10:03:39 after the ccs incident what does the community think is the best methods of crowdfunding projects 10:05:44 Can you send monero whilst offline? 10:15:53 <4rkal:monero.social> CCS with good opsec is still the best 10:17:23 <4rkal:monero.social> But whoever is holding the funds should disclose their setup to be "reviewed" by the community. At least in my opinion. 10:17:56 how would you trust a reviewed setup 10:18:25 <4rkal:monero.social> Wdyn? 10:18:30 <4rkal:monero.social> Wdym? 10:19:53 how would you verify that the approved setup is actually being used 10:20:06 <4rkal:monero.social> You can't 10:20:17 <4rkal:monero.social> Don't verify; trust 10:20:19 <4rkal:monero.social> Lol 10:20:47 <4rkal:monero.social> You are already trusting them to hold the funds so... 10:20:54 and what type of entity would be trustworthy in your eyes 10:21:12 <4rkal:monero.social> Multisig with many devs 10:39:53 You can sign a transaction offline, yes. And then submit it to an online node 10:40:07 Same as any other coin 10:45:34 <4rkal:monero.social> You can't tho can you? 10:45:52 <4rkal:monero.social> You have to have an online device too 10:46:20 <4rkal:monero.social> Before submitting the file to an online node right? 11:10:57 Well yeah, you can't be both online and offline at the same time 11:12:06 The important part is that the private spend key is on a device that never touches the internet 11:13:28 can you give examples of this setup 11:27:38 Anonero 11:47:06 <4rkal:monero.social> https://anonero.io 11:47:11 <4rkal:monero.social> Tor required 14:57:39 Thanks for foundation devices and stack wallet, cake and Monerocom wallets have native tor in next update. 14:57:46 https://matrix.monero.social/_matrix/media/v1/download/monero.social/GqqdxqmLRKySYSMvHBdXIEzh 14:57:53 https://matrix.monero.social/_matrix/media/v1/download/monero.social/EiqfXknyFrwhxHEytXfFyzNi 14:58:04 Thanks to foundation devices and stack wallet, cake and Monerocom wallets have native tor in next update. 16:09:16 monerokon 2024 planning in about an hour 16:09:20 in #monero-events:monero.social 16:09:36 agenda https://github.com/monero-project/meta/issues/929 18:51:57 <4rkal:monero.social> But whoever is holding the funds should disclose their setup to be "reviewed" by the community. At least in my opinion. <= some consideration should be made to physical security as well if "publishing" your setup, targeting involving meatspace could become more likely 19:09:45 <123bob123:matrix.org> Disclosing somethings is actually worse for opsec 19:16:04 Its on my google drive 19:40:56 hi guiz 19:42:52 sounds like security through obscurity 19:43:23 have rules that must be followed 19:43:42 regarding the opsec 19:43:44 Hello diego. 19:47:55 security through obscurity is a great thing when it comes to physical world 19:48:22 (rather, is a part of the equation) 19:53:15 Upload a floor plan of your home with positions (screenshots of any/all security cameras) so we can help improve your setup 20:01:49 yes dont forget to send the address to check if you are in a safe place 20:02:00 just in case 20:11:04 <4rkal:monero.social> If you told people about your terrible opsec beforehand there would probably have been a large backlash. 20:11:21 <4rkal:monero.social> We only learned about your setup once it was too late 20:12:45 <4rkal:monero.social> Disclosing that you have for example and offline qubes os install with an offline vm to sign transactions can't really make it easier to attack you. On the other hand if you do something stupid the community might be able to help 20:14:31 I think the opsec should be disclosed in the future 20:15:18 security through obscurity has limits 20:15:26 an attacker will find out 20:16:30 that or having a standard that everyone must follow once they get enough responsabilities 20:18:23 it'd not be ridiculous to ask for an airgapped signer when you manage funds >1M$ 20:19:33 and a signer in an offline cube when managing funds > 10k$ 20:19:55 <4rkal:monero.social> Yeah for example don't use an online windows machine when managing 500k in funds 20:20:01 and a signer in an offline qube when managing funds > 10k$ 20:20:42 we learn from our mistakes 20:21:26 <4rkal:monero.social> But yeah having a certain standard sounds like a good idea. Should have EXACTLY the same setup for every dev tho 20:21:56 Shouldnt* ? 