News for hackers. Stuff that matters.
Re:IOTA Surges Past Ripple by knocte on Wednesday December 06, 2017 @05:36AM (#15860046)
IOTA is kind of a joke IMHO:

* They have this thing called the "coordinator" which is a master-node run by them, which is a single point of failure. The codebase that this node runs is proprietary software. They claim there will be no need for this masternode in the long run but they never say any ETA about when to remove it (which hints that removing it may always expose the security flaws of their network). This means it's Proof of Authority instead of Proof of Work, therefore, not decentralized.

* It's 100% premined, which smells as scammy as Ripple. It's not a coin, it's an entity handing you gift vouchers with their name on it.

* I've heard they rolled their own crypto. Yes, let that sink. Haven't verified this myself though.

* There's no way for new nodes joining the network to recover the full history of the transactions (a IOTA speaker told me there are some public FTP servers or something where you can get a copy...). So yeah, it's an "append and forget" blockchain, lol.

Be prepared for a big (&deserved) crash.

Re:IOTA Surges Past Ripple by lojack on Wednesday December 06, 2017 @06:56AM (#15860425)
I see this argument against premining all the time, and while I’m not bullish on IOTA, I think it’s worth at least calling out... just because it’s premined doesn’t mean it’s a scam. Most of the time I see this argument from crypto purists that think the only valid currency is evenly distributed. Using XRP as an example (because I’m most familiar with it), Ripple has been nothing about transparent about the supply of XRP and what it’s being used for. They have made it clear that they own the majority at the current time, and their holdings will be used to further their partnerships. Everything Ripple has done has been completely upfront and transparent. Their mission is well stated, and they have a clear plan. Whether or not they will achieve their goals is a different story, but there is nothing they’ve done that seems remotely like a scam to me.

You may not agree with premining for other reasons, but please don’t call something a scam just because someone is trying to be a capitalist.

In the context of deceiving users and leading them to believe there is a more even distribution than there is in reality – premining could be a scam. The examples you gave, however, don’t fit the bill.

Re:IOTA Surges Past Ripple by gtrubetskoy on Wednesday December 06, 2017 @09:38AM (#15861300)
> just because it’s premined doesn’t mean it’s a scam

Not a scam, but there is a problem with premining. Consider the first 1 million Satoshi's bitcoins, which, albeit unintentional, still qualifies as pre-mining IMO - we don't know who owns them and whether they are spendable, their value is mind-boggling and if any one of them is spent, it can cause a panic.

Re:IOTA Surges Past Ripple by gruez on Wednesday December 06, 2017 @10:01AM (#15861471)
It's not premining because it was publicly announced so you at least had a chance of getting it
Re:IOTA Surges Past Ripple by knocte on Wednesday December 06, 2017 @10:25AM (#15861708)
This.
Re:IOTA Surges Past Ripple by gst on Wednesday December 06, 2017 @05:49AM (#15860111)
> I've heard they rolled their own crypto. Yes, let that sink. Haven't verified this myself though.

They decided it's a good idea to use ternary logic instead of binary logic so they had to write their own cryptographic primitives based on ternary. Here's a good analysis about the security issues: https://medium.com/@neha/cryptographic-vulnerabilities-in-io...

Re:IOTA Surges Past Ripple by Slartie on Wednesday December 06, 2017 @06:21AM (#15860250)
> They decided it's a good idea to use ternary logic instead of binary logic

This is the one main thing that keeps me very, very skeptical regarding IOTA (and the coordinator thing, although that may be resolved someday when traffic increases so they can remove it - at least that's what they say).

It looks a bit like they had this JINN processor developed which appears to be ternary in nature, but it went nowhere, and then they pivoted that into IOTA and stubbornly kept the ternary stuff because that might revive this JINN thing again later on, if IOTA catches on. At least that's how it looks to me from the outside. It's a bit hard to get reliable information about this JINN thing, as the company that apparently developed it, Jinn Labs, is nowhere to be seen publicly, with the excuse of being in "stealth mode". As far as I can see, this entire thing could just as well be vaporware as it could be revolutionary tech developed under strict NDAs.

