Surprisingly good for a Windows XP VM

But, a big bag of private keys also has certain advantages

Also-

How many NVK proximal influencer-podcaster-types (bent, odell) and their investment project operators (1031) that funded coinkite lost money in this thing? What about secondary corporate operators that used coldcards for key handholding services? 

Did they "know better" or get a heads up?

Even verifying possession of the physical HW will not be definitive proof.  It is theoretically possible for someone in possession of the ColdCard HW to recreate the wallet by importing a compromised seed.  How would that differ from the original wallet of the real victim?

I think on-chain history is the only real proof.  To verify a claim, someone would have to trace where the funds originally came from - like an CEX withdrawal, or from some other KYC-ed account.  Doing that manual forensics for thousands of separate victim addresses is an insane amount of work though.

The problems of spam in last four years and it has increased with time are all from merit system failures. When shitposters ranked up easily, with shitposts, they will spam everywhere.

I noted about it.

Before this post, I remember someone posted that total new accounts did not increase too much, but spam increased a lot. If my memory serves me, you made that post some days after the signature ban kick-off.

That information is right because I saw they woke up newbie accounts then farmed merits and it has become more popular when they got more merits in their circles, from merit sources and years later, it's what we have witnessed recent months with shitposts around.

I also posted somewhere that they have a trick to create threads, waiting a merit source to merit it, then they will use their accounts to merit that thread/ post. They take advantage of merit source like a quality guarantee for that post/ thread, and honestly it's a clever strategy but when it is abused, it's easily realized.

The risks are high so the message to btc people is clear. You must not support any fork which is supported by ~2%. Tempted people must not risk their valuable bitcoins for new forked coins unless Replay Protection is in place but dumping them in exchanges is going to be strenuous. If the forked coins come to existence they will be worthless because exchanges do not waste precious time on worthless forks.

That's why he said "so to speak".

Back then, seeds weren't used. I had a wallet like that. 10 years later, I went back to that wallet and everything was there, all in order. Without seeds and "complex things".

Perhaps what's needed is to relearn how to build wallets without adding more and more extras.

I once read something very interesting: "The more security a person seeks, the less security they end up having. Confidence increases, and you become careless about simple things."





I don't know if such a great effort was needed at the beginning.

Entropy was quite low. The good fortune of quickly finding a wallet with substantial funds motivated him to go further and allocate more resources.

But of course, I don't think he's an amateur. It was certainly well-planned, but you can't have spent too much time planning, for fear of someone else discovering the flaw first.

I didn't checked for both of those. You may be right. Last download was yesterday morning (08-08 8:30am my time). I will let you know if I am blocked.

The addresses are now compromised.
Everyone could claim the ownership of the sending addresses (the private keys).
Identifiying the original and authentic owner is almost impossible (it would require checking upon the possession of the physical hw, something that looks very impractical to me).

@LoyceV

While there is entry about each GET in the logs, not each one of them is downloading whole file.

I am checking for file size before download, so you get entry in log file, but the file is not fully downloaded (in fact nothing is downloaded, only size checked).

Yesterday I received a notification from your ANN thread, and frankly it seems to me that you are playing on thin ice. Some reference links could be considered a violation of mixer ban rules. (I think I drew your attention to that earlier). I advise you to revise it or at least talk to theymos about it.
You yourself know that there are many members who would be happy to start a new drama against you, and it would probably be good for your health and the health of your business if you solved it preventively.

I don't think he's exactly an amateur, but I understand the point.

I can imagine the situation: he discovers the flaw and goes to test it to see if it's really true.
Start running the script, perhaps with the goal of verifying if your own wallets are affected. Within minutes, they begin targeting third-party wallets with hundreds of BTC being transferred to your account.
I believe the first reaction will be one of shock, but at the same time, incredibly exciting.
Suddenly 1000 BTC appears in your account. You must be ecstatic in your basement.
You're probably already thinking of a thousand and one things you'll want to do with that money.