20:21:58 luigi1111w: which is why I suggested that trusted persons deal with it without telling who they are, ofc I got laughed at 20:22:52 <4rkal:monero.social> But yeah having a certain standard sounds like a good idea. Shouldn't have EXACTLY the same setup for every dev tho 20:23:04 Maybe that will get more consideration now ig 20:23:17 Seems like people want 4/9 multisig + the plot of a Tom Cruise movie 20:23:32 2/7 20:23:42 I like 4/90 20:23:43 1/1 20:23:50 <4rkal:monero.social> 6/9 20:24:12 (4rkal is serious) 20:24:28 Dreamlandia 20:24:31 I hope people realise we will just be shooting the shit and nothing will happen until multi sig is ready(tm) 20:24:35 4/9 would not be irrealist in managing the cold wallet honestly lol 20:25:09 <4rkal:monero.social> Sorry for cringy joke ofrn 20:25:44 monerokon has not set up their multisig wallet yet because all participants need to be online at the same time for some amount of time 20:25:58 takes a while to do 20:26:01 irrealist (brb while i dictionary) 20:26:18 lmao 20:26:23 highlight and Rclick 20:26:30 > monerokon has not set up their multisig wallet yet because all participants need to be online at the same time for some amount of time 20:26:30 Arent they trusting rino aka basically dr 20:26:59 they want to set up CLI multisig as well for cold wallet 20:27:04 rino = hot wallet 20:28:01 ahi thoight rino = their solution 20:28:24 if people are trusted and good standards are adopted the risk is already significantly reduced even without multisig 20:28:38 They want to use simplex for their key exchange, thata right 20:29:37 they want to set up a simpleX group, I have no idea how things will be set up 20:30:11 that is, no idea what it will be used for 20:30:35 why is simplex better for key exchange than pgp encrypted email? Is it just cause simplex establishesbs p2p connection for the blob exchange? 20:30:57 *establishes 20:31:04 Security/convenience i think 20:31:14 sure, but why? 20:31:18 Or how? 20:34:27 So with pgp, because i have to give my blob thing to all participants several times/vice versa - i would have to encrypt the message separately with each participants pgp.pub keys 20:35:00 Unless there is a shared pgp key between us all (not sure how that would be distributed securely) 20:35:49 Protonmail does the above automagically(?) Simplex even more automagically(?) I dont know 20:36:24 do that with the key ? 20:36:58 tho that means if anyone leaks everyone is compromised, we cant just revoke one key 20:41:55 Yeah, should still be shared encrypted on simplex. There are still five (for example) phones with the blob on it. Unless there is autodestruct on messages, i guess. 20:45:01 > So with pgp, because i have to give my blob thing to all participants several times/vice versa - i would have to encrypt the message separately with each participants pgp.pub keys 20:45:01 not sure I understand this correctly, do you mean with pgp you have to create multiple encrypted messages, each for every participant? 20:46:06 You have to encrypt the message with someones public key 20:47:58 yes, but you can add multiple pub keys to one encrypted message 20:48:30 TIL? 20:49:58 Nice, PGP is more than pretty good https://crypto.stackexchange.com/a/86489 20:51:37 So midipoet i see no reason for not using pgp over trusting 'thr next best thing since sliced bread' app 22:11:26 Community meeting next Saturday - what do we discuss 22:13:40 280 XMR to be handed to 37c3 event organisers to pay an outstanding invoice, and to fund the current event: https://repo.getmonero.org/monero-project/ccs-proposals/-/merge_requests/105#note_22896 22:13:59 How to fix the ccs wallet because every option has a reason not to move forward with it 22:14:35 are we gatekeeping the ccs so that only core / seraphis devs will receive funding? is everyone finally happy? 22:16:59 xmrscott wants to raise a Q about http://mattermost.getmonero.org/ 22:21:01 adding a custom "fr-external" tag to ccs proposals with an extra "donate-url" field would allow things to be displayed on the funding required page, and simply re-direct people to the link. (no progress bar or anything unless integration for specific funding platforms is added to scrape their api on regular intervals) - problem is that the ccs backend can't be built (needs a docke 22:21:02 r wizard to handle old php dependencies) 22:23:27 also subscribe to featherwallets RSS feed https://featherwallet.org/feed.xml (theres going to be nice update soon with offline QR code transfer capabilities 22:25:53 diceware (adding dice rolls to produce seeds / add extra entropy?) and other things listed here https://matrix.to/#/!mehPttlWNbDtNeDbvu:monero.social/$wt5Khi3WaiXC8rRjPTA_QtolVgJHIp0NevdlS9Dy2bE?via=matrix.org&via=monero.social&via=nitro.chat 22:30:26 Plowsof: whats the gatekeeping topic about? 