I'll definitely stay very, very skeptical for now, as it's so hard to get reliable information about IOTA aside from the bling-bling on the surface. I also tried to look at the code of their reference implementation on GitHub a bit recently, since it's mostly Java and I'm mostly a Java dev for a living right now I was interested, but the code quality I can see there is pretty bad overall (like there are almost no comments, most comments you find are actually code that was commented out, formatting seems incoherent, huge amount of bloat code even by Java standards among which it's hard to actually find any real logic), so that excursion also did achieve nothing with regard of alleviating my skepticism.

Re:IOTA Surges Past Ripple by Aledgerly on Wednesday December 06, 2017 @09:43AM (#15861338)
So much misinformation here. The Jinn project is in active development.
Re:IOTA Surges Past Ripple by bhaak on Wednesday December 06, 2017 @10:10AM (#15861560)
Have you anything more substantial as proof than your word for it?
Re:IOTA Surges Past Ripple by hobofan on Wednesday December 06, 2017 @06:03AM (#15860172)
>  the IOTA developers had written their own hash function, _Curl_

Did...did they intentionally name it curl, so that when you search for "Is curl secure?" you will find articles saying that curl - the widely used library - is secure, in the hope that people will confuse the two?

I know that you shouldn't assume malice when it can be explained with incompetence, but combined with some of the other points here, I can't help but feel that this was intentional.

Re:IOTA Surges Past Ripple by malikNF on Wednesday December 06, 2017 @06:45AM (#15860378)
To be very honest, when I first heard about IOTA, there was an article that had the phrase "the inventor of curl", I incorrectly assumed for a while that Daniel Stenberg was involved in the project.
Re:IOTA Surges Past Ripple by albertgoeswoof on Wednesday December 06, 2017 @06:42AM (#15860362)
I think the insecurity of their function was a mistake. I doubt they would deliberately code something that threw collisions and have a cover up plan that is basically name it curl and hope people get it mixed up with the real curl.
Re:IOTA Surges Past Ripple by eternalban on Monday December 11, 2017 @03:07AM (#15895755)
fwiw, was bored and exploring for the first time the (my God) toxic social timelines of these crypto coins and happened to end with IOTA and the story of the home grown hash function. Just posting what I just read about this topic and not an +/- either way on the topic at hand:

Sergey Ivancheglo (@Come-from-Beyond) claims the collisions were intentional and for the purposes of IOTA the hash merely had to be a one way function:

https://gist.github.com/Come-from-Beyond/a84ab8615aac13a4543...

He addresses his base-3 number system design decision as well (by appealing to authority no less :)

> name it curl

In above he references Curl-P and the final letter (see his last gist) also explicitly asks that the MIT security blogger use the full name which she declined.

Re:IOTA Surges Past Ripple by EthanHeilman on Wednesday December 06, 2017 @07:24AM (#15860554)
The other hash function they use is called Kerl a homonym of Curl.
Re:IOTA Surges Past Ripple by Buttes on Wednesday December 06, 2017 @09:29AM (#15861234)
It gets better... their "improved" version of "curl"? Kerl.

You can't make this shit up.

Re:IOTA Surges Past Ripple by tuddman on Wednesday December 06, 2017 @09:57AM (#15861441)
kerl comes from the fact it wraps & extends keccack hashing library. So the name is actually quite fitting.
Re:IOTA Surges Past Ripple by Aledgerly on Wednesday December 06, 2017 @09:45AM (#15861349)
Kerl is Keccak I.E. SHA-3, the international NSA standard. They called it Kerl for fun in homage of Curl, which is still under active development with the absolute world-leading cryptographers of lightweight cryptography. Curl had to be invented to push LIGHTWEIGHT cryptography which is necessary for the Internet of Things. It's quite astonishing how much misinformation is spread around.

https://blog.iota.org/iota-foundation-hires-cybercrypt-615d2...

