00:38:10 hi need help please 01:47:51 I might be hilariously out of touch with this but in case it isn't said: Seth it out. He's sold out. He's no cryptopunk 01:50:44 if you think otherwise, make your case. He's been pushing the fabric between the values he knows and his own profits for a long time. I honestly don't know anyone who doesn't think he's a total sellout nowadays 01:53:11 that sweet spot between "I love monero!" and bitcoin "#blessed" 01:53:12 if you can understand monero than tell me how he's not a scammer 02:53:13 Seth will convert more people to Monero than anyone in Monero only content silos on social media platforms 02:55:02 If he just says Monero only, no one who needs to see his posts will see any of his posts. 02:55:12 If you don’t understand that, then your brain is too small 03:01:56 https://x.com/sethforprivacy/status/1816267117592993811 03:12:25 <3​21bob321:monero.social> Banned word btw 03:12:28 <3​21bob321:monero.social> S*th 03:32:47 ironically, Seth has been looping back around to Monero after being disillusioned with how terrible lightning is, how bad Bitcoin privacy is, and how horrendous the BTC community is intellectually 04:18:29 ban 04:19:17 S*th is a banned word /s 04:20:21 "I honestly don't know anyone who doesn't think he's a total sellout nowadays" anyone who understands monero's shortfalls 04:25:06 "if you think otherwise, make your case." The day i lose sleep over how what another man does in his own time, ill be sure to go tell my story in #monero-beyondmeat 04:31:47 ofrnxmr: what are in your opinion understands monero's shortfalls? 04:40:56 <3​21bob321:monero.social> I think sith lord gave up after whirlpool got nuked by the gov 04:42:55 I need someone to update themonero.dance for xmr 04:47:37 my smol brain sees bullshit when I see's it. He's trying hard to be two things and take advantage both ways without committal to anything while appearing "graceful" but he isn't and he's milking people with his affiliations and those of his sponsors. Maybe it's a coincidence. But what do I know? I have a very smol brain 04:51:46 "what are in your opinion understands monero's shortfalls?" Its not nearly as private or scalable as monero gospel preachers would like to believe 04:52:32 He did a really good job of chasing down the problems with lighting privacy. When money doesn't get in the way this guy has talent 04:52:54 And it often spends more time kicking tires than solving problems 04:54:56 "He's trying hard to be two things and take advantage both ways without committal to anything while appearing "graceful" but he isn't and he's milking people with his affiliations and those of his sponsors" milking who 04:55:09 What does he sell to monero? 04:55:28 has he mentioned proton lately? yes. That's just one of the many 04:55:39 Meanwhile, here in monero, we fund oscar hopefuls 04:56:29 "has he mentioned proton lately? yes. That's just one of the many" whats your point? That he's not allowed to use proton? 04:57:02 it's pathetic. and it's actually what I hope I might be able to contribute (humbly) towards. All the pieces are here but it's such a complex project that no one knows everything. Much like when I do so when I work on a satellite or a missile. 04:57:17 "hope" < actions, dancer 04:57:51 I'm not without actions. I've been doing things. I appreciate the goading :) 04:57:56 You want to be an influencer, but youre just hating on a guy who speaks his mind on his twitter 04:58:22 systems engineers are influencers now 04:58:23 And wanting to be an influencer is sad 04:58:48 No. Systems engineers are systems engineers 04:59:05 That's what I do 04:59:12 Having a blog doesnt make you an influencer 04:59:33 Youre mad that seth has a twitter 04:59:43 "shutup and shill my monero!" 04:59:46 goddamnit I"m not an influencer I only have a twitter with barely anyone followers 04:59:59 You WANT to be an influencer 05:00:24 lightning is the best protocol ever envisioned 05:00:27 And youre salty that your idol doesnt do a better job of shilling monero. Its weak 05:00:29 don't @me 05:00:40 I've taken great steps to not be an influencer. I post crazy things just to see who sticks around lol 05:01:30 Youre focused on s*th. Find a better hobby 05:02:27 when something captures my focus, it does. then it passes. I haven't mentioned seth in probably almost a year 05:02:29 I'm not defending him, im saying youre like 2yrs late to the "fk s*th" party 05:02:51 Its disgruntled fanboyism at best 05:03:20 I was on his team 2 years ago. I gave him a chance. I don't understand "fanboyism" 05:03:30 Find a new influencer to idolize and be disappointed with 05:04:00 "I was on his team 2 years ago. I gave him a chance. I don't understand "fanboyism"" << contradicted yourself all in one message 05:04:13 I said my peace already. I said it everywhere. It's the past now 05:04:50 "i was on his team" << llol. "i gave him a chance" lmao "i dont understand fanboyism" you literally just explained that you were bandwagoning 05:05:02 it's up to future generations to interpret now 05:05:24 Bruh. Monero is only a decade old 05:05:30 https://sethforprivacy.com/posts/why-i-focus-on-bitcoin/ "I said my peace already. I said it everywhere. It's the past now" him too, now take this drivel elsewhere 05:06:13 in the whirlwinds of crypto markets, it's easy to lose focus on the fact that we're changing the world here 05:06:45 luigi1111 lightning is a shitcoin @luigi. 05:06:49 yeah, then for some reason we start talking about what seth had for breakfast 05:06:54 wohh price went up and down, i forgot im changing the world here 05:07:00 insightful 05:07:30 +100 plowsof 05:07:52 Lol. 05:08:12 precisely 05:08:15 <3​21bob321:monero.social> Ban 05:08:28 This isnt even market talk, this is barely passable for #monero-beef. Thats y i said #monero-beyondmeat 05:09:10 Can take up your grievances with seth's personal choices on the twit 05:09:40 I think the reason everyone has banned you is bc you're such a banterer. this is a 3 line convo extended by your efforts 05:10:19 bruh is trying to restart the ban convo 05:10:27 Go touch grass 05:10:37 >dMartian has left the chat 05:10:41 Ty 05:11:43 "if you think otherwise, make your case. " << complains when someone responds. Some ppl.. smh 06:54:49 hey everyone, i've been using monero to proxy between different chains and cexs -- just for privacy. but seems i'm always timing moves with red candles 😅 a lot of times i'll move say eth or randocoin into monero through some bridge like simpleswap then "churn" to a different account, then send to a cex, then sell there and offramp -- and that can take a few hours between all 06:54:50 the confirmations. 