mircea_popescu: why do people constantly want to do things differently than the way things are done i have no idea.
fluffypony: benkay: depends on the type of business
fluffypony: benkay: they may move things around during the month for operational purposes (change addresses in a wallet etc.), so moving it into one address is a very quick operation
mikaeldice: I was thinking more of an open ledger which automatically updates with expenditures from preset addresses. The user adds a justification, maybe associates an expense account to it
mircea_popescu: that's the accounting standard, bitcoin companies do use it, etc.
benkay: fluffypony: wouldn't simply signing with the addr key suffice?
mircea_popescu: so then what are you talking about ?
fluffypony: mikaeldice: they could just publish their monthlies and prove they have access to the funds they claim by sending it to a public address
mircea_popescu: mikaeldice http://trilema.com/2013/accounting-for-the-nonzero-asset-corporation-the-mpex-standard/
mikaeldice: I'd like to see bitcoin companies start using a more transparent accounting system that's more detailed than the blockchain. It wouldn't really cut down on fraud, but it might make the incompetent more noticeable and accountable.
moiety: i just realised i used later tell earlier probably wrongly because i was looking at the wrong part of the people list
gribble: alexsanjose was last seen in #bitcoin-assets 5 days, 19 hours, 12 minutes, and 36 seconds ago: <alexsanjose> if you come across in humans in Central America who have bitcoin gambling operations and they want to talk to a reporter, tell them i dont bite alexandra.alper@thomsonreuters.com
benkay: just another dumpun. don't break yourself.
benkay: the log
mikaeldice: Nothing new.. I've been wondering for a while if there is a better forum than bitcointalk, though.
asciilifeform: artifexd: sadly, i'm otherwise occupied. but you are encouraged to do it yourself
mircea_popescu: artifexd only after he finishes the cardano
mircea_popescu: "- The Yubikey personalization app saves a .csv logfile with the programmed key values meaning a malware-based attack may discover the log files on block devices even when the files have been deleted"
artifexd: asciilifeform: I have one that I'm willing to sacrifice to the cause but I have no idea how to do that.
asciilifeform: mircea_popescu: looks like it only mentions the server-end crap
mircea_popescu: i'm the grandmaster of white sauces.
moiety: pasta is good for the soul :]
mircea_popescu: the "deeper" connections
mircea_popescu: thestringpuller paths that include any given segment at most once
moiety: fluffypony: aww! i wonder if they followed on land too!
mircea_popescu: thestringpuller actually i would imagine its accuracy is a linear function of the average length of noncircular paths.
mircea_popescu: thestringpuller that'd be accurate
mircea_popescu: ah, the sweet pleasure of the utter destruction of schmucks that thought they knew better
mircea_popescu: they just split, lost the government, are probably going straight to the history books.
mircea_popescu: this romanian party, was ruling party. a year or so ago i quit, and quite publicly told them to either bring me the head of the then-president or else there will be no fucking party.
benkay: <fluffypony> I worked at this IT company, and there were these two cute sales girls (literally the only two decent looking people at the company) << including you?
