<a​lpharabius:matrix.org> There's a secret blood oath duh

<a​lpharabius:matrix.org> Nah i'm just fucking witchu, what he said

recanman: idk probably some parts of it. We shall see

<r​ecanman:agoradesk.com> Thanks, I didn't read much into it and have been extremely busy. Bad timing I guess

<b​tclovera:matrix.org> Hi luigi1111: can you confirm that you are receiving DM?

<p​lowsof:matrix.org> no lovera, ill help ya

<b​tclovera:matrix.org> I just read somewhere that Luigi wasn't receiving DM

don't believe there are dms between matrix and irc

I'm not logged into matrix so yeah I won't get them

<1​23bob123:matrix.org> Plowsof is matrix <> bridge

<recanman> "Is the fluffypony plan being implemented?" <== it reads like a bunch of decentralization theater to me. how do you multisig website hosting?

<r​ecanman:agoradesk.com> I worded it incorrectly, its just that I read recent messages and thought a decision was already made

<r​ecanman:agoradesk.com> I disagree with it

<k​inghat:matrix.org> you could have the website hosted from the repo source. github and other hosts offer this.

<r​ecanman:agoradesk.com> Good point, just not sure about that

<r​ecanman:agoradesk.com> Binaries would also be hosted on github?

<r​ecanman:agoradesk.com> Probably less than 50% of people verify hash, and less than 20% of those verify pgp signatures

<r​ecanman:agoradesk.com> So github could modify it easily

<r​ecanman:agoradesk.com> What am I saying...it's all a mess. I am extremely busy

<k​inghat:matrix.org> they could be. or from multiple places. they are built on github. as long as they are still reproducible.

further centralizing around github doesn't seem ideal. Binaries used to be uploaded to Github too tho for convenience

<k​inghat:matrix.org> replicate them wherever you want really

<k​inghat:matrix.org> ^ binaries

k I thought we were talking about replicating plowsof

<k​inghat:matrix.org> sounds like a risky procedure 😬

is it time to just put the binaries up with those torrent magnet links? I guess the underlying question there is whether the cdn management is .... cumbersome or centralizing etc

of course the obvious solution is to train an AI chatbot to do all the things

we'll just train it on all the logs of all the things

the super administrators will create multi sig ssh wallets for sensitive infrastructure access

"replicate plowsof" => please wait until the headache passes , geonic "decentralisation theatre" i agree, i also do not want it to be a distraction from setting up emergency/temporary measures to ensure that the CCS gets back up and running asap

fluffypony will tari labs continue the sponsorship of the CDN used by getmonero? getmonero.org/community/sponsorships

does anyone know the specs of the server that fork networking provides and who uses it? gingeropolous should be listed in their place otherwise

<1​23bob123:matrix.org> Lets create a CDN through monero nodes :)

do what now?

you have provided/maintained a server(s) for development for years gingeropolous

forknetworking provide affordable ip addresses so people can attack us :P

<1​23bob123:matrix.org> We need CDN so people in north korea don’t have slow website access

<m​onero-hackerindustrial:monero.social> There are watcher services out there that keep an eye out on changes in hashes for binaries to detect malicious activity. Something like that would have helped detect that time malware was served from the get monero domain

<m​onero-hackerindustrial:monero.social> luigi1111: Do you have access to the windows machine or not until after thanksgiving?

<m​onero-hackerindustrial:monero.social> I thought I would share this here too:

<m​onero-hackerindustrial:monero.social> monero-project/meta #923

<m​onero-hackerindustrial:monero.social> This is my outline for the incident response. My goal is to gather all the evidence to conduct forensics and identify any malware to complete the picture of what happened. Once that is identified I can then document the incident with additional context.

Yes also not until after

geonic: I literally note that in the proposal - "Finally, some of these workgroups simply CANNOT have any form of multisig / ACL / group access, and by definition each individual on the workgroup can exercise complete control and abuse their position (or be wrench-attacked, or be compromised). I've tried to note that below."

geonic: what's your alternative proposal, since you think that this proposal is decentralisation theater?

<c​trej:matrix.org> > <g​eonic> <recanman> "Is the fluffypony plan being implemented?" <== it reads like a bunch of decentralization theater to me. how do you multisig website hosting?

