Bitcoin Explorer - Revision history

Midnightmagic: Protected "Bitcoin Explorer": author removed important warnings about funds loss ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

2023-09-14T22:48:20Z

Protected "Bitcoin Explorer": author removed important warnings about funds loss ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

← Older revision	Revision as of 22:48, 14 September 2023
(No difference)

Midnightmagic: replacing a responsible warning of funds loss, pointers to additional information and timely twitter commentary from bx seed author

2023-09-14T22:47:44Z

replacing a responsible warning of funds loss, pointers to additional information and timely twitter commentary from bx seed author

← Older revision		Revision as of 22:47, 14 September 2023
Line 1:		Line 1:
			==WARNING: FUNDS LOSS==

			The use of specific versions of this tool to generate wallets has been [https://milksad.info/disclosure.html documented in CVE-2023-39910] to have already resulted in significant funds loss due to the inexplicable removal of the inclusion of OS randomness and replacement thereof with mere time-based seeding. The author's implication that the use of OS randomness is cryptographically equivalent to low-entropy time-only based seeding is inaccurate.

			'''DO NOT USE THIS TOOL TO CREATE WALLETS NOR RECEIVE FUNDS.'''

			[https://news.ycombinator.com/item?id=37057601 Additional write-up by Greg Maxwell describing some of the extent of the damage done]<br>
			[https://archive.ph/BvGH7 Author inexplicably asserting the broken bx seed command is working as intended]<br>
			[https://archive.is/YlwCQ Author inexplicably asserting that tdryja pointing out his error is just part of the 'core playbook']<br>

			'''The following page is preserved for archival purposes.'''
			-----

	Bitcoin Explorer (bx) is an advanced command line application that is included as part of [[Libbitcoin_Explorer\|libbitcoin-explorer]]. [https://github.com/libbitcoin/libbitcoin-explorer/wiki Extensive documentation] and [https://github.com/libbitcoin/libbitcoin-explorer/wiki/Download-BX signed binaries] for Linux, OSX and Windows are available on GitHub.		Bitcoin Explorer (bx) is an advanced command line application that is included as part of [[Libbitcoin_Explorer\|libbitcoin-explorer]]. [https://github.com/libbitcoin/libbitcoin-explorer/wiki Extensive documentation] and [https://github.com/libbitcoin/libbitcoin-explorer/wiki/Download-BX signed binaries] for Linux, OSX and Windows are available on GitHub.

Evoskuil: /* Entropy */ Replace the "it has been determined" link with report from developers, which provides the CVE link.

2023-09-06T17:06:32Z

Entropy: Replace the "it has been determined" link with report from developers, which provides the CVE link.

← Older revision		Revision as of 17:06, 6 September 2023
Line 11:		Line 11:
	WARNING: Pseudorandom seeding can introduce cryptographic weakness into your keys. This command is provided as a convenience.		WARNING: Pseudorandom seeding can introduce cryptographic weakness into your keys. This command is provided as a convenience.

	Despite this documentation, it [https://~~milksad~~.~~info~~/ has been determined] that the command may have been used for live wallet seeding. Consequently the command has been [https://github.com/libbitcoin/libbitcoin-explorer/pull/729/commits/5281cfb370614716aa7dd1e099def193401da6f3 removed].		Despite this documentation, it [https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910 has been determined] that the command may have been used for live wallet seeding. Consequently the command has been [https://github.com/libbitcoin/libbitcoin-explorer/pull/729/commits/5281cfb370614716aa7dd1e099def193401da6f3 removed].

	==Examples==		==Examples==

Evoskuil: Add hyperlink to seed command removal.

2023-08-19T17:35:15Z

Add hyperlink to seed command removal.

← Older revision		Revision as of 17:35, 19 August 2023
Line 11:		Line 11:
	WARNING: Pseudorandom seeding can introduce cryptographic weakness into your keys. This command is provided as a convenience.		WARNING: Pseudorandom seeding can introduce cryptographic weakness into your keys. This command is provided as a convenience.

	Despite this documentation, it [https://milksad.info/ has been determined] that the command may have been used for live wallet seeding. Consequently the command has been removed.		Despite this documentation, it [https://milksad.info/ has been determined] that the command may have been used for live wallet seeding. Consequently the command has been [https://github.com/libbitcoin/libbitcoin-explorer/pull/729/commits/5281cfb370614716aa7dd1e099def193401da6f3 removed].

	==Examples==		==Examples==

Evoskuil: Change updated version to 3.8.0 (vs. 3.7.0). 3.7 was staged much earlier and never tagged for release.

2023-08-17T20:06:10Z

Change updated version to 3.8.0 (vs. 3.7.0). 3.7 was staged much earlier and never tagged for release.