As the hours tick by and the news breaks, the dilemma begins: how are you going to move the money without getting caught? I stole hundreds of BTC from people who saved their whole lives. What have I done!?

Now you may be debating whether to return everything, return part of it, or ignore the matter altogether.




I'm talking about the seed (so to speak), because to date that's what's guaranteeing the security of these coins.

Interesting, I'll grab a copy of it's only a terabyte. 

LoyceV, can I create a mirror of your data on my new baremetal server?

I unexpectedly received more storage.

It's funny how delusional some people are

Like most shitforks, they will most probably try to call themselves "bitcoin" as well. Similar to what bcash guys did in early days back in 2017 like having it listed as bitcoin on bitcoin.com website (Roger Ver owned the site).

I don't think this chain would come to existence considering it only has ~2% support from miners but hypothetically the process to claim the "airdrop"! is similar to the past ones. Read the LoyceV topic (the link is in the comment above mine).

The biggest problem is that since this is an exact copy of bitcoin (blockchain and code) the risk is the lack of what's known as "Replay Protection". That means if you create a bitcoin transaction and send it out (on bitcoin network), the same exact transaction is valid on this forked chain and vice versa.
So if for example you find an exchange that sells this shitforkcoin and send your shitforkcoins to an address generated on that exchange (on the shitfork network), your bitcoins could also be sent to the same address (on bitcoin network) as well; and getting them back from the exchange could be a problem if the exchange doesn't want to cooperate which they usually don't.

That makes dumping such forkcoins complex. You first need to generate 2 addresses that you control and then simultaneously send the same coins on both chains to different addresses on each chain (eg. bitcoin to address_1 and shitfork to address_2). If that failed due to replay attacks, you should repeat that until you succeed in separating your coins. Then you spend your shitforkcoins from address_2 to the exchange.

The other difficulty you'll face is the slowness since as I said this malicious fork doesn't have any support and with low hashrate blocks could only be found at very large intervals which makes confirmation a nightmare not to mention such a chain would be susceptible to 51% attacks.

Claiming forked coins is a very dangerous action because it will need private keys of your bitcoins. That means if people are greedy to get forked coins, but they do their fork claiming carelessly by leaking their Bitcoin private keys in a wallet that still stores bitcoins, their bitcoins will possibly be stolen. It's not only just risky but very stupid, being greedy to get forked coins that still don't know about their values while firstly and very quickly, they might lose their valuable bitcoins.

LoyceV's Bitcoin Fork claiming guide (and service).

It depends on what's being brute forced and how the attacker tries to do it.

Seed Phrases:

The ColdCard firmware flaw caused ColdCard to only generate seeds from a small number of possibilities. It's still in the billions though.

What the original attacker surely did was run a script to generate the same list of seed phrases. Billions. The script then generated wallets from those seed phrases and searched addresses for a balance. Evidence suggests the attacker's script stopped searching a seed when it found an empty address and moved on to the next seed.

Normally, hunting for wallets by searching random seeds is impossible. There are too many possible seed phrase combinations to search. It's in the quadrillions of quadrillions of quadrillions. But the ColdCard firmware bug meant all seeds generated by ColdCard came from a much smaller list unless the user used dice rolls. This made it possible to hunt for ColdCard seed phrases.

And by the way... I'm sure attackers are trying to find 2-of-3 multisigs this way. They're generating seed phrases and testing combinations to see if any generate wallets with a balance. That's a much slower process, but for attackers, it just means running a script and letting it churn away as it tests combinations. I do think 2-of-3 multisig wallets created on ColdCards will be found.

Passphrases:

Trying to crack a passphrase is different.

The first thing an attacker will probably do is a dictionary search. They'll run a script to try all words to see if any are being used as a passphrase. Anything more than 4 or 5 words isn't going to be easily found. Anything more than 6 words isn't going to be found at all.

Again, to be clear: They'll generate a wallet at the seed+abandon to see if they get an address with a balance. No? They'll generate a wallet for the seed+ability to see if they get an address with a balance. Etc. They have to generate and check every wallet, one at a time.

Th next thing an attacker will probably try is a charachter search. This is slower. They have to generate a wallet for the seed+a... then the seed+b... then the seed+c. And they have to test every wallet for every number and symbol too. Then they start over to check wallets for the seed+aa and the seed+ab and the seed+ac... etc. They'll be running a script that churns away until it finds something.

Here's the thing:

Brute force attacking passphrases is only feasible if the attacker has a reason to check that specific seed phrase.

If a seed phrase has never been used by itself as a wallet, an attacker has no way of knowing if it's been used with a passphrase or as part of a multisig... unless the attacker found the paper/metal backup of course. That's an obvious clue the seed was probably used. But in the ColdCard attacks, the thieves are searching seed phrases based on the list of billions of possible seeds the borked ColdCard firmware could generate.

If your seed phrase was truly random, it cannot be found by seed phrase hunting. Bu ColdCard's seeds weren't truly random, so they can be found by using the same borked method ColdCard used.

I don't see anything bad in "asking" about it if the platform removed the mixer from the website. Currently I don't see a mixer link there - only I see something about a "coming" privacy/CoinJoin feature. (The repeated knowing promoting of mixing services instead would, in contrast, be a reason for a ban.) However I don't know the details of the case.

The proposal of a hard deadline of a week I made was only because the discussion shifted to a more generalized question, away from the Omnisee case. And I think this is good, it would be best to have a clear rule (even if "unofficial" like most rules in the forum), instead of reacting to every case individually.

The idea is that theymos' involvement would not even be needed. The rule would generate the incentives for the managers to handle these cases fastly and with the least possible drama. theymos would be simply notified to include the link in the blacklist, but the signatures then would already have disappeared.

Thus in my past post I clarified that I would support a ban for repeating offenders if they know (that can be proven with archive.org links for example) that they should have detected that website as a mixer.

Anyway I don't expect this to happen too often.

If the problem becomes bigger then it's an idea to consider, but otherwise I don't consider it necessary - as I wrote I think the hard 1 week deadline would provide the needed incentives already to react fast.

I agree, but practically speaking ... how can a manager detect a service in advance that later will change their product portfolio and offer a "prohibited" service? If you have a customer who wants to do something fishy with the good you're selling to them, they probably won't tell you.

Most rules for offenses in social networks and forums are of the type: if you detect malicious behavior X, you have time until time/date Y to react to it (e.g. remove offending links or content).

Technically it would be optimal if the managers had some option to sigban their own participants indeed. But I don't think this is feasible or desirable.

I think also if we had the strict 1-week rule followed by a credible ban threat, then admin intervention normally would be minimal, because managers would be as fast as possible to close the affected campaigns. And normally 80-90% of the participants would also react faster, because if they see that the campaign is paused, they would remove their signature and search a new one.

What I could imagine was a stricter rule for serial offenders, i.e. if a manager is suspected to knowingly admit offending services he could have detected (e.g. because their advertising wording was already close to a mixer's from the start on), or has already repeatedly campaigns for offending services before, they could be banned instantly. Same for participants who advertised offending services repeatedly.

I've changed my mind about decoy wallets. I now think using the seed-only wallet as a decoy isn't a good idea.

Using the seed-only wallet as a decoy lets whoever finds that seed know the seed phrase has been used. That gives them a reason to start searching passphrases.

The ColdCard attackers had to search billions of seed phrases to find coins. Searching billions of seed phrases isn't hard since the attacker was surely running automated scripts to generate wallets and check addresses. Almost all of the seeds were empty. Maybe a few thousand out of billions of seeds had wallets.