<c​trej:matrix.org> geonic, honestly, what do you want people to do? Everyone knows that it is a difficult process, so of course the first idea proposal isnt perfect. Instead of bitching about it, can you please provide improved suggestion?

100% - dissenting without an alternative is just nonsensical

if you want the Core Team to continue, that's fine, but understand that maybe some or all of the current members don't want that, so then you'll need to factor that into your counter-proposal

<g​orillaquest:matrix.org> dictatorship

<g​orillaquest:matrix.org> we need that

<r​brunner7:monero.social> Who opined to introduce a dictorship? Or what is, currently, a dictatorship?

<1​23bob123:matrix.org> easier to just whinge and not have alt solution 🤔

<r​brunner7:monero.social> Yes. I think I had a little insight lately, when I noticed several accounts here, on Reddit, and on GitHub commenting on our plight, accounts never seen before

<r​brunner7:monero.social> I now believe those are mostly "disaster tourists": en.wikipedia.org/wiki/Disaster_tourism

<r​brunner7:monero.social> This in contrast to any theories that assume that those are mostly actively malicious

<g​orillaquest:matrix.org> what is this supposed to mean

<g​orillaquest:matrix.org> are you calling me a nobody

<o​cean:matrix.thisisjoes.site> sussy chungus

To be honest, i hope i am the only one that is disappointed that Core lost half a million euro of community funds, but then instead of taking responsibility by regrouping and improving their roles, methods and responsibilities for stewarding the project (roles that they gladly chose i might add), they propose to disband while passing on responsibility to the rest of the community. We could have done that years ago and

potentially avoided this situation. Not to mention that years ago, a small Community tried to remove responsibility from Core and there was pushback.

*not the only one disappointed

<r​ottenwheel:kernal.eu> midipoet why do you say they propose when it was a proposal put forward by a one of them, that also stepped down from it?

I disagree on equating fluffypony's proposal with "Core proposing to disband"

<r​ottenwheel:kernal.eu> Great minds think alike.

<1​23bob123:matrix.org> tbh there isnt enough consensus to split like this

<r​ottenwheel:kernal.eu> Who said Dan?

<1​23bob123:matrix.org> have a look on how things are done here. fighting and pissing match

<1​23bob123:matrix.org> no imagine that when trying to "re structure"

<1​23bob123:matrix.org> now*

<1​23bob123:matrix.org> its will turn into divergent the movie

<1​23bob123:matrix.org> factions and shit

<1​23bob123:matrix.org> i think css is a test case tbh to see if we can pull our finger out and do it on a small scale

<1​23bob123:matrix.org> i think ccs is a test case tbh to see if we can pull our finger out and do it on a small scale

<r​ottenwheel:kernal.eu> Who is "we"?

<1​23bob123:matrix.org> you, me and everyone

<r​ottenwheel:kernal.eu> ofrnxmr: you sleepy?

rottenwheel: fair enough, then it seems a proposal by a former Core member to more formally remove responsibilities from Core

binaryfate: is that more accurate ^

<1​23bob123:matrix.org> lol rotten

<1​23bob123:matrix.org> havnt heard the other core members take either

midipoet: yes, though his proposal even if followed through doesn't necessarily imply that all individual members would just pass on all their responsibilities and vanish

His proposal has a lot of merit, kicking constructive discussions if nothing else, though the timing is a pity IMO. Everyone reads this in the emotion of the CCS failure, and that didn't need to be so.

binaryfate: well they have mentioned numerous times that some would prefer not to continue the stewardship role, so presumably it is the case for more than 1. If it's the case that some, or most, want to remain then all members of Core (if they haven't already) should make it clear whether they wish to remain or not. This would preferably be done by stating their desire to lead one, or more, of the proposed new WGs.

Otherwise we are just dancing around the actual topic, which is "how much administration burden are the members of Core willing to burden moving forward".

For the record, i don't think it's fair that Core should maintain Supra-voting weight, without being willing to maintain a more than trivial administrative burden. They can be supported with that burden more widely from the community (always would have if they had of asked), but the fundamental stewardship role should surely remain.

<1​23bob123:matrix.org> so you want core to have more input cause of the "voting weight"?

123bob123: they have always had Supra-voting weight. that's a primary function of Core.

