-
m-relay
<nononynous:monero.social> Something should be done to use Tor easier and having the possibility to be a full Tor public node
-
m-relay
<nononynous:monero.social> Because right now people doing proxy + tx-proxy still uses clearnet
-
m-relay
<nononynous:monero.social> Theres probably a latency difference with the clearnet but thats only a problem for miners which they probably only use clearnet already
-
m-relay
<nononynous:monero.social> Best could be launching monerod with the controlport of Tor to use:
-
m-relay
<nononynous:monero.social> a proxy (for transactions)
-
m-relay
<nononynous:monero.social> an hidden-service (the client RPC) + an other one (for the P2P interface)
-
m-relay
<dave.jp:matrix.org> A simple node manager, get everyone running local node + proxy with a few clicks is the need of the hour
-
m-relay
<dave.jp:matrix.org> We have gupax p2poop mining gui , but we don’t have one for node 😂
-
m-relay
<dave.jp:matrix.org> Sometimes I feel, simple things are left as it is to for now reason but like having loopholes
-
m-relay
<dave.jp:matrix.org> Sometimes I feel, simple things are left as it is to for no reason but like having loopholes
-
m-relay
<gingeropolous:monero.social> man, using that p2p exchange was such a breeze. whats the name of it now.... crap i forget. the first one that had btc <-> xmr
-
m-relay
<gingeropolous:monero.social> anyway, it had all the tor stuff just built in. Like, it just did all the connecting for you and then got the bitcoin information you needed or whatever and did it all over tor, without me having to do tor stuff
-
m-relay
<gingeropolous:monero.social> to me, that could be a pinnacle of the monero gui
-
m-relay
<gingeropolous:monero.social> bisq. there it is. good work brain
-
m-relay
<ofrnxmr:monero.social> Bisq? Never heard of if
-
m-relay
<ofrnxmr:monero.social> Android termux node and monerosuite are the best solutions atm
-
m-relay
<dave.jp:matrix.org> Haveno is based on Bisq code 😅
-
m-relay
<ofrnxmr:monero.social> Android termux node's "tor" setup does 100% tor
-
m-relay
<ofrnxmr:monero.social> Whats bisq? Is bisq a spoon of haveno?
-
m-relay
<ofrnxmr:monero.social> haveno-reto.com - ive been using this for years
-
m-relay
<dave.jp:matrix.org> Yes
-
m-relay
<ofrnxmr:monero.social> Bisq must be some new shitcoin exchange
-
m-relay
<gingeropolous:monero.social> ugh why am i getting this in your quotes "Unable to load event that was replied to, it either does not exist or you do not have permission to view it."
-
m-relay
<dave.jp:matrix.org>
bisq.network
-
m-relay
<gingeropolous:monero.social> like, whatever you are quoting i don't see it. i just see the "unable to load"
-
m-relay
<ofrnxmr:monero.social> ew
-
m-relay
<ofrnxmr:monero.social> Haveno-reto.com
-
m-relay
<basses:matrix.org> ??
-
m-relay
<basses:matrix.org> ??
-
m-relay
<syntheticbird:monero.social> ewwww Java
-
m-relay
<gingeropolous:monero.social> yeah just seein that message
-
m-relay
<dave.jp:matrix.org> Bisq currently has more liquidity
-
m-relay
<ofrnxmr:monero.social> I prefer my monero to be a solid or gas
-
m-relay
<ofrnxmr:monero.social> Liquid is centralized
-
m-relay
<dave.jp:matrix.org> Anyways, node manager gui is a must
-
m-relay
<ofrnxmr:monero.social> Have you tried android monero termux node
-
m-relay
<dave.jp:matrix.org> I guess you have taken a pill, take some rest
-
m-relay
<ofrnxmr:monero.social> And orange pill
-
m-relay
<dave.jp:matrix.org> I don’t have a spare android device
-
m-relay
<gingeropolous:monero.social> nah, even a node manager is too much. just need it to Just Work
-
m-relay
<ofrnxmr:monero.social> Monerosuite.org
-
m-relay
<dave.jp:matrix.org> Maybe the dev who made gupax can code something out
-
m-relay
<ofrnxmr:monero.social> Nodes are some play thing, run once and leave it alone
-
m-relay
<ofrnxmr:monero.social> Arent*
-
m-relay
<dave.jp:matrix.org> Is it plug and play ? Easy for noobs to get it running with a few clicks?