Re:IOTA Surges Past Ripple by baby on Wednesday December 06, 2017 @10:04AM (#15861502)
SHA-3 is not an NSA standard. It was invented by Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche who are researchers at various companies/universities and are from Italy and Belgium.

Your curl function is not even listed as one of the major lightweight crypto primitive on Lux' zoo: https://www.cryptolux.org/index.php/Lightweight_Hash_Functio...

Your post is full of shit.

Re:IOTA Surges Past Ripple by algorithmsRcool on Wednesday December 06, 2017 @09:52AM (#15861397)
I am very curious about what 'LIGHTWEIGHT' cryptography is defined as. I am also dubious about anyone that claims to have 'absolute world-leading cryptographers' since many strong cryptographers are quietly employed by intelligence agencies and most others are academics.

Also, since we are being pedantic, SHA-3/Keccak is an NIST standard, which is a federal agency of the United States.

Re:IOTA Surges Past Ripple by hobofan on Wednesday December 06, 2017 @11:19AM (#15862266)
I'm not an expert in the field, but there certainly have been efforts here and there to make "lightweight" crypto that needs little computational resources (and therefore battery power). One example would be KASUMI[0].

[0]: https://en.wikipedia.org/wiki/KASUMI

Re:IOTA Surges Past Ripple by IncRnd on Wednesday December 06, 2017 @10:22AM (#15861687)
This kind of post doesn't work when cryptographers read it.
Re:IOTA Surges Past Ripple by makomk on Wednesday December 06, 2017 @05:48AM (#15860104)
I've heard that they didn't just roll their own crypto, but that it was in fact unsurprisingly found to be broken and the devs then claimed that this was intentional to stop anyone setting up a clone without the central closed-source coordinator.
Re:IOTA Surges Past Ripple by madsravn on Wednesday December 06, 2017 @07:40AM (#15860625)
It's the second time I hear that today. I don't deny it's true, but can't we put some sources on this? I think it is a little childish to just be spreading rumors.
Re:IOTA Surges Past Ripple by DalasNoin on Wednesday December 06, 2017 @08:31AM (#15860902)
It took me while to find this, he calls the vulnerability a "copy-protection measure"

https://gist.github.com/Come-from-Beyond/a84ab8615aac13a4543...

Re:IOTA Surges Past Ripple by knocte on Wednesday December 06, 2017 @05:50AM (#15860115)
Hahahaha!
Re:IOTA Surges Past Ripple by jp_rider on Wednesday December 06, 2017 @08:45AM (#15860975)
It appears their own crypto was already vulnerable. A friend pointed me to this article:

https://www.forbes.com/sites/amycastor/2017/09/07/mit-and-bu...

He was also concerned that there's no security proof in the whitepaper. To me, it seems like you could feasibly launch an attack with less than a majority of the computing resources.

Re:IOTA Surges Past Ripple by Buttes on Wednesday December 06, 2017 @09:31AM (#15861250)
My understanding is you only need 33% of the hash power at any given time. Since PoW is only done as part of sending transactions, it probably takes less hash power than you'd think to cause problems.
Re:IOTA Surges Past Ripple by EGreg on Wednesday December 06, 2017 @09:34AM (#15861273)
Why does everyone repeat that Byzantine consensus requires maximum 33% of participants to be dishonest?

If messages cannot be forged, then a consensus could make positive progress with even 99% of participants being dishonest.

Re:IOTA Surges Past Ripple by Buttes on Wednesday December 06, 2017 @09:47AM (#15861366)
>Why does everyone repeat that Byzantine consensus requires maximum 33% of participants to be dishonest?

Not 33% of participants, 33% of the hash power, could just be one participant with a pile of GPUs or ASICS or "JINN" chips lol. That's the claim made by the IOTA author, anyway.

Right now it wouldn't surprise me if someone could amass 90+% of IOTA hash power anyway.