gribble: The wunderbar S.MPIF pe Trilema - Un blog de Mircea Popescu.: <http://trilema.com/2014/the-wunderbar-smpif/>; The Legend of Malin Kundang by Muthy - YouTube: <http://www.youtube.com/watch?v=4IPjMv1Zef0>; PV#1 Light Novel Indonesia "TOP IDOL!" - YouTube: <http://www.youtube.com/watch?v=8DRKmyeXj6s>
gribble: The wunderbar S.MPIF pe Trilema - Un blog de Mircea Popescu.: <http://trilema.com/2014/the-wunderbar-smpif/>
gribble: The wunderbar S.MPIF pe Trilema - Un blog de Mircea Popescu.: <http://trilema.com/2014/the-wunderbar-smpif/>
gribble: The wunderbar S.MPIF pe Trilema - Un blog de Mircea Popescu.: <http://trilema.com/2014/the-wunderbar-smpif/>; Economic cycles finally explained pe Trilema - Un blog de Mircea ...: <http://trilema.com/2014/economic-cycles-finally-explained/>; Gloria pe Trilema - Un blog de Mircea Popescu.: <http://trilema.com/2014/gloria/>
mircea_popescu: thestringpuller Apr 23 05:03:11
benkay: submit to the personalization, mircea_popescu
gribble: WARNING: Currently not authenticated. Trust relationship from user thestringpuller to user ukto: Level 1: 0, Level 2: -4 via 3 connections. Graph: http://b-otc.com/stg?source=thestringpuller&dest=ukto | WoT data: http://b-otc.com/vrd?nick=ukto | Rated since: Wed Jun 15 00:24:56 2011
gribble: WARNING: Currently not authenticated. Trust relationship from user thestringpuller to user utko: Level 1: 0, Level 2: 0 via 0 connections. Graph: http://b-otc.com/stg?source=thestringpuller&dest=utko | WoT data: http://b-otc.com/vrd?nick=utko | Rated since: never
benkay: something like 'this bet resolves as yes if there's more yes than no'
gribble: WARNING: Currently not authenticated. Trust relationship from user thestringpuller to user Ukyo: Level 1: 0, Level 2: 0 via 0 connections. Graph: http://b-otc.com/stg?source=thestringpuller&dest=Ukyo | WoT data: http://b-otc.com/vrd?nick=Ukyo | Rated since: never
benkay: was there a recursive bitbet recently?
benkay: not quite the dragon of btc
benkay: <BingoBoingo> fluffypony: All it takes is 1 Manul and then you have 0 doges << ftfy
thestringpuller: I'm reading up on the march 21st logs, just wondering what came of the IRC interview.
thestringpuller: seems like Romania is the new Brazil
jurov: he is there
jurov: mrstickball, you can inquire Mr. Miquel J. Pavón Besalú for lulz if you want provided you publish the convo,
mircea_popescu: artifexd fluffing is when a youngish girl that aspires to one day make money from porn tries her inept damdest to get up the overworked penis of some druggie pronstar guy
fluffypony: well it's better than some of my nicknames in the 90s
fluffypony: till they started calling me fluffypony and FP in emails and at Friday afternoon drinks
fluffypony: and they thought "fluffy pony" was much better
fluffypony: artifexd: that came up as part of the convo that night ;)
fluffypony: so in the wee hours of a debaucherus night/morning they decided my nick name would be fluffy horse
mircea_popescu: before or after the oral sex ?
fluffypony: and they decided to give me a nick name
fluffypony: and they were known as fluffy puppy and fluffy bunny
fluffypony: I worked at this IT company, and there were these two cute sales girls (literally the only two decent looking people at the company)
fluffypony: oh I saw that in the log
mircea_popescu: btw, what's with the brony power puff nick ?
fluffypony: on the toilet
mircea_popescu: btw, what's the worst time to have a productive streak ?
pankkake: I have had some productivity streaks while on the train
Namworld: Seems like a good reason to not give up then.
mircea_popescu: pankkake see, the problem is you don't fly enough.
pankkake: fluffypony: I'll eventually make a script to put them on my ereader. maybe I'll read them all then
Namworld: Returning the investment is not something that the forum can digest you say? So if I complete repaying all my lenders, all hell will break loose on the forum?
pankkake: there's no public nav for berkshire?
mircea_popescu: anyway : because i actually included pc5 explicitly, the share actually has a clear mechanism to track nav pretty closely.
artifexd: Well. Crap. I hate asking questions when the answer is in black and white.
mircea_popescu: " It may pay a dividend during any period I determine this expedient, but there is no promise of monthly dividend (nor does such a thing make any sense whatsoever, for most companies)."
pankkake: it's in the blog post iirc
mircea_popescu: dividends will happen if there's no rational use of capital comensurate with historical gains, so if the thing makes ~10% pa for a while, and there's no way to beat that, i'd start distributing capital
mircea_popescu: so in general, the share should appreciate through tracking its nav.
artifexd: mircea_popescu: What is the way in which purchasers of f.mpif are expecting to make money? Increase in nav? Dividends?
mircea_popescu: fluffypony they'll buy virtual mining shares.
mike_c: i'm sure they will find someone willing to take it.
fluffypony: so now they have this pile of BTC that was meant for GoCoin
fluffypony: mike_c: I'd love to know what they're going to do since GoCoin rejected their investment
mircea_popescu: <mike_c> they got their mistakes out of the way with SF1. You need to jump on SF2, it's going to the moon. << i forget, what was the eventual return on that thing ?
mircea_popescu: as long as the user can choose, you're scott free.
mircea_popescu: <Naphex> we are planning on reaching regular folks as well << tbh, as long as you ernestly offer the strong version, nobody can hold it against you that you also offer a convenient version.
mircea_popescu: <benkay> hey, guys: which is less likely to leak? openssl or gpg? << gpg may still have a bug or two in there.
pankkake: that's like the password things that require you to have "at least one number, one capitalized letter, one symbol"
mircea_popescu: they used same principle, except (afaik) even shittier implementation
artifexd: The code to run a yubikey server is open source so you, I, or anyone is welcome to swap out the key and run their own server.
mircea_popescu: <benkay> all of a sudden i'm struck by the notion that the only good withdrawal message is one gpg-signed by the withdrawing party. << welcome to... 2012 ?
pankkake: oh was that why the mtgox keys worked only with mtgox?
mircea_popescu: artifexd> That may, or may not, invalidate the ability to use yubikey's servers though. I don't know. << afaik blowing their key does make it unable to use the servers, because you see, the true beauty of stupidty : they actually narrow the keyspace (significantly) to make their product vendor-lockedin
mircea_popescu: unlike the bitbet style, which while being exactly the same thing, is socially unacceptable.
mircea_popescu: <Naphex> asciilifeform: i'm talking from a server end point, i don't have to keep user secret. just public key <<< see, there. that's the value proposition : it allows the operator to say "sorry, fuck you" to the user in terms that are socially acceptable,
mircea_popescu: asciilifeform> you gotta transport the secret to the user << did i wake up today in a parallel universe where public-key crypto was never invented ? << no, you woke up in a parallel universe where microsoft is still a business model.
asciilifeform: may as well say that it beats being dragged behind a truck until nothing remains on the rope but a tattered thread of skin.
fluffypony: there we go
mircea_popescu: so how was the difficulty ?
moiety: BB start the BitBet nao!
BingoBoingo: 'They were developed as a water rescue/lifesaving dog, but according to O. Krasnovskaya, "That was not a good idea as [they] were not willing to save drowning people, but mostly were looking to bite them so this breed was never developed".'
BingoBoingo: asciilifeform: The basenji is basically a pariah dog type. What other dogs revert to after uncontrolled breeding. Natural strays.
asciilifeform: basenji - that looks quite like the dogs i saw in Timis.
fluffypony: they're one of the ancient breeds, so they're the dogs in ancient egypt that the pharoahs worshipped
BingoBoingo: They look like malnourished strays
moiety: i know the ones!
fluffypony: they yodel
fluffypony: they'll take a Manul on
BingoBoingo: fluffypony: All it takes is 1 Manul and then you have 0 dogs
moiety: the hattori is a bit more vicious on little wires than i was expecting
moiety: unfortunately not. i tried to frankenstein the usb bit on the end with a non frayed one. i ended up with more bits than i started with D;
gribble: The operation succeeded.
moiety: ;; later tell mircea_popescu even the doges are at it now http://s3-ec.buzzfed.com/static/2014-04/enhanced/webdr04/25/10/enhanced-buzz-22480-1398437911-8.jpg must be for cinco de mayo
jurov: oh i misunderstood... easy to use system for an issuer, not for the user
fluffypony: I'd hazard it's easier to list there than on MasterCoin
fluffypony: well that's the end of that
BingoBoingo: mike_c: Well, the monthly reports will include exact balances, but I'm not yet sure about the wisdom of offering balances in real time. That might leak things like when exactly trades executed and where I had orders sitting on the orderbook.
