2 New bug reports DELETED from Samourai Wallet's Gitlab Repo

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: Kruw on November 09, 2023, 03:30:01 PM

Quote from: Medusah on November 09, 2023, 02:17:27 PM

And they are correct. Your absolute claim that you "negate the potential gained privacy" is false, because it is absolute. It is the same as saying that mixers provide no privacy.

I guess o_e_l_e_o and I are just going to have to disagree with you on this one:

Quote from: o_e_l_e_o on June 03, 2023, 11:55:03 AM

Whirlpool does use a central coordinator, so it is absolutely vital that you use it with your own node and Tor to keep your privacy from the central coordinator.

Sorry, I meant I guess n0nce and Jon_Hodl and BlackHatCoiner and o_e_l_e_o and I are just going to have to disagree with you on this one:

Quote from: n0nce on March 19, 2022, 09:05:26 PM

It's disingenuous though. I mean they sell it as super duper anonymous, while random SPV wallet devs don't. The ability to use Whirlpool without a full node is extremely misleading and barely better than not mixing at all honestly. It should not be a feature in the first place, in my opinion.

Quote from: n0nce on March 20, 2022, 06:23:50 AM

Honestly, it shouldn't even be an option not to run your own node if this software is supposed to be privacy-first. Their 'default nodes' shouldn't even exist, they should all be taken offline if they're serious about privacy.

Quote from: Jon_Hodl on July 25, 2023, 09:34:32 AM

I would also like to point out that if you are using either method but you are not running your own node, you are trusting both your wallet as well as the CoinJoin coordinator with your xPub key which is completely antithetical to the whole idea of increased privacy via CoinJoin.

Quote from: BlackHatCoiner on August 21, 2023, 11:23:19 AM

Note: To enjoy great levels of privacy with coinjoin, running your own full node is a prerequisite. If viewing your wallet's balance requires a third party, then the gained privacy is questionable.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: Medusah on November 13, 2023, 02:20:17 PM

That does not mean it is smart to do it, but it gives you the freedom to do whatever you like with your money.

No no no, you've got it all wrong. Every bitcoin transaction should be ran past Kruw personally to make sure that he approves of it before being broadcast. You are only allowed to spend your coins in ways that he thinks are acceptable. Roll Eyes

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: Medusah on November 13, 2023, 02:20:17 PM

In regular wallets, you can create an output that is worth less than the mining fees required to spend it. That is generally allowed. Maybe not in Wasabi land, but in electrum, sparrow, samurai etc, it is allowed. That does not mean it is smart to do it, but it gives you the freedom to do whatever you like with your money.

I heard you the first time:

Quote from: Kruw on November 09, 2023, 02:09:37 PM

Quote from: Medusah on November 09, 2023, 01:47:02 PM

No. Good wallets give you the freedom to do as you like. There are infinite ways for the user to mess things up if they choose to do so, the wallet cannot prevent you from every. For example, paying unnecessarily high fees is (and should be) allowed.

I guess I can't argue against someone who takes the stance "Wasting your Bitcoin and ruining your privacy should be allowed."

Medusah

sr. member

Activity: 336

Merit: 296

Quote from: Kruw on November 10, 2023, 07:25:46 AM

If Samourai Wallet quite clearly displayed sending coins to 1111111111111111111114oLvT2 in a tx0 transaction, would you consider it "not a bug" and just say that "people are free to do with their money whatever they want"?

In regular wallets, you can create an output that is worth less than the mining fees required to spend it. That is generally allowed. Maybe not in Wasabi land, but in electrum, sparrow, samurai etc, it is allowed. That does not mean it is smart to do it, but it gives you the freedom to do whatever you like with your money.

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

More outrage from the Samourai community about the creation of unmixed change: https://twitter.com/ErgoBTC/status/1181573118810361856

Quote from: ErgoBTC

Unmixed change is radioactive waste with an infinite half life.

It points to every mix you have participated in.

This is strictly worse for privacy.

The solution isn't coin control and a warning label.

The solution is not creating it in the first place. #RootCauseAnalysis

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: o_e_l_e_o on November 10, 2023, 07:53:54 AM

You have completely missed the point, as usual. I don't care why people create such outputs - I'm not the one judging other people for using their money in the way they choose to use it. I'm not the one trying to apply my rules to everyone else, and censor those I do not agree with. If people want to do something you deem "stupid" with their money, then they should be completely free to do so. I think NFTs are stupid, but people should be absolutely free to spend their bitcoin on NFTs if that's what they want to do.