Even in the ColdCard situation, where the total number of possible seeds is limited and known, it's still billions of seeds. It isn't feasible for thieves to try to crack passphrases for billions of wallets, since they don't know which of the billions of seeds might have passphrase wallets except for those which had something at the main seed-only wallet. Those thieves are trying to crack passphrases of seeds they know have been used.

I believe it's wiser to use a simple passphrase as a decoy wallet. One word, easily cracked, for a decoy wallet. And leave the seed-only wallet untouched, never used.

I avoid putting people in my ignore list so I can watch what they say without additional clicks. Well, some exceptions are made.
I believe having a script or an option to filter or restrict sending merit to a specific user would be better than ignoring them. I am talking especially about staff with the ability to ban members mainly.

---

By the way, members of some signature campaigns should be double checked because having a long post and 2 - 3 quoted texts in the same post are classic ways to avoid suspicions and make their posts look good while they are empty inside.

Good point, but at that point, there's no such decoy thing if you're not funding on it.

I would never make myself harder than before like that, but currently I choose my favorite signature, hashes it and put it as my extra passphrase, which I can access it from anywhere anytime.

I wonder how many people realize that in this case, a "decoy" wallet have increased the risk, as it tells the attacker they found a used seed phrase. That gives them the possibility to start brute-forcing the passphrase. If you would have used the weak seed phrase only in combination with a passphrase, it would have been many orders of magnitude more difficult to find.[/quote]
You missed 2 real things: the perspective of hacker & the function of decoy.[/quote]
Nope, I didn't miss that. A decoy works if someone finds your (physical) seed phrase backup. In this case, the decoy is like a big flag that says: "there could be more money here".

There have already been reports of 2-word passphrases being compromised.

That completely depends on the passphrase. If someone uses just 2 BIP39 words, that only gives 4 million possibilities, which is many orders of magnitude easier to brute-force than the weak seed words.
[/quote]

In this case, and many similar cases to come, a passphrase is still a good way to secure your funds, and letting hackers eat the decoy as a warning to move your funds immediately. This still doesn't increase the risk as you claim. The rest depends on how the user uses the "passphrase." The user could even use a one-word passphrase with 64 hexadecimal characters, and the funds would still be there until next Christmas when the user is ready to move the funds.

In short, it depends on:
1. How the attacker detects whether it's a decoy address and decides to invest all their resources in a single wallet that they believe "It's a decoy, got a correct passphrase and you'll get the whale." which there's no script / tools exist for detecting such things.
2. (MOST IMPORTANTLY) how the user leverages the passphrase instead of entering their Instagram password to secure their real funds.

I still believe in SHA256, and accessing my funds from anywhere I want without letting a company give me the keys to my funds or storing my own keys in SDB is far worse.

Yeah I ended up adding passphrase to my trezors.

3 washers with 8 characters each

I decided on 32 of my 36 punches knock out 0OIL

so my passphrases are 32 to the 8th cubed or

1099511627776 x 1099511627776 x 109951162776

that's 121 bits and the 1099511627776 is all the cold card had as that is 40 bits.


as for convinent well the trezor has a standard wallet with say 0.04 BTC and the each of the 3

passphrases have say 0.32BTC total 1 of  btc

what's nice is keeping the passphrase in my banks safety deposit box slows .96 btc from my own spending

issues.

do I like it no

perhaps there is a script that monitors the decoy addy. the decoy gets swept huge, tons of warnings in real life start happening. gives a head start to move the passphrased coins out.

If that were actually necessary, we should consider the whole setup to be terribly wrong and faulty. I find this very very wrong to have to carry my mnemonic seeds with me all the time. Sorry, no, this should NOT be necessary! And it is not necessary if we knew that entropy generation wasn't screwed up completely.

Apparently there's more due diligence needed to verify that entropy generation isn't flawed. Easier said, than done, though...


This can only work if users learn and understand how to safely and properly generate their own mnemonic seeds. There are many ways to screw this up without being easily able to notice it.

A mnemonic passphrase (the additional thing) needs to be complex enough to withstand brute-force attacks (it's also computationally somewhat expensive as each guess iteration requires 2048 rounds of PBKDF2 with HMAC-SHA512), but it adds a security layer with no margin for error if you fail to document it properly and highly recommended also redundantly. Commonly you should also separate it from your mnemonic recovery words, so it needs separate secure storage places.

That's quite a (necessary) burden with many possibilities for people to screw up.

On the other hand, with the necessary knowledge and understanding, I'm with you. I just have doubts it will work out for the masses.


If the additional mnemonic passphrase is brute-forceable, the creator has failed already badly. It does not make sense to me, e.g. to use just a few additional words from the BiP39 wordlist. The mnemonic passphrase needs to be complex enough that brute-force attacks are not feasible.

With a complex enough mnemonic passphrase I consider the "decoy" wallet as a valuable canary indicator of compromise. Users of such a setup should of course pay very much attention to not link their "decoy" UTXOs with their "hidden" main stash(es).

You missed 2 real things: the perspective of hacker & the function of decoy.

it's called decoy for a reason. once the owner see their decoy is gone , the owner can immediately move the funds. it does not increased the risk at all, it literally does increased the security for the funds. and in this case (the worst case ever displayed on this day UNTIL probably 100 next years), the hacker knows well brute-forcing into passphrase is such a waste of time because the owner could be already moved the real funds within no-time.

FYI, brute-forcing passphrase for a single wallet most likely TOOK MORE TIME than brute-forcing the whole ColdCard default seed.

I thought we are talking about un-promotable condition (sudden discover) and handing out harsh ban.

Manager tempban himself and the participants?

Yes.. I added this line of code in the last update:

when you posted this :

I followed LoyceV suggestion, reproduced the error and added it.

The second check and the greater than  were just extra extra [/url]

I had to look up Gibson's trick and I think that it is good up to a point- even though it takes away from some randomness, but the filling in of characters likely ends up helping with difficulties to guess the password by others or difficulties to break by password guessing machines.



For example, sometimes we might have created some passwords and then we cannot remember the exact details of how we had varied the base word(s), so maybe if the password base starts out as:

Great Mary

So then we try to consider how to vary our base word, so then maybe we might vary it, yet without practice we cannot recall the exact details of how we had varied it. Maybe the end result looks like this:

34gGgGr88ea88t##mMmM@@ry43 

That seems pretty hard to break, even though it is not random, and we might have to create some kind of a note to ourself to remind us of our password and how we had varied our password within some formula that we will remember based on a note to ourself, no?


I think that it is good to make clear that there is a difference when we are talking about our passwords and our passphrase.

The recent Coldcard issue ended up causing the initial passwords to be easily crackable, so then the passphrase ended up giving a second layer of protection, and of course, if we knew that our passwords were going to be so vulnerable, then we need even higher levels of protection for our passphrase.

I doubt that in normal cases we need our passphrase to be treated the same as our passwords so 12 characters or more with a combination of characters, numbers, letters, and capital letters is better, even though maybe there might be some lacking in our randomness in the sake of our also wanting to have some abilities to have some memory of it out of convenience and also not wanting to lock ourselves out of our own coins.  And, surely our own level of paranoia might cause us a lot of inconvenience if we end up overdoing it.


I agree that a lot of us are likely rethinking the level of complexity of our previous passwords and the extent to which we need to improve them for modern times, as the times are ongoingly evolving.

Best thing to do, add your own entropy my friend. Learn about entropy.

Unfortunately, it's new.

Just because of one stupid manufacturer mistake, don't lose your belief in hardware wallets. There are so many good hardware wallets out there.

People forget some important things, mostly new people. They think that owning a hardware wallet their fund 100% secure, and this is the reason by using hardware wallet removes the feeling of safety, especially for anyone who has not learned more about safety risk.

Hardware wallets are just one key element; you can add more security risks to your stored system.
- Learn entropy
- Make your own key
- Create a multi-signature transaction
- Store your funds not just in one single bucket

I agree.  @DireWolf, it is obviously totally your choice whether you keep that positive rating on his account.  But you should at the very least correct the facts that have been proven wrong in the meantime.

Read my post again. I believe you didn't understand that it's one of the original solutions for cold-storage before hardware wallets were invented. PLUS Electrum is one of the truly tested wallets in the Bitcoin ecosystem.

It's not a debate. It's a FACT.

 

Shower thought. The ColdCard situation might be an inside job.

Yes, that's right. Currently I have no problems with loading PMs and based on the reports of other members, who have a lot more messages, like icopress, I see that this will not be a problem in the future either.
With that, I got the answer to my main question, but considering that some other useful information for members appeared in the thread, such as the suggestion to use TryNinja's user script or LoyceV's PM publisher to get PMs, I think that this discussion is still useful for forum members, so I will leave this thread open.

I looked at his first 5 pages of his post history and I can say above 89% of his post from the first to the fifth page is mostly gambling related post few post on other boards, which justifies him not earning enough merit.

The truth is that abusers always remain abusers once they see the opportunity to abuse. Infact the world today uses thing for the wrong purpose you can relate that to every industry in the world.

200 posts in 2 months - you made it to look like it would be a lot, but it's 3-4 posts a day. And you're completely wrong that I'm posting without reading. Usually I post in same old topics that I follow each day, or in fresh topics that has maybe 15-20 replies - it doesn't takes much time to read every post there. I don't see much point to post in longer topics because with my 45th reply there I can't add anything new. Or of it's continous discussion, most of time I don't have time to read everything from beginning till the end to add my input.
But anyway, this topic isn't about me.

Yeah, fixing grammar, spelling and style is correct use of AI, but unfortunately, good tool now is used for bad purpposes too much.

I don't think that I brough problems for myself there

If you want to get all your PMs (inbox and outbox), you can try TryNinja's user script or LoyceV's PM publisher.

https://bitcointalk.org/index.php?topic=5481421.msg63489687#msg63489687]TryNinja's user script
https://gist.github.com/ninjastic/bc568895778132e1414564147d3a9aaf

LoyceV's PM Publisher's description.

I missed so much fun apparently when I enslaved myself in the gambling section. I will have a nice vacation over here watching all of you with my unhealthy popcorn.
LTU_btc, you were away from troubles and with your post, you brought problems.
Soon we will see some known users and their alts posting and replying for themselves with signature enabled 🍿

one is  1
I     is  l

so they are easy

0 and O may not be easy

I am waiting on a brass plate for fast easy back up sheet {in house}

the washers in bank vault

Unfortunately, there is a misconception in our psychology that if something has worked for a long time before us, then we consider it proven, although it may not be so. Every new incoming user thinks, "if everyone is using it so calmly, then someone has checked everything for sure." But it turns out that the system has not been properly tested in five years. And in the age of AI, we will hear more than once about the secrets of systems that were in plain sight, but only the latest AI model will be able to find it.

I understand that, but as I said, that's not the post I was referring to, as he linked another post that was also deleted and person who wrote it got tagged. That's the one I believe was made with AI.

To be honest, I don't think this is a good solution for the truly paranoid (or even for the mildly paranoid).   You've just switched from using hardware wallets over to Electrum as your preferred solution.

What if there was some vulnerability exposed within the Electrum development? It really wouldn't make that much difference to the final outcome.

But for the truly paranoid, install Electrum in a computer that will NEVER connect to the internet FOREVER, and generate your seed phrase there. Write it down, then keep it in a safe place. The same for the computer, keep it locked in a vault.

Keep sending Bitcoin to that address.