BingoBoingo: mike_c: It will be harder to track my part of MPIF, but the monthly statements will still exist, and there's the part where at least at the start of this the operation I am running is smaller than the other portions.
jurov: because it was never proven otherwise? i can see that
asciilifeform: jurov: this notion is not original to me, visit the literature
gribble: Weak key - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Weak_key>; hybrid message-embedded cipher using logistic map - arXiv: <http://arxiv.org/pdf/1209.2582>; State convergence and keyspace reduction of the Mixer stream cipher: <http://eprint.iacr.org/2010/628.pdf>
gribble: The operation succeeded.
jurov: guess the dividend plans are guarded with utmost secrecy :D
jurov: SFI unit holders are entitled to receive dividends indirectly from the Fund's startups which have a
thestringpuller: i'd rather put money in mpif
mike_c: they got their mistakes out of the way with SF1. You need to jump on SF2, it's going to the moon.
thestringpuller: they are gonna show us howt hey run this show
jurov: so not one of their startups is profitable yet.nice
jurov looks whether SF1 paid any divs ..nope
gribble: Major Tom | The Venture Bros. | Adult Swim - YouTube: <http://www.youtube.com/watch?v=-aqvIU1dkD8>; Major Tom - The Venture Bros. Wiki - The People's Republic of ...: <http://venturefans.org/vbwiki/Major_Tom>; Ghosts of the Sargasso - The Venture Bros. Wiki - The People's ...: <http://venturefans.org/vbwiki/Ghosts_of_the_Sargasso>
Naphex: nah, the rest look like bull
Duffer1: sf2? oh lawd another one?
ozbot: btcXchange.ro - The first Bitcoin exchange in Romania
Naphex: so there's that
Naphex: but we will be adding some nice UX for GPG authentication
Naphex: not just the crypto community
Naphex: thestringpuller: i am, i will be adding GPG auth. but thats it
Naphex: sure. if you get all 4 the only thing that can save you is hope you don't hit any short-circuits or be enough in the hot wallet
thestringpuller: Naphex: i can get all three by putting a gun to the customer's head
benkay: the comparison is not made on the basis of openness, rather by asking professionals and the experienced what their opinions are and why they are that.
benkay: this goes back to the problem of trust in the wot. openssl, pirate...ask anyone who knows things what they think of the two.
artifexd: Open source compared to open source. The point is that being open doesn't make something trustworthy.
artifexd: Similar to the transparency of... openssl?
benkay: so yubi is a signing thing? what are these yubi servers an implementer talks to?
benkay: artifexd: i don't know enough about the thing. it pretends to be a keyboard, though? sounds like a lot of unexaminable dependencies.
Naphex: ah, i doubt it. unless their personalization tool phones home, but doubt that
artifexd: benkay suggested that the yubikey could phone home (or any attacker) with the new contents if it were reloaded. I was questioning that.
asciilifeform: yubi, by all indications, is designed to resist any attempt to determine whether it leaks key. therefore i must assume that it does.
benkay: all of a sudden i'm struck by the notion that the only good withdrawal message is one gpg-signed by the withdrawing party.
Naphex: and gox had the keys
asciilifeform: all of the traditional crapola is present. enforced and perpetual dependence on the vendor, for example.
artifexd: That may, or may not, invalidate the ability to use yubikey's servers though. I don't know.
artifexd: The point was that, instead of reading the key, an attacker could put his own key in there since he supposedly has access to the device prior to the client getting it. Also, the client could generate and insert is own keys thus destroying the attacker's advantage.
asciilifeform: in that respect, it is exactly like other seekoority snake oil products.
asciilifeform: you don't need an army and navy to pwn yubi users. just a little bit of cooperation from the vendor.
Naphex: some risk reduction is worth it, even if not bulletproof in all theoretical/practical/NSA cases
benkay: can't vet the thing's behavior, artifexd. might as well be squirting things written to those slots back home.
Naphex: true, but my risk is still reduced, that an attacker/breacher would have to have private keys leaked, have user secrets, and have user email, and penetrate hard within infrastructure without detection, to nab some satoshi from the hot wallet
asciilifeform: does he need to? the way it is designed - yes
asciilifeform: vendor has the key.