06:54:52 i've started to hold xmr long term, to try and time the buys and sells to the market, but i'm wondering if there are better ways 06:54:54 any tips here? better bridges or different approaches? 06:57:08 oops, sorry wrong channel - didn't see the "workgroup" in my sidebar. i'll repost in support 07:09:12 this ofrnxmr guy 07:09:14 at the very least, read his message first ffs 07:22:16 first of all, seth represent himself as a "Privacy guy", he was full time bitcoin whistle blower, but after bitcoin lost its every single privacy and became useless he came to suck up to monero because he just ran out of "Privacy related subject" to talk about, i know a lot of people came to monero through seth after they understood the importance of privacy + shortcomings of bitc 07:22:16 oin in that regard + core devs has no plans to fix it 07:22:18 but what if you could achieve a half decent half assed privacy on bitcoin? wont he reverse this flow? if you think logically, he or anyone that cares about privacy should know that bitcoin wont give you privacy and there is no hope for it so he should focus more on other projects such as monero,zano etc.. 07:22:20 but despite all of these he is so fixed on bitcoin and finding a toy to play with it on its blockchain(is it bep 200 or something these days?), as bitcoin cash guys said: bitcoin folks motive is to waste time until CBDC gets ready 07:22:22 but yes its his free time he can do whatever he likes, the real problem is some core people from real privacy projects give him too much credit 07:24:11 i dont care if you want to suck up to him or not but, seth is just a guy who wants to play around with new toys on bitcoin, he doesnt give a single fuck about freedom nor privacy or any other right-wing movement 07:25:47 that guy said the same thing, that we shouldn't forget our way which is maximum privacy, most of the people here are not "monero guy" but "privacy guy" if you have better option tell us now well switch right away(there are non to my knowledge) 07:28:57 The funny thing is, he came to monerocon to talk about bitcoin privacy😂 07:29:40 And why we need more privacy tools on bitcoin 07:29:42 Just use monero bro 07:30:07 simpleswap can freeze your coins. consider swapping through https://haveno-reto.com 07:31:57 he works for a bitcoin hardware wallet manufacturer now, not surprising 07:34:52 Btw pressuring new people to doxx themselves should be a punishable act imo 07:34:54 I dont care if its just trolling or not but dont make it personal 07:35:29 as i told, he is a bitcoin guy not privacy 07:37:28 Disagree 07:37:51 Only recently went btc and he’s coming back. Been privacy guy for years upon years 07:38:40 bitcoin privacy is a totally lost cause 07:38:59 they had samourai until they didn't 07:39:34 it was their last remaining bit of real cypherpunk privacy 07:40:37 Are you the admin on r/monero? 07:40:56 Wasn’t the Whirlpool backend open source? No one can just throw up new coordinators? 07:40:57 i am one of the mods yeah, im guessing you need a post approved? 07:41:13 nobody want's to run one 07:41:25 and the ones that do have no visibility 07:41:46 Yes that but also if you can confirm our reddit account for shadowex is the legitimate one (have posted a link to it on our contact page) 07:42:29 Last account got instant banned because we accessed reddit on Tor. Why does reddit have a tor link but if you use it your account gets suspended. 07:42:50 The charges against tdev and the other guy are **conspiracy** to laundry. The charges are due to their social network posts and crap. They were bragging about help North Korea & shit. That’s why they got indicted. 07:42:52 Long story short, running that coordinator is not a crime. People shouldn’t be afraid to run one. 07:43:02 ^ 07:43:05 haha thats my problem as well 07:43:59 i dont have a the required bandwith and storage and time 07:44:00 what should i do? 07:44:04 i dont have the required bandwith and storage and time 07:44:04 what should i do? 07:44:20 the docs also said they laundered every single dollar that went through it 07:45:18 Well the only evidence of that will be their own stupid ass statements 07:45:30 It’s really like they wanted to be indicted or something 07:46:10 WHY YOU DONT USE MONERO INSTEAD??? 07:46:10 this is such a mental gymnastic for seth fanboys, why you cant use monero? 07:48:19 Who is “you”? 07:48:52 anyone who is interested in bitcoin privacy tools 07:49:12 Seth is king Monero recruiter. The statements about him are incredibly inaccurate. 07:49:59 you say to check your website yet your website has a different reddit account on it than the one you are submitting with lol 07:50:15 king monero? who was that again? 07:50:25 check again in 5 mins, clearing cache 07:50:37 ShadowEXofficial is the new one. 07:51:03 you see it on the contact page? you must of got a message from a different account that reddit banned after I made one post because we were on Tor. 07:51:36 https://matrix.monero.social/_matrix/media/v1/download/matrix.org/okDqVSKQZFVxyoLxmdktEKQH 07:51:44 or is that the banned one 07:52:29 thats the banned one. 07:52:48 ill repost it 5 mins. 07:56:40 is mymonero gone for real`? 