00:00:06 yo > <@longtermwhale:synod.im> qubic had 49% at one point. ofrn "scammer" xmr is downplaying the power qubic has. sell now 00:00:16 this one is getting impersonated in #monero as well 00:04:14 (wtf is happenning) 00:05:01 @interestingband:matrix.org: You asked for evidence of impersonation. Now you've just seen it live :D 00:05:43 Yeah, but you used this as an excuse to remove my writing permissions 00:06:49 and now I'm curios who is this spammer that is writing such stupid insults 00:07:07 You were another reason why I set up stricter moderation in #MRL. Many users complained about you. 00:07:51 I've asked politely kayabanerve about PoS and was waiting for a reply 00:07:54 still waiting 00:08:08 u won't get a reply 00:08:14 luke "fed" parker is another scammer 00:08:39 200 xmr for a book. serai is never coming out (rug pull) 00:08:53 same talking words as usual for each time 00:09:08 datahoarder you've been warned 00:09:14 spreading misinformation about qubic 00:10:00 Literally building tools to spread awareness about Qubic https://blocks.p2pool.observer/ 00:10:08 @rucknium: I've asked for a link to "propaganda that was going on in another channel", not impersonation 00:10:08 yes, the one you have pinned in your Discord channel 00:10:33 i don't have discord 00:10:36 The tools your own staff pins as they are useful 00:10:55 @interestingband:matrix.org: This is true. But impersonation is a form of propaganda. 00:11:00 what is "staff"? you're crazy datahoarder 00:11:17 staff my balls 00:11:36 sorry #monero-research-lounge it had to be done 00:12:04 @interestingband:matrix.org: he literally sent irc logs link 00:12:30 on other highlights, added subaddress support + additional tx keys to the InProofV1/2 / OutProofV1/2 creator :D 00:12:42 in go! 00:12:49 Hey, the new UI looks good 00:12:52 when did you update it 00:13:08 a few days ago! SVG as well 00:13:19 it also has pages for all blocks now, including orphans 00:13:30 + shows withheld transactions if any 00:13:42 example https://blocks.p2pool.observer/block/15b118a6abe4becbda405fce9a30b1fa37e3ec76dc79815712753da18057f228 00:13:49 Pretty cool 00:13:56 or https://blocks.p2pool.observer/block/47536af8b3b8cceb258c2ed7f5a15bb0563fe6a4bbd0adf8d27e3b0b367e62a3 00:14:37 @rucknium: Many users will complain about insecure cryptography, but you won't do anything about it 00:15:09 DataHoarder 00:15:13 https://mrelay.p2pool.observer/m/matrix.org/JAOzRsaxJEWhTVPFjRSwaoOS.png (clipboard.png) 00:15:14 does it need all of that? 00:15:32 I load https://cdn.jsdelivr.net/npm/bootstrap⊙5/dist/css/bootstrap.min.css 00:15:38 DDG no idea why that shows up 00:15:46 (with a checksum) 00:16:31 I don't see DDG locally, so that must be an extension you have 00:17:00 DataHoarder: I think related to search engine I'm using somehow 00:17:21 I can probably move the CSS in later, everything else is generated SVG :) 00:17:23 even though I pasted URL directly in url bar 00:17:57 Do you have the DuckDuckGo extension installed 00:18:41 no just firefox with DDG set to default search engine 00:19:52 it happens when you visit a link from DDG results 00:19:56 https://mrelay.p2pool.observer/m/matrix.org/IomxWpuGeJeJfngcphfJgIQA.png (clipboard.png) 00:20:42 No idea then :( 00:21:00 why did that turn into an emoji 00:21:07 that should be illegal on IRC 00:21:20 it's just local. I see : ( here 00:49:03 how much hashrate did bitmain have with their x5? they went somewhere. is their hash signature gone from the nonce maps? 00:49:34 212kh/s 00:49:59 some places still have them avail for purchase 00:50:55 @gingeropolous:monero.social: 00:54:04 gingeropolous: afaik sech1 said they came down a bit, but still there 02:04:26 @captaincanaryllc:captaincanarynode.org: , where? ive looked 03:11:56 yeah @captaincanaryllc:captaincanarynode.org , i meant total hashrate. was it 2gh/s? i know this was answered before but i forget 03:15:28 so a publish or perish with an infinite k would essentially make us dependent on a 100% connected internet. Which is probably more probable than the case of a malicious actor attempting selfish mining. 03:21:43 ugh that wasn't worded right. 03:25:16 but yeah, with an k=infinity, the "only" thing a 51% attacker can do is mine empty blocks.. but they are still competing with the honest miners, so its not 100% censorship. They can't initiate massive re-orgs, so they can't do double spends.... 03:26:13 and in case the internet does break, then the DNS checkpointing system could be used to get things back on track. 03:27:47 the probability that the internet will stay connected is greater than the probability that the monero network will be attacked by massive hashrate 03:27:48 there we go 03:28:12 no thats not it. damnit. im going to sleep 03:38:26 the probability that the internet will split is less than the probabilit that the monero network will get attacked by massive hashrate. yeah i think thats it 03:38:37 k = infinity for the win 03:45:15 it'd have been funny if libera.chat would have had a netsplit just now 06:45:09 In the event that the chain reorgs back to the original chain, I guess. > <@monero.arbo:matrix.org> I missed if someone already asked.... but why the fuck are invalid transactions tuffed back into the mempool 06:46:08 It's an odd situation, certainly, but it is technically possible for those transactions to become valid again if another reorg restores the original chain. 06:51:32 I think it's just a rare edge case that didn't come up until now. Sure, the behavior doesn't make sense in this context, but the behavior is correct in the more common situation where only one block is reorged. 06:54:50 interestingband:matrix.org still waiting 06:55:56 interestingband:matrix.org Btw, do you all understand that it's all about how much money are needed in order to compromise consensus and conduct the worst possible attack (double spending ?) ? 06:56:12 interestingband:matrix.org For example, how much money sholud be paid to someone who owns these DNS domains in order to cause chain split (for example two different sets of exchanges that accept XMR) and do actual double spending ? 06:56:41 interestingband:matrix.org 0 people here who can verify cryptography is funny 07:05:01 Okay, so you are proposing an attack where malicious DNS servers present different checkpoints to different nodes to force a chain split? The current proposal I believe is 7 checkpoint servers with 5 needing to agree on a checkpoint before it gets enforced. So you would need to control 5 of the DNS servers to cause a chain spl [... too long, see https://mrelay.p2pool.observer/e/vYjBrbUKa2lKLUVX ] 07:05:20 Youre talking to an imposter 07:05:32 how come he can still speak 07:05:59 Whoops. 07:06:09 this is truly like the hit video game among us 07:14:58 Clearly the imposter is speaking in bad faith, but the attack is interesting to think about. It wouldn't be an easy attack to execute, and it would be very easy to detect, since (correct me if I'm wrong), it would be straight-forward to publish the conflicting DNSSEC-signed records and prove that the DNS servers were misbehavi [... too long, see https://mrelay.p2pool.observer/e/hbrlrbUKMk91US14 ] 07:16:16 i love that the impersonator is prepending their messages with the matrix ID of who they're impersonating 07:16:43 trying to fool IRC users lol 07:17:56 @torir:matrix.org: it's not a real attack simply because you can turn it off, and one chain is gonna keep getting mined while the other isn't 07:18:31 What ? 07:18:57 it allows to do double spending, how is that not a real attack ? 07:19:41 if no one trusts that form of consensus i fail to see how it could take over the network 07:21:36 It seems close to an eclipse attack to me. If pulled off, you could force the victim to have a different view of the chain. As I understand how --enforce-dns-checkpoints works, the victim node will ignore all other blocks if it is presented with valid 5/7 DNS records for an alt chain. 