Naphex: so user gives me yubi pub key, and then shoots OTP
asciilifeform: even if a con artist has fooled him into thinking otherwise
Naphex: and OTP just removes the risk of insider/intrusion that can just spam hotwallet servers or trade messages with withdrawals
Naphex: for me it promises a OTP, from the user. which i can validate without holding a secret
asciilifeform: benkay: it promises that a private key can be sent in the post, left plugged in at wiring closet, etc. without danger.
asciilifeform: ed felten's words, 'try to make a safe that can be left in burglar's living room' sums up the issue
asciilifeform: Naphex: 'cardano' could in principle be used as 'token.' but you gotta understand the difference between what yubi promises and what honest people can actually physically achieve
pankkake: ;;rate asciilifeform 1 makes the best tinfoil hats
kakobrekla: Naphex forget it, he is busy with the sub
asciilifeform: take minute to think, what is yubi hiding, when refusing to publish the design ?
Naphex: i'd just stop ther eand request gpg auth:P
Naphex: to just have it on the phone / or cached or who knows what
Naphex: if i have to deliver DH/GPG secret to the client for GAuth
Naphex: asciilifeform: still protecting Gauth secret ruins the whole point
asciilifeform: you gotta transport the secret to the user << did i wake up today in a parallel universe where public-key crypto was never invented ?
Naphex: you're not handling the private keys since you can just check yubico servers
asciilifeform: and undertakes to solve a problem to which there can be no solution
asciilifeform: the device comes with not one but two gestures of bad faith
Naphex: guess so, still.. you'd still need the button pressed
Naphex: there is a response bit more down
Naphex: taken measures to mitigate the security issues. We examined an updated firmware
asciilifeform: there we go.
asciilifeform: a closed gadget suggests that there is something to be gained from learning what has been kept closed.
fluffypony: benkay: did you see their reply to my TagPesa questions? they're all shock and horror that I suggested that institutional investors and even casual observers aren't impressed with them
pankkake: unless it signs with the main key
fluffypony: benkay: yeah the whole thing is a joke
benkay: fluffypony: you missed the conversation where we mocked sfi for just listing a bunch of other people's projects on their havelock page.
jurov: but they must be somehow online for ppl to be able to trade
jurov: thestringpuller: burnside (of btct) trolled coinbr hard, because mpex keys are online
asciilifeform: the closed aspect suggests, 'none'
fluffypony: on the topic of SeedCoin: http://bitcoin-betting-guide.com/james-cannings-blog/seedcoin-fund-i-update-no-gocoin-what-next/
jurov: thestringpuller: mpex did lose few bitcoins due to human errors, don't paint mp as saint
asciilifeform: we cannot see if the promise is kept
asciilifeform: the hardware makes a promise.
thestringpuller: what's the point of 2 factor?
asciilifeform: they're not.
Naphex: doubt their open
Naphex: of the hardware?
asciilifeform: i see no description of the internals.
Naphex: and you don't have to keep the secret keys for it
Naphex: i'd recommend the system over gauth
asciilifeform: the hardware.
Naphex: so there
Naphex: asciilifeform: i trust them mostly, but the security level is chosen by the client. so if client trusts yubi, then it trusts yubi validation servers
asciilifeform: gotta ask, what's the basis for trusting 'yubikey' ?
Naphex: i have state-full firewalls that know the protocol before
Naphex: OTP - is otp released to the client, by levels email yubikey/gpg/ - whatever
benkay: what does the message look like?
Naphex: everything else gets dunked a long way from there
Naphex: they can't
thestringpuller: because you've audited all 100% of the code oyu're running
thestringpuller: or they can dump unencrypted memory with a 0 day exploit you have no idea about yet trust your system completely
thestringpuller: please direct me to another facility of such high standards.
Naphex: thestringpuller: honestly if you have a well designed system, that gets breached and you get ninja'd out of the 10 hotwallet BTC
pankkake: if the machine is really offline even Windows ME should be fine!