← Older revision		Revision as of 20:06, 17 August 2023
Line 2:		Line 2:

	==Entropy==		==Entropy==
	In versions prior to 3.7.0 bx included the '''seed''' command, which was explained in the [https://github.com/libbitcoin/libbitcoin-explorer/wiki/Random-Numbers/897620743e329ca9ae8926cba5e717122619f439 Random-Numbers] topic:		In versions prior to 3.8.0 bx included the '''seed''' command, which was explained in the [https://github.com/libbitcoin/libbitcoin-explorer/wiki/Random-Numbers/897620743e329ca9ae8926cba5e717122619f439 Random-Numbers] topic:

	With the exception of cert-new, any BX command that requires a random number obtains that value as an argument. This places the responsibility of ensuring random number strength on end-users and also helps them understand the potential for problems... The seed command is provided as a convenience, and is the only command that generates randomness.		With the exception of cert-new, any BX command that requires a random number obtains that value as an argument. This places the responsibility of ensuring random number strength on end-users and also helps them understand the potential for problems... The seed command is provided as a convenience, and is the only command that generates randomness.

Evoskuil: Use the preceding (relevant) Random Numbers topic.

2023-08-17T18:26:21Z

Use the preceding (relevant) Random Numbers topic.

← Older revision		Revision as of 18:26, 17 August 2023
Line 2:		Line 2:

	==Entropy==		==Entropy==
	In versions prior to 3.7.0 bx included the '''seed''' command, which was explained in the [https://github.com/libbitcoin/libbitcoin-explorer/wiki/Random-Numbers Random-Numbers] topic:		In versions prior to 3.7.0 bx included the '''seed''' command, which was explained in the [https://github.com/libbitcoin/libbitcoin-explorer/wiki/Random-Numbers/897620743e329ca9ae8926cba5e717122619f439 Random-Numbers] topic:

	With the exception of cert-new, any BX command that requires a random number obtains that value as an argument. This places the responsibility of ensuring random number strength on end-users and also helps them understand the potential for problems.		With the exception of cert-new, any BX command that requires a random number obtains that value as an argument. This places the responsibility of ensuring random number strength on end-users and also helps them understand the potential for problems... The seed command is provided as a convenience, and is the only command that generates randomness.
	...
	The seed command is provided as a convenience ~~for demonstrative purposes only~~, and ~~should never be used to secure real bitcoin~~.

	and was itself [https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-seed documented] with the following warning:		and was itself [https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-seed documented] with the following warning:

Evoskuil: Add missing hyperlink.

2023-08-17T17:55:38Z

Add missing hyperlink.

← Older revision		Revision as of 17:55, 17 August 2023
Line 8:		Line 8:
	The seed command is provided as a convenience for demonstrative purposes only, and should never be used to secure real bitcoin.		The seed command is provided as a convenience for demonstrative purposes only, and should never be used to secure real bitcoin.

	and was itself documented with the following warning:		and was itself [https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-seed documented] with the following warning:

	Generate a pseudorandom seed.		Generate a pseudorandom seed.

Evoskuil: Repair vandalism, replace `bx seed` example with `echo [user entropy]`, add info on seeding.

2023-08-17T17:38:39Z

Repair vandalism, replace `bx seed` example with `echo [user entropy]`, add info on seeding.

← Older revision		Revision as of 17:38, 17 August 2023
Line 1:		Line 1:
	~~= WARNING USE OF THIS SOFTWARE WILL RESULT IN YOUR FUNDS BEING STOLEN =~~		Bitcoin Explorer (bx) is an advanced command line application that is included as part of [[Libbitcoin_Explorer\|libbitcoin-explorer]]. [https://github.com/libbitcoin/libbitcoin-explorer/wiki Extensive documentation] and [https://github.com/libbitcoin/libbitcoin-explorer/wiki/Download-BX signed binaries] for Linux, OSX and Windows are available on GitHub.

	~~'''WARNING: The use of this library to generate seeds, contrary to the author's own following suggestions~~ that ~~include no warnings whatsoever, WILL RESULT IN YOUR FUNDS BEING STOLEN~~ as ~~per:'''~~

	~~'''~~[https://~~milksad~~.~~info~~/ ~~CVE~~-~~2023-39910 aka Milksad~~] ~~archive here:~~ [https://~~archive~~.is/~~KbdGI Milksad Archive~~]~~'''~~

	~~'''WARNING: The author is taking zero responsibility~~ for participating in the use of his code in critical reference materials and has taken to blaming the people who used his code to create seeds as per his own examples, in spite of this code being used widely in many non-wallet programs, examples, a widely-read book, and ~~in suggestions in many places~~ on ~~Reddit~~.~~'''~~

	'''~~For reference~~, the ~~following is instructive~~:~~'''~~		==Entropy==
			In versions prior to 3.7.0 bx included the '''seed''' command, which was explained in the [https://github.com/libbitcoin/libbitcoin-explorer/wiki/Random-Numbers Random-Numbers] topic:

	* [https://github.com/libbitcoin/libbitcoin-~~system/commit/6d5a06e283d81260165e0eab95175069bf03b408 git commit where the author wrote vulnerable RNG code without~~ any ~~warnings and described it~~ as ~~"optimal"]~~		With the exception of cert-new, any BX command that requires a random number obtains that value as an argument. This places the responsibility of ensuring random number strength on end-users and also helps them understand the potential for problems.
	* [https://news.ycombinator.~~com/item?id=37057601 Additional write-up by Greg Maxwell describing some of~~ the ~~extent~~ of the ~~damage done]~~		...
	* [https://archive.~~is/TVGrU Author asserting a 32-bit non-entropic~~ seed ~~to a seen gen~~ is ~~working~~ as ~~intended]~~		The seed command is provided as a convenience for demonstrative purposes only, and should never be used to secure real bitcoin.
	* [https://archive.is/BvGH7 Similar, ~~"working as intended"]~~
	* [https://archive.~~is/YlwCQ Author asserting it is all a part of a core conspiracy against him]~~

	~~'''WARNING~~: ~~The following is being left as-is for historical reference.'''~~		and was itself documented with the following warning:

	~~== FOR HISTORICAL REFERENCE ONLY ==~~		Generate a pseudorandom seed.
			WARNING: Pseudorandom seeding can introduce cryptographic weakness into your keys. This command is provided as a convenience.

	~~Bitcoin Explorer (bx) is an advanced command line application that is included as part of [[Libbitcoin_Explorer\|libbitcoin-explorer]]. [https://github.com/libbitcoin/libbitcoin-explorer/wiki Extensive~~ documentation~~] and~~ [https://~~github~~.~~com~~/~~libbitcoin/libbitcoin-explorer/wiki/Download-BX signed binaries~~] for ~~Linux, OSX and Windows are available on GitHub~~.		Despite this documentation, it [https://milksad.info/ has been determined] that the command may have been used for live wallet seeding. Consequently the command has been removed.

	==Examples==		==Examples==
	Generating a new bitcoin address:		Generating a new bitcoin address:

	$ ~~bx seed~~ \| bx ec-new \| bx ec-to-public \| bx ec-to-address		$ echo [user entropy] \| bx ec-new \| bx ec-to-public \| bx ec-to-address
	13ua8RRSxLpL5WL5cKUDepUCvJZgGWuKh7		13ua8RRSxLpL5WL5cKUDepUCvJZgGWuKh7

Line 82:		Line 76:
	* [[Libbitcoin_Explorer\|libbitcoin-explorer]]		* [[Libbitcoin_Explorer\|libbitcoin-explorer]]
	* [[SubvertX]]		* [[SubvertX]]

	~~= WARNING USE OF THIS SOFTWARE WILL RESULT IN YOUR FUNDS BEING STOLEN =~~

	==References==		==References==

Midnightmagic: sigh

2023-08-09T21:34:39Z

sigh

← Older revision		Revision as of 21:34, 9 August 2023
Line 11:		Line 11:
	* [https://github.com/libbitcoin/libbitcoin-system/commit/6d5a06e283d81260165e0eab95175069bf03b408 git commit where the author wrote vulnerable RNG code without any warnings and described it as "optimal"]		* [https://github.com/libbitcoin/libbitcoin-system/commit/6d5a06e283d81260165e0eab95175069bf03b408 git commit where the author wrote vulnerable RNG code without any warnings and described it as "optimal"]
	* [https://news.ycombinator.com/item?id=37057601 Additional write-up by Greg Maxwell describing some of the extent of the damage done]		* [https://news.ycombinator.com/item?id=37057601 Additional write-up by Greg Maxwell describing some of the extent of the damage done]
			* [https://archive.is/TVGrU Author asserting a 32-bit non-entropic seed to a seen gen is working as intended]
			* [https://archive.is/BvGH7 Similar, "working as intended"]
			* [https://archive.is/YlwCQ Author asserting it is all a part of a core conspiracy against him]

	'''WARNING: The following is being left as-is for historical reference.'''		'''WARNING: The following is being left as-is for historical reference.'''

Midnightmagic at 20:24, 9 August 2023

2023-08-09T20:24:11Z

@@ Line 1: / Line 1: @@
 Bitcoin Explorer (bx) is an advanced command line application that is included as part of [[Libbitcoin_Explorer|libbitcoin-explorer]]. [https://github.com/libbitcoin/libbitcoin-explorer/wiki Extensive documentation] and [https://github.com/libbitcoin/libbitcoin-explorer/wiki/Download-BX signed binaries] for Linux, OSX and Windows are available on GitHub.
@@ Line 62: / Line 79: @@
 * [[Libbitcoin_Explorer|libbitcoin-explorer]]
 * [[SubvertX]]
 ==References==