Joined 1/8/2019
Reputation -2473
Nothing to tell.
is subscribed to content from these users. Their content will appear in the activity feed.
These users are subscribing to . 's content will appear in their activity feed.
Seems like withdraw option still not working fine, I tried a withdraw of 499 sats and it didn't deliver, I wonder how long will it take for the issues to be resolved?
Please explain what you found out later.
I haven't reproduced it, but It looks like I wasn't holding the user funds database lock during the LND transaction (just checking before) - so a script was able to simultaneously do a single deposit (creating a balance), and numerous different invoices to withdraw, then there was a short period where more than one of those withdraws would check the balance as valid and proceed to tell LND to pay it - it turns out I was not checking for multiple withdraws from the same user (just the same invoice). Stupid mistake - but nothing that can't be addressed. I guess I've learned my lesson.
These are the changes I am going to roll out in response:
1) I'm adding an additional step for withdraws so that they must be validated in DB before being sent to LND. Once validated, funds will be "reserved" from the user. The user will have to "cancel" withdraws that haven't been submitted before they can release those funds.
2) I'm adding a rate limit on transactions. I'll start with one every 5 minutes. A bit of an inconvenience, and I'll revisit this in the future.
3) I'm going to add pessimistic locking on the database funds table. This may slow things down, but it does improve security.
4) I'm adding an account lock which will trigger on suspicious activity. This will protect a user should their credentials be hijacked, and will protect ZapRead against automated attacks.
Other possible things I may add:
Captchas. Certainly for new accounts, and possibly for withdraws. Sorry bots.
Very interesting, thanks for sharing! I kinda suspected a race condition. Should have looked at stuff like this :/
I guess I've learned my lesson.
Was it worth the funds you lost? Do you want to disclose the amount?
Captchas [...] Sorry bots.
I'm more concerned that this will just hurt users. If I really want to bypass the captchas I'll pay some asians (no hate), so don't do this. Pls. (Atleast withdrawals only, even tho' I wanted automated daily withdrawals.)
I'm adding a rate limit on transactions.
Yeah why not, you can use zapread as a first wallet, but once you use LN frequently you'll wanna run your own node.
Very inspiring discussion!
PS You should buy new mic :D
My knowledge is unfortunately low in this area. What happens if you close the channel - you can log in with Lightning? Will Lightning be just a form of authorization to the accounts we have today?
How is Bitcoin doing these days? How does bitcoin today compare with Bitcoin of 2017? It seems like a lot has changed. So, here is a quick look I decided to put together.
Segregated witness was activated in August 2017. It segregates signature data from transactions into blocks past the 1Mb limit - effectively freeing room in the block for more transactions. It also paved the way for other improvements related to future soft-forks as a way to add new features to Bitcoin without disrupting existing users or requiring everyone to update their software. Let's look at segwit adoption:
Not as good as one would have hoped, but the trend is good. In terms of large (i.e. in value) transactions, Segwit has become the sleight majority. In terms of the number of transactions and block-space used, SegWit is now half of the transactions.
That pesky 1Mb block limit, which can't be removed without a hard fork (and associated risk/split/centralization). How has it changed over the last 5 years?
The solid block around 2018 is when blocks were full - fees were sky-high, and we were witnessing a boom in Bitcoin. The blockchain hit a wall. SegWit was new. That seemed to have resolved, and we can now see that blocksize averages of 1.3Mb are common. The blocksize could still be even higher as not everyone is using SegWit yet.
What happened to fees over time?
The fee issues leading up to 2018 is clear - but then, it seems to have settled down. It may not stay that low if the demand for transactions goes up, but we are far from the fee issues we had in 2017 and 2018.
The beta lightning network is still under development, but, it is already very useful. If you are reading this, you've probably enjoyed a few Lightning Network transactions already.
The number of public channels and capacity seems to have reached a plateau. A public capacity of 1000 BTC seems to be the sticky point. Unfortunately (fortunately!), due to the nature of the Lightning Network, we can't see how many transactions are going on. How's that for privacy enhancement? I can say that my lightning node has already conducted almost 130,000 transactions. Yes - that's right 130K! I think I've paid under $1 in routing fees for all of those combined. I also open channels at 1-2 satoshi/byte, so minimal chain fees too.
If we were to have this kind of transaction capacity on the native blockchain, that would take about 52 blocks of space. Also, remember - I am just one of now 12,000 public nodes on the network. I might be among the most active nodes, but I hope that one can see the scaling going on here. At even $0.01 per transaction, that would have cost $1,300 to transact on-chain, likely more.
