Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Ariong
Jun 25, 2012

Get bashed, platonist!

evilweasel posted:

Yes, a ton of claims were sold. The buyers have made out like bandits.

But the sellers can rest easy knowing they found a way to lose money on FTX one last time.

Adbot
ADBOT LOVES YOU

Deptfordx
Dec 23, 2013

drat. Imagine losing all your savings, then losing them again. :ohdear:

zedprime
Jun 9, 2007

yospos

cruft posted:

I have a moral question for the thread.

I need to implement an account creation system that's wide open to the public. I can't rely on email verification, and I need it to work on IPv6. Accounts are sort of lightweight, but an attacker could cause problems by registering thousands, or even hundreds, of accounts.

I'm trying to come up with a way to do this that is resistant to this type of Denial Of Service attack, and I keep coming back to HashCash: in order to register, you have to do some complicated calculation that takes time. This essentially makes you use electricity frivolously in order to sign up, but I'm only requiring this to prevent the entire system from being vulnerable to attacks.

Essentially, this was the original goal of HashCash: trying to slow down spam to the point that it's not interesting as an attack. In the normal case (nobody attacking), only a few dozen machines would be doing this every 6 months. So, like, probably less energy use than having a screensaver for a year. Honestly, it might even be less energy use than running Google Docs, I don't know.

This solution is giving me the willies because it has the stink of Bitcoin on it. But is it morally defensible?
You can do the same thing without compute with some of the more secure greatest hits of the bad user sign up competitions. Have users answer trivia about the Ottoman empire. Make users spend time painting a MS paint portrait for their profile. The P=NP wall does not require compute if you can offload it into a users brain.

cruft
Oct 25, 2007

zedprime posted:

You can do the same thing without compute with some of the more secure greatest hits of the bad user sign up competitions. Have users answer trivia about the Ottoman empire. Make users spend time painting a MS paint portrait for their profile. The P=NP wall does not require compute if you can offload it into a users brain.

This is a cool idea, but I have to make something that can't be replayed. Doing this with trivia questions requires a ton of work on my end, and once the questions are discovered, it can be automated. It certainly raises the bar, but HashCash makes it easier for me, which is an important consideration: at the end of the day, the computer's time costs less than mine.


Tunicate posted:

Have them mail in a physical letter to make an account.

This is my favorite. <3

Agents are GO!
Dec 29, 2004

Abongination posted:

48 hour wait on account creation.

:10bux: to make an account

Fools Infinite
Mar 21, 2006
Journeyman
Get contact information first, then have a long series of captchas that are trivially broken by automation but are insanely aggravating to a human user. Have them repeat needlessly, fail all the time, have to try again. Throw cryptic errors, play horrible music you can't mute, blinking colors, over sized illegible font, the <marquee> tag. Offer a useless chat bot assistant that just outputs unhelpful random generic advice. Make complaint and bug submission forms that themselves become endless mazes of nonsense. Give the chat a voice feature that doesn't even try to understand them. That way you can be sure that anyone completing such a gauntlet is a bot or other malicious actor (if they weren't before they sure will be now).

Eventually a pattern of real human frustration and angry will emerge that you can use to separate the real users. You know, violent mouse shaking, keyboard smashing, page refresh slamming, swearing at the chat bot. Then you can send them a working link like a week later.

ynohtna
Feb 16, 2007

backwoods compatible
Illegal Hen

Fools Infinite posted:

Get contact information first, then have a long series of captchas that are trivially broken by automation but are insanely aggravating to a human user. Have them repeat needlessly, fail all the time, have to try again. Throw cryptic errors, play horrible music you can't mute, blinking colors, over sized illegible font, the <marquee> tag. Offer a useless chat bot assistant that just outputs unhelpful random generic advice. Make complaint and bug submission forms that themselves become endless mazes of nonsense. Give the chat a voice feature that doesn't even try to understand them. That way you can be sure that anyone completing such a gauntlet is a bot or other malicious actor (if they weren't before they sure will be now).

Eventually a pattern of real human frustration and angry will emerge that you can use to separate the real users. You know, violent mouse shaking, keyboard smashing, page refresh slamming, swearing at the chat bot. Then you can send them a working link like a week later.

Industry best practices. :thumbsup:

Zero One
Dec 30, 2004

HAIL TO THE VICTORS!

Deptfordx posted:

Question: Could you have traded the debt on FTX.

E.g. FTX owed you say 100k. If you thought 'Well, clearly I'm never seeing a penny of this'. Could you have sold the rights to any future reimbursement for pennies on the dollar to someone who thought otherwise?

NPR had a podcast episode about this recently: https://www.npr.org/2024/04/19/1197958783/ftx-bankruptcy-claims-sam-bankman-fried

Pham Nuwen
Oct 30, 2010



Tunicate posted:

Have them mail in a physical letter to make an account.

If it's at all feasible for your usecase, this is the correct answer.

drk
Jan 16, 2005
I've got a place near me offering unlimited letter delivery anywhere in the US for 68 cents a piece (latency not guaranteed)

cruft
Oct 25, 2007

Pham Nuwen posted:

Tunicate posted:

Have them mail in a physical letter to make an account.

If it's at all feasible for your usecase, this is the correct answer.

I was thinking the problem with this scheme was that I have to pay for the postage, but then I remembered when I was a kid it was common to have to send a Self-Addressed Stamped Envelope to get your Alfie Bike Reflector or whatever. They even started abbreviating it SASE.

Clearly this is what I need to do.

PhazonLink
Jul 17, 2010

Deptfordx posted:

drat. Imagine losing all your savings, then losing them again. :ohdear:

theyll going to reinvest in a new coin because they think they can make it back up

Cactus Ghost
Dec 20, 2003

you can actually inflate your scrote pretty safely with sterile saline, syringes, needles, and aseptic technique. its a niche kink iirc

the saline just slowly gets absorbed into your blood but in the meantime you got a big round smooth distended nutsack

ynohtna posted:

Industry best practices. :thumbsup:

don't forget the entire support section of the site is a 10-item faq, none of which could possibly be helpful to anyone, like "Q: why won't my computer turn on??" and "Q: Why is [service] so freakin EPIC? I love [service]ing!!

Ghost Leviathan
Mar 2, 2017

Exploration is ill-advised.

Cactus Ghost posted:

don't forget the entire support section of the site is a 10-item faq, none of which could possibly be helpful to anyone, like "Q: why won't my computer turn on??" and "Q: Why is [service] so freakin EPIC? I love [service]ing!!

And every item is on a different page.

notwithoutmyanus
Mar 17, 2009
Crypto: 12 seconds to zero. https://www.bbc.com/news/world-us-canada-69018575

"The Peraire-Bueno brothers stole $25 million in Ethereum cryptocurrency through a technologically sophisticated, cutting-edge scheme they plotted for months and executed in seconds,"

SettingSun
Aug 10, 2013

I wish that article went into detail on the exploit. Sounds like they were able to hijack pending transactions and change their destinations.

divabot
Jun 17, 2015

A polite little mouse!

SettingSun posted:

I wish that article went into detail on the exploit. Sounds like they were able to hijack pending transactions and change their destinations.

here's the PDF of the indictment, which gives all the detail that we know at this time

Vincent Van Goatse
Nov 8, 2006

Enjoy every sandwich.

Smellrose

drk posted:

I've got a place near me offering unlimited letter delivery anywhere in the US for 68 cents a piece (latency not guaranteed)

Could you have them send me a dozen gross of Es and Js? Capital only.

dr_rat
Jun 4, 2001

Vincent Van Goatse posted:

Could you have them send me a dozen gross of Es and Js? Capital only.

I'm sorry thos lttrs hav bn discontinud. Cuts hav bn hard.

Alphabts only 21 lttrs now!!!

SettingSun
Aug 10, 2013

divabot posted:

here's the PDF of the indictment, which gives all the detail that we know at this time

God it's even better than I could have imagined. They own a bunch of validators. When notified that one of them was about to validate a transaction they tricked a bunch of MEV Bots to arbitrage on the validation, and through profiling them knew what coins they would buy and sell to arbitrage with. Through a relay exploit they were able to tamper with the transaction bundle the Bots made and force them to to buy the criminal's junk coins (which they knew to own from their profiling) and not sell it back to complete the arbitrage.

GhostofJohnMuir
Aug 14, 2014

anime is not good
wild that their scam was on an entire class of front running bots in the etherium ecosystem I didn't even know existed. scammers scamming scammers all the way down

Spuckuk
Aug 11, 2009

Being a bastard works



Lammasu posted:

Didn't he get really depressed and become a priest?

Honestly a hilarious ending

MechaCrash
Jan 1, 2013

That was Tim Langdell of Edge Games. His entire deal was, as stated, using the fact that he owned the word "Edge" to shake people down. "He's not using these, just using it to shake people down" was basically the defense of Electronic Arts, and the judge agreed, taking away the Edge trademarks.

I remember there being some fuckshit about "MIRRORS, a game by EDGE," but my half-assed attempt at Google didn't turn anything up.

