Re: [Bitcoin-development] The insecurity of merge-mining

2013-12-31 Thread Peter Todd
On Wed, Jan 01, 2014 at 05:09:27AM +, Luke-Jr wrote: > > You assume the value of a crypto-currency is equal to all miners, it's > > not. > > > > Suppose I create a merge-mined Zerocoin implementation with a 1:1 > > BTC/ZTC exchange rate enforced by the software. You can't argue this is > > a s

Re: [Bitcoin-development] The insecurity of merge-mining

2013-12-31 Thread Luke-Jr
On Wednesday, January 01, 2014 4:53:42 AM Peter Todd wrote: > On Tue, Dec 31, 2013 at 01:14:05AM +, Luke-Jr wrote: > > On Monday, December 30, 2013 11:22:25 PM Peter Todd wrote: > > > that you are using merge-mining is a red-flag because without majority, > > > or at least near-majority, hashin

Re: [Bitcoin-development] The insecurity of merge-mining

2013-12-31 Thread Peter Todd
On Tue, Dec 31, 2013 at 01:14:05AM +, Luke-Jr wrote: > On Monday, December 30, 2013 11:22:25 PM Peter Todd wrote: > > that you are using merge-mining is a red-flag because without majority, or > > at least near-majority, hashing power an attacker can 51% attack your > > altcoin at negligible co

Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?

2013-12-31 Thread Matt Corallo
We already have a wonderful system for secure updating - gitian-downloader. We just neither use it not bother making actual gitian releases so anyone can use it to verify signatures of downloads. Jeremy Spilman wrote: >I didn't know about the dedicated server meltdown, it wasn't any of my > >i

Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?

2013-12-31 Thread Jeremy Spilman
I didn't know about the dedicated server meltdown, it wasn't any of my infra. Anyway, my previous offer still stands.One less 'security theater' approach would be if we could provide forward-validation of updates using the blockchain. It's always going to be up to the user the first time they inst

Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?

2013-12-31 Thread Mike Hearn
> > The site was actually moved onto a dedicated server temporarily and it > melted down under the load. I wouldn't call that no progress. > Oh, it did? When was that? I must have missed this excitement :) Any idea how much load it had? Perhaps I wasn't clear on the point I was making Drak's thr

Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?

2013-12-31 Thread Gregory Maxwell
On Tue, Dec 31, 2013 at 5:59 AM, Mike Hearn wrote: > but moving to different ones is > controversial, hence no progress :) The site was actually moved onto a dedicated server temporarily and it melted down under the load. I wouldn't call that no progress. Perhaps I wasn't clear on the point I w

Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?

2013-12-31 Thread Benjamin Cordes
Interesting. I think the original BitDNS discussion was more interesting that what currently is happening with namecoin, see https://bitcointalk.org/index.php?topic=1790.0 Satoshi said there: "1) IP records don't need to be in the chain, just do registrar function not DNS. And CA problem solved,

Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?

2013-12-31 Thread Mike Hearn
Given that hardly anyone checks the signatures, it's fair to say downloads aren't protected by anything at the moment. SSL for downloads can only raise the bar, never lower it, and if the NSA want to kick off the process of revoking some of the big CA's then I'm game (assuming anyone detects it of

Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?

2013-12-31 Thread Gregory Maxwell
On Tue, Dec 31, 2013 at 5:39 AM, Drak wrote: > The NSA has the ability, right now to change every download of bitcoin-qt, > on the fly and the only cure is encryption. Please cut it out with the snake oil pedaling. This is really over the top. You're invoking the NSA as the threat here? Okay. The

Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?

2013-12-31 Thread Drak
Has anyone seen the talk at 30c3 on the current NSA capabilities? https://www.youtube.com/watch?v=b0w36GAyZIA Specifically they are able to "beat the speed of light" between you and a website such that if you communicate with Bob, they can sent competing packets that will arrive before Bob's packe

Re: [Bitcoin-development] Merge mining

2013-12-31 Thread rob . golding
> But there's so much 'dry powder' out there (GPUs), I wonder if *not* > supporting merge-mining is any better? At least the attacker has to do > some unique PoW, so you hope it's costing them something. With lots of people having access to 100TH+ there's not really much 'cost' to doing a 51% att