Otherwise the project would be at risk of being derailed by commons/peanuts

<1​23bob123:matrix.org> but are you inferring they shouldn't be in the shadows "administrative role"?

I am saying they can't really have one without the other

If they arent ACTUALLY stewarding, why should they have stewardship voting rights?

<c​trej:matrix.org> > Yes. I think I had a little insight lately, when I noticed several accounts here, on Reddit, and on GitHub commenting on our plight, accounts never seen before

<c​trej:matrix.org> One of the commenters on github is the director behind discreet, another "privacy" coin. I would assume that it is in his best interest to use the situation to gain market share. The writing style of the other two seem familiar in context of discreet shilling.

<1​23bob123:matrix.org> ok i get you know

can just serve binaries via torrents, you'll save up on some 1000 trillion USD AWS S3 bills

<1​23bob123:matrix.org> I can host minio on rpi4 if you need :)

the trend (in the western world at least) is households getting optical fiber

perfect for p2p file sharing

also less susceptible to binary switch-a-roo fuckery

<1​23bob123:matrix.org> I can seed with limewire if needed :0

plowsof, i guess I don't understand that the fork network servers are for.

<t​rasherdk:monero.social> > <d​sc_> the trend (in the western world at least) is households getting optical fiber

<t​rasherdk:monero.social> I'm in the far east, sporting a 1GB fiber home connection, with free mobile data at a very high throughput connection, very cheap. Western world my ass 🖕

nice trasher, internet here (eastern europe) is very cheap/good too

<c​harutocafe:matrix.org> i'm happy with my 800kbps

the only thing available to me is optical fiber

I chose the minimal service, 300Mbps

more than enough

i have 1gbit at home because I run an AWS competitor

midipoet: to be clear, I sort-of envisioned some Core members like binaryFate transitioning into multiple (if not all) of the proposed workgroups, but then as a result of splitting it like that you create more of a hydra and less of a one-headed snake

fluffypony: i understand that. The first step is then to figure out who from Core wants to maintain a leadership role, and in which workgroup, and which members definitively do not want any responsibility.

yes that's an excellent next step - and then my other thought around that was that maybe some workgroups fill up faster than others (also some workgroups don't need a lot of people, they're fine with like 2-3)

so there's definitely a path there

<a​lpharabius:matrix.org> Hi fluffy

<a​lpharabius:matrix.org> We ❤️fluffy

<h​yolobrika:envs.net> Does Monerujo encrypt wallet files?

<s​paceguide:matrix.org> it seems so, yes

<h​yolobrika:envs.net> Thank you.

<h​yolobrika:envs.net> I can't seem to get it to connect to onion nodes

<h​yolobrika:envs.net> Oh wait. There's a "Tor mode" that I have to enable

I figured a way for new style ccs wallet, where we keep luigi and plowsof and add 3rd person

<c​trej:matrix.org> Yes. Wallet files are encrypted with the "crazypass"

<a​nhdres:matrix.org> yes, they're encrypted with the crazypass

trustless and easy to use, doing writing up now

<h​yolobrika:envs.net> What's a crazypass?

we may use monero multis-sig only once or not at all

<h​yolobrika:envs.net> Is it risky to connect to non-onion nodes over clearnet and then use Tor?

<a​nhdres:matrix.org> anhdres.medium.com/how-monerujos-cr…-password-scheme-works-dc4f99a99ff0

i would like >this< already existing and functioning CCS workgroup to be able to resume discussing ideas and putting things forward for funding. the CDN .. back end stuff, i have no input on .. im not a sysadmin or have any idea how any of it works

if binaryFate agrees with temporarily increasing his surface area, that sounds fine to me. The show must go on or something.

<h​yolobrika:envs.net> Isn't that called a KDF?

these temporary measures do not include multisig wallets IMO - just this week i've nearly been ran over at least twice, i have no measures in place should i meet my maker, i have a secure pgp key that is now 5 days old which exists on 3 cold storage medias.

multisig .. cumbersome / experimental / logistics problem - soon(tm)

ok but was it by a bus

it was a small car so i probably would have survived but still

why don't we just add multisig and be done with it all -_-

even if it's not private as long as it works

<r​ucknium:monero.social> IIRC, Monero's current multisig cryptography has not been proven secure. That may be a good reason not to use it.

i know lol i'm talking about fixing it or making a new one

<r​ucknium:monero.social> I think the answer that that question is that we don't have anyone currently working on Monero who can write or review a security proof AFAIK.

fuuuuuuuuuuuuuck

<a​nhdres:matrix.org> I don't know what that means

where do people go to learn that kind of stuff? like deep crypto shit not just coding

<r​ucknium:monero.social> I don't know exactly what it takes, but some of the people I know about who are able to write and review security proofs have PhDs.

oh rip lol

so that means we gotta hire adults

nvm we don't need multisig then

if we hadn't got robbed we coulda used that money to send one of us to university

<r​ucknium:monero.social> We could see if sarang (Aaron F.) would want to try. He used to do a lot of work for Monero and could be hired to do it. He works for Cypher Stack now.

<h​yolobrika:envs.net> I don't know much about it but it's a way of deriving an encryption (or other) key from a password. It stands for "Key Derivation Function".

<h​yolobrika:envs.net> en.wikipedia.org/wiki/Key_derivation_function

<r​ucknium:monero.social> Some researchers at the CISPA Helmholtz Center for Information Security once said they could be interested in creating security proofs for Monero multisig: libera.monerologs.net/monero-research-lab/20230308#c214622

<r​ucknium:monero.social> IIRC the MAGIC Monero Fund contacted them after the meeting, but they we not ready to commit to anything at that time.

<h​yolobrika:envs.net> Does monero not have multisigs as of now?

<r​ucknium:monero.social> It does, but the implementation is considered experimental.

ok boys here's my plan: 1) we raise enough funds 2) we buy a shit ton of graphic cards 3) we buy pirated gpt tech off the dark web 4) we build private chatgpt 5) we feed gpt with source code from other blockchains that have multisig 5) we tell it to spit out monero multisig 6) ???? 7) PROFIT!

time to start thinking like 21st century gentlement

<a​nhdres:matrix.org> Sounds like that, but m2049r: could answer it definitely

probs cheaper than hiring some rocket scientist

<spadin_spider> if we hadn't got robbed we coulda used that money to send one of us to university <= well that would've involved stealing it for a different purpose -__-

<h​yolobrika:envs.net> It would be nice to have that actually. I would like to be able to use a social recovery wallet. One of the reasons it has taken me so long to get into crypto is the fear of losing it all and not being sure how to protect against that.

plowsof: you have to look *both* ways before crossing the street

luigi1112: nah lol since universities are irl we can just hire pi's and muscle to keep tabs on them... if their loyalty to monero ever comes into question, or if they can't deliver us multisig, we pay them a little visit

scratch that idea though - my a.i. idea better

>_> <_< *am i in England or Europe... oh whats this meme on my phone lol BANG*

;')

I think MS is likely secure enough, but usability is...not awesome

we still need a new one ;-;

otherwise we'd be using it

<h​yolobrika:envs.net> Do any Android clients support the experimental multisigs yet?

<s​paceguide:matrix.org> that can happen you in banks too

<o​frnxmr:monero.social> monero-wallet-cli

doubt it considering the official gui client doesn't have it

only cli

<r​brunner7:monero.social> Yup, CLI is the only game in town

<s​paceguide:matrix.org> cellphone wallets should not be used for bigger wallets, use with caution, for beer money or something

^ agree 120%. mobile is spyware

<o​frnxmr:monero.social> I disagree

<o​frnxmr:monero.social> Windows is spyware

<o​frnxmr:monero.social> Google android is spyware

-_- so ur a mac fanboy...? wtf

mac/iphone

<r​brunner7:monero.social> OpenBSD ftw

<s​paceguide:matrix.org> if you absolutely need windoz, use it in a sandboxed vm

<o​frnxmr:monero.social> > <s​padin_spider> mac/iphone

<o​frnxmr:monero.social> No.

<s​paceguide:matrix.org> Iphone is also fucked up

<s​paceguide:matrix.org> even newer hardware these days is su

<s​paceguide:matrix.org> even newer hardware these days is sus

<h​yolobrika:envs.net> I'm only planning to keep as much money in it as I keep in my regular wallet

<h​yolobrika:envs.net> Are you responding to my comment about multisig support?

<o​frnxmr:monero.social> Yes^

spaceguide: 2013 was the year that killed hardware innocence in pc's with the introduction of intel ime and amd psp

<g​orillaquest:matrix.org> why not

anything built since then is owned by government

<h​yolobrika:envs.net> How and how common is it?

<s​paceguide:matrix.org> I guess, I should not have to explain that

<g​orillaquest:matrix.org> phones are more secure than desktop

self-plug: in my (freelance) day job I am a systems engineer for the Maemo Leste project, a FOSS (debian based) operating system for mobile phones: leste.maemo.org/images/thumb/e/e8/Statsfun.jpg/800px-Statsfun.jpg

i use it as my daily driver

and yes, SMS, calls etc. work

gorillaquest: if that's what u gotta tell urself to sleep at night bro

<1​23bob123:matrix.org> bitwarden.com/help/kdf-algorithms

<r​ucknium:monero.social> Hyolobrika (carrier pigeon bridge (sorry about the delay)): RINO wallet may be what you are looking for. AFAIK, it uses the experimental Monero multisig.

<s​paceguide:matrix.org> I know of 3 cases..

<g​orillaquest:matrix.org> ?

<s​paceguide:matrix.org> and yes, cellphones can be made safer, yet, you always have yet another minicomputer in the cell, you don;t control, which is yet another vector

<g​orillaquest:matrix.org> your not supposed to have access to that

<1​23bob123:matrix.org> I use my own stringray :0

<g​orillaquest:matrix.org> that gives applications root privileges which breaks security

if we're talking about safe from the everyday hacker then i agree phones can be safer to use... but no chance to hide from google/apple and the government, their spying, or their data collection. in that realm pc rules

<g​orillaquest:matrix.org> Phones also have secure elements and now MTE

<s​paceguide:matrix.org> well, your provider has access to it, as well as all three letter agencies

<g​orillaquest:matrix.org> Use GrapheneOS

exactly. pc's aren't TOO much safer in that regard anymore because of ime/psp but at least there's no "provider"

<1​23bob123:matrix.org> You can avoid google its not hard

old ddr2-era pc is the way to go for no spyware

<s​paceguide:matrix.org> untill AMD was safe ?

<s​paceguide:matrix.org> untill when AMD was safe ?

123bob123: "its not hard" you talking about installing a custom os like graphene? yeah "its not hard" if you have one of a handful of phone models

spaceguide: i forget which cpu it was but i'm 99% sure it was released in 2013

may have been one in the bulldozer series

<s​paceguide:matrix.org> google pixels for instance

<g​orillaquest:matrix.org> there's a reason they only support google pixels

<g​orillaquest:matrix.org> because every other phone doesn't meet their security requirements

<s​paceguide:matrix.org> I do use still a bulldozer series

<g​orillaquest:matrix.org> no secure element, broken verified boot, etc

<1​23bob123:matrix.org> Thing i dont get with GOS is you use it to degoogle and then they have google sandboxed play services.

<g​orillaquest:matrix.org> GOS doesn't advertise themselves as degoogling

<s​paceguide:matrix.org> you are not forced to use them

<g​orillaquest:matrix.org> its some community members that assume that

spaceguide: yes, google pixels. which makes you wonder about the hardware... perhaps your software is google-free, but the hardware itself was made by the adversary you're trying to evade with software

spaceguide: yeah u might wanna double check ur exact model to make sure if u have psp or not

<s​paceguide:matrix.org> I do install most of my apps straight from source

<g​orillaquest:matrix.org> AOSP is "degoogled" in a way

don't get me wrong, google pixel with graphene is still probably the best option out there, it's just so impossibly far from optimal

<1​23bob123:matrix.org> They use to advertise as degoogled

if somebody released a truly spyware-free smartphone that would be a game changer... makes u wonder why it hasn't happened already... makes u wonder what happened to those who tried

<g​orillaquest:matrix.org> because google has the funds to harden the secure element and they prioritize security

<g​orillaquest:matrix.org> unlike other phones besides apple phones

yeah we have different definitions of security bro xD

Oh wow dsc_ I didn't know you worked on that. I retired my n900s when "2g" networks were shut down everywhere I use a phone.

<g​orillaquest:matrix.org> You can hypothesize about backdoors in any hardware. Pixels are the most externally researched/analyzed mobile devices and provide an objectively much higher level of security than any other options that GOS could support

<1​23bob123:matrix.org> Maybe move to offtopic keep plowsof happy

yeah among mobile devices - i'm still considering all devices including pc's

123bob123 ok ur right we need to focus on fixing monero

so who all gonna pay me to buy graphics cards?

for epic 21st century a.i.-driven r&d for monero multisig

pigeons: hehe yeah, if you are looking into using that OS again; motorola droid 4 (2012) works quite well

<h​yolobrika:envs.net> Ty

dsc_: foss os for a non-google, non-apple device? now why didn't we talk about this earlier rofl instead of google pixies

spadin_spider: it certainly is nice to just be able to `apt install` everything from the debian repos on your phone

<h​yolobrika:envs.net> Ty

dsc_ does it actually work as a phone in 2023 tho? idk much about mobile bands but i hear they change

our next target is the pinephone

oooo i've heard good things about that one

but it is only a matter of time before proper FOSS mobile hardware come out (like pinephone), that is the trend at least

unfortunately for now we support a small number of devices

my currently relationship with my smartphone is treat it like nuclear waste until i need to make a call or send a text... been considering upgrading to a basic phone if i can find one with tethering, but if i can get a smartphone that isn't fucking rooted (like that motorola u mentioned) then that may be an even better option

rooted/backdoored whatever the proper term is

for sure

<x​mrscott:monero.social> As an owner, Pinephone Pro isn't anywhere near ready for daily driver wiki.pine64.org/wiki/PinePhone_Pro_Software_State

<s​paceguide:matrix.org> how far is it useable

<g​orillaquest:matrix.org> It's not open source hardware in general. The entire main SoC is not open source. There is substantial confusion between a device running an open source OS and the device being open source

<x​mrscott:monero.social> Terrible battery life, terrible calling and SMS experience. Would only recommend as a dev device right now

<g​orillaquest:matrix.org> Pinephone has 100% proprietary hardware for the SoC, radios, SSD, etc. Those components aren't open hardware. The cellular radio is very strange and has a separate CPU running an outdated proprietary fork of Android to talk to the baseband instead of the OS doing it directly.

<x​mrscott:monero.social> The last update by GNOME on better mobile support was over a year ago: blogs.gnome.org/shell-dev/2022/09/09/gnome-shell-on-mobile-an-update

<x​mrscott:monero.social> If you're not familiar with Pine64's strategy, their strategy is basically: release HW and hope there's a big enough software community to support it which is why the software XP is so lacking several years later

<x​mrscott:monero.social> There was even an internal skuffle between Pine64 and some of the major SW contributors blog.brixit.nl/why-i-left-pine64

<h​yolobrika:envs.net> localmonero.co/knowledge/remote-nodes-privacy

<h​yolobrika:envs.net> Is Monerujo a "light wallet" such as mentioned in this article?

<h​yolobrika:envs.net> Does it have some sort of "redundancy" so that no one node in your list of nodes can censor your transaction?

u guys mine xmr? today i hit the 0.09 mark i'm rooting so hard for it to hit the big 0.1

<o​frnxmr:monero.social> Use your own node

<o​frnxmr:monero.social> Featherwallet has multibroadcast

<o​frnxmr:monero.social> And no, its not a light wallet

<o​frnxmr:monero.social> (re monerujo)

<h​yolobrika:envs.net> I would like to. But I can't at the moment.

<h​yolobrika:envs.net> There are lots of things I am planning to self-host when I am able.

<h​yolobrika:envs.net> There are lots of things I want to self-host when I am able.

<o​frnxmr:monero.social> A node doesnt have to be malicious to "not relay"

<o​frnxmr:monero.social> it might just have connection issues

featherwallet has multibroadcast?

thats awesome

<a​nhdres:matrix.org> Monerujo comes with an embedded list of community trusted nodes, which you can delete or edit or add your own to it.

<h​yolobrika:envs.net> So? Redundancy is useful either way.

<p​lowsof:matrix.org> cakewallets chicago meetup happened, a few asked if the presentations would be recorded (yewtu.be/watch?v=xCEIcUWdUM0) reddit.com/r/Monero/comments/17qx2f…o_monero_meetup_was_a_success_heres

<g​orillaquest:matrix.org> I almost won that kahoot