Also the stuff about the hacking contest is pretty neat. I don't know enough about it that I could understand any of the technical details, but I can understand what I've seen so far.

chadbear
Jan 15, 2020

SettingSun posted:

God it's even better than I could have imagined. They own a bunch of validators. When notified that one of them was about to validate a transaction they tricked a bunch of MEV Bots to arbitrage on the validation, and through profiling them knew what coins they would buy and sell to arbitrage with. Through a relay exploit they were able to tamper with the transaction bundle the Bots made and force them to to buy the criminal's junk coins (which they knew to own from their profiling) and not sell it back to complete the arbitrage.

So not really a scam just crypto working as intended

OneEightHundred
Feb 28, 2008

Soon, we will be unstoppable!
Best I can tell what happened is like, the people running validators wanted to make frontrunner bots where they can sandwich pending transactions between their own buy and sell transations and validate the whole thing at once for zero-risk money. The problem is they can set up the sell transaction to only go through if it's been properly sandwiched but the only check they can put on the buy transaction is that no transactions have occurred since the transaction it's supposed to be inserted directly after, so they came up with a dumb protocol to keep their pre-authorized frontrunning transaction sandwiches secret and authorize the whole thing at once. (And if someone cut in front of them, the buy transaction would fail.)

But someone found a way to get relays to leak the transactions, at which point they could validate it themselves but remove the sell transaction from the block, then put something in front of it that would make the sell transaction fail, leaving the bots stuck with the things they bought.

SettingSun
Aug 10, 2013

Yeah at the core they broke the trustless system by compromising the thing in charge of the trusting.

This got me to look into MEV and boy howdy, that sure is a thing. Basically sanctioned insider trading, as far one can sanction something governed by computer code.

divabot
Jun 17, 2015

A polite little mouse!

SettingSun posted:

Yeah at the core they broke the trustless system by compromising the thing in charge of the trusting.

This got me to look into MEV and boy howdy, that sure is a thing. Basically sanctioned insider trading, as far one can sanction something governed by computer code.

yeah. This strikes me as a bad case, cos you've got the SDNY attorney talking about the integrity of the Ethereum blockchain. WHAT loving INTEGRITY MF

cruft
Oct 25, 2007

Update to my account creation thing:

Crust First posted:

This sounds like a technical solution to a human problem.

This wound up being the right answer.

JavaScript turns out to be about 500 times slower than C for this calculation. I'm not terribly surprised: browser people have an incentive to make it a waste of time to try and mine bitcoin on users' computers with JavaScript. But this means that if I wanted to rate limit a single computer to only create 1440 accounts in a 48-hour event, they could create 720,000 accounts with a C version.

So, at best, I'm adding a bunch of code to put up a tiny speed bump. Even adding 20 accounts would be pretty problematic for this situation, and even with a browser, that's trivial. Unless I make hashcash generation take hours, I'm providing no effective protection.

This event is 15 years old, and I have a hunch I've been down this road before. It's probably why I created the existing account creation system in the first place: you have to present a token present in a pre-generated list stored on the server.

So I'm just going to let the server admin allow anyone to register with a toggle, and put a big warning around it that this opens you up to a nasty attack which humanity hasn't really solved yet: not with email verification, captchas, or proof-of-work.

cruft
Oct 25, 2007

Taking a step back here, I think what I've discovered is that even getting this idea to work the way it was envisioned in the 1990s takes way too much electricity, and is totally impractical. There's an existing solution that requires a central authority, is super easy to implement, and uses a tiny fraction of the electricity. There's just no good way to decentralize this.

Sound familiar?

cruft fucked around with this message at 00:56 on May 18, 2024

GoutPatrol
Oct 17, 2009

*Stupid Babby*

OneEightHundred posted:

Buncha loving gibberish

this is only good for Bitcoin

notwithoutmyanus
Mar 17, 2009
Gentlemen! The next investment scam opportunity has arrived! Even the name is original!

https://app.joincommonwealth.xyz/

Welcome to:

crypto scams posted:

Common Wealth.

Investments
Fully decentralised. Fully on-chain. The way it was meant to be.

A powerful, all-in-one platform that makes investing in Web 3 simple. Unlock access to the hottest early stage crypto deals, all on one platform.

With amazing things, like a ...https://app.joincommonwealth.xyz/funds/priceless-fund A...Priceless...Fund? Which raised 1.35 million dollars based on:

"The Priceless Fund comprises $1.35 million worth of investments into 14 promising startups in Web3 plus a $WLTH airdrop from Common Wealth of $1.05M. No investment was necessary - this is a completely free "earn-to-own" VC fund. The 'investors' in the fund earned their Slice by completing missions and quests learning about and promoting the 15 projects in the Priceless Fund portfolio."