Keep in mind this is all on a measly 1Mb blockchain.
I think that Bitcoin is in a pretty good place. There are still things to work on (i.e. keeping fees low), but the future is bright. We are not in a corner, and there are multiple exciting developments in the works. The change that has me most excited is BIPs 340, 341, and 342. These Bitcoin Improvement Proposals add (through soft-fork) Schnorr Signatures, Taproot, and Tapscript. I should do a future post to explain what this gives us in more detail - but I'll say now that it gets me really excited for the future of Bitcoin. I'm talking about privacy, scaling, safety, and powerful smart contracts.
* Note that nowhere in this post did I make any mention of market prices.
130.000 transactions! Some scaling. Is zapread the most active on the LN network? Do you know which sites are competing with most transactions on LN with zapread?
I think that https://lnmarkets.com/market might soon be no. 1 :)
https://lnmarkets.substack.com/p/ln-markets-may-5th-2020-issue-3
You can get those graphs I post from https://txstats.com/
Works great, but do you have idea how to upvote post without Jquery in the future? :D
Yes some better iu. Now I can see a sent message when withdrawing
It looks much better now, good job! We are going in the right direction
PS
Do you know how often the limbo balance is released? I've been waiting over a week, just wondering.
Great question. I should add a timer there!
The limbo is released when LND reports as perma-failed, invoice expires, or it is confirmed paid by LND. I have issues still with their API. Sorry it is not very friendly right now. LND is working on enhancements still. I am conservative with that to keep people from trying to steal funds.
Interesting, but need some fixes :(
Or maybe something with cache
Anyway: TypeError: t(...).modal is not a function (if I want to upvote post)
Probably, because Bootstrap modal forms require JQuery
https://fred.stlouisfed.org/series/BOGMBASEW
A main difference between the most recent jump compared to 2008 is that in 2008, they were able to actually drop interest rates. Interest rates were already low at the start of this crisis - so not much of a drop there.
Now read that article again thinking about what's different this time. What do you think?
The guy that runs this site is called @RudyHavenstein on Twitter He's absolutely hysterical. Very US centric but never the less, seriously funny and completely sarcastic.
Properly binged out after watching all 3. I can see why you like them so much. Kinda interesting watching them now we have Bitcoin. A personal line of enquiry has been very much enhanced ie. American Libertarianism (Right) and the original left/Anarcho Libertarianism... Now i have positive freedom and negative freedom to fit in... Feels like i already have it but i will upset too many Bitcoin Maxi's if i expound. I'm sure you know exactly where I'm going with this @Zelgada Thanks again for the share ;)
Just watched part 1. Superb. Confirmation Bias much? And there was me thinking there's something wrong with me haha.
Profound also, watching it in this present moment. Put this in the context of The Century of the Self and you have many answers. I get off on seeing dissonance in people (a little evil i know), but i really enjoy the feeling of it myself as i know i'm being challenged and learning. Great share Thanks
Not through the first one yet, but it's very interesting to learn that being selfish is always the best strategy (if everyone does it, which is why everyone does it).
First 20 minutes were hard, but it gets very interesting after that!
Continuing with the theme of improving the website front end, I've been removing jQuery from all parts of ZapRead.
For the latest changes, I moved all of the real-time WebSockets aspects into a microservice and updated to .NET Core 3.1 (ZapRead is still on .NET 4.7). This removed my jQuery dependence for the real-time aspects.
I have also removed toastr and replaced it with the much lighter tata-js (which again, doesn't need jQuery).
We just got our best speed-score yet! I'm amazed at how much of a difference it makes in site performance to not have jQuery.
I also did some testing, and now a fresh load of the homepage is about 650k download. A cached load is now under 50k. I think this also contributes to a much faster website.
But there's more! Once I update the editor to the new version, things are going to get even faster.
If you want to speed up the site (and save billions of dollars), you can compress PNG, JPG and GIF files more strongly.
For example, I compressed the Zapread logo with optipng and reduced it from 92KB to 81KB (12% less).
Under Linux there are commands:
optipng
jpegoptim
gifsicle... I think?
If I'm not mistaken, it's all lossless optimization.
I'm using a CDN proxy, and the images should already be optimized. I could make it lossy, or use a more efficient format. I think that the download size is the smallest performance hit right now. There are other issues I should address first. Still - I'll keep this in mind as a future upgrade!
Update:
Good news. I was able to re-create the vulnerability in testing, and I was able to implement the fix in testing.
I will be implementing multiple safety fixes but will unfortunately have to leave transactions offline for a bit longer until it is complete.
Anti-fragility!