GM

Cause #garnet isn't maintained and unreliable I switched back to #amethyst. It works so much better. It's faster on tor only relays and I don't see these fucking replay guy anymore (hugh improvement)😁

Hope some dev will develop a client with #monero support built in.

#Chainalysis appears to have intercepted #Monero node traffic. Here's what I've uncovered of their lil' hack, explained like you're 5-years-old. And to be fair, it's quite telling of the problems blockchain forensics (a form of data science) is having with Monero's robust privacy.

Chainalysis operates “faux nodes” which are nginx (pronounced engine-x) servers that act as reverse proxies. In plain English, that means they forward→traffic to real nodes, while capturing a copy 💾 of the underlying data.

The case of node.moneroworld.com

node.moneroworld.com isn't actually a node, but points DNS A-records to a bunch of legit Monero node IP addresses. Think of it sort of like a load balancer; it connects Monero traffic (users) to any of the many participating nodes that are attached to it. So if one of the nodes goes offline, it directs users to the nodes that are still online.

So before Chainalysis even enters the picture, let's say a node is attached to the load balancer. The node itself is hosted on a VPS (Virtual Private Server). This is a type of hosting service that utilizes virtualization technology to provide users with dedicated resources on a server that is shared among multiple users. However, if the node operator stops paying for the VPS or no longer wants to run the node, they might abandon it. Chainalysis has been keeping a very naughty eye on the load balancer, and after seeing this node quit, rents the same VPS that previously hosted the node. If the DNS zone records (responsible for linking domain names to IP addresses) aren’t updated in a timely manner, a dangling DNS record could persist, meaning the network (popular wallets, GUI, load balancers, etc) still associates that IP with a "trusted" node.

So from what I can tell, let's assume you connected to, and used these malicious nodes nakedly, meaning you walked into the crowded sauna nude, and didn't wear a VPN (underwear), and didn't have Tor (a towel) between you. Here's what they could see:

-IP

-IP latency

-timestamp

-input, output, fee structure

Simply using a VPN cuts this in half, and putting Tor between you (or just using .onion public nodes) keeps you mostly safe. But of course, running your own node, eliminates all the problems. And the takeaway here perhaps, is that even when transacting via a malicious node, it still doesn't know your recipient, and is trapped in a bunch of fog unless you do something outside the ordinary with the fee structure.

The inbound Monero fork called FCMP++ (Full Chain Membership Proofs), which is a form of Merkel Proof with a couple other things, will replace ring signatures, and is going slam the door on Chainalysis' small shell game. It could set the table for PIR (Private Information Retrieval), which is a cryptographic protocol that allows retrieval of an item from a server, without revealing which item was retrieved. This would be egalitarian for all the people who cannot run their own nodes (cost, access to resources, etc), and rely on public nodes.

Is this Chainalysis exploit also a threat to Nostr relays?

#askNOSTR

Anyway, would appreciate correction to anything I got wrong. I feel that the expectation of XMR's privacy is so sky high, that we bitcoiners can forget that the tradition of hard forks in Monero is really what keeps its privacy a step ahead, and so hardened to the always improving, always evolving threats to privacy.

—Jus Dos

I won't be using my S9s this year 😭😭😭 After the halving they're no longer worth it for me.

Would you consider going into debt to buy more bitcoin?

A Bitcoin address holding 185 BTC just became active after 11 years of dormancy. The funds were originally withdrawn from Silk Road in September 2013 and had remained untouched until two hours ago.

I never used a fitbit or similar because I think they are privacy nightmares. I'm also not a big fan of measuring everything (or over-optimizing everything).

But now I'm curious: are there any that don't suck and are reasonably privacy preserving? If anyone knows it's probably the nostr crowd lol

👀

Plebs haven't forgotten you, Hal.

May 4, 1956 - Aug 28, 2014

Considering adding native Tor into Amethyst just to go around relay per-connection limitations.

Then we could keep all accounts connected and downloading their events at all times, while using a separate exit IP for each nostr filter.

There wouldn't need to be a global account switcher. Users could have 100s of accounts working together.

Plus, huge privacy gains.