07:56:43 is mymonero gone for real? 07:57:05 Didnt know that we have a King 07:57:06 Maybe that's why the monero church project got blocked 07:59:09 Our exchange when we started earlier this year were based in Germany, we had to shut down for a month and half and came back online this week because of legal issues, but since then registered it to another jurisdiction in which we have no obligation to collect any information and operate as we were. We received an order to meet reporting standards or to shutdown back in May, so w e just shutdown and relocated so we would be legally allowed to operate as we were before without bending to the will of those who want to destroy privacy. the fact 'suspicious' addresses that exchanges are suppose to flag is completely stupid, and only exists limit the spread of Crypto use, every single transaction on a public blockchain will always have been linked to what they call 'suspicious' addresses if you go back far enough 09:31:57 apply for https://kycnot.me/ list 09:35:28 https://x.com/ProtonWallet/status/1816108710386647344 09:37:22 already done from months ago, contacted him again few days ago after relaunch and he should be finally doing it. 09:38:05 sadly monero is just a shitcoin in the eyes of the super privacy focused proton foundation 09:38:26 They accept it as payment 09:41:53 no they dont 09:43:15 Maybe im imagining haha, I swear I paid with monero for proton vpn, or must of been another vpn 09:43:46 ivpn or mullvad 09:44:24 proton has been actively ignoring monero for 7.5 years eventhough its one of the top voted proposals on their "the voice of proton community" forum 09:44:36 ivpn I think 09:45:10 its because they are 'privacy' focused as a marketing strategy, they do not really care about it 09:47:16 Proton must be private because they hold their customers private keys 09:50:17 https://matrix.monero.social/_matrix/media/v1/download/matrix.org/IwFlqVShQQDcGMyEEMGCRKCr 09:50:21 lmao they removed lightning and coinjoin 09:51:30 ofrn jinxed it lol 09:51:52 yea, personally the lack of monero payments is a deal breaker for vpns, for me 09:53:54 https://vigilante.tv/w/f9t487fgh9HtKVKHH1rdjt 09:54:04 11:50 Proton Mail 09:54:33 IVPN takes XMR directly and sponsors monerokon every year. 09:58:19 i didnt try ivpn, but mullvad fits my vpn criterias 09:58:28 i didnt try ivpn, but mullvad fits my vpn criterias too 09:58:40 Anytime an alleged criminal has used the protonmail service the feds subpoena them and the crook gets arrested 09:59:01 most of them are not criminal 09:59:23 bro, literally any public, centralised, and for-profit company can be forced to comply to whatever the law enforcement demands 09:59:35 proton is no different 09:59:57 the question is only, did the user remain anonymous while using the service or not 10:00:08 thats the problem 10:00:10 they could have arrested trump's shooter if they wanted, he had his finger prints all over the place 10:00:11 No logging(tm) 10:00:12 but as long as you want to use privacy tools simply for your personal privacy, they knock your door 10:00:14 if not, then LE will get them next 10:00:21 Yeah of course this is what happens when you leave the encryption to a third party 10:01:49 Some people walk into a casino, believing that they could win 10:01:51 it's all a matter of implementing proper opsec, depending on the use of internet one wishes to have https://blog.nihilism.network/servers/opsec4levels/index.html 10:02:18 thats why if your centralized, you should log least amount of data 10:02:20 like in mullvad you can buy subscription with monero without any kind of sign up req and using tor address of the website at that while keeping the service open source 10:03:08 Yes Mullvad is a great example of how to implement privacy and security in a centralised environment 10:03:39 as a company there are a few things they can do if they truly care about their users' privacy (no logs / and allow anonymous traffic) 10:03:40 but that's not the point here, the point is, as a user, what are you doing to protect yourself from repercussions 10:04:33 if you use a service with your gmail account, and actually mention you live somewhere, and without keeping tor between you and the service, that service cannot be used anonymously, period 10:05:40 Being completely anonymous online is next to impossible 10:05:55 i know but ease of use matters too 10:05:56 i want most amount of privacy with least amount of labor req for maintaining/learning and doing it 10:05:58 im okay with paying money as long as they accept something like monero that doesnt blow up my opsec 10:06:19 If an adversary has enough money time resources skill ect they’ll find you eventually 10:07:21 every one has different char based on these two factors but in the end, the service that give users most of these two is the winner 10:07:24 it is definitely possible, if you implement the proper technology and behavior https://blog.nihilism.network/servers/opsec/index.html, with proper internet use segmentation https://blog.nihilism.network/servers/internetsegmentation/index.html 10:07:26 quit having this defeatist attitude, it doesnt lead anywhere 10:08:10 thats why we need to normalize it so it gets harder and more expensive to pinpoint people among the crowd 10:08:42 just like how tor use it(i know tor is not fully private) 10:09:20 anonymity in general is a much stricter practice than that of privacy, and opsec-wise it is more demanding, but no it's not impossible 10:09:53 either way im going to wait for protons response, if they promises to implement monero payments its fine but if not, i guess im gonna switch to tuta for now 10:14:29 https://survey.stackoverflow.co/2024/ 10:14:30 stackoverflow 2024 survey results are out 11:38:33 They ignored 6year old vote and recclently tweeted "not interested in shitcoins" 11:38:56 "either way im going to wait for protons response, if they promises to implement monero payments its fine" so.. dont hold your breath 11:40:00 "WHY YOU DONT USE MONERO INSTEAD???" Monero isnt some sort on panacea 11:40:52 Sure "use money" is better than most other solutions, but its far from fool proof 11:41:05 "Use monero*" 11:44:07 they already responded 11:45:09 they said monero is le scary crime coin aka the same argument the feds made when trying to ban regular citizens from using encryption aka the very thing their entire product is built on 11:45:10 their twitter account also follows a bunch of btc maxis lol 11:45:20 ^ right 11:46:51 Proxy store is the only "official" way to send them xmr for anything, and they also block signupsbover their onion unless you feed them another existing email addr 11:50:11 turns out it was never about privacy 12:25:48 Proton is known for closing accounts when requested by feds. check video above 12:26:50 monerobull, I read your reddit post 12:27:12 yes? 12:27:50 I don't think there is a vulnerability, tx fees should go higher in that case right ? 12:29:21 no 12:29:28 they should actually go down 12:29:31 and they did 12:29:55 your wallet should automatically select a higher fee level but that was bugged 12:30:34 I mean if miners are constant and there's a lot of tx to be mined, tx fees should compete for higher right ? 12:31:05 I mean I read the post in reddit but can't get the technical issue in there 12:31:07 people need to shift the blame target from the company, to their own opsec, that's something i don't see often enough 12:31:09 anyone can help me out 12:31:32 https://localmonero.co/knowledge/dynamic-block-size?language=en 12:32:25 Proton is suspicious in itself, since they suggest false privacy 12:32:53 by creating and posessing the private key 12:33:37 yea serverside encryption is phallacy 12:33:57 you can not access the mail service via imap or pop3 12:35:52 thnks 12:38:12 it is also very strange that discord is bein used for communication in the crypto space although it is proven spyware: https://spyware.neocities.org/articles/discord 12:44:43 there were already great improvements in communication e.g. bitmessage https://wiki.bitmessage.org/ 13:03:17 Discord is mainly used for public communiation and 13:03:25 community management (*Authoritarian tools*) 13:03:50 Also, Discord and Bitmessage are the most opposite messenger I could ever imagine myself 13:04:04 Bitmessage don't even support group chat 13:04:24 and was unmaintained 13:04:57 discord is a centralised, closed-source, chat service meant for mass-surveillance 13:05:15 It isn't an issue if it is public 13:05:38 and yea, in conclusion it's only usable for public use 13:05:58 and yea, in conclusion it's only suitable for public use 13:28:32 "monerobull, I read your reddit post" << sounds like nonsense to me tbh (the people taking credit) 13:29:11 " to our campaign namely Incognito," lol 13:30:32 it does have. called "subscriptions" http://unixmen.com/wp-content/uploads/2013/07/Bitmessage_012.png 13:33:17 It hasn't changed. Really as *email-oriented* as I remember 13:37:36 Depends on what you mean by "public", but I can't use it since it requests that I put in a telephone number 13:37:55 Also all of its client code is closed source 13:38:00 Yes that is fair. I had to use juicysms 13:41:22 If it at least we could add SimpleX 13:42:19 https://blog.nihilism.network/servers/opsec4levels/index.html different internet uses: public use (you're under surveillance), private use (you're not under surveillance), anonymous use (you're the same among other users, and cant be deanonymized), and sensitive use (actions that must remain secret at all costs) 14:06:13 thats the part tht i cant pass as well 14:06:14 im okay with email but phone number is meh(i used the web application) 14:08:49 For having made a discord account recently is impossible. If you don't have a residential IP you're screwed. Numbers will be invalid whatever you try, you can't change your email, captcha everywhere, you can't join servers or start discussions. Of course everything fail silently 14:08:54 whats your opinion on using simplex without any additional layer of protection like vpn,dns changer, sandboxing etc etc.. 14:08:54 can it be used for sensitive data? or its anonymous and private? 14:09:35 4 questions hold on 14:10:03 whats your opinion on using simplex without any additional layer of protection like vpn,dns changer, sandboxing etc etc.. 14:10:04 does it fall under sensitive use case? or anon? or private? or maybe all? 14:11:21 thats why i came to matrix directly 14:12:47 > whats your opinion on using simplex without any additional layer of protection like vpn,dns changer, sandboxing etc etc.. 14:12:48 I say it's fine, they have alternate routing. Just don't use it in clear if you don't want your ISP to know it 14:12:50 > can it be used for sensitive data? 14:12:52 Their messenger protocol is safer than Signal with more cryptographic properties accross the board. Everything post-quantum, even the key exchange (which isn't the case of Signal) 14:12:54 > or its anonymous 14:12:56 Completely anonymous, no ID whatsoever. For peopl to start talking with you, you have to create a one-time link. When they connect through that link they then initiate encrypted connection with you and you share your profile (name photo etc). 14:12:58 Same for group chats. You can also generate incognito profiles. Thats what almost everyone uses in Haveno-reto simpleX channel 14:13:00 and private? 14:13:02 Yes 14:20:09 i did install it on my system but its group chat was bit of a mess, but i use it for 1 to 1 conversations and it works fine 14:20:30 Group chats are really more like 1:1 chats 14:20:31 and about signal 14:20:32 i cant trust them after the drama tbh 14:21:14 You connect directly to most group participants 14:22:33 yeah but loading messages is slow, and some minor issues 14:22:34 in general it needs little bit of polishing to compete with signal or telegram UI/UX 14:22:36 The big + for simplex is not relying on default servers 14:22:48 I honestly lost track of Signal drama, all I know is that I can't propose SimpleX to my inner circle because they are already too dumb to use Signal 14:22:52 Loading msgs is slow, mostly over tor or when using ios 14:23:42 But not slow in general. The slow msgs are platform and network issues, not simplex issues. Signal is slow over tor too (bcuz of tor ddos) 14:24:27 (ban everyone for offtopic, kbye) 14:24:50 my analysis on simplex: 14:24:50 -it is open source (clientside+serverside): suitable for private use 14:24:52 -it can be used anonymously ? depends on the VM / host setup 14:24:54 -sensitive use ? depends on the VM / host setup 14:27:50 signal on the other hand, is not open source on the serverside 14:28:05 signal on the other hand, is not open source on the serverside, so i don't consider it suitable for private use 14:28:17 there was a critical part that no one paid attention to it iirc 14:28:18 when durov(telegram owner) bashed signal everyone defended signal for bein open source unlike telegram server side, audit by thousand blah blah 14:28:20 but the most important part was that: 14:28:22 durov said, for companies located in the US, they cant use custom Cryptography for their apps/products and US is so serious about this, now you can say that well its a mechanism to stop scammers and fake encryptions 14:28:24 but in telegrams situation, durovs brother custom made that their cryptography to use for encryption and its open source and audited as well in case you dont trust them(encryption wise but still its closed source server component) 14:28:28 I don't get why sensitive use would depend on the VM / host setup 14:28:58 sensitive use has the requirement where you need to have plausible deniability, so yea it depends on the vm / host setup 14:30:32 that was one of the main reasons telegram left the US as durovs claims 14:30:34 im not a cryptographer but i dont think this is a small matter when government decides what cryptography you want to use for your service, i mean, its obvious that they dont want to let people stay anon and private right? 14:30:36 this is something that i didnt see anyone mentions it, fanboys just shilling each other for being a honeypot 14:32:08 btw telgrams cryptography is made by durov's genius? mathematician brother iirc and as i said, its open source if you want to audit it yourself 14:32:40 1. PQXDH is a custom scheme. yes they are using SHA and AES-256, but also Curve25519 which is not endorsed by NIST. I'm highly doubtful about this: US is so serious about this. I don't remember signal trying to obtain some sort of FIPS or whatever. 14:32:42 2. durov brother are the most hypocritical pos, they sold their soul to putin and proposed an encryption scheme with several vulnerabilities and unknown variables. All of that being opt-in of course. Not later than 1 month ago someone shared on #monero-offtopic a post from a furry explaining all the issue with Telegram encryption. They are the first one to shit on other while stil l giving server access to russia gov to *counter Terrorism* 14:32:48 that was one of the main reasons telegram left the US as durovs claims 14:32:50 im not a cryptographer but i dont think this is a small matter when government decides what cryptography you want to use for your service, i mean, its obvious that they dont want to let people stay anon and private right? 14:32:52 this is something that i didnt see anyone mention it, fanboys just shilling each other for being a honeypot 14:33:32 thx for summarizing 14:34:28 oh mb forgot about Kyber. Signal is using Kyber, which is endorsed by the NIST 14:36:18 I may be a little harsh with durov but honestly every telegram shillers out there are praising a honeypot. I remember back in the day when they were saying to be *safer because we use SHA-512 instead of SHA-256* 14:37:00 and other non sense. They are the same one willing to change from AES to GHOST because its russia certified 14:37:17 GOST* 14:38:00 they didnt give server access to russia thats a russian version of telegram which durov owned before running away from russia to the US 14:38:02 and i does this furry have any kind of verified team-company-cryptographer to do this audit officially or its another signal fan myth? 14:38:04 im not a cryptographer and i dont know how curve25519 and kyber works 14:38:06 but can you use custom maid cryptography which is open source and audited and approved by several reputable security researchers? 14:38:08 as a US based company 14:40:32 Ah alright nice to know that. 14:40:34 He was a cryptographer if I recall correctly yes. I can't find it right now, so yeah septicism is appreciated. 14:40:36 There are absolutely no constraints on US based company to use whatever encryption scheme they want, the issue is when they want to obtain some security certifications. Signal isn't interested by that since their audits and protocol clarity speak for itself 14:40:38 and NIST should be one of the US governments departments or related agencies right? 14:40:40 did they found any kind of loophole in the cryptogrphy itself? 14:42:09 the NIST is american agency defining technological standard, which include cryptograpic algorithm that are deemed secure and on which industry certification is based on. 14:42:12 well on paper yes 14:42:14 but do we have any kind of living example? that was the whole drama about, telegram said you cant, signal said we can if we want to 14:42:20 the NIST do not make any audits of external protocol 14:43:25 how do they know its flawed? 14:43:26 shouldnt you break it first before any claim that downplay the cryptography? 14:43:31 Honestly I don't really know at this point. I should look more into it. This seems very weird 14:43:48 wdym? 14:45:33 the problem is, this NIST doesnt approve the PQXDH scheme made by durov brothers right? 14:45:34 why is that? it doesnt have any kind of exploitable flaw AFAIK 14:46:02 while being open source for external audits by third parties 14:46:45 wow. what. PQXDH is the encryption scheme cooked up by Signal not durov 14:48:05 also I said earlier NIST do not make any audit.. Their job is to sit on a table and make tournaments in which they elect which encryption algorithm is going to secure the United States. 14:48:27 And on which industry certification will be based on 14:49:16 They aren't paid to audit and verify new cooked up encryption schemes. There is too much for that 14:49:19 #monero-offtopic:monero.social 14:49:27 the problem is, this NIST doesnt approve the telegrams encryption scheme made by durov brothers right? 14:49:28 why is that? it doesnt have any kind of exploitable flaw AFAIK 14:49:33 i mean telgrams scheme 15:33:33 sorry if i missed the discussion on the black marble attack: https://antidark.net/board/viewtopic.php?t=10 15:33:39 any idea on how to solve that issue ? 15:33:56 the attackers supposedly revealed how they were doing it 15:36:17 ``` 15:36:18 All you had to do was use the official RPC to create ~200,000 accounts per wallet. Create 2 or 3 wallets each with 200K accounts. Start depositing money to each of these accounts in very small amounts. Wait some hours to have all of them verified. 15:36:20 Randomize sweeping the accounts or taking out a percentage from each account. Within a couple of minutes of doing that from multiple wallets and multiple accounts the Monero blockchain will clog up. Job done. 15:36:22 ``` 15:36:24 ``` 15:36:26 All you had to do was use the official RPC to create ~200,000 accounts per wallet. Create 2 or 3 wallets each with 200K accounts. Start depositing money to each of these accounts in very small amounts. Wait some hours to have all of them verified. 15:36:28 Randomize sweeping the accounts or taking out a percentage from each account. Within a couple of minutes of doing that from multiple wallets and multiple accounts the Monero blockchain will clog up. Job done. 15:36:30 ``` 15:36:39 > All you had to do was use the official RPC to create ~200,000 accounts per wallet. Create 2 or 3 wallets each with 200K accounts. Start depositing money to each of these accounts in very small amounts. Wait some hours to have all of them verified. 15:36:40 > Randomize sweeping the accounts or taking out a percentage from each account. Within a couple of minutes of doing that from multiple wallets and multiple accounts the Monero blockchain will clog up. Job done. 15:45:40 https://links.hackliberty.org/post/2209654 some discussion on the same topic here, and supposedly one of the "antidarknet" admins responded 15:46:04 https://links.hackliberty.org/post/2209654 some discussion on the same topic here, and supposedly one of the "antidarknet" admins responded with more details 15:47:35 https://links.hackliberty.org/post/2209654 discussion on the same topic here, and supposedly one of the "antidarknet" admins responded with more details 15:52:16 What issue? 15:52:39 Their “Results” section said nothing about Monero 15:53:31 well, the black marble attack, like i was mentionning 15:53:43 you're saying it's not a problem ? 15:54:51 It wasn't a black marble attack, and they themselves mention it 16:00:24 They don’t mention that anything Monero related was accomplished due to the txs. Only that Monero was used as a tool. But Monero was not the target 16:00:51 Monero mostly worked. So what issue? 16:08:18 they wasted that amount of money for no gains lol 16:08:18 just donate it to ofrnxmr to take over the world 16:08:27 They just stole XMR 16:09:32 By trolling the withdrawal functions of badly coded markets 16:10:08 Aka they are criminals who stole 300k in xmr from other criminals 16:12:18 They act like noble fighters against CSAM but in reality this was just for profit 16:21:30 "they wasted that amount of money for no gains lol" 100 16:21:52 They didnt screw up anybodies tx 16:22:28 For the first few days, tx might have been delayed a couple hours. After that, every wallet updated and tx were confirming in minutes again 16:23:17 No tx were dropped. No tx were purged. If they broke a wallet" its more likely that they broke it another way that i wont comment on 16:40:09 they made money 16:53:38 <3​21bob321:monero.social> I dont think it clogged the blockchain 17:08:45 The key sentence from that post how they managed to end up with XMR for about USD 300'000: 17:08:52 > Creating an account and depositing then withdrawing while spamming Monero network resulted in getting multiple times the same amount over and over. 17:09:44 That sounds ... strange. Even stranger if more than a single site was exploitable this way. Well, could be they used the same base software, of course, but still. And how do you even detect something like that? By accident? 17:10:33 by looking for it 17:10:36 they were basically doing pentesting 17:12:23 Did they prove that they actually did it yet? 17:12:41 Maybe. I am just at a loss right now to imagine which way round you have to program your XMR managing software wrongly so that this happens. If it does not confirm in 10 minutes just send again? Come on ... 17:13:17 Until then I’m considering their whole “antidark” theory an elaborate (and kinda twisted tbh) way to rugpull/cover up mismanaged donations to their group 17:14:02 no 17:14:04 The message itself (which granted is probably just a clueless admin putting a front for it all) seems off too 17:14:34 It could’ve been the opposite problem; it attempts to resend too often 17:14:49 more likely it's "click withdraw" "check if funds are in wallet / if they have been withdrawn in the last 10 blocks" "send funds" 17:15:26 or just literally a ~10 block countdown on the withdraw function, not considering any pendingn transactions 17:16:36 archetype wasn't exploited and they are pretty top tier in terms of tech / features 17:17:13 so i wouldnt be surprised if this only worked because other markets had crappy template software / their own bad implementations 17:17:58 we know that there is DNM template software because one of them made a monero.town community 17:18:00 I thought of an interesting idea a bit ago—say a node receives a transaction and then puts it in mem_pool. If another node receives the same transaction (or a transaction that would become invalid once the other transaction is put in a block), can they tell that the transaction is invalid/malicious? 17:19:33 monerobull: Yeah, that's at least a marginally plausible way how the software could work in a brain-dead way to have this result 17:19:35 Asking because if that is the case, then 1. The people claiming that Monero transactions are “effectively instant” due to mem_pool need to stop, cuz that is….very dangerous; and more pertinently 2. This creates a strong incentive to flood the network if too many merchants use mem_pool to verify stuff 17:21:48 only if they previously received the first tx 17:22:52 Hmm, well that also throws a wrench in my idea for easy and secure local transactions 17:24:13 you can game in-person transfers with a lot of effort if you are connected to the vendors local node 17:24:42 but if the vendor uses their local node only for themselves, they can assume a tx will go through once their node has received it 17:25:51 Basically you’d have a low-powered wallet device with no networking capabilities outside of a memory-safe NFC protocol. The “register” at the location would be a node. The node would send the transaction info (ie how much to send) to the wallet via NFC (or usb idk/c) and the wallet would generate the transaction (after the owner verifies the info is correct). The transaction 17:25:52 is sent to the register, which will then put it on the blockchain 17:27:16 That system would be nice, but if what you say is true then a bad actor could go to one store, pay, quickly go to another, pay, and keep doing so until the first transaction gets added. The worse the flood, the worse it gets 17:28:48 Basically each transaction would be like a “check”, which the vendor would then “cash in” by putting it on the blockchain 17:28:50 But then chaining transactions like that would result in some checks being “bounced” 17:30:16 no thats not how it works 17:30:24 > go to one store, pay, quickly go to another, pay 17:30:26 The attack couldn't work like this. Transactions propagate throughout the network too quickly. The correct attack method would be to send the spent output to oneself at the exact same time as the payment at the store. 17:30:29 the second stores node would see it in mempool and not allow it 17:30:46 this really only works with submitting transactions within seconds 17:30:52 Ok that was what I was asking before 17:31:01 Phew 17:31:40 it also only works with zero conf, one conf and the vendor is basically 100% safe 17:31:49 So long as nodes can verify that a given transaction is invalid due to mem_pool’s status alone, it should work (at least better than before) 17:31:53 Yeah 17:31:55 i know, reorgs are a thing but unlikely 17:32:40 basically how zero conf trickery works is you connect to the vendors node but also to some really well connected node like a mining pool 17:33:04 then you send the vendor their payment and also right before that send to the mining pool node 17:33:53 0-conf doesn't work as well as it should in Monero at the moment since double spend notifications aren't propogated AFAIK 17:34:22 Thinking about making a PR for that sometime when I get time 17:34:24 the vendor might accept the payment but the transaction will actually fail 17:34:26 you just gotta get out of there quickly and not show your face again haha 17:34:39 I've heard that there were actually some failed payments during monerokon 17:35:21 What kind of failure? Did the payment processors see it come in and then leave? 17:35:26 not malicious but on accident 17:35:53 no i think its more likely that people tried to send but had bad internet or something and it never went through 17:36:04 ah 17:36:16 i know that the bar didnt pay too close attention on if they actually received the coins 17:36:48 i definitely was given a beer once before the btcpay confirmed the payment 17:43:17 Let’s face it: most people will never go for a 2 minute wait before paying for something irl (unless it’s something *big*) 17:44:02 Hmm 17:44:58 Never thought about that: do debit/credit cards actually do any processing on-card, or is it just a “””simple””” encrypted data retrieval 17:46:03 when you swipe your card it isn't even encrypted data retreival. the scanner just sees the all the details printed on your card 17:46:57 That's old cards 17:47:15 New ones use NFC chip 17:48:23 Mine's a "new" card with NFC, but it also has the insertable chip and the swipe band. Does the swipe band still work the same today? 17:49:59 It can't do any processing regardless of whether it's "encrypted" on the mag stripe, so I'd imagine as long as you store that stripe data persistently, it probably acts as a permanent spend access to your account 17:56:06 chip/nfc/magnet stripe are different, magnet has no security at all, and cannot use in most EU anymore, in latin america still work (I think most countries), chip as far I remember is signing the transaction, while nfc has more or less the data of the magnetic strip but only used for low transactions think was up to EUR30, but all system are not secure at all. That is only what I remember (is now a pretty while that I last read about, so not sure if it 17:56:08 is 100% correct, only vanishing memories) 17:59:16 p​reland: "Basically each transaction would be like a “check”, which the vendor would then “cash in” by putting it on the blockchain" <= cool you are thinking about the same thing :) 18:34:08 Revuo Monero Issue 204 - July 18 - 25, 2024. https://www.revuo-xmr.com/weekly/issue-204/ 19:48:00 just catching up again, some of which I just scrolled thru 19:49:06 <3​21bob321:monero.social> Nooooo 19:49:13 <3​21bob321:monero.social> Tldr? 19:49:21 "he doesnt give a single fuck about freedom nor privacy or any other right-wing movement" <<>> can confirm that he does 19:49:29 also freedom and privacy is not a right-wing movement, everybody is here :) 19:50:45 now please pump, I have families all across the world to take care of. Thx 19:51:38 <3​21bob321:monero.social> Sith lord does free monero outreach 20:00:08 Revuo Monero Issue 204: July 18 - 25, 2024. https://www.revuo-xmr.com/weekly/issue-204/ 20:07:22 Monero doesnt have rbf 20:07:58 The only way, afaik, rebroadcast a spent tx, is to sybil the receiving node and then rebroadcast to a well connected node 20:08:50 or wait 3 days 20:09:15 0 conf is, afaik, only dangerous if the sender and receiver are both connected to a node that cannot propagate transactions 20:09:55 Waiting 3 days involved tx taking longer than 3 days to confirm (or tx that were reorged and unable to confirm for reasons i dont remember) 20:10:26 How easy is it to find which node merchant is connected to ? 20:10:28 But under the attack, i dont think we ever had 3 day long backlogs 20:10:35 How easy is it to find which node a merchant is connected to ? 20:10:51 Xmrbazaar was uaing sethforprivacy's rofl 20:10:56 Bitcart uses seths too 20:11:19 Same as if everyone uses cakes and cake flushed their txpool during updates 20:11:20 It's more dangerous than it needs to be since nodes do not propagate double spend notifications, they silently drop them. Ideally, nodes should propagate proofs of double spends to their peers so that every single node on the network can mark txs with certain key images as "attempted double spend" 20:11:42 So it can be targeted for 0conf attacks 20:11:49 Yea 20:12:19 If the other tx is mined, does the node drop this attacker tx ? 20:12:23 If sender and receiver are using different nodes, its not a problem from what i can tell 20:13:44 ofrnxmr: It IS a problem since nodes may not perceive that a double spend attempt is happening even if 90% of the rest of the network has a different tx for the double spend 20:14:09 Ideally, you would want a notification to cancel a merchant order as fast as possible in the case of a double spend attempt 20:14:31 What about if it’s already mined ? Of the node forks off and rejects those blocks 20:14:52 What about if it’s already mined ? Does the node forks off and rejects those blocks 20:15:32 "Ideally, you would want a notification to cancel a merchant order as fast as possible in the case of a double spend attempt" gotcha 20:15:36 dave.jp: IIRC the node will keep the transaction in the mempool for a few days in case of a reorg 20:15:51 The node doesn't fork off from the network though 20:15:58 Shouldn’t it drop it immediately? 20:16:39 Not necessarily. There might be a reorg that contains *their* double spend tx 20:17:05 The reorg would have that txs mined if it was legit ? 20:17:10 For the double spend, id have to sybil my own (mining) node and rebroadcast it there, yea? 20:17:25 To avoid my node rejecting my tx 20:17:29 From "black marble attack" to "I sent a lot of transactions" lol 20:18:00 Well it doesn't *have* to, but it could. What *can't* happen is both of them be on the chain 20:18:02 Black marble attack = they jist read ruckniuns analysis and decided to ride the bandwagon 20:18:30 So let’s keep it in mempool for 10 blocks instead of 2 days ? 20:18:53 What’s the max block a reorg is allowed? 20:18:54 Btw domain name infos are really interesting because it's the same provider that "HavenoMain" used 20:18:59 Im not really sure who reorged tx dont confirm later? 20:19:12 Why* 20:19:28 Hmmmmmmmm 20:19:42 Its a bit weird to send a tx, have it reorged, rhen the $ is just stuck for 3 days? 20:20:04 Yeah that’s a bit weird 20:20:09 infinite 20:20:29 Yeah, i caused a 200+block reorg on stressnet 20:20:33 Also shame abt the debit/credit card thing from a few hrs ago; also very scary lol 20:20:49 Cheese and crackers 20:21:03 400+ minutes of work, evaporated 20:21:06 Scary 20:21:22 Or reorged* 20:22:33 Well actually technically not infinite if your node has block checkpoints enabled, which most nodes have *on* by default. Technically speaking, the nodes with block checkpoints enabled is a soft fork of the network where block checkpoints aren't enabled, but the probability of there being a reorg that deep is very low 20:23:54 I’m trying to think about the ramifications of that happening on mainnet, with there being more services using xmr…. 20:23:59 There's an argument to be had that once PoW has confirmed the transaction, you should drop the other double spend version from your mempool 20:24:18 "but the probability of there being a reorg that deep is very low" 20:24:28 Of you have 51% of hr it was actually really easy 20:24:42 Yes 20:24:48 I wonder what the probability would be given a certain percentage of hashrate 20:25:02 Well yeah if you can 51% the network everything kinda breaks 20:25:07 i only had just around 50% of hr 20:25:11 Well idk about "very easy", but possible do perform reliably over a long enough span of time 20:25:24 it was 8hrs or so in my sleep 20:25:39 Wait when were you 51%ing the network 20:25:46 Stressnet 20:25:58 Were you the reason that the network kept getting reorged a few weeks back 20:26:30 No 20:26:41 I remember it was getting reorged almost constantly then 20:27:13 My poor little ryzen mobile chip mined a block, was 10 blocks deep, then got lost after a reorged 20:31:02 preland: A mainnet block? A 10 block re-org on Monero mainnet would be unprecedented AFAIK. 20:31:28 No on stressnet 20:31:41 This was a few weeks ago 20:31:42 Or maybe over a month ago, idk I’m a bit bad with time 20:33:26 AFAIK, the main reason there were deep re-orgs on stressnet was nodes getting stuck because of bugs that have been patched on stressnet now. Some of the patches were band-aids, but they work enough for stressnet. 20:34:02 jeffro256: Are you thinking about implementing something like BCH double-spend proofs? 20:37:10 Didn't know those existed before now, but yes that's exactly the idea 20:37:24 Should be simpler on Monero since we don't have scripts 20:38:09 BCH developers have done a lot on 0-conf. Could be worth looking at. They have newer Zero conf escrow I think. 20:38:57 https://bitcoincashresearch.org/t/chip-2021-08-zces-zero-confirmation-escrows/537 20:39:17 May need some scripting. 20:39:19 Will do! DSPs are exactly what we would need for robust double spend detection in the real world 20:41:53 The 10-block-lock also means we don't have to worry about mempool tx chaining, which is nice for devs ;) 21:20:02 tldr on this> 21:20:20 tldr on this? 21:27:05 r4v3r23: BCH has a way to notify of an attempted double spend in the mempool. It makes zero-conf txs safer. Supposed to, at least. 22:18:32 I don't understand why Edward Snowden doesn't like monero. On paper you would think they go together good. He blew the whistle bc americans and other countries citizens where getting spied on and bc he believed in privacy . But he be promoting zcash while as far I know they had pre mined. 22:22:34 snowden is anyway a statist, he is only again a too dystopian government but not against gov at all, no wonder with his family background... 22:24:00 IMO he would not even be a minarchist... Respect for what he did, but he went not down the rabbit hole deep enough...