skip iguana and go for this ?

As you know we are offering bounties for finding security issues in the code base. Approx 16 hours ago, we received a vulnerability report.

Within 6 hours we had verified it, developed and tested a fix and started updating the notary nodes. In order to give enough time for the field to update, I set the fix to activate at 4:30 PM UTC. This was about 16 hours time and I was hoping long enough for the field to update and short enough to avoid a zeroday attack.

Unfortunately, the attacker sees the fix on github as it is open source and he deployed an attack within the last hour. I was forced to move up the activation time to 5am UTC, which is less than half an hour from now.

Exchanges have been notified, along with pools. Notaries are almost completed the update. The damage from this attack will be minimal, actually zero, as the security bounty is offset by whatever damage is done, so the total cost remains the same.

If you are running a native komodod, you need to update. The network is about to do a controlled fork.

The problem of fixing things in an open source project is a difficult problem to solve. In this case we deployed a fix within 6 hours of being notified, had everything update and still we get hit with an attack. It does feel like antivirus vs virus.

Anyway, we will get better and better and dealing with these things more efficiently, but it is much better to already have the fix deployed than getting blindsided by an attack. Next time I will set the activation time shorter to give less time for attacker to deploy. (always assume and prepare for next time, so if it happens you are ready)

Mainchain is paused as it tries to find consensus to move forward. So without tx being possible it seems relatively safe, but this means basilisk mode wont work until the chain gets going again.

I can break these down

Brands:
 - SuperNET
 - Agama
 - Komodo


Not brands:
 - EasyDEX (the shapeshift like exchange service in Agama)
 - Full/Native/basilisk Mode (i.e. blockchain download or no blockchain download in Agama)

The 'Mode' situation has been further simplified as we disabled 'Full Mode' from all the coins that have 'Native Mode'. So what the end user has to decide is simple: a) download the blockchain, or b) don't download it. We can illustrate the difference with icons and simple description.

SuperNET = the main brand, the organization behind the other brands

Agama and Komodo are/will be endorsed semi-independent brands. They have a loose connection to the parent SuperNET organization.

Now that we are past the hardfork block 246748, I updated to a version that hardcodes that.

If your node went past that block, you will need to resync. If not, just update and it will get onto the mainchain.

This time around could have gone a bit smoother, I had botched the initial hotfix. If I   didnt, we could have avoided resyncing. Unfortunately, at middle of the night hours it wasnt possible to get the code reviewed so I had to do the best given the time available (< 1hr).

As I wrote last week, it is not possible to live in an attack free environment. If you rely on that, then the first attack and there is trouble. We are getting better at dealing with these attacks, our immune system is getting better, but we can still do better. And we will.

Due to needing resync, basilisk mode will be spotty for some hours. Best to not do any large transactions until it is announced mainchain is like clockwork again and evilchain is gone

why you losing your mind here dear relaxx and try to undestand its properly with cool mind and with full consentration over it.

I dont believe omnigames was ever distributed, at least it was still in the incubation stage, so there shouldnt have been any assets available. I have not heard from the project leader in a while

hmmmmm Then I probably made loss

https://www.mynxt.info/asset/7441230892853180965

Thought the asset is running supernet

Issuer   NXT-MRBN-8DFH-PFMK-A4DBM
SuperNET

I learn from mistakes

Thanks for this. I admit that the frustration of the latest BTC forking got me wound up and that overflowed to my comments. I realise James has had bigger issues at hand with the recent bugs. If it's worth attacking then it must be a threat to someone which is positive.

One other issue, when/if Bitcoin Unlimited is deemed a failure, how does that affect the notary servers going forward?

[/quote]

I can break these down

Brands:
 - SuperNET
 - Agama
 - Komodo


Not brands:
 - EasyDEX (the shapeshift like exchange service in Agama)
 - Full/Native/basilisk Mode (i.e. blockchain download or no blockchain download in Agama)

The 'Mode' situation has been further simplified as we disabled 'Full Mode' from all the coins that have 'Native Mode'. So what the end user has to decide is simple: a) download the blockchain, or b) don't download it. We can illustrate the difference with icons and simple description.

SuperNET = the main brand, the organization behind the other brands

Agama and Komodo are/will be endorsed semi-independent brands. They have a loose connection to the parent SuperNET organization.
[/quote]

Thanks for your prompt reply jl777, good stuff!