>If messages cannot be forged

Tbh this is not even a given with IOTA.

Re:IOTA Surges Past Ripple by EGreg on Wednesday December 06, 2017 @09:54AM (#15861417)
Okay but it was more of a general question. I see Hashgraph and others always saying that they need 33% of participants to be honest. But with unforgeable message signatures that limitation doesn't apply.
Re:IOTA Surges Past Ripple by pas on Wednesday December 06, 2017 @10:11AM (#15861575)
Virtual Voting in hashgraph requires a 2/3 agreement.

Of course PoW provides some protection against sybil attacks, but the reality is that with enough hashpower the network can be overtaken. (Hence why HashGraph is a closed network.)

Re:IOTA Surges Past Ripple by EGreg on Wednesday December 06, 2017 @10:53AM (#15862011)
What does POW have to do with Hashgraph? It doesn't use POW.
Re:IOTA Surges Past Ripple by pas on Wednesday December 06, 2017 @11:14AM (#15862209)
oops right, I mixed up IOTA with HashGraph.
Re:IOTA Surges Past Ripple by CyberDildonics on Wednesday December 06, 2017 @10:32AM (#15861799)
Proof of work isn't about forging transactions, it is about ordering them.
Re:IOTA Surges Past Ripple by EGreg on Wednesday December 06, 2017 @10:54AM (#15862018)
If all you needed was a way to order transactions you would not need proof of work at all. Here for example is the PTN:

https://intercoin.org/technical.pdf

Re:IOTA Surges Past Ripple by CyberDildonics on Wednesday December 06, 2017 @11:02AM (#15862096)
First, a paper written three weeks ago of an unproven currency is a bit of stretch.

Second, I didn't say it was necessary to order transactions, I said that is what it is used for, which is correct. You are replying to a point that I didn't make.

Re:IOTA Surges Past Ripple by EGreg on Wednesday December 06, 2017 @12:59PM (#15863246)
You said proof of work is ABOUT ordering transactions. I was trying to say that it's not. It's used for other things: namely as a way to determine the next miner, like leader election in consensus protocols. It also adds a lot of computation on top of the transactions to show that the miner is heavily invested in the ecosystem and thus serves as an economic incentive. It has almost NOTHING to do with ordering transactions. Transactions are ordered by the blockchain, and everyone has to verify them anyway.
Re:IOTA Surges Past Ripple by CyberDildonics on Wednesday December 06, 2017 @09:09PM (#15867038)
You do realize that the miners' purpose is to order transactions right?
Re:IOTA Surges Past Ripple by EGreg on Thursday December 07, 2017 @01:50AM (#15868216)
Pretty sure it's not. Go ahead and prove it with a link.
Re:IOTA Surges Past Ripple by CyberDildonics on Thursday December 07, 2017 @07:43AM (#15869526)
Re:IOTA Surges Past Ripple by Aledgerly on Wednesday December 06, 2017 @09:46AM (#15861356)
So much misinformation, where to begin. IOTA is using Keccak/SHA-3, then they are developing a new kind of LIGHTWEIGHT cryptographic primitive together with the world leaders of this field

https://blog.iota.org/iota-foundation-hires-cybercrypt-615d2...

Re:IOTA Surges Past Ripple by baby on Wednesday December 06, 2017 @10:07AM (#15861531)
nice try IOTA
Re:IOTA Surges Past Ripple by albertgoeswoof on Wednesday December 06, 2017 @08:58AM (#15861051)
So, how come no one has done that?
Re:IOTA Surges Past Ripple by Buttes on Wednesday December 06, 2017 @09:31AM (#15861251)
The closed-source coordinator, presumably.
Re:IOTA Surges Past Ripple by tuddman on Wednesday December 06, 2017 @10:01AM (#15861479)
> It's 100% premined, which smells as scammy as Ripple. It's not a coin, it's an entity handing you gift vouchers with their name on it.

