<b​asses:matrix.org> now I'm rethinking about the decision of writing a blog post about chainalysis, take a look on how Tor project handles such situation blog.torproject.org/tor-is-still-safe

<b​asses:matrix.org> being transparent is better than looking like you are trying to hide it

<o​frnxmr:xmr.mx> Who's trying to hide anything? why would we acknowledge what we've already acknowledged

<o​frnxmr:xmr.mx> Theres a whole youtube series about how to break monero, called breaking monero

<o​frnxmr:xmr.mx> If you want to write a blog post, github.com/monero-prohect/monero-site

<b​asses:matrix.org> for the ones that don't know

<o​frnxmr:xmr.mx> Nobody is stopping you

<b​asses:matrix.org> I wasn't saying that I'm the one writing about it, rather someone one from MRL or knowledgeable.

<o​frnxmr:xmr.mx> we dont pay 100k/yr to devs and reseaeches to they can spend 6hrs at 1.1xmr/hr to write a blog post that will be read by 14 people

<o​frnxmr:xmr.mx> i'd prefer devs spend their time working on monero

<b​asses:matrix.org> source on 14 people?

<o​frnxmr:xmr.mx> And again, the fact is that monero is not perfect

<o​frnxmr:xmr.mx> There are no guidelines on churning

<o​frnxmr:xmr.mx> Weve been recommending against remote nodes _forever_

<b​asses:matrix.org> or you are just throwing random made-up statistics?

<o​frnxmr:xmr.mx> yes

<b​asses:matrix.org> not constructive

<o​frnxmr:xmr.mx> Neither is cheerleading

<o​frnxmr:xmr.mx> Go write the post or find someone who has nothing better to do

<b​asses:matrix.org> matrix.monero.social/_matrix/media/…matrix.org/xvxrthxBDIOXHTduIudSRPeS

<o​frnxmr:xmr.mx> ? Why would i care to be distracted by fud?

<b​asses:matrix.org> perhaps you are not, but outsiders maybe

<o​frnxmr:xmr.mx> is it true that decoys can be elimited? OF COURSE

<o​frnxmr:xmr.mx> Its always been true

<o​frnxmr:xmr.mx> Is it possible to use off chain data to trace the path of monero spending? OF COURSE! Its always been true

<o​frnxmr:xmr.mx> If it wasnt, we would never had standardized ring size, increased ring size, planned to increase with seraphis, or threw that all away in favor of FCMP

<o​frnxmr:xmr.mx> Rings are trash and always have been

<o​frnxmr:xmr.mx> p2pool had to hard fork to stop damaging rings

<o​frnxmr:xmr.mx> There are 2 mrl issues (108 and 109) that targeted the pollution of ribs via coinbase outputs

<o​frnxmr:xmr.mx> The only thing that matters is that we get fcmp out the door

<o​frnxmr:xmr.mx> Because there is NO fact based advice on how to best manage monero outputs

<o​frnxmr:xmr.mx> Stealth addresses and CT (amounts) are the only things truly private in monero

<o​frnxmr:xmr.mx> The tx graph is not

<b​asses:matrix.org> Anyways, I think that being transparent through official mediums (like blog, which is turning into just a changelog) is the right approach instead of letting rumors spread, which also keeps your community knowledgable with current development/attack vectors so they can base their threat model correctly.

<o​frnxmr:xmr.mx> The blog has a big post about fcmp on it

<o​frnxmr:xmr.mx> "so they can" do what? They cant

<o​frnxmr:xmr.mx> all they can do is use a _trusted_ onion node, or a node that they run themself

<o​frnxmr:xmr.mx> sit back and wait for fcmp

<o​frnxmr:xmr.mx> "dont use clearnet nodes without a vpn/tor" is common sense

<o​frnxmr:xmr.mx> It doesnt matter how private your blockchain is if your connecting over clearnet to broadcast your txid directly to them

<o​frnxmr:xmr.mx> Also, youre the only person in monero i see asking questions. Even chainalysis is having the video taken down _everywhere_

<o​frnxmr:xmr.mx> Monero are the ones keeping the video circulating.

<b​asses:matrix.org> Monero market itself as community-driven, there should be transparency about everthing going in community.

<b​asses:matrix.org> wym?

<o​frnxmr:xmr.mx> i mean, the video link has beem DCMA'd everywhere

<o​frnxmr:xmr.mx> We've put up torrent, hosted it on personal websites, odysee, etc

<b​asses:matrix.org> yea?

<o​frnxmr:xmr.mx> We're the ones spreading the video around, because theres nothing new or exciting in it

<o​frnxmr:xmr.mx> We have a hackerone telling ppl bot to use remote nodes from many months ago

<b​asses:matrix.org> ik, but this irrelevant to what I was suggesting, it looks like the actual project is out of loop/not caring while the community do care.

<o​frnxmr:xmr.mx> We had PSA's telling ppl bot to use remote nodes for years due to malicious high fee

<o​frnxmr:xmr.mx> And the software itself (cli) warns users not to use remote nodes

<b​asses:matrix.org> hackerone is a bug bounty platform...

<o​frnxmr:xmr.mx> The community is spreading the video,

<o​frnxmr:xmr.mx> "the actual project" == the community

<n​ihilist:nowhere.moe> Yea i saw that, when you want to use a non-onion node it forces you to type a long argument lol

<o​frnxmr:xmr.mx> I mean, it was disclosed on reddit

<o​frnxmr:xmr.mx> reddit.com/r/Monero/comments/134jbd…_advisory_new_attack_from_malicious

<o​frnxmr:xmr.mx> "this-is-probably-a-spy-node"

<b​asses:matrix.org> Exactly, that is why I suggested that so monero community can have a legit source to share instead of comments scattered.

<o​frnxmr:xmr.mx> Magic blog post

<o​frnxmr:xmr.mx> New blog post "i thought we told yall to stop using remote nodes?"

<n​ihilist:nowhere.moe> Perhaps a forum would better fit the need ? Like discourse ?

<o​frnxmr:xmr.mx> monero.observer/tevador-security-ad…nero-wallets-malicious-remote-nodes

<n​ihilist:nowhere.moe> (Correct me if I'm missing the point)

<o​frnxmr:xmr.mx> I think the post is like "water is wet"

<o​frnxmr:xmr.mx> Why are we wasting writing blog post to explain things that are obvious

<o​frnxmr:xmr.mx> the fud screenshot you posted has NOTHING to do with the video

<o​frnxmr:xmr.mx> Its just dero "account model" fud

<b​asses:matrix.org> that is opposite of what I'm saying, but yes, discourse is a lot better & reliable for managing long discussions/threads that Reddit and group messsaging platforms

<o​frnxmr:xmr.mx> Dero, yknow, the chain that had everythinf incl amoints unravelled, and is still unfixed

<b​asses:matrix.org> missing the point of the current discussion, but discourse is also a great idea that I suggested before

<o​frnxmr:xmr.mx> Its called "dont feed the trolls"

<o​frnxmr:xmr.mx> chainalysis didnt do anything special. And the ppl spreading fud are bag holders of a deanonymized chain

<n​ihilist:nowhere.moe> I think torproject could be copied on that, they have a blog where they share the latest news, and they also have a discourse for their community

<b​asses:matrix.org> acknowleding an issue doesn't imply "feeding trools"

<b​asses:matrix.org> acknowleding an issue doesn't imply "feeding trolls"

<o​frnxmr:xmr.mx> acknowledging what issue?

<o​frnxmr:xmr.mx> Please explain what were acknowledging

<o​frnxmr:xmr.mx> "dont use remote nodes"?

<o​frnxmr:xmr.mx> monero.observer/tevador-security-ad…nero-wallets-malicious-remote-nodes

<o​frnxmr:xmr.mx> Old news

<b​asses:matrix.org> some people are very over protective about Monero being hidden dev/not engaging with the community

<o​frnxmr:xmr.mx> That CEX can keep track of the outputs the decoys that they own?

<o​frnxmr:xmr.mx> old news

<b​asses:matrix.org> yes, a reminder

<o​frnxmr:xmr.mx> we have one every 3 months

<b​asses:matrix.org> where?

<o​frnxmr:xmr.mx> The spam that caused a "black marble" attack was like 4 months ago

<n​ihilist:nowhere.moe> Could be a "best opsec practices" section somewhere, saying that to maintain anonymity its best to do x y z

<o​frnxmr:xmr.mx> There isnt any

<b​asses:matrix.org> was there a blog post about it?

<o​frnxmr:xmr.mx> Dont use remote nodes, uae onion nodes if you must

<o​frnxmr:xmr.mx> Idk, you read the blog, not me

<o​frnxmr:xmr.mx> We have list.getmonero.org as well

<o​frnxmr:xmr.mx> But its pretty much dead

<b​asses:matrix.org> there is not, could have written about it as he was the one researched about the spam attack

<o​frnxmr:xmr.mx> monero.observer/monero-mean-effecti…ises-suspected-spam-attack-subsides

<b​asses:matrix.org> other than that you will keep news agencies claiming "anonymous sources" etc for info regarding some specific

<b​asses:matrix.org> other than that you will keep news agencies claiming "anonymous sources" etc for info regarding some specific situation

<o​frnxmr:xmr.mx> Some news channel claimes that MAGIC is in charge of the technical direction of monero

<b​asses:matrix.org> there's no need to continue arguing about a transparency issue and being more engaging in with the community

<o​frnxmr:xmr.mx> Write the post!!

<b​asses:matrix.org> yes, that is what I'm talking about

<b​asses:matrix.org> someone from MRL or that keeps up with MRL discussions

<o​frnxmr:xmr.mx> Mrl doesnt discuss this

<b​asses:matrix.org> bruh wtf

<b​asses:matrix.org> u reply before thinking for 1 sec?

<b​asses:matrix.org> monero-project/meta #1070

<o​frnxmr:xmr.mx> mrl doesnt discuss off chain tracing using 9yr old methods

<b​asses:matrix.org> >Chainalysis capabilities video.