Flood, earthquakes, some company coming out of nowhere and digging in your yard for an emergency gas/electric line repair and many others.
Also, about the rice thing, just grab a pair of new sneakers and use the silica gel from them, rice that absorbs humidity will be a problem itself.

There is no perfect solution for anything, there is always a risk.


And nobody would have believed them when they said they were giving all the coins back to the owners, everyone would have said they are preying on people who can't prove they are the owners of those coins.
A cold wallet manufacturer taking your money without your knowledge would have been the end of any company.

Would it be illogical to think that this might not be just a random attack but a preplanned one? For which the bug or vulnerability was planted years ago, and was never found or patched on purpose to keep collecting information for a major attack, but doing it in a way that shouldn't make it suspicious for those in control of everything? Because there are cases unfolding where users reported similar problems years ago, but the developers or their support never took them seriously or looked into it. Maybe those few people who got their funds stolen back then were just victims of a few test tries if it actually works or not? 

The only feasible way to 'get the word out' would be via an 'emergency' such as we are seeing now.

Of course I am very interested in whether these guys are crooks or not, so I try to look at things from all angles.  What if there was an even better reason (e.g., and even bigger back-door.)  The 'responsible' thing to do would be to scare the shit out of people with a relatively bogus defect and a dose of social media engineering.  In that way, everyone would hear it pretty soon, and would take the desired action of draining their Coldcard-based wallets ASAP while in the scheme of things the userbase would not actually lose all that much.  I'm pleasantly surprised that non of my stuff I was not hit.

Anyway, that's a charitable hypothetical excuse for Coinkite's activities and proclivities.

---

As for keeping this particular vulnerability undisclosed, it's not real practical.  The problem was really a pretty basic one which happens all the time.  [There may be some code running in space built against header files inappropriate for the Linux kernel installed due to problems much like this one.  Who knows?]

I don't do almost any coding any more, but my friends who do are ga-ga over AI.  All I can say is that if AI missed a very common pre-processor issue like this, it's not very good at code checking.  Did they forget to teach the model that RNG was extra critical?  Do they even need to?  Not impressed!

They could have taken most of the coins though. Regardless, however, I agree that either way their business would be completely over.

Not true, they could have advised moving funds without disclosing the vulnerability up front.

Yeah I don't think bitcointalk is 100% free speech but because is it of the trust system. User can say what they want, but some may hesitate if they think it could lead to negative trust rating. Whether that's justified or not is a different discussion.
Telling this based on personal experience. lol I even got neutral tag with ref "asshole" by just meriting a post.

That's why there's a magic ignore button. By the way, if he's already on your ignore list, why are you discussing someone on that list in a topic dedicated to him? Admit it, you don't get enough of he's attention?



Not caught is not a thief. I'm sure you know this proverb.

This world is full of hypocrisy. It can't be eradicated. But when someone starts behaving inappropriately, everyone starts to shun them. This form of "honesty" is unpopular.

Are you suggesting we put Satofan44 on this forum's honor roll? With the note "he's a very good person at heart"?

That's not the post I was referring to. When talking about another merit abuse, Lucius was talking about this post, to which I said that it "reeks of AI". User in question even tried to save himself by throwing someone else under the bus, but it didn't end up as he planned.

Local MFS stands for Mobile Financial Services. We have several of them, like bKash, Nagad, Rocket, and more. These MFS are backed by real banks. It's the same as a Cash App type thing, but it is kind of more regulated here. Can be used on all kinds of devices that support a SIM card. Most MFSs have their dedicated apps, and they support the USSD dial system as well. So, I am kinda sure he meant that he paid in fiat using one of these services.

As for the accounts and the usernames, these names seem Bangladeshi. I have no idea how many names a person can think of while creating an account. These names seem like real names, and not just usernames like LoyceV.

The victim does bear some responsibility here. There is no denying that, no matter how much people dislike hearing it.