No scam. There was an announced, publicly available crowd sale available to anyone paying attention & interested in 2015. Sorry you missed it.

Re:IOTA Surges Past Ripple by nlperguiy on Wednesday December 06, 2017 @05:47AM (#15860093)
Ethereum had a master node too.

Other than that, yeah it's weird. Although I'm not sure why there's so many announcements of businesses like Microsoft, Fujitsu doing partnerships with IOTA. Sounds very weird and overpumped.

Re:IOTA Surges Past Ripple by gst on Wednesday December 06, 2017 @05:50AM (#15860114)
> Ethereum had a master node too.

Ethereum never depended on a centralized master node.

Re:IOTA Surges Past Ripple by rocqua on Wednesday December 06, 2017 @06:28AM (#15860289)
There were the canary contracts, which while they were active (they've been deactivated in mid 2016).

These simply stated whether a chain was good or bad, and they were controlled by the makers of ethereum. I don't know if they were ever used to mark a chain as bad, but they certainly represented centralized control.

I do see your point that most of the time, ethereum functioned using the decentralized protocol, but there was a centralized fallback.

Re:IOTA Surges Past Ripple by bhaak on Wednesday December 06, 2017 @08:50AM (#15861007)
From what I gathered from the links below, they were intended to stop mining if an unintentional hard fork would have happened. Or maybe also to force miners to upgrade? Did the Frontier release not yet have the ice age mechanism?

The wiki page suggests that there was an option to ignore the canary contracts. So you could mine nevertheless without recompiling the source.

There's no such option with IOTA as the coordinator is closed source.

https://github.com/ethereum/wiki/wiki/Bad-Chain-Canary

https://blog.ethereum.org/2015/07/22/frontier-is-coming-what...

Re:IOTA Surges Past Ripple by csomar on Wednesday December 06, 2017 @06:23AM (#15860268)
That's not the point. The coordinator gets to decide their "blockchain". They don't have mining or another election mechanism.
Re:IOTA Surges Past Ripple by Legogris on Wednesday December 06, 2017 @06:52AM (#15860416)
Microsoft has been very promiscuous with partnerships in the recent years. It doesn't really signify much in terms of promise of individual projects.
Re:IOTA Surges Past Ripple by JohnJamesRambo on Wednesday December 06, 2017 @06:05AM (#15860179)
Businesses do that all the time, it has no drawback for them. I suspect it is like the ones with Ethereum, that will never mean they actually use Ethereum, they are just learning about it.
Re:IOTA Surges Past Ripple by carolita on Wednesday December 13, 2017 @05:58AM (#15913462)
* Coordinator is a mechanism put in place to aid the network in its infancy. Same as with Bitcoin.

* I don't see the correlation between pre-mined and scammy. Please elaborate. In my view it eliminates greed/TX costs because there is no mining.

* Has been discussed ad nauseam months ago, but here it is again https://blog.iota.org/upgrades-updates-d12145e381eb

* ?

Re:IOTA Surges Past Ripple by rootsudo on Wednesday December 06, 2017 @06:53AM (#15860420)
Yep they rolled their own crypto and are broadcasting it as a feature vs a con.
Re:IOTA Surges Past Ripple by markatkinson on Wednesday December 06, 2017 @10:08AM (#15861546)
You seem to be a pretty big bitcoin fan (all your other comments), so I would say it is fair that you may be slightly biased against IOTA.

IOTA does not proclaim to be finished, it is still in beta. Hence the need for the coordinator. The coordinator will be turned off once there are enough transactions to secure the network.

Re:IOTA Surges Past Ripple by knocte on Wednesday December 06, 2017 @10:29AM (#15861764)
> Hence the need for the coordinator. The coordinator will be turned off once there are enough transactions to secure the network.

I already said this in my comment, no need to reiterate it. You didn't repeat, though, that there's no ETA or rough threshold of when it would be safe to turn it off.