-
m-relay
<ofrnxmr:monero.social> Yes
-
m-relay
<dave.jp:matrix.org> Works on windows ? macOS ?
-
m-relay
<ofrnxmr:monero.social> Its docker based
-
m-relay
<ofrnxmr:monero.social> i dont uae windows or mac - couldnt tell ya
-
m-relay
<ofrnxmr:monero.social> And if you run windows. You should just buy monero like a normie
-
m-relay
<dave.jp:matrix.org> So rules out majority of users
-
m-relay
<ofrnxmr:monero.social> Leave the servers to the server os
-
m-relay
<ofrnxmr:monero.social> Good
-
m-relay
<ofrnxmr:monero.social> Consumers dont need to run servers
-
m-relay
<dave.jp:matrix.org> I need node to use monero, not buy
-
m-relay
<ofrnxmr:monero.social> No you dont
-
m-relay
<ofrnxmr:monero.social> You can use a trusted onion/i2p node
-
m-relay
<dave.jp:matrix.org> They need to, if you are paying for a service which fed operates
-
m-relay
<ofrnxmr:monero.social> You just have to know somebody who isnt a windows pleb
-
m-relay
<ofrnxmr:monero.social> Or use monero-gui
-
m-relay
<dave.jp:matrix.org> Moneroworld was trusted
-
m-relay
<ofrnxmr:monero.social> No it wasnt
-
m-relay
<ofrnxmr:monero.social> Its, for years, pointed to who the fkkn"oiws
-
m-relay
<dave.jp:matrix.org> lol getmonero.org had it all over
-
m-relay
<ofrnxmr:monero.social> And gingeropolous even warns ppl NOT to use xmrchain
-
m-relay
<dave.jp:matrix.org> Plebs don’t know what’s trusted or not, they just use google
-
m-relay
<ofrnxmr:monero.social> Trusted means.. drumroll... someone you trust
-
m-relay
<dave.jp:matrix.org> If they can’t find a simple 2-3 step solution to run a node , they will end up with a fucked up node
-
m-relay
<ofrnxmr:monero.social> Windows users use windows, telemetry on
-
m-relay
<ofrnxmr:monero.social> they have bigger issues than chainalysis
-
m-relay
<dave.jp:matrix.org> Yah bill knows what you are typing every single character
-
m-relay
<basses:matrix.org> what's wrong with xmrchain?
-
m-relay
<ravfx:xmr.mx> who is behind xmrchain?
-
m-relay
<ravfx:xmr.mx> considering people throw there txid and sometime even verify transactions on there...
-
m-relay
<dave.jp:matrix.org> So let’s remove windows and macOSs. builds from getmonero , make it 100 geek only coin
-
m-relay
<ofrnxmr:monero.social> Gingeropolous
-
m-relay
<ofrnxmr:monero.social> Same person who runs moneroworld
-
m-relay
<dave.jp:matrix.org> Or just change monero slogan to privacy only for a few
-
m-relay
<dave.jp:matrix.org> So let’s remove windows and macOSs. builds from getmonero , make it 100% geek only coin
-
m-relay
<ofrnxmr:monero.social> Privacy is only as good as the person using it
-
m-relay
<ofrnxmr:monero.social> Ppl use mymonero on windows
-
m-relay
<ofrnxmr:monero.social> Ppl use browser wallets
-
m-relay
<ofrnxmr:monero.social> Ppl email their seeds using gmail / drive
-
m-relay
<dave.jp:matrix.org> Mymonero is fucking listed on getmonero
-
m-relay
<basses:matrix.org> ginger fed?