<n​ihilist:nowhere.moe> Frankly, the Achilles heel that chainalysis is targeting here, is the trust people have in centralised exchanges

<o​frnxmr:xmr.mx> and remote nodes

<n​ihilist:nowhere.moe> It is from that, mainly that they can do stuff

<o​frnxmr:xmr.mx> You dont have to run a cex to own the output distribution

<o​frnxmr:xmr.mx> You can just spam the network

<o​frnxmr:xmr.mx> And keep track of every output that you created and control

<o​frnxmr:xmr.mx> You can also dust wallets of potential targets and perform EAE if users arent paying attn

<o​frnxmr:xmr.mx> Literally hours of videos from sarang and sgp are better training vids than chainalysis

<m​onerobull:matrix.org> way easier to just have the FBI ask the CEX on your behalf though

<m​onerobull:matrix.org> and free!

<o​frnxmr:xmr.mx> Spamming outputs to yourself doesnt cost a lot either

<o​frnxmr:xmr.mx> especially if the goal is just to create black marbles while avoiding block size increase (using lowest fee, and cycling)

<m​onerobull:matrix.org> its still free vs spending

<o​frnxmr:xmr.mx> And not as useful lol

<m​onerobull:matrix.org> they didnt even bother to run proper fake nodes which would have cost what? $30 per month? and those are very useful, in fact, their most useful asset

<o​frnxmr:xmr.mx> cex data is nice, but 50% of tx vs 99% is a big diff

<o​frnxmr:xmr.mx> They literally did tho

<m​onerobull:matrix.org> you need to spam a loooooooot to get 99% tx

<m​onerobull:matrix.org> they proxied to other real nodes

<o​frnxmr:xmr.mx> no. You need to spam 110ktx/day

<o​frnxmr:xmr.mx> Type, 90*%

<o​frnxmr:xmr.mx> They disnt tho

<o​frnxmr:xmr.mx> that was playing devils advocate

<m​onerobull:matrix.org> they did though

<o​frnxmr:xmr.mx> they disnt

<o​frnxmr:xmr.mx> The node is still up and isnt proxied afaict

<m​onerobull:matrix.org> or am i retarded and dont understand the digilol article

<o​frnxmr:xmr.mx> And they have THOUSANDs of ips pointing at their own real nkde

<o​frnxmr:xmr.mx> Digilol spoke to rupee who claimed he didnt control those ip's anymore

<m​onerobull:matrix.org> so they have one real node and a bunch of proxies

<m​onerobull:matrix.org> even without the video leaking, that could have been discovered

<o​frnxmr:monero.social> 96.43.139.226

<o​frnxmr:xmr.mx> digilol.net/blog/chainanalysis-malicious-xmr.html

<o​frnxmr:xmr.mx> Not in the list

<o​frnxmr:xmr.mx> This is 1 of like 10 nodes that rupee controlled where the ip was supposedly "lost"

<o​frnxmr:xmr.mx> 96.43.139.226:18089/get_info

<o​frnxmr:xmr.mx> If its proxied to another node, it still makes 0 sense for them not to run the node themselves, with the ability to tamper with relay times and decoys

<o​frnxmr:xmr.mx> I'm sure they didnt have 100s or 1000s of nodes, but they likely had that many ips proxied to their node

<o​frnxmr:xmr.mx> I also wouldnt be surprised if they were running the majority on --public-node IPs (simple/bootstrap mode)

<o​frnxmr:monero.social> b10c.me/observations/06-linkinglion

<o​frnxmr:monero.social> These nodes were in the video and are still active today

--public-node is opt in , nuff said

Makes sense from a personal privacy / resource perspective but its reducing the pool of available nodes for simple mode

The problem cant be solved can it. Trusted nodes can still be spy nodes unless you can see the server before your very eyes

<o​frnxmr:monero.social> Trust nodes = people you actually trust

<o​frnxmr:monero.social> Not some fake trust

<o​frnxmr:monero.social> public-node has to be opt-in, because it can obliterate your data cap

<o​frnxmr:monero.social> Which is also why its a dream honeypot

<o​frnxmr:monero.social> Bad actors nodes likely ALL have it enabled

<o​frnxmr:monero.social> I wouldnt mind if --public-mode was killed altogether

<o​frnxmr:monero.social> You can use boostrap mode and specify a daemon. No reason to tell advertise rpc to random strangers over p2p network

<o​frnxmr:monero.social> I really see absolutely NO good reason for --public-node. It doesnt even need a replacement, just kill it with fire

<o​frnxmr:monero.social> 1. Local node

<o​frnxmr:monero.social> 2. Enter a node that you trust

<o​frnxmr:monero.social> nobody needs "use random rasp pi or honeypot"

<3​21bob321:monero.social> Me i have lollies

<b​asses:matrix.org> Candies*

<3​21bob321:monero.social> Thats merica!

<b​asses:matrix.org> wording matters, or you will get caught in 4k 📷