So...people dropped...350k expecting to get 3x that back in an airdrop. Yeah, that's about it. With completely well known and promising startup titles with such as:

Chirp
Blocklords
Fairside
Cookie3
Nyan Heroes
Gasp
Mavryk Network
Common Wealth
Dyor exchange
Diamondswap
Analog
OP games
Nibiru Chain
Asymmetry
Rabbet

:confused:

Popete
Oct 6, 2009

This will make sure you don't suggest to the KDz
That he should grow greens instead of crushing on MCs

Grimey Drawer
Pay someone $1k to make a fancy looking website with every crypto/NFT buzzword and then spend a couple hours writing up a nonsensical "white paper" and boom, you got startup money you're never expected to actually do anything with.

I am shocked anyone is still throwing money at this stuff though. Is it just speculators who are hoping one of them takes off or are there still true believers?

Agents are GO!
Dec 29, 2004

Popete posted:

Pay someone $1k to make a fancy looking website with every crypto/NFT buzzword and then spend a couple hours writing up a nonsensical "white paper" and boom, you got startup money you're never expected to actually do anything with.

I am shocked anyone is still throwing money at this stuff though. Is it just speculators who are hoping one of them takes off or are there still true believers?

Those are the same thing at this point.

Facebook Aunt
Oct 4, 2008

wiggle wiggle




Popete posted:

Pay someone $1k to make a fancy looking website with every crypto/NFT buzzword and then spend a couple hours writing up a nonsensical "white paper" and boom, you got startup money you're never expected to actually do anything with.

I am shocked anyone is still throwing money at this stuff though. Is it just speculators who are hoping one of them takes off or are there still true believers?

Sure the last 13 things I "invested" in turned out to be scams, but the "fundamentals" are sound. There are a handful of bad actors, but the "technology" has never failed.

:airquote:

Facebook Aunt
Oct 4, 2008

wiggle wiggle




TFW you still believe the scammer's sales pitch even after the scam is over. He's a scamming rear end in a top hat but he made some good points.

kw0134
Apr 19, 2003

I buy feet pics🍆

MechaCrash posted:

That was Tim Langdell of Edge Games. His entire deal was, as stated, using the fact that he owned the word "Edge" to shake people down. "He's not using these, just using it to shake people down" was basically the defense of Electronic Arts, and the judge agreed, taking away the Edge trademarks.

I remember there being some fuckshit about "MIRRORS, a game by EDGE," but my half-assed attempt at Google didn't turn anything up.
I mean, yeah, a trademark only exists if you use it in commerce. That's not only a defense, that's a bedrock principle of why that law exists in the first place. So if you can't show that your mark is used to identify some good or service, it's a legal nullity.

Space Fish
Oct 14, 2008

The original Big Tuna.


"This new crypto platform will be supported by these online games that, when they take over the internet, will explode in value!"

The web3 game development cycle, in which millions of dollars are poured into sub-meme trash that no one ever sees much less plays, vs flinging even just five figures at someone to flesh out their catchy Game Jam concept, vs the years-long, seven-figure process it takes some experienced professionals on Kickstarter to make the kind of game they already know by heart.

So much software development chasing platforms that are born and killed in darkness. Not entirely out of the ordinary, except here the baseline goal isn't even building a better _____. The foundation is already poo poo and they're supposed to build a miracle on top of that.

MechaCrash
Jan 1, 2013

kw0134 posted:

I mean, yeah, a trademark only exists if you use it in commerce. That's not only a defense, that's a bedrock principle of why that law exists in the first place. So if you can't show that your mark is used to identify some good or service, it's a legal nullity.

True, but the trick is that "pay him to gently caress off" was cheaper than actually fighting it in court, so a lot of people did. Which is how this poo poo always goes: settling out of court is cheaper than fighting it, and this works until the squatter decides to pick a fight with someone big enough and angry enough to make an example out of them.

Electronic Arts is a cancer and bad for video games as both industry and medium, but "they crushed the Edge guy" is something I can give them some credit for. :v:

tango alpha delta
Sep 9, 2011

Ask me about my wealthy lifestyle and passive income! I love bragging about my wealth to my lessers! My opinions are more valid because I have more money than you! Stealing the fruits of the labor of the working class is okay, so long as you don't do it using crypto. More money = better than!
Anyone else noticed how easy it is to create an entirely new thing, just by putting the word "digital" in front?

digital vehicle

digital contract

digital currency

digital people

Adbot
ADBOT LOVES YOU

Facebook Aunt
Oct 4, 2008

wiggle wiggle




Works for other words too.

gay vehicle

gay contract

gay currency

gay people

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply