell-responds/ [-- Attachment #2: Type: text/html, Size: 891 bytes --] ^ permalink raw reply [flat|nested] 18+ messages in thread
end of thread, other threads:[~2014-02-13 12:21 UTC | newest]
Thread overview: 18+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-02-10 11:28 [Bitcoin-development] MtGox blames bitcoin Drak
2014-02-10 11:54 ` sickpig
2014-02-10 12:25 ` Gregory Maxwell
2014-02-10 14:40 ` Isidor Zeuner
2014-02-10 16:30 ` Troy Benjegerdes
2014-02-10 16:45 ` Gregory Maxwell
2014-02-10 18:25 ` Troy Benjegerdes
2014-02-10 18:45 ` Jameson Lopp
2014-02-10 18:53 ` Gavin Andresen
2014-02-10 19:07 ` Troy Benjegerdes
2014-02-10 19:23 ` Peter Todd
2014-02-10 19:30 ` naman naman
2014-02-10 19:40 ` Peter Todd
[not found] ` <52F9377D.9010405@gmail.com>
2014-02-11 20:42 ` naman naman
2014-02-11 20:49 ` Gregory Maxwell
2014-02-11 20:56 ` naman naman
2014-02-13 12:20 ` naman naman
2014-02-10 16:49 ` Drak
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox