20 ms·

IOTA: A tangled mess

353 points by wglb 9y ago

akerro 9y ago
IOTA wallet is full of really bad bugs, just look how bad it is on first pages, the more pages you skip, the worse it is. It still doesn't work on Linux, for many users wallet crashes or shows green screen and nothing more. Doesn't work through Wine either. https://github.com/iotaledger/wallet/issues https://github.com/iotaledger/wallet/issues Issues on github have no responses from developers since early November and there were no commits since than, what's surprising, there were a lot of blog posts on their domain and many subreddits how great they are (!!??) BitFinex two week ago had problems paying out IOTAs, payouts were cancelled without any reason. Didn't try again since that time. A lot of domains explaining how to buy IOTA look dodgy, like they were made by 14yo in '90s. There are dozens of domains like supportiota, forumiota, iotasupport.com, howtobuyiota.co.uk ? Why do they all exist and duplicate content? Watch out out there.
- cjhanks 9y ago
  I have never seen a GitHub issues page quite like that. Pages and pages of issues ranging from; "Somebody stole thousands of dollars from me" to "My money is stuck and I can't get it out".
  - tfha 9y ago
    I've also read that the devs have seized funds from users. Specifically, if you use the same address twice in IOTA (extremely common habit in cryptocurrency), you reveal your secret key, and the devs will take your money. Among many other wallet related issues.
    - jackstraw14 9y ago
      Citation for your claim? The story I've read is that the IOTA Foundation will hold your funds so you can reclaim them.
      - Rarebox 9y ago
        The system is clearly not decentralized, if one organization can hold your funds for "misbehavior".
        SAI_Peregrinus 9y ago
        The idea that they'd let you reclaim your funds is also ridiculous. Your private key was compromised, they have no way to identify you.
    - markatkinson 9y ago
      This is radically inaccurate. If you send from an address, trash that address and never use it again. You can receive to an address as many times as you want but once you send from it you gotta move to a new address. The desktop wallet does this automatically so no need to worry about doing it yourself.
    - drewm1980 9y ago
      "All tokens which will ever exist were created on day one and pre-distributed to people who signed onto the project very early." It sounds to me like they are pretty up front about their intention to take all of your money. That is how they started. Same for Bitcoin, only Bitcoin hides it behind a schedule of mining fees so it is more Ponzi scheme while this is more television priest.
- jayjay13 9y ago
  As far as I know there are no bugs in the wallet it's just not completly self explaining. tbh from my view there are just the wrong people in the whole space... 95% of the people are here to get rich quick and not for the developement and it's excatly these people who have problems with Key reuses and so on.. the people have to do their research in such a young space..
  - zaphar 9y ago
    If your software is expected to have bugs then you shouldn't allow people to put money in it. You should be setting the expectation that the chain will get regular resets while you work out the kinks. You should be discouraging exchanges at every opportunity and shouting loudly at the world not to put money in your alpha release software. It doesn't appear that IOTA is doing any of those things.
  - akerro 9y ago
    >95% of the people are here to get rich quick and not for the developement You're saying that application and developers came completely unprepared for the market?
    - jackstraw14 9y ago
      No, the market was unprepared for an application that is still in alpha.
      - ultraluminous 9y ago
        Still in alpha but accepts real-money deposits in the tens of thousands. I think the market was unprepared for anyone being that brazen.
        jackstraw14 9y ago
        Who is accepting deposits, and why tens of thousands? Real money is deposited into exchange accounts to buy crypto assets. No one is making fiat deposits into an IOTA organization. You should examine your reality if you think developers of alpha software have any obligation to provide non-technical folks with a way to use it. It's open source, nothing is stopping you from building your own wallet if you want something better. But they don't owe you anything on the basis of the protocol simply existing. Ask yourself, why do you expect that?
- jackstraw14 9y ago
  > It still doesn't work on Linux What are you talking about? I haven't used the wallet on anything but Linux, and I've had no problems.
  - akerro 9y ago
    https://github.com/iotaledger/wallet/issues/631 https://github.com/iotaledger/wallet/issues/631 https://github.com/iotaledger/wallet/issues/577 https://github.com/iotaledger/wallet/issues/577 https://github.com/iotaledger/wallet/issues/511 https://github.com/iotaledger/wallet/issues/511 https://github.com/iotaledger/wallet/issues/416 https://github.com/iotaledger/wallet/issues/416
bsamuels 9y ago
why would you dump $2,000 dollars into a crypto coin you don't understand
- yorwba 9y ago
  Because you don't understand any crypto coin, but know or have heard of people who have dumped large sums into some coin and brag about their returns, so you want in on the gold rush. FOMO, essentially.
  - dahdum 9y ago
    Let's be fair, the author did do more research than 95% of other investors before buying...
    - matthewbauer 9y ago
      True but he’s still playing with fire. No one knows when the bull market will dry up but lots of people will end up losing money.
      - patrickaljord 9y ago
        He's not playing with fire if he invested what he can afford to lose, he's just having fun like people do when they bet on horses or similar gambling (as longs as it's done responsibly obviously).
- kogepathic 9y ago
  The author dumped a lot more than $2,000 into IOTA. They mention buying 26,000MI at $0.85, which would be a $22,100 investment. Just 5,600MI was worth $28,000 at $5/MI. Why anyone would put that amount into a cryptocurrency they don't find trustworthy is beyond me.
  - dmichulke 9y ago
    > Why anyone would put that amount into a cryptocurrency they don't find trustