00:41:00 I know this show is supposed to be less technical, but I was surprised that there was little to no mention on the methods for tracing used for those who wanted a bird's eye view. We got super lucky that the attacker was using a wallet that *appears* to be similar to PocketChange, so we got a whole lot of of output splitting and re-consolidation that the core wallet would warn agai 00:41:00 nst. The answer to this question is pretty straight forward: never reconsolidate more than 2 outputs at a time. Skipping over this detail made Monero seem a lot more traceable than it actually is to layman IMO. The layman would simply consolidate their outputs to one output, not 11, like the hacker did, which makes tracing future hops way harder 00:42:44 To be clear IDK if it was PocketChange, and I don't know if PocketChange's input selection does this by default. If so, this is a good reason why to not use PocketChange unless that code is revised 00:43:31 Reconsolidating multiple outputs from the same source is probably one of, if not the most, sharpest heuristics against sender anonymity 00:46:26 jeffro did not steal the CCS funds evidently, thank you jeff , i always knew you where a stand up guy 00:47:03 You can trust me because I said that I didn't steal them and I wouldn't lie to you plowsof 00:47:18 if they actually used pocketchange and did it to taunt us that would be insane 00:47:22 is there a heuristic that says it _was_ actually pocketchange? because the monero-gui can quite easily send to 15~ recipients 00:47:34 so to can.. cake.. and others 00:47:49 all our "tracing" is best guess 00:47:59 the cli even (with a bit of ctrl+v in a text file to construct the large string) 00:48:04 its just "more likely" that it was pocketchange if its specifically 11 00:48:35 https://matrix.monero.social/_matrix/media/v1/download/matrix.org/kQKjIwJyfviEUutHTlRgWCeE 00:48:38 even the gui has it 00:48:42 why would pocketchange make only 11 out tx's and stick out like that? 00:48:57 doesnt all pocketchange use 11? 00:49:12 10 pockets 1 change 00:50:10 There was a transaction which had 11 outputs IIRC, and then a later tx which has 6(?) of those outputs in 6 of its rings. It'd could've been GUI but you'd have to manually type in 10 destinations and for what? Just to re-consolidate them in the very next tx? 00:51:11 i wonder if xmrack and Rucknium have any new things to share from their dive into it 00:53:48 or if spackle_xmr has adjusted their churner :) 00:54:25 https://github.com/spackle-xmr/MoneroTools 👍️ 00:58:30 Yes. It appear so. From https://anhdres.medium.com/monerujos-pocketchange-what-it-is-and-how-it-works-8e1ea1f7489e: 00:58:30 > As long as it’s enabled, every time you use Monerujo to send moneros somewhere, it will take a bigger coin, split it in parts, and spread those smaller coins into 10 different pockets. That way, the coins won’t merge again, and you’ll be ready to spend instantly from all those pockets without waiting the dreadful 20 minutes. 01:01:22 every major wallet hack needs to use 11 outs to blend in with the crowd moving forward 01:08:40 how am i still connected here holy jesus 01:08:48 irc usually sucks for me anyway goodmorning gentlement 01:09:00 Good morning sir 01:09:35 what's been good my man 01:10:01 @anarkiocrypto.. he's not here but since years? has practiced and advised churning , also wondering what he makes of the recent events 09:29:45 escapethe3ra: just letting you know that someone is sending very targeted phishing e-mails to monero community devs about monero.observer domain renewal. 09:29:54 https://matrix.monero.social/_matrix/media/v1/download/kernal.eu/LugMDtmaHCmtExaMhCuIFZht 09:31:58 Does the link really go to that netcup . eu? Because that itself looks pretty legit. The real website under that address, that is. 09:31:59 <123bob123:matrix.org> Hmm 09:32:26 Of course not, it's a phishing link. 09:32:40 interesting 09:32:43 Alright :) 09:33:31 <123bob123:matrix.org> Lol 09:33:47 <123bob123:matrix.org> https://www.virustotal.com/gui/home/upload 09:33:47 <123bob123:matrix.org> Paste url in ^ 09:34:52 It's behind Bunny CDN and then Cloudflare but then the actual server is down so not operational rn or they're getting ready 09:35:50 https://matrix.monero.social/_matrix/media/v1/download/kernal.eu/EQoXjQZUuQjpdXprTdUakQBb 09:48:09 <123bob123:matrix.org> Is that the address in the phishing link? 09:48:46 if you receive one if these make sure to: 09:48:46 - not click links with tracking parameters, if you're curious visit the root url using tor browser 09:48:46 - block external media such as images in your client 09:48:47 - double check the link **targets** before clicking on them 09:48:47 - double check the sender e-mail, the displayed name "Netcup GmbH" doesn't mean anything 09:48:48 yeah 09:51:27 we're probably being targeted now because they expect shit opsec from monero community after the CCS incident 09:51:47 if you receive one of these make sure to: 09:51:47 - not click links with tracking parameters, if you're curious visit the root url using tor browser 09:51:47 - block external media such as images in your client 09:51:48 - double check the link **targets** before clicking on them 09:51:48 - double check the sender e-mail, the displayed name "Netcup GmbH" doesn't mean anything 09:53:00 if you receive one of these make sure to: 09:53:01 - not click links with tracking parameters, if you're curious visit the root url using tor browser 09:53:01 - block external media such as images in your client 09:53:02 - double check the link **targets** before clicking on them 09:53:02 - double check the sender e-mail domain, the displayed name "Netcup GmbH" doesn't mean anything 09:56:09 <123bob123:matrix.org> Bring it mofo! 09:58:32 <123bob123:matrix.org> Is that the real from email? 10:01:46 yeah it's real: 10:01:46 ``` 10:01:47 Received: from cloud-89a880.managed-vps.net (cloud-89a880.managed-vps.net [78.128.81.241]) 10:01:47 by mail.digilol.net (Postfix) with ESMTP id 05F3A3C1F553 10:01:48 for ; Fri, 10 Nov 2023 09:13:04 +0000 (UTC) 10:01:48 Authentication-Results: mail.digilol.net; 10:01:49 dkim=pass header.d=combellbe.com header.s=default header.b=o4RbfoFS; 10:01:49 spf=pass (mail.digilol.net: domain of infos⊙cc designates 78.128.81.241 as permitted sender) smtp.mailfrom=infos⊙cc; 10:01:50 dmarc=pass (policy=reject) header.from=combellbe.com 10:01:50 ``` 10:08:37 <123bob123:matrix.org> https://github.com/alpkeskin/mosint 10:13:58 <123bob123:matrix.org> Not on spamhaus list too 10:27:34 Did you get off the hook and now you're on edge? Have you been looking for her best possible way to score a good amount of any kind of ɖrųɠ since your neighbouring plug let you down ? Stay classy ✌🏻 🔥‼️and get across to the most vouched for HEAVILY from coast to coast & everything is tested ‼️🔥 -FREE SHIPPING AVAILABLE TO ALL OVER THE USA 🇺🇸 10:27:34 -🛑Reddits 260mg 🛑 10:27:35 -🍊Orange Teslas CP260mg🍊 10:27:35 -😸Ketamine (R Shards)😸 10:27:36 -❄Pure uncut Coke 💯 10:27:36 -💊MDMA (Molly crystals) 💊 10:27:37 -💁🏼SASS “MDA” 💁🏻 10:27:37 -🌈Lucy paper 200ug🌈 10:27:38 -☢Addies 30mg IR ☢ 10:27:38 -Xanax 🦴White🦴Blue🦴Yellow B707 -🔵Oxys 10:27:39 -😇Crystal Meth😇 10:27:39 -🥤Wockhardt syrup 🥤 10:27:40 -👽DMT Powder & CARTS 👽 10:27:40 -Full gram THC carts 🌲 10:27:41 -🍄Penis Envy, Golden Ts & White Albino🍄 10:27:41 -LSD 🌀 Gels 250ugs & 300ugs sheets available 10:27:42 -Edible cakes 10:27:42 -Cali Dispensary Exotic Sativa, Indica and Hybrid Flower strains like Moonrocks, Zootiez, OG Kush etc🍁 10:29:15 Banhammer: BanhammerMonero: 10:29:31 <123bob123:matrix.org> [Banhammer]() 10:37:24 who would take a drug named after reddit 10:39:48 Whats it called? Also no 10:40:43 > we're probably being targeted now because they expect shit opsec from monero community after the CCS incident 10:40:55 That's a maximally pessimistic view of this :) 10:41:35 Just hope they learn and really highten their security practices 10:45:12 <123bob123:matrix.org> Must be a data scrape 10:50:47 nobody born before the year 2000 uses emojis, that will surely limit the pool of suspects 11:09:24 <123bob123:matrix.org> Oo 11:39:11 recanman: mind if I dm you? 15:10:54 What the hell is Wockhardt Syrup? 15:14:05 Its monero 15:14:44 is an H 1 receptor blocking agent 15:15:39 so an antihistamine 15:16:06 Used to 15:16:42 They released an update around 24-48 hrs (before?) The hack, which nade the number more random 15:16:53 Made* 15:18:24 Are messages being dropped? 15:24:24 nioc: no, seems like ofrnxmr is replying to old messages 15:25:04 whoops. nioc, i didnt quote 15:25:23 was replying to monerobull & jeffro regarding pocketchange always using 11 15:25:37 Thx 15:26:52 Yes but as previously discussed the hacker may not have updated 15:27:39 No auto update 15:28:55 How hard is it to install a fucking spell checker. Option 2: Get a ofrnxmr: parser on my end. 15:34:23 a spell checker that engages in sexual activities 15:34:42 weird request trasher, weird 15:37:51 I that perspective, I agree 😆 15:37:51 Also, adjust your parser. I was not suggesting an improper relation between a potential spellchecker and ofrnxmr for the record 🤣 15:39:29 you dont want ofrnxmr to have some fun? cmon now :P 15:41:38 "i that perspective" 15:41:38 Are you my alt? 15:42:12 With a spellchecker? I'm not judgemental. 15:42:12 Ah, my primary has awoken. 15:42:17 (yes) 15:44:22 Option 2 sounds kinky btw. But a bit off topic, maybe even nsfw 15:45:39 https://photos.google.com/photo/AF1QipOarFOS0ZQBxnS6gu8FGueULJuq_kDcTO3bvvaq 15:46:18 https://matrix.monero.social/_matrix/media/v1/download/monero.social/viQoVJAYxLFoAcjqnXUueKDw 15:46:28 Better. 15:47:12 It's Friday night here. 15:48:08 Happy friday good Sir(s) 15:49:29 NSFW: I had to google that one "not safe for work". 15:49:56 does that bottle say 'headache' in italian ? 15:51:44 dsc_ No, it's one of the great ones. Barolo is (maybe) a close cousin, but still. 15:53:12 No I'm on a lame ass Jacob's creek, to finish of the evening. 15:54:14 *Now I'm ^ 16:29:27 jeffro256, xmrack , plowsof : Last year tevador said "If you want to know my personal opinion, I'm for going all in on privacy. That means removing the tx_extra field and mandating all transactions to have 2 inputs and 2 outputs." https://github.com/monero-project/monero/issues/6668#issuecomment-1195995604 16:29:40 Requiring 2in/2out for all txs would require dummy inputs: https://github.com/monero-project/research-lab/issues/96 16:30:10 Consolidations is how Juraj Bednár proposed this probabilistic analysis of Monero merchant revenue at MoneroKon 2023: https://piped.video/watch?v=-sTT84Up7FY 16:31:08 We don't really know how requiring 2out/2in for every transaction would affect identifying the real spend since users would still need to do consolidations. It would just happen one output at a time, some time after the 10 block lock. It would also make using Monero annoying for users who need to consolidate. The decoy selection algorithm could be modified to select more from rece 16:31:08 nt outputs, but that's not the only thing you would have to consider. 16:31:26 I have some draft code to count likely PocketChange transactions _and_ likely consolidations from many-output txs using the Hungarian algorithm. I'm not ready to release results since I need to double-check everything for correctness. Probably not in the near future since I really need to focus on OSPEAD. People are rightly asking what is taking so long. 16:31:45 What I see in the draft results is no obvious increase in PocketChange-like transactions per day or week when PocketChange was released, nor an increase in txs that consolidate enotes from 11/12-output txs. 16:33:07 Well it would be a better situation than "one at a time". You can still consolidate any N outputs in O(log N) time b/c each round you consolidate in N/2 transactions 16:34:07 But yeah it would be worse by a certain linear factor 16:35:02 Yes, you're right. But broadcasting two consolidation txs at the same time might provide certain information to an observer. 16:35:07 Well max of 2-output would prevent the PocketChange terrible reconsolidation type of tracing 16:35:44 It would still be better than putting it all in the same transaction IMO 16:37:03 You might've taken this into account, but they had a pretty long beta testing period 16:38:08 I thought the beta testing started at the beginning of May 2023. 16:42:42 Ehhh I think you're right 16:43:08 I think I was thinking of the development time since it was on their roadmap almost 2 years ago 16:43:57 There really is no discernible increase in 11/12-output txs? 16:45:56 Not that I can see with my eyes. To do a proper time series statistical analysis would require a lot more thought. Time series is a complex area of statistics since observations are not usually independent. 16:49:36 Thanks for looking at that! 16:50:36 I know Monerujo is pretty popular among android users but I guess that isn't a big enough slice of total userbase 16:51:47 2 and 16 ftw 16:52:04 You have to enable PocketChange. Maybe few users enabled it. 16:53:19 > jeffro256, xmrack , plowsof : Last year tevador said "If you want to know my personal opinion, I'm for going all in on privacy. That means removing the tx_extra field and mandating all transactions to have 2 inputs and 2 outputs." https://github.com/monero-project/monero/issues/6668#issuecomment-1195995604 16:53:19 Agree, but 2 and 16 16:53:28 Limiting the number of outputs would not affect the type of analysis that Juraj Bednár did. 16:54:08 Limiting inputs is an issue that i cant wrap my head around 16:54:48 For P2Pool coinbase output consolidations, you could allow many inputs as a special rule for coinbases. 16:56:02 Im in the party of segregate coinbase 16:56:04 Whatever option maximizes privacy should be priority. But that's just me 😎 16:56:26 and also dont use rings for coinbase consolidations 16:57:33 drain the general fund by making it fund seraphis + full chain membership things 16:58:22 What? 17:00:22 that would optimise privacy in the smallest time frame 17:01:40 and funding a "known secure" multisig as Rucknium requested exploring in the last MRL meeting 17:04:21 But https://en.wikipedia.org/wiki/The_Mythical_Man-Month 17:04:28 I like optimizing privacy, but.. Get that CCS shit together, and do it. ( I have to admit, at this point, I don't think monero multisig is viable) 17:04:31 "Its central theme is that adding manpower to a software project that is behind schedule delays it even longer." 17:07:00 to me that implies we should reduce manpower and let only one person do everything 17:08:00 How do you get there? Please break down your reasoning. 17:10:47 My request was aimed at SNeedlewoods: 17:11:27 qwik math ... more men = more time ... less men = less time!? 17:11:38 jk btw 17:12:26 No answer? Just noise. 17:12:31 You're close to what the author proposes, but not one person doing *everything*, just a small number of people (or one) doing "the programming". Think of an operating room. How many surgeons are there usually? Just 1. There are nurses, people to organize the tools, people who hand the surgeon the tools, people who clean the tools, people monitoring vital signals, people who are ta 17:12:31 king notes just outside the operating room, etc. The author posits that an organizational model like that usually produces the best results when doing software engineering 17:13:31 iirc ooo123 asked had anyone achieved anything worth noting as a team , im not sure if there where answers, maybe he was referring to this ^ lol 17:13:35 lmao that name 17:16:16 It's hard to tell if Monero development suffers from too many cooks in the kitchen. I can't tell b/c there's always so much to do, but there's never enough reviewers and testers (except for really important stuff) 17:16:22 jeffro256: Hanging out on GitHub for a while would show how many people are involved in a single change to the monero code. The MF'er can count all he want's but his math doesn't add up. 17:18:34 Idk sometimes that happens where everyone gets involved in one change, but most of the time you have on person who does almost all the coding work for a PR, then everyone else reviews/suggests small changes/tests 17:18:39 That's not only that. Bad math = bad boy. Zero argument. 17:19:06 damn I got destroyed™️ 17:19:30 By involved in that last comment, I meant involved actually writing code. It's good to have losts of people involved otherwise in things 17:20:14 that sound's like an interesting approach jeffro256, but would be really hard to organize for monero I guess?! 17:20:26 jeffro256: That Moo dude is my hero. I've been watching for years. 17:20:29 sorry trasher if my bad joke offended you 17:21:54 Yeah it would have to happen by volunteerism but I don't think it would be impossible 17:22:13 mooo is a beast 17:22:25 Np 17:22:36 Yes, cows are 17:23:47 No worries. I can take shit, not getting offended. I won't shut up though, if I see a challenge 😎 17:24:42 s/got/not/ ^ damn keyboard. 17:26:21 Any of you can get me a USB wired danish keyboard, I'm in need. 17:26:21 This one wont last much longer. 17:26:52 H E L V E T E 17:26:56 wait that's swedish 17:26:57 Fkn ofrnxmr, go fix your spell check 17:27:03 Off-topic, but has there been a public discussion anywhere about securing the general fund? 17:27:27 Not too much in public yet 17:27:37 svensk jævel :) 17:27:44 ja toch 17:28:27 how is it secured currently? or how to secure it moving forward? 17:28:41 yes 17:29:37 That isn't Swedish. It's "Ja tak" same as danish. 17:29:49