-
m-relay
<ofrnxmr:monero.social> Luigi even uses gmail
-
m-relay
<dave.jp:matrix.org> Remove that first
-
m-relay
<dave.jp:matrix.org> Getmonero feels like a honeypot
-
m-relay
<basses:matrix.org> and windows
-
m-relay
<ofrnxmr:monero.social> Edge too
-
m-relay
<ofrnxmr:monero.social> And got "hacked" for 400k
-
m-relay
<dave.jp:matrix.org> Yes
-
m-relay
<ofrnxmr:monero.social> Used Ssh password instead of keys as well
-
m-relay
<ofrnxmr:monero.social> Its on cloudflare too
-
m-relay
<dave.jp:matrix.org> Anyways give them tools, don’t exclude them; going back to my cave
-
m-relay
-
m-relay
<ofrnxmr:monero.social> ❤️ we have the bestest xore team
-
m-relay
<basses:matrix.org> will open a CCS for spreading OPSEC and hardening Guides
-
m-relay
<ofrnxmr:monero.social> 💀
-
m-relay
<ofrnxmr:monero.social> actions speak louder than ccs proposals text
-
m-relay
<ofrnxmr:monero.social> We have bigger problems than a website
-
m-relay
<ofrnxmr:monero.social> Monero p2p traffic can be blocked at isp lvl extremely easily
-
m-relay
<basses:matrix.org> best monero funding spent, just watch
-
m-relay
<ofrnxmr:monero.social> We dont support duplex connections over anonymity networks
-
m-relay
<ofrnxmr:monero.social> Sure sure
-
m-relay
<ofrnxmr:monero.social> Youve been here how long? and youve changed nothing. Doesnt take a ccs to make a pull request
-
m-relay
<ravfx:xmr.mx> literaly a 2 minutes job after they receive the order
-
m-relay
<ofrnxmr:monero.social> Writing guides doesnt get work done
-
m-relay
<ofrnxmr:monero.social> Reading privacyguides doesnt get work done
-
m-relay
<basses:matrix.org> it does in the long run, trust
-
m-relay
<ofrnxmr:monero.social> Want servers hardened? Then go harden them
-
m-relay
<ofrnxmr:monero.social> 🚮
-
m-relay
<ofrnxmr:monero.social> I trust actions
-
m-relay
<ofrnxmr:monero.social> Not ccs proposals for "pay me to lecture"
-
m-relay
<ofrnxmr:monero.social> Acting like we dont have extremely capable people here already
-
m-relay
<basses:matrix.org> bruh wtf you saying lmao
-
m-relay
<ofrnxmr:monero.social> Guides dont defeat politics either
-
m-relay
<ofrnxmr:monero.social> Im saying making a ccs proposal to find a guide is just preaching to the choir
-
m-relay
<ofrnxmr:monero.social> Or rather, to empty seats
-
m-relay
-
m-relay
<basses:matrix.org> gm sir
-
m-relay
<ofrnxmr:monero.social> Fluffy isnt here
-
m-relay
<ofrnxmr:monero.social> Moneroguides are trash
-
m-relay
<ofrnxmr:monero.social> No offence
-
m-relay
<ofrnxmr:monero.social> But their guides are poorly written / full of inconsistencies and bad info. I didnt click the link, just saw the name
-
m-relay
-
m-relay
<ofrnxmr:monero.social> And they didnt even mention tgat p2pool os expensive and spams the chain as a result of creating tons of dust outputs
-
m-relay
<ofrnxmr:monero.social> their node guides were full of bad info too
-
m-relay
<ofrnxmr:monero.social> Getting paid to score 70 on a knowledge test is a larp
-
m-relay
<ofrnxmr:monero.social> Monerosuite.org >>> whatever stupid guide they wrote
-
m-relay
<ofrnxmr:monero.social> and again, not trying to be offensive, but i'm the one who has to correct all of the poor quality guides
-
m-relay
<ofrnxmr:monero.social> Its like.. obvious that the ool writing these guides don't actually use the info regularly
-
m-relay
<ofrnxmr:monero.social> Like writing a tor guide when you dont use tor
-
nioCat
<ofrnxmr:monero.social> And if you run windows. You should just buy monero like a normie <<>> they don't let me buy like a noemie
-
m-relay
<ofrnxmr:monero.social> Feather comes with onion nodes
-
m-relay
<ofrnxmr:monero.social> (and tor)
-
m-relay
<daybreak:nitro.chat> First time I heard p2pool bad 😮
-
m-relay
<daybreak:nitro.chat> Tell me more!
-
m-relay
<neromonero1024:monero.social> isn't fcmp gonna help with p2pool consolidation (smaller tx size, less fee)?
-
m-relay
<neromonero1024:monero.social> the dust is an issue, yes... but don't think it can be solved unless solo mining becomes viable
-
m-relay
<neromonero1024:monero.social> isn't fcmp gonna help with p2pool consolidation (smaller tx size for more inputs, thus less fee)?
-
m-relay
<neromonero1024:monero.social> the dust is an issue, yes... but don't think it can be solved unless solo mining becomes viable
-
m-relay
<ofrnxmr:monero.social> Solo mining is viable..
-
m-relay
<ofrnxmr:monero.social> Pool mining is a joke / scam for small/med miners
-
m-relay
<ofrnxmr:monero.social> Why do you think large miners mine on a pool, when they can hit blocks solo?
-
m-relay
<ofrnxmr:monero.social> its because they make more xmr due to taking advantage of small who (reportedly) donate their solo blocks
-
m-relay
<ofrnxmr:monero.social> Small miners on p2pool are the dumbest of the bunch
-
m-relay
<ofrnxmr:monero.social> Mining on p2pool mini gets you anywhere from 20-80% of the earnings that youd make solomining. Only benefit of p2pool for small miners is being paid 0.0002xmr within days of starting
-
m-relay
<ofrnxmr:monero.social> Essentially having big miners offer you peanuts in exchange for your entire blocks if you hit one (which you will)
-
m-relay
<ofrnxmr:monero.social> If it takes you 1 yr to find a block (according to calc), that is 1 year _on average_. Acounting for fees, it would take 15months accumulate 1 block via p2pool mini for a small miner.
-
m-relay
<ofrnxmr:monero.social> Its very likely that you will hit a block _before_ 15months. Of course there is a chance that you have 400% effort (and takes 4 years to hit a block), 50% of the time, blocks are found with less than 100% effort.
-
m-relay
<ofrnxmr:monero.social> solomining is the best way to mine for a user with low hashrates
-
m-relay
<ofrnxmr:monero.social> users with large hashrates benefit from pool mining due to having small miners donate their blocks to them
-
m-relay
<servers.guru:matrix.servers.guru> We don't resell hetzner anymore since a few months. We have our own virtualization stack on dedicated servers from different providers ( depending on location). We still resell hetzner for arm and cloud-server.
-
m-relay
<monerobull:matrix.org> Cool, good to know
-
m-relay
<daybreak:nitro.chat> Are they?
-
m-relay
<daybreak:nitro.chat> Has ginger commented on the chainanal stuff
-
m-relay
<daybreak:nitro.chat> Could the block explorer somehow be backdoored so if the first link you opened was a specific transaction it'll assume your IP made that transaction 😮
-
geonic
never been a fan of pool mining, solo mined 3 blocks using the GUI
-
m-relay
<quickex:matrix.org> hey guys! Am i alone who struggles with reddit ban? just created community, posted nothing and banned next day...
-
plowsof
quickex if you registered using tor that'll get you shadowbanned
-
plowsof
in these situations i would love to recommend monero.town but that can't be accessed currently with tor
-
m-relay
<monerobull:monero.social> bcs ddos from exit nodes crashes the lemmy frontend
-
plowsof
all you have to do is employ a team of sysadmins... maybe an onion load balancer and some mods to lemmy omgggg
-
plowsof
\/s ^ is there an opportunity for the community to fund a bounty of sorts to help the effort monerobull?
-
m-relay
<monerobull:matrix.org> onion load balancer doesnt do anything if the ddos is coming from clearweb exit nodes
-
m-relay
<monerobull:matrix.org> there are alternative lemmy frontends but once again the lemmy routing stuff makes it impossible for me to figure out how to get it working and there is no guarantee that those wont also just crash
-
plowsof
does lemmy.cafe have 'secret sauce' that we need?
-
m-relay
<nononynous:monero.social> Need to rate limit the frontend delivery + an other server to serve static contant
-
plowsof
what im asking is, can there be a bounty for 'hand this dockerfile to monerobull to fix the problems' or is this more of a 'pay a team of sysadmins to overlook the entire project / fix things / pay for extra infra '
-
m-relay
<monerobull:matrix.org> the vps should be powerful enough
-
m-relay
<monerobull:matrix.org> lemmy sadly isnt just a docker container, it also has some nginx config stuff and that is a big mess
-
m-relay
<monerobull:matrix.org> if some trusted god-sysadmin wants to set it up from scratch with a tor friendly frontend + onion we could do a bounty for that
-
m-relay
<321bob321:monero.social> probably not get targeted
-
m-relay
<monerobull:matrix.org> right now it works "good enough" even while under attack that i am scared to mess with it too much
-
m-relay
-
m-relay
<monerobull:matrix.org> for some reason the vps reports 99% storage usage but ncdu -x / shows like 1/3
-
k4r4b3y
I would like having the town on the darknet. However, what would be swell, would be, having the jerboa app also connect to the town's onion.
-
k4r4b3y
I don't think jerboa can connect to .onion URLs for reaching lemmy instances, yet.
-
m-relay
<js:nil.im> So with everyone here having a strong opinion that you must run a full node, I guess people in here hate feather? What are the actual security problems of using feather?