22:31:08 so currently the only assurances for proposals in the ideas stage have been made to core / seraphis dev things 22:31:38 the rest of them (myself included) are being left in the dark / asked to wait for a magic fix 22:32:42 how do you mean assurances? 22:33:45 funding will be secured for them (one way or another: either directly from the general fund / put forward for retro funding(should the ccs wallet situation be fixed shortly) or a combination of the 2) 22:38:20 all of the inprogress proposals are covered* this is for the proposals at ideas 22:49:50 Can we not just a set up a RINO wallet as a stop gap in the short term ? Is it that we don't have anyone trusted enough to run it? 22:55:51 we need more than one incase someone gets hit by a bus 22:59:30 Just leave the backup with a couple of trusted members. Don't say who 23:00:03 i am in favour of any stop gap short term solution. the bar for being "more secure" than the previous setup is really low and the disclosure can be as simple as "its not a hot wallet" hooray 23:00:25 plowsof: I agree. 23:00:52 multisig which is what RINO is based on though, is not "known secure" (there is an above zero chance an exploit exists) 23:01:07 it will be fine 23:01:28 and it's a short/medium term solution anyway 23:01:47 if events want to risk 12k with it, i am sure CCS can risk the same 23:02:22 how much normally does the CCS wallet need to hold at any one time? 23:03:26 the last group of pending payments accumulated about 600 xmr in 1 month which is an ok estimate to throughput 23:03:58 there was over 600xmr in proposals ready to be merged when the bad news was announced 23:04:52 Yeah, i count ~870 XMR in ideas now (not founding FCMPs) 23:05:02 Realistically it's gonna be 1-2k if people don't leave milestones for years. 1k per 3 months is probably not far off, I can easily check later 23:05:04 some are a no go 23:05:41 events won't keep all funds raised in RINO 23:06:11 CLI multisig = cold, RINO = hot 23:06:51 we have to ask ourselves then, the theoretical multisig hacker: would they steal a few measily monteros or wait for something big - if this is the only reasoning then , it would be safe, however , the damage to the project/core team if it happens would be severe / out weight the monetary value so seems appealing for enemies 23:08:17 in security there is a counter argument for everything :( 23:08:20 so theoretically what is the total amount we are willing to risk in a RINO wallet? 23:08:43 250 XMR? 23:09:35 244~xmr was the "unhacked amount" in the CCS2 (the small wallet that was actually used to payout people quickly) so its a good number to start at 23:09:50 Just make that the max allowed for each wallet. Will take some managing, admittedly but it's doable. 23:10:42 And just distribute control out to trusted members and don't say who 23:11:05 also, ensure backups are distributed out as well, to mitigate bus 23:11:15 to reduce the number of Monero needed to be held please pump (blasphemy) 23:11:38 reduce the coinbase outputs temporarily 23:11:53 this is no time for inflation 23:13:07 right, so we have a plan? 23:14:01 the github security experts and the anti ccs / core people will be mean to us 23:15:13 People are mean here most of the time these days, so how does that change anything? 23:16:26 we probably need four RINO wallets, and four (?) trusted members + plowsof. 23:41:47 Round and round we go 23:44:06 Or should i say 23:44:07 facepalm 23:44:37 That IF core holds it 23:46:34 argument has been had and settled 23:46:44 Solution: core doesnt hold the money, duh 23:47:13 Lets just leave the money in the known vaults why dont we 23:47:13 they are not trustworthy? 23:47:57 let Cat do it, nobody would suspect 23:48:06 +1 23:48:25 Lets give it back to luigi, so i can rob him twice in a row 23:48:38 Or give to bf, so when i finally get him, i can wipe monero clean 23:48:56 Or give it to cat 23:49:02 .. why would i waste my time on cat 23:49:06 Cat wont even get me famous 23:49:31 I hacked cat for 100xmr? "do you want a gold star sticker, ofrn?" 23:50:34 Making a big deal out of peanuts. What we lost were funds that should not have been there