Re:IOTA Surges Past Ripple by baby on Wednesday December 06, 2017 @10:00AM (#15861466)
Ripples sounds more legit to me. I mean look at this thread about IOTA: https://www.reddit.com/r/Iota/comments/70ya29/time_for_a_par...

Anyone putting their money in IOTA is an absolute idiot.

Re:IOTA Surges Past Ripple by tuddman on Wednesday December 06, 2017 @10:04AM (#15861507)
> Anyone putting their money in IOTA is an absolute idiot.

I bought in when it was trading well under $1. I'm holding long term so I don't much care about today's price, but it _is_ nice to be up >700% so far.

I don't consider myself an absolute idiot on this one.

Re:IOTA Surges Past Ripple by CyberDildonics on Wednesday December 06, 2017 @10:28AM (#15861760)
Winning money at a casino doesn't mean you made a good investment.
Re:IOTA Surges Past Ripple by carolita on Wednesday December 13, 2017 @06:01AM (#15913469)
What do you mean?
Re:IOTA Surges Past Ripple by lewi on Wednesday December 06, 2017 @06:28AM (#15860286)

  It's 100% premined, which smells as scammy as Ripple.
It needed to be as there are no miners in the IOTA network.

Additionally, In contrast to conventional ICOs, IOTA had 0% of their ICO reserved for founders. Not a single iota. The founders had to purchase their technology back during the ICO.

Furthermore, there was no allocation for foundation or ecosystem funds. They asked the community to donate for this foundation to exist. They reached 5% of total supply and that is what the foundation runs on. (~140Ti)

  I've heard they rolled their own crypto.
Its easily searchable, please inform your self.

  it's an "append and forget" blockchain, lol.
Can you please explain the issue with this?
Re:IOTA Surges Past Ripple by tromp on Wednesday December 06, 2017 @06:46AM (#15860387)
> IOTA had 0% of their ICO reserved for founders.

So the founders were forced to buy IOTA from themselves if they wanted some?

Re:IOTA Surges Past Ripple by lewi on Wednesday December 06, 2017 @06:55AM (#15860422)
Yes
Re:IOTA Surges Past Ripple by Mithorium on Wednesday December 06, 2017 @12:49PM (#15863153)
Think about what that means. If I issue my own currency and "sell" it to myself, any amount I bought would be free
Re:IOTA Surges Past Ripple by ryanmerket on Monday December 18, 2017 @03:28PM (#15955169)
As long as the price goes up...
Re:IOTA Surges Past Ripple by nhaehnle on Wednesday December 06, 2017 @06:49AM (#15860401)
So they didn't reserve any iotas for themselves; instead, they got the BTC that people used to buy the initial iotas. Six of one, half a dozen of the other.

... which isn't actually so bad when you think about it, as long as those BTC all went to their foundation.

Iota has bigger problems, like pretending to be more efficient by using a DAG, when in reality everybody still needs to see the whole tangle to verify transactions.

Re:IOTA Surges Past Ripple by lewi on Wednesday December 06, 2017 @07:01AM (#15860450)
The BTC about 500k USD worth, of which 200k got taken as VAT, was used to develop the technology for the first 2 years. Only in the last month have the IOTA foundation been able to legally access the money donated to them by the community.

As opposed to say, tezos which has 232mil to develop their self-governing token. Additionally, "the founders get 8.5% of the fiat proceeds in cash in addition to 10% of the tokens"\

  Iota has bigger problems,
Can't attest to this. But if you are interested in discussing the tangle I suggest joining the slack. Specifically check out #tanglemath
Re:IOTA Surges Past Ripple by Cthulhu_ on Wednesday December 06, 2017 @06:50AM (#15860405)
> The founders had to purchase their technology back during the ICO.

Which is still dirt cheap and they got first dibs so nothing major there.

Re:IOTA Surges Past Ripple by lewi on Wednesday December 06, 2017 @07:03AM (#15860466)
So its functionally the same as an ICO with a 40% premine? Of which 20% of the tokens go directly to the founders because they figured out how to write a paper.