When a passphrase is optional and users choose not to use it, they significantly increase the risk of becoming victims sooner or later. Unfortunately, that's the direction it almost inevitably leads.

Well deserved, ZAINmalik75. 👏

To be honest, I've been on the his list for quite some time, but I've never really utilized that responsibility. In all that time, I didn't tag a single user. 🙂

That's probably one of the reasons. To be fair, I don't visit the Reputation board very often, even though that's where the trust system matters the most.

We need someone who is active and uses the trust system fairly, and I think ZAINmalik75 deserves to be on the list.

Some people (up to a point) manage to carefully hide their idiocy. I can assume that at the time of his credit, Satofan44 wasn't displaying any negative qualities (did he lack the courage at the time? ), and in that case, the users who credited him for quality posts can't be blamed for anything.


Here is LoyceV's explanation regarding previously merits.

If a lack of restraint is disrupting the BTC-community, or worse, is breaking (does it break?) the forum rules, then isn't that a reason to take some action?


I understand freedom of speech and all that, but is this kind of commentary acceptable? Especially since it's clearly off-topic on a technical forum.

Freedom of speech ends where the "freedom" of others begins.

Yes, you can ignore this user (and turn a blind eye) to avoid seeing their unfriendly posts, but other users and forum guests will see it. Why would users interested in bitcoin need this shit?


Normal people don't squat down and bark back at a barking dog. But if people create discomfort for others, they are usually isolated. At least for a while, to "cool down" and reconsider behavior.

I wonder if Satofan44 enjoys the BTC-community's attention being directed at him?

You and most users who are not wallet developers are all unable to check things in wallet codes (even codes are open source or public for verification). We have to rely on reviews from wallet developers, security experts but developers and experts can make mistakes or bias.

But if you still want to know where to get wallet reviews, here.
https://walletscrutiny.com/
Type a wallet brand and find reviews

You have to trust wallet manufacturers, wallet reviews while bad things can still happen. Sayings are like "don't trust, verify", but because you can not verify wallets by yourself in security, you have to trust third-parties like wallet reviewers.

Aren't you tired of dickriding yourself? As for merit distribution, I do agree that users may merit familiar faces more, but look at yourself, aren't you where you are solely due to your knowledge!?


Breh, the terms you mentioned literally SCREAMS racism.


People are result of circumstances (brain is fragile thing, and as such garbage environments create more garbage). Although, certainly it does not exempt one from wrong acts that one may commit.


Looks like, if you had any powers, you would have already become next Hitler.

Thanks for that. This makes a lot of sense. I was still new when I started there long ago and kept running into very rare statistical abnormalities but didn't know nearly as much about this stuff as I do now. For example, at 2x my longest loss streaks there were 49x, 48x, 48x, 47x. The 49x has a 1 in 130 trillion chance on its own. I also had 32 loss streaks twice in one day (1 in 11 billion chance) only about 5k rolls apart, which I found interesting.

Of course you should, that was the whole point of the merit system. Meanwhile most of the senior members that would be considered here "respected" turned the merit system into a popularity contest as found on Instagram, where they merit-bomb their friends on mediocre posts but refrain from meriting someone who they don't like or whose opinion they don't like in that particular thread, even if the post is extremely substantial. Of course, such retards such as LoyceV hate it when they are called out especially by a new user who has better technical knowledge than 99.9% of the seniors here.  It is the classic case of status quo corruption, but most would prefer to be silent lest they not risk their positions of power or income from signature campaigns. 

None of the terms that I regularly use refer to any kind of "race". How about users first familiarize themselves what it actually means to be racist. 3rd world parasites, pieces of shit, pajeets, Islamic goat fuckers and so forth -- none of these are any kind of racism. Do you mean to blame me for describing the truth of the world, that an extremely disproportionate amount of people from the 3rd world are pieces of shit? Of course, it is the fault of Satan and not of the people themselves. Dare he not speak the truth of the world.