07:21:48 Of course, you would have to mine all the blocks on the alt chain yourself, so you'd have to invest in mining as well. 07:21:55 yeah 07:22:55 hence why i feel it would be interesting to have other checkpointing providers that can be configured by the node admin :) would allow for some diversification, if one wants to enable this feature 07:23:22 It might be possible against an automated exchange or something if you can A) compromise 5 DNS servers run by reasonably well-trusted community members B) convince those community members to tarnish their reputation, since the attack can be proven to have occurred, C) successfully identity the node the exchange uses D) success [... too long, see https://mrelay.p2pool.observer/e/9ZaErrUKa1A5U1pa ] 07:23:52 that's a lot to be asking, honestly :) not impossible, but a lot 07:24:31 I think a fair mitigation, if we feel the need, would be to have nodes share the DNSSEC-signed records that they see via some gossip protocol. Of course, if we had such a gossip network we wouldn't actually need DNS at all. 07:24:55 But if we had a gossip network conflicting records could easily be detected. 07:25:20 there's quite a few things that can be done overall 07:26:54 the problem is also the part where you're trying to isolate DNS requests to a specific IP/requester: it's kind of impossible in most cases 07:27:41 Yeah, I don't fully understand DNS myself, but my current understanding is that you are likely to use the same DNS server and see the same cached records as at least one other node. 07:28:20 Especially if you use a big service like Google or Cloudflare's DNS. 07:28:45 So an even easier mitigation is to just config a big DNS server for your node. 07:29:09 Or even if you use your ISP's one, your ISP might just proxy to a larger upstream server anyway. 07:30:19 The only way you could give different responses to a DNS request is to run custom malicious nameservers for the hijacked domains (and the fact that you're running custom nameservers would have to be visible by everyone), and to reply different things to a specific IP (or packet format, very unlikely unless your resolver is a c [... too long, see https://mrelay.p2pool.observer/e/hdmdrrUKX2ZjYzRS ] 07:30:36 Ironically, the domains being on Cloudflare offers a certainty that they're not being that kind of malicious 07:31:44 There was a conversation earlier about running custom nameservers, wasn't there, to get around Cloudflare's 300 TTL? Or maybe I mis-skimmed that. 07:32:44 I dunno. But I do think it is not a realistic attack. Especially compared to the more realistic potential of a double-spend attack from Qubic. 07:35:43 well, qubic could have done a double-spend already 07:36:42 They did 117, just not their own 07:40:50 they could've been backed by someone who wanted to defraud an exchange or similar :p 07:48:44 There is already a possibility here for anyone to double-spend. Just automate deposits to an exchange when Qubic is ahead some amount on https://qubic-snooper.p2pool.observer/tips.txt and withdraw if they don't get a long re-org. 07:49:18 Or even just automate depositing and withdrawing over and over. If Qubic does another big re-org, you might get lucky. 07:49:55 If the exchange asks, you have a bad arbitrage script that withdraws automatically when it detects the arbitrage opportunity has disappeared. 07:50:07 huge exchanges already increased number of confirmations 07:50:16 they aren't stupid 07:50:32 Yeah. There might be one or two out there that haven't. 07:50:40 Maybe a swap service? 07:57:06 how many for mexc and kucoin? 07:57:19 Last i checked kucoin was 12 and kraken 32 07:58:19 is fixed float still 3? 😅 07:58:32 it's 10 07:58:53 ok good, it was 3 last i checked while this was still going on 07:59:36 "they aren't stupid" sadly it seems kraken was relying on monero wallet cache to actually work and save information 08:01:52 There is almost certainly a target out there that has not kept up with recent news and increased required confirmations. How many confirmations does BasicSwap require? 08:03:47 a large exchange not backing up information to an external database and relying on monero wallet cache https://github.com/monero-project/monero/issues/10067#issuecomment-3271441030 08:08:42 On the one hand, when you have to integrate hundreds of coins into your exchange, it can be tricky to fix edge cases for each and every coin. On the other hand... if you were to do the sensible thing, write a generic framework that can handle many types of coin, wouldn't it make sense to store all the information about all wit [... too long, see https://mrelay.p2pool.observer/e/jKOqr7UKNjMxSU9X ] 08:09:06 @torir:matrix.org: The script (btc) coin moves first 08:09:59 does anybody know how the DNMs have been dealing with the potential reorgs? I assume they have also increased their confirmation times? 08:10:08 Number of xmr confs before releasing the script coin is set to 3 by default, but can be changed by the user 08:11:08 Where is the option to do that? 08:11:26 basicswap.json, in the monero section 10:27:39 What happens if a reorg happens on a coin that was spend as soon as possible? 10:27:39 Will both transactions go back to the mempool? Or will the second transaction become completely invalid? 11:08:01 of the 117 or 118 invalidated transactions that we know of, can anything be inferred from/about them with regards to the above^ e.g. we had 8 blocks for people to spend unlocked funds iiuc 12:20:16 09:31:44 There was a conversation earlier about running custom nameservers, wasn't there, to get around Cloudflare's 300 TTL? Or maybe I mis-skimmed that. 12:20:33 The program works and has been tested, whether this setup is to be used is not up to me :) 12:20:44 But from tests they are the first to switch and become consistent 12:22:44 RE: https://github.com/monero-project/research-lab/issues/145 I feel that calling them "lucky transactions" is a bit of a misnomer, at least if I understand the proposal correctly 12:32:23 qubic has not been attempting selfish mining as of recent 12:32:56 their blocks are published when found directly now (no withheld transactions either) 12:33:23 but they also only have like max 1-2 txs 12:33:31 most have 0 txs, so back to empty block mining 12:34:06 since they stopped selfish mining their efficiency numbers seem to have gone up, so they are making more by just straight up mining 13:03:05 how does blocks.p2pool.observer determine that a block has not been disclosed? it currently marks all of the qubic blocks as "selfish" but it seems that they've been disclosing them so far at least > their blocks are published when found directly now (no withheld transactions either) 13:03:26 it doesn't mark as selfish 13:03:39 the red refers to the part behind the background 13:03:42 not the proof :D 13:03:51 oh yeah! my bad! 13:03:52 they haven't disclosed view wallets yet 13:03:59 as for how 13:04:07 look at their stratum mined height and id 13:04:20 you can find an id there you don't see in the network, and how many txs it has 13:04:48 I keep track of these - and keep looking for alternate blocks across a large set of monero RPC to find if they ever make it to network 13:05:05 then I cache them and their whole block template, for safe keeping 13:05:09 then they have full information 13:05:19 i figured it would work as much :) thanks for the confirmation! 13:05:41 it's a bit more on the face how it works when looking at https://qubic-snooper.p2pool.observer/tips.txt 13:06:17 i somehow find that more clear to look at, so i've been looking at it the most :D 13:06:30 that shows only that status ofc 13:06:40 blocks. is more of an after-the-fact explorer 13:07:07 but also can show any selfish blocks as well, as a bonus (it looks at the data source for tips) but it doesn't add them to database 13:07:13 you can see this in the source code 13:07:47 -nodejs-pools param that allows me to query that similar API internally, could use this for anything else 13:08:01 plus another api for the withheld txs 13:08:35 both views have been interesting to look at, thanks for your work and for taking the time to explain it to me! :) 13:53:36 I have a list of transactions that have been invalidated. These were found in blocks 3499670 to 3499676 on the altchain. These are displayed as blue here 13:53:37 https://irc.gammaspectra.live/3d4322617de1e118/image.png https://paste.debian.net/hidden/5ea3d92e/ 13:54:03 these transactions are currently unmined in mempool or no longer found (@rucknium:monero.social should have an archive of these) 13:54:11 in total 115 transactions 13:54:30 I am adding the markings to the blocks page in a bit :) 13:57:24 I still have quite a few stuck transactions on my node https://p2pool.io/explorer/txpool 13:57:29 They just keep returning after flush_txpool 13:57:46 4 stuck at the moment 13:57:58 sorry I didn't flush after wiping 14:06:05 hmm, this stuck transaction https://p2pool.io/explorer/tx/ef608776beee26f5f3ac0076f7c20640fc3f9cf12d6bdcb108259c30140fd1e6 has decoys from today, so after the big reorg. It must be some different reason why it's stuck 14:07:59 Maybe it used decoys from reorg'd blocks? i.e. that wallet was online when reorg happened, and wallet cache got borked somehow. Just a theory 14:09:43 I don't check these, only transactions that were included in blocks on reorgs 14:14:42 I wrote this ""short"" explainer trying to condense invalidated transactions and global output indices https://irc.gammaspectra.live/6faf582e1accfb25/image.png 14:17:40 I don't know how good the wording is. 14:29:03 DataHoarder: Can you make sure to save the whole txs for archival purposes? My txpool archiver saves txid, fee, weight, and key images of inputs, but not the whole tx. 14:29:12 ouch 14:29:13 lemme see 14:29:47 Otherwise, the archiver would be as large as the blockchain. 14:30:02 Yeah. that's why I didn't want to archive them myself :D 14:30:09 more hoarding I guess 14:30:47 I have nodes that I didn't flush the txs. I can save them if it's not easy for you. 14:31:44 I can save them, just need to add it onto the code 14:31:51 I'll mention which txids I don't have yet 14:32:32 But more importantly, wording notes :) 14:32:59 I may try to create a diagram that explains tx invalidation when the output index changes. 14:33:03 I don't think calling entities that explicitly cause invalidated transactions past 10+ reorgs and affect users "malicious attackers" 14:33:21 the diagram: https://irc.gammaspectra.live/e304f162614845e4/image.png 14:33:56 lol I thought I missed your diagram or something. 14:33:56 I can link it there later once it exists, it's a very internal detail otherwise 14:34:06 Actual photo of the last mrl in-person meet 14:35:09 I think that's something MRL could put a statement out, specifically around global output index issues on big reorgs / invalidation of these txs? 14:36:03 Probably. 14:40:33 keeping them in some transparency log somewhere could be useful eventually anyway if wallets would want to notify users that privacy could be compromised on subsequent transactions (and to push them towards making a change transaction or something to recover somewhat) 14:59:13 I'll be storing them rucknium in json/hex blob but I won't get to use them (I need liveness) but should have them stored for future usage 14:59:37 Thanks! 14:59:46 I'll present an endpoint to fetch these. Note I'll only save txs not mined by others, and only from blocks past +10 deep from tip 14:59:58 so it should have a very limited storage set 15:01:19 DataHoarder: Here's the code for the txpool archiver if you want to run it locally: https://rucknium.github.io/xmrpeers/reference/txpool.collect.html 15:15:19 got them all stored 15:15:34 115 of them 15:15:50 endpoint for them https://blocks.p2pool.observer/tx/1ddccf341edd64f58e669fc17568f07cec84b04a7f6be7d455b4ca206a99ec7f/json 15:15:56 I thought 117? 15:16:02 not the ones I detected 15:16:12 the others have been mined by other means 15:16:54 I explicitly looked at txs in blocks that I had and were not mined yet/in pool, or that did not exist at all anymore (flushed) 15:17:00 all the others I could find mined 15:17:12 if you have a full list I can compare them 15:17:47 Ok, will check in a few. Preparing that update for the dns pr 15:17:49 ^ as for the endpoint, JSON output, but has the 'blob' entry which should be the full tx 15:18:18 the rest of fields won't get updated, so don't expect double_expect_seen to flip to true 15:18:54 you can see blue blocks in https://blocks.p2pool.observer/ as well and get the listing per block 15:19:10 Ctrl+F for 3499660 to scroll there :) 15:19:13 or open full listing 15:19:32 relevant blocks with invalidated transactions 15:19:36 https://blocks.p2pool.observer/block/d3ed1c8867a05813f8f15f1c011790e883df54f99c0e9da6df92c0a6c36d5c7b 15:19:41 https://blocks.p2pool.observer/block/021ac55033935e731f576dd7226cdd0430c1c5cbcf23b19c56fe92ee2fbb2d84 15:19:44 https://blocks.p2pool.observer/block/66736b780e13c6623ee7599e5314ca5dac2c55c11d076684975fa62476f74e9d 15:19:47 https://blocks.p2pool.observer/block/9be23f6704592a40197a1c0aa0523fb57411ffb2ccb0e0dc6b3e3b46a3903483 15:19:51 https://blocks.p2pool.observer/block/9489923b1773c2575e3320b84357e451b2dc625ba1cb9d2f4d6c352689c5ac7d 15:33:11 > <@radanne:matrix.org> https://mrelay.p2pool.observer/m/matrix.org/BhyBBdUeqPNtFvmgPgSMvavJ.png (image.png) 15:33:11 This made me laugh out loud. Don't they know not releasing XMR back into the wild doesn't prevent anyone else from receiving / using it, it just raises the price of the remaining units? In what world would the gov auctioning back seized XMR cause increased adoption of XMR amongst criminals? 15:36:21 @jeffro256: liquidity 15:36:47 says in the higlighted text 15:37:04 same reason they don't sell smoke seized crack and some it themselves 15:38:19 They do tho, if you go to the right sheriffs office 15:39:04 wouldnt be surprised if they stole a lil xmr here and there too 15:39:30 I got robbed by border agents before, lol. 15:39:46 @ofrnxmr:xmr.mx: happens always with corrupted cops 15:40:30 that's the big advantage with crack: you can smoke it before they can steal it from you 15:40:56 @ofrnxmr:xmr.mx: rip 15:41:41 I understand that they think that that would have a negative effect on liquidity, but which criminal would be buying XMR directly from the government, ostensibly using traceable online payments? And usually criminals are long cash (or XMR in this case), they aren't buying it, so a decrease in liquidity in this direction helps them. 15:42:27 @basses:matrix.org: in some other corrupted countries they ransom you 15:43:34 As long as any working DEXs exist, criminals can sell. If the gov allowed selling, the gov could undercut criminals by selling XMR at market value or a loss. But if they choose not to sell, then criminals get to be relatively more important market makers. 15:45:18 they see crypto as a tool that can be easily used criminals than obtaining cash 15:46:13 so want to minimize that and while being the biggest holders of such coins 15:59:59 Added a description feature to blocks.p2pool.observer, now mainly has a big box for Qubic https://blocks.p2pool.observer/block/06beef9d26fce408b68aac0d1cea9fb01d5f73616a5fdff5167c799725ce6db1 16:00:09 > Qubic is now unequivocally considered a malicious attacker, not only affecting end users but additionally harming their privacy permanently. 16:09:07 and for P2Pool https://blocks.p2pool.observer/block/978d24c80dfd0bb9e465ebb07689ec35d0c8859d27957f125ce263833954af0b 16:31:20 thank you a lot DataHoarder for all the work 16:35:02 I do what I can besides hoarding data :) 16:35:39 Really most of this is thanks to me reimplementing p2pool in Golang here https://git.gammaspectra.live/P2Pool/consensus and as a side effect implementing half of monero utilities 16:35:56 so I always have something almost "drop-in" for about any section of it 16:38:22 oh damn a go randomx implementation 16:38:38 oh yeah. also random side project 17:16:08 Couldn't the senders of the 115 invalidated transactions preserve some of their privacy by crafting custom transactions that contain all the exact same decoys except the ones that were invalidated? 17:19:21 that is what ringdb would allow, yes 17:19:29 except it got invalidated as well in the reorg 17:20:27 DataHoarder: yup lmao 17:21:05