That's exactly my point: Unlike NFTs which are merely "stupid", there is no use case at all for creating this dust output in Samourai. It's pure downside to the user from every aspect (as well as a downside to all of the other users of Bitcoin who now have to compete for less available block space).

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: Kruw on November 10, 2023, 07:25:46 AM

If Samourai Wallet quite clearly displayed sending coins to 1111111111111111111114oLvT2 in a tx0 transaction, would you consider it "not a bug" and just say that "people are free to do with their money whatever they want"?

That would clearly be a bug since the user in question does not control that address.

Quote from: Kruw on November 10, 2023, 07:25:46 AM

Since you can't come up with a use case for these burn outputs being created from Whirlpool, I think I've proven my point that this is a bug and no one would ever do something so stupid deliberately.

You have completely missed the point, as usual. I don't care why people create such outputs - I'm not the one judging other people for using their money in the way they choose to use it. I'm not the one trying to apply my rules to everyone else, and censor those I do not agree with. If people want to do something you deem "stupid" with their money, then they should be completely free to do so. I think NFTs are stupid, but people should be absolutely free to spend their bitcoin on NFTs if that's what they want to do.

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: o_e_l_e_o on November 10, 2023, 07:13:24 AM

Tell me why people send coins to burn addresses such as 1111111111111111111114oLvT2? Tell me why people send coin to the genesis block public key? Tell me why people burn coins with OP_RETURN outputs? Tell me why people trade their bitcoin for worthless shitcoins? Tell me why anybody would throw a coin in a well to "make a wish"? Tell me why people throw over a million euros in to the Trevi Fountain each year?

As I've already explained to you, Samourai quite clearly displays the change output prior to Tx0 being signed. If a user does not want to create that change output, then they are free to modify the transaction. People are also free to do with their money whatever they want. They do not need permission from you, Wasabi, or any other pro-censorship third party to do so.

If Samourai Wallet quite clearly displayed sending coins to 1111111111111111111114oLvT2 in a tx0 transaction, would you consider it "not a bug" and just say that "people are free to do with their money whatever they want"? Since you can't come up with a use case for these burn outputs being created from Whirlpool, I think I've proven my point that this is a bug and no one would ever do something so stupid deliberately.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Tell me why people send coins to burn addresses such as 1111111111111111111114oLvT2? Tell me why people send coin to the genesis block public key? Tell me why people burn coins with OP_RETURN outputs? Tell me why people trade their bitcoin for worthless shitcoins? Tell me why anybody would throw a coin in a well to "make a wish"? Tell me why people throw over a million euros in to the Trevi Fountain each year?

As I've already explained to you, Samourai quite clearly displays the change output prior to Tx0 being signed. If a user does not want to create that change output, then they are free to modify the transaction. People are also free to do with their money whatever they want. They do not need permission from you, Wasabi, or any other pro-censorship third party to do so.

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: o_e_l_e_o on November 10, 2023, 05:26:05 AM

Once again: https://bitcointalksearch.org/topic/m.63102560

Stay on topic and stop evading the question - Tell me why anyone would ever lose their sats deliberately by creating these traceable Whirlpool dust outputs:

https://mempool.space/address/bc1qp25y8kfywz88myuh7ed3dmx3vv2z2dwuxhjnlv

Value of output: 305 sats
Mining fee paid to create output: 369 sats
Mining fee paid to spend input: 1,776 sats
Net loss from dust bug: 1,840 sats
New transactions clustered: 5 txs

https://mempool.space/address/bc1q83sfgfefwupz8w3faawxjr5v8uf03ttjclrkda

Value of output: 933 sats
Mining fee paid to create output: 1,234 sats
Mining fee paid to spend input: 4,333 sats
Net loss from dust bug: 4,634 sats
New transactions clustered: 12 txs

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: Kruw on November 10, 2023, 05:05:47 AM

"Explaned to Kruw dozens of times"?

Once again: https://bitcointalksearch.org/topic/m.63102560

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: o_e_l_e_o on November 10, 2023, 02:52:30 AM

As has been explained to Kruw dozens of times, the change output from Tx0s are sent to a separate account and deliberately segregated from your other UTXOs. There is no way to accidentally include them in a transaction. Any user consolidating their change output as has been done in the transaction he has linked to above is doing so deliberately. I understand that Kruw gets angry when people spend their bitcoin in ways that he personally doesn't approve of, but there is no bug here, just Kruw either being deliberately misleading or simply not understanding what is happening.

"Explained to Kruw dozens of times"?... You never gave even a single example of why someone would ever want to deliberately create a transaction that causes them to lose their BTC and their privacy:

Quote from: Kruw on November 07, 2023, 11:50:33 AM

Quote from: o_e_l_e_o on November 07, 2023, 10:39:52 AM

1 - Both Samourai and Sparrow tell you the size of your change output prior to signing and broadcasting Tx0. If you don't want to create a change output of this size, then you go and edit your transaction. This is the expected behavior of any good wallet.

Tell me why you would you ever want to send an output to yourself that costs more in sats to create than it is worth. Any good wallet would prevent you from taking this unnecessary loss.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: Medusah on November 09, 2023, 02:17:27 PM

Wasting your money and your privacy in real life are allowed, I do not understand why here should be otherwise. If you are reckless, you are going to regret it.

As has been explained to Kruw dozens of times, the change output from Tx0s are sent to a separate account and deliberately segregated from your other UTXOs. There is no way to accidentally include them in a transaction. Any user consolidating their change output as has been done in the transaction he has linked to above is doing so deliberately. I understand that Kruw gets angry when people spend their bitcoin in ways that he personally doesn't approve of, but there is no bug here, just Kruw either being deliberately misleading or simply not understanding what is happening.

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: Medusah on November 09, 2023, 02:17:27 PM

And they are correct. Your absolute claim that you "negate the potential gained privacy" is false, because it is absolute. It is the same as saying that mixers provide no privacy.

I guess o_e_l_e_o and I are just going to have to disagree with you on this one:

Quote from: o_e_l_e_o on June 03, 2023, 11:55:03 AM

Whirlpool does use a central coordinator, so it is absolutely vital that you use it with your own node and Tor to keep your privacy from the central coordinator.

Medusah

sr. member

Activity: 336

Merit: 296

Quote from: Kruw on November 09, 2023, 02:09:37 PM

I guess I can't argue against someone who takes the stance "Wasting your Bitcoin and ruining your privacy should be allowed."

Wasting your money and your privacy in real life are allowed, I do not understand why here should be otherwise. If you are reckless, you are going to regret it. I do not propose to not warn someone for their bad actions, but if despite the warning they still will want to do it, who am I to stop them?

Quote from: Kruw on November 09, 2023, 02:09:37 PM

No, they do not provide any warning to users before collecting their data from them. @walletguy closed the issue and said "Feel free to submit a PR if you so desire, but it will not be merged. Your proposed warning text makes no sense and claims made in said text are not true in the slightest." - https://web.archive.org/web/20230417145554/https://code.samourai.io/wallet/samourai-wallet-android/-/issues/458

And they are correct. Your absolute claim that you "negate the potential gained privacy" is false, because it is absolute. It is the same as saying that mixers provide no privacy.

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: Medusah on November 09, 2023, 01:47:02 PM

No. Good wallets give you the freedom to do as you like. There are infinite ways for the user to mess things up if they choose to do so, the wallet cannot prevent you from every. For example, paying unnecessarily high fees is (and should be) allowed.

I guess I can't argue against someone who takes the stance "Wasting your Bitcoin and ruining your privacy should be allowed."

Quote from: Medusah on November 09, 2023, 01:47:02 PM

I have not used that samourai software, but don't they warn you that if you do not run your own node you rely on someone else's? What else should they say?

No, they do not provide any warning to users before collecting their data from them. @walletguy closed the issue and said "Feel free to submit a PR if you so desire, but it will not be merged. Your proposed warning text makes no sense and claims made in said text are not true in the slightest." - https://web.archive.org/web/20230417145554/https://code.samourai.io/wallet/samourai-wallet-android/-/issues/458

Medusah

sr. member

Activity: 336

Merit: 296

Quote from: Kruw on November 07, 2023, 11:50:33 AM

Tell me why you would you ever want to send an output to yourself that costs more in sats to create than it is worth. Any good wallet would prevent you from taking this unnecessary loss.

No. Good wallets give you the freedom to do as you like. There are infinite ways for the user to mess things up if they choose to do so, the wallet cannot prevent you from every. For example, paying unnecessarily high fees is (and should be) allowed.

Quote from: Kruw on November 07, 2023, 11:50:33 AM

Samourai acts as a surveillance app, sending everyone's financial history to their servers.

I have not used that samourai software, but don't they warn you that if you do not run your own node you rely on someone else's? What else should they say?

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Ouch, this non private toxic change output created by Whirlpool's tx0 was even larger than the 0.001 pool denomination itself: https://mempool.space/address/bc1qmgnthpjk4ecgmq4hlne6h79q7ykaf4w8n9jzkv

Even worse, that traceable coin was then consumed as an unnecessary input, wasting block space and linking the two transactions together: https://mempool.space/tx/8b63b69e91a5c5ebd840a0dcb8bda38f12e3812485ab263291ab3cfe3819cd06

It's like they don't even know there's a cost or limit involved with block space Lips sealed

Kruw

member

Activity: 378

Merit: 93

Enable v2transport=1 and mempoolfullrbf=1

Quote from: o_e_l_e_o on November 07, 2023, 10:39:52 AM

Probably deleted since OP is a recurrent concern troll - https://nitter.cz/PavelTheCoder/status/1647970679805947910#m

In this thread you linked, disgraced Samourai developer 'PavelTheCoder' (who also was caught lying exactly like you were about WabiSabi coinjoins being traceable) calls the issue I opened for enabling "absolutely vital" privacy features by default on Samourai wallet "a retarded change".

Quote from: o_e_l_e_o on June 03, 2023, 11:55:03 AM

Whirlpool does use a central coordinator, so it is absolutely vital that you use it with your own node and Tor to keep your privacy from the central coordinator.

Samourai acts as a surveillance app, sending everyone's financial history to their servers. You claimed that it's "absolutely vital" to keep your privacy by connecting to your full node and using Tor, and yet this "absolutely vital" privacy improvement was DELETED from Samourai's Gitlab repository: https://web.archive.org/web/20230417145554/https://code.samourai.io/wallet/samourai-wallet-android/-/issues/458

Quote from: o_e_l_e_o on November 07, 2023, 10:39:52 AM

1 - Both Samourai and Sparrow tell you the size of your change output prior to signing and broadcasting Tx0. If you don't want to create a change output of this size, then you go and edit your transaction. This is the expected behavior of any good wallet.

Tell me why you would you ever want to send an output to yourself that costs more in sats to create than it is worth. Any good wallet would prevent you from taking this unnecessary loss.

Quote from: o_e_l_e_o on November 07, 2023, 10:39:52 AM

2 - Tx0 clearly pays the coordinator, and this output is easily identified. The privacy of Whirlpool coinjoins does not depend on this fee payment being secret. It does not matter if you and I both pay to the same coordinator address - there is zero loss of privacy.

Apparently you are not aware of Samourai's statements regarding reuse of coordinator fee addresses: https://stephanlivera.com/episode/150/

Quote

Stephan Livera: Also. So recently there’s been this whole debacle around Wasabi wallet getting flagged. So essentially some users, so the two recent examples, which to my knowledge, are the third and fourth cases that I know of. So there was Catxolotl from Binance Singapore. And then the other guy was RonaldMcHodled. RonaldMcHodled was withdrawing from Paxos. And so it’s sparked up this whole debate about basically how easy is it to flag CoinJoin transactions. My perspective on it was, look, these are like an unforced error. Wasabi should not have had a fixed fee address. And in fairness to Wasabi they are now changing that, after a lot of debate and a lot of time on this topic.

Samourai Wallet: It doesn’t matter now though. The impact has already been made. There’s no going back from more than a year of address reuse. It’s tied into the architecture of the mixes now. So it’s very good that they finally changed that. But it really isn’t going to do all that much.

If this is so important to Samourai that coordinator fee addresses are not reused in Wasabi, why would they delete an issue from their Gitlab repo proving that the coordinator fee address is reused in Samourai?

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Probably deleted since OP is a recurrent concern troll - https://nitter.cz/PavelTheCoder/status/1647970679805947910#m

These are both non issues.

1 - Both Samourai and Sparrow tell you the size of your change output prior to signing and broadcasting Tx0. If you don't want to create a change output of this size, then you go and edit your transaction. This is the expected behavior of any good wallet.

2 - Tx0 clearly pays the coordinator, and this output is easily identified. The privacy of Whirlpool coinjoins does not depend on this fee payment being secret. It does not matter if you and I both pay to the same coordinator address - there is zero loss of privacy.

Topic: 2 New bug reports DELETED from Samourai Wallet's Gitlab Repo (Read 571 times)