-
k4r4b3y
I don't hate feather, neither do I think "everyone should run a full node"
-
plowsof
feather can be pointed at a local node
-
plowsof
using a remote node over tor still has concerns, i'd watch the breaking monero episode 7 on remote nodes. here is the canonical youtube link
youtube.com/watch?v=n6Bxp0k7Uqg
-
k4r4b3y
plowsof: thanks, I should check it. However, Monero cannot reach as much people as it could, if it were a requirement on everyone to run a full node.
-
plowsof
as many services has stated, including localmonero RIP - when a customer has an issue with something, 'just use feather' pretty much solves it
-
k4r4b3y
:)
-
plowsof
id rather people use a remote node than giving their viewkey to a remote scanning service
-
k4r4b3y
plowsof: ++
-
moneromooo
Depends which people I guess.
-
k4r4b3y
what's alex from localmonero doing these days?
-
k4r4b3y
it would be a loss to have him leave the monerosphere permanently.
-
plowsof
the people need to decide what kind of people they are hmmm "So you want to send/receive Monero?" monero.garden type reading material perhaps
-
k4r4b3y
plowsof: yes, that's a good idea. Perhaps a step-by-step reading guide: "follow these articles if you are a merchant and want to accept XMR in your online store."
-
k4r4b3y
"follow these articles if you want to hoard Monero and pass it onto your sons."
-
k4r4b3y
or, follow these articles if you want to isolate feather wallet and monerod on your qubesOS:
karapara.kyun.li/wiki/feather-walle…llet_isolated_qubes_whonix_setup_en
-
plowsof
note that local node management is on feathers to-do list
-
k4r4b3y
plowsof: that sounds cool.
-
plowsof
so there would be a scale: full local node on the left, and fr**wallet on the right
-
plowsof
-
plowsof
also js, iirc due to feather wallets multi broadcasting of transactions, it could be possible for an outside observer to determine that this tx was made using FW, pls confirm
-
plowsof
i read this a year(s) ago, maybe things have changed
-
m-relay
<js:nil.im> So you’re saying the more people use feather the more private it will get? :P
-
k4r4b3y
"feather wallets multi broadcasting of transactions" <--- I am guessing my setup (which I linked above) with feather wallet in an offline qube, only allowed to connect to the 18081 port of my monerod node, disables such a "multi broadcasting" feature on feather wallet's part.
-
BlueyHealer
Viewkey to a remote scanning service? What?
-
BlueyHealer
Anyway, are there big disadvantages of using Feather with a local node?
-
k4r4b3y
BlueyHealer: I think plowsof was thinking about mymonero wallet.
-
BlueyHealer
Not like I would be running any, space would be a concern, an extra HDD would cost more than my entire stash of XMR)
-
k4r4b3y
BlueyHealer: "are there big disadvantages of using Feather with a local node?" <--- I can't think of any disadvantages.
-
BlueyHealer
k4r4b3y, ah, never heard of it.
-
k4r4b3y
"an extra HDD would cost more than my entire stash of XMR" <--- high tech, low stack (of XMR).
-
BlueyHealer
wdym?
-
k4r4b3y
I mean, HDD prices are fairly low nowadays (last I checked). If that amounts to more than your XMR stash, imo you should get more XMR. (tongue in cheek)
-
k4r4b3y
I was also making a point about the fact that Monero is such a high-tech piece of software and we are using it, yet most of us have minuscule stacks of it.
-
k4r4b3y
In the event of hypermonero-ization, we won't be the most beneficiaries of such event (due to our low stacks of XMR).
-
BlueyHealer
I mean, I don't need more XMR, I spend very little. And I have needs more important than buying extra XMR.
-
k4r4b3y
Kinda like cyberpunk: high tech low life.
-
BlueyHealer
ah, get it.
-
k4r4b3y
BlueyHealer: understood.
-
boldsuck
ofrnxmr:monero.social: > Trocador and plowsof nodes have tx-proxy. Not sure about the others
-
BlueyHealer
I wonder: in such a case, I guess a remote Tor node would be enough? Plus threat model being low, the biggest risk being "what if XMR is cracked down on in the future".
-
boldsuck
Mine (mainnet) have always had that too. I haven't found a .onion P2P node for stagenet in years.
-
k4r4b3y
BlueyHealer: if you aren't someone that is personally targeted by intelligence agencies, you are good with using a remote onion node. Always compare the remote node's transaction fee with some other source, though; as the remote nodes might lie to you about the fee rates.
-
BlueyHealer
Also now I am afraid that I connected to nodes without Tor a few times :/ Wonder if this would bite me in the ass. Chainalysis is Western so even smaller deal, but the other nodes in the list might've been controlled by my country...
-
k4r4b3y
BlueyHealer: going forward, use .onion ones.
-
BlueyHealer
Yeah, know about fees) Even without comparison, I usually see it is less than "pocket change".
-
k4r4b3y
yeah
-
BlueyHealer
k4r4b3y, yeah, I have been doing so for a while now. I just wonder if my previous mistakes could contribute to my future transactions.
-
BlueyHealer
At least I have a reassurance in being extremely unlikely to be targeted, and impossible to target "seriously".
-
k4r4b3y
BlueyHealer: that's good. Keep it that way.
-
BlueyHealer
I just wonder if the past mistakes could impact future ones.
-
k4r4b3y
BlueyHealer: you need to be more specific in your worries. What exactly are you worried about? What kinds of past mistakes could impact future ones (again, what?)?
-
BlueyHealer
I meant the transactions I made via clearnet from that wallet - would they have an impact on what I would do with the wallet going further? Would transferring to a new wallet help?
-
k4r4b3y
That's better. So, if I am understanding you correctly, one of your worries is that you think that your enotes ("your xmr coins") might be associated with your clearnet IP, and that in the future, as you keep using your enotes, you think that this association might persist?
-
BlueyHealer
Yeah, and whatever funds would get into this wallet afterwards. I am reading materials on XMR now but still not quite grasping this.
-
k4r4b3y
I think the privacy worries you have with incoming, new coins into your wallet aren't related to your "past mistake" of using clearnet nodes.
-
k4r4b3y
Each monero transaction that spends an enote ("coin") also presents to the blockchain 15 other decoys. As such an obfuscation piles upon one another on the blockchain, your own coins will get mixed in with others'.
-
k4r4b3y
The line between your coins and others' coins, to an outside observer, will blur.
-
k4r4b3y
So, putting some time interval between the times that you've used clearnet nodes, and then spent your own coins using the onion nodes; that time interval plays to your advantage, imo. The longer it is, the more obfuscated and untraceable the supposed link will be.
-
k4r4b3y
BlueyHealer: also, see this video in order to understand the tracing capabilities of chainalysis from last year:
vimeo.com/1009284260
-
BlueyHealer
Ah, good to know. Also... Is the decoy selection relying on the node or something else too? Could a node mix in known decoys?
-
m-relay
<basses:matrix.org> mentioned on the website?
-
m-relay
<quickex:matrix.org> nope, registred from google
-
k4r4b3y
"Could a node mix in known decoys?" <--- I suppose a malicious node could do that, although I am quite uneducated in this topic.
-
BlueyHealer
I either missed that or haven't read far enough.
-
m-relay
<basses:matrix.org> google what?
-
m-relay
<basses:matrix.org> you mean real IP address?
-
moneromooo
The wallet decides which indices to pick. The node can't substitute other keys or the tx will fail to verify.
-
moneromooo
A node *might* be able to decide which outputs they want in a tx, then manufacture a fake distribution that has only these, and claim the chain has just 16 outputs on it.
-
moneromooo
Not sure if that'd work. I don't want to spend time trying, but if somone here wants to...
-
moneromooo
(ie, that node would send the wallet info that would induce it to pick the outputs the node wants it to use)
-
BlueyHealer
Ah, will look into this.
-
moneromooo
Now, it would be tamper evident, if you keep logs (or even check the "here what was selected" line on confirmation.
-
k4r4b3y
"A node *might* be able to decide which outputs they want in a tx, then manufacture a fake distribution that has only these, and claim the chain has just 16 outputs on it." <--- so yeah, isn't this the "textbook definition" of a malicious node providing a remote wallet its known decoys?
-
sech1
The node only sends output distribution, i.e. how many outputs are in each block
-
sech1
it can probably manipulate this output to make wallet pick some specific outputs
-
moneromooo
Yes, but I was thinking it'd claim 0 everywhere except on the places it wants you to pick.
-
sech1
But it needs proof of concept
-
k4r4b3y
sech1: that sounds like it supports my initial, uneducated intution.
-
k4r4b3y
FCMP++ will cleanse everything.
-
m-relay
<basses:matrix.org> would be nice if someone could create a prrof of concept
-
m-relay
<basses:matrix.org> proof*
-
moneromooo
Even if the daemon cannot induce the wallet to create a tx with that data, it actually allows the daemon to tell at least one output of yours:
-
moneromooo
it sends the wallet a distribution with 16 outputs, and then the wallet asks for all these plus an extra one. Which has to be yours. Very unlikely to be one of the 16.
-
moneromooo
Actually, there'll be some uncertainty, the wallet asks for 2.5 times 16 IIRC. So the daemon would have to claim 40 on the chain.
-
sech1
It could send a distribution where a single block has these 40 or so outputs, and all belong to the attacker, and all are spent already
-
moneromooo
Why would spendness matter ?
-
moneromooo
And yes, no uncertainty actually. I was wrong there.
-
sech1
If they are spent or not doesn't matter, yes. If the all belong to the attacker
-
sech1
*they
-
moneromooo
Oh, can't work, fortunately: // sanity check THROW_WALLET_EXCEPTION_IF(m_rct_offsets.offsets().back() >= OUTPUT_DISTRIBUTION_MAX_OUTPUT_SUM, error::wallet_internal_error, "Unrealistic number of outputs in output distribution");
-
moneromooo
(that's 100000000)
-
moneromooo
Ah, I remembered adding something like this:
-
moneromooo
THROW_WALLET_EXCEPTION_IF(m_rct_offsets.back() <= max_rct_index,
-
moneromooo
error::get_output_distribution, "Daemon reports suspicious number of rct outputs");
-
moneromooo
Nevermind then. Was interesting to think about, even if it was thought of before.
-
sech1
Where is that code? I can't find it
-
moneromooo
wallet2.cpp
-
sech1
not in the master branch
-
moneromooo
Oh. Maybe just in Townforge then...
-
moneromooo
No, in monero master, line 9149.
-
sech1
ah, it has different name there
-
moneromooo
Ah the first one comes from feather mods I merged into TF long ago. The second one is mine, from ages ago.
-
moneromooo
Oooh, might be able to bypass this check:
-
moneromooo
Claim 0 everywhere, except on the places you want to the wallet to pick, and put the real number of outputs on the last slot. The wallet will never pick those as they're 10 block locked.
-
moneromooo
So that goes past the sanity checks.
-
moneromooo
Back in the race ^_^
-
moneromooo
Quick sanity check against this might be to check every slot has >= 1 (the min number of coinbase outs).
-
moneromooo
(after rct coinbases becomes mandatory)
-
k4r4b3y
moneroomoo: would that be assuming that the malicious node operators do not possess coinbase outputs?
-
moneromooo
Then again, it's not enough: someone will ask for N-1 coinbases and still disclose their real out...
-
moneromooo
I don't think so.
-
sech1
Maybe make the output distribution built-in up until some block, like monerod checkpoints
-
moneromooo
Yes, or a hash of the first N distriution slots, and update N with every release.
-
moneromooo
Depends on the size of it I guess.
-
jeffro256
Is the Matrix server down for other people too?
-
ofrnxmr
Yes
-
m-relay
<chaser:monero.social> (the monero.social Matrix seems unreachable for me from both accounts, this is a test message attempt at 16:28 UTC from my monero.social account.)
-
m-relay
<quickex:matrix.org> yep
-
m-relay
<rottenwheel:kernal.eu> PSA. monero.social Matrix homeserver is down. If you still want to participate in today's MRL meeting or just hang with us while CS fixes it, use a different homeserver or join through IRC.
-
BlueyHealer
IRC FTW
-
BlueyHealer
Just as I borked my Matrix install's media capabilities.
-
m-relay
<rottenwheel:kernal.eu> > Hello,
-
m-relay
<rottenwheel:kernal.eu> >
-
m-relay
<rottenwheel:kernal.eu> > We have received a copyright complaint under our Terms of Use and Copyright Policy from Chainalysis about the following materials uploaded by your user account to archive.org:
-
m-relay
<rottenwheel:kernal.eu> >
-
m-relay
-
m-relay
<rottenwheel:kernal.eu> >
-
m-relay
<rottenwheel:kernal.eu> > The above materials have been disabled. If you believe that this copyright complaint was in error, you may file a counter-notice (as described under the question "How do I submit a copyright complaint counter-notice?"). If you seek more information about the copyright claim, for instance, identification of the particular allegedly infringed work(s), please let us know.
-
m-relay
<rottenwheel:kernal.eu> >
-
m-relay
<rottenwheel:kernal.eu> > You are only permitted to upload materials that you have the rights to. The Internet Archive disables accounts that repeatedly violate the copyrights of others. Thank you for ensuring that your use of archive.org abides by our Terms of Use.
-
m-relay
<rottenwheel:kernal.eu> >
-
m-relay
<rottenwheel:kernal.eu> > --
-
m-relay
<crispycat:matrix.calitabby.com> p- pwease stop sharing our silli video 🥺🥺
-
BlueyHealer
haha funny i2p torrent go brr
-
k4r4b3y
based
-
k4r4b3y
"look babe there is at least one peer that's pulling the chainalysis IRS leak video. Let's share it with him."
-
m-relay
<nihilist:nowhere.moe> test
-
m-relay
<nihilist:nowhere.moe> yea the monero.social matrix server is fine right
-
m-relay
<tsjk:bitcoinist.org> everyone talks about this chainalysis video. I already trust noone and know that everything I do on clearnet is logged. Will it make me wiser?
-
k4r4b3y
-
m-relay
<tsjk:bitcoinist.org> thanks. wonder if I can download that
-
k4r4b3y
yt-dlp should work
-
k4r4b3y
I have an i2p-magnet link for it as well
-
k4r4b3y
magnet:?xt=urn:btih:d371d4e4cb9a3760ef79e94fde0b8edf22062e49&dn=Chainalysis+Presentation+on+Monero+to+IRS+-+August+2023&tr=http://tracker2.postman.i2p/announce.php
-
m-relay
<tsjk:bitcoinist.org> yeah, please paste the magnet.
-
m-relay
<tsjk:bitcoinist.org> awesome
-
plowsof
bitcoinist dot org is back?
-
m-relay
<tsjk:bitcoinist.org> Was it away? I'm somewhat new to matrix and just picked a server that looked ok.
-
m-relay
<plowsof:matrix.org> welcome 👋
-
m-relay
<tsjk:bitcoinist.org> Thanks :)
-
m-relay
<strawberry:monero.social> Main takeaways iirc:
-
m-relay
<strawberry:monero.social> - run your own node, or at the very least use onion remote nodes
-
m-relay
<strawberry:monero.social> - don't use exodus or other wallets which use non-standard fee rates
-
m-relay
<strawberry:monero.social> - avoid spending multiple related outputs at the same time
-
m-relay
<strawberry:monero.social> - use a proxy if you need to use exchanges or swap websites
-
m-relay
<strawberry:monero.social> If you're already using common sense and these best practices you should be okay
-
k4r4b3y
"avoid spending multiple related outputs at the same time" <--- this one stin{g,k}s.
-
m-relay
<tsjk:bitcoinist.org> I do run my own node, at least. Common sense is not so common, I heard.
-
m-relay
<tsjk:bitcoinist.org> Anyway, I'm not worried for my own sake, but am always curious about knowing what the potential enemy is doing.
-
k4r4b3y
@tsjk:bitcoinist.org ++
-
m-relay
<hanshan:monero.social> I have a clearnet link if you want:
-
m-relay
-
m-relay
<tsjk:bitcoinist.org> Thanks. I already got it now. :)
-
m-relay
<daybreak:nitro.chat> And this link has stayed up since day 1
odysee.com/chainalysis-monero-tracing:e
-
m-relay
<daybreak:nitro.chat> What if we do a no chainalysis november and spread this video everywhere for a month
-
m-relay
<daybreak:nitro.chat> I'm not that well versed in monero's current decoy selection algorithm I just know that it isn't using gamma distributions. Does monero now sometimes choose decoys from years in the past even when the change output is like a day old?
-
m-relay
<daybreak:nitro.chat>
xmrchain.net/tx/88f1e62b4156ef99272…6d85badff3fb20a623f8f33d9bc1aab4971 in this transaction for example there are two really old utxos and the rest are relatively new so would it be a fair guess to say the 2 oldest outputs in the ring are probably real
-
m-relay
<daybreak:nitro.chat> Or does the algorithm account for that
-
m-relay
<dave.jp:matrix.org> Dsa for old decoys is indeed not that good
-
m-relay
<dave.jp:matrix.org> Bulk of the decoys get selected from very recent outputs , but MRL thinks that’s the best approach
-
m-relay
<dave.jp:matrix.org> Anyways with mythical fcmp this won’t be a problem
-
m-relay
<daybreak:nitro.chat> Interesting IG I'll just trust MRL!!
-
m-relay
<snowman:tetaneutral.net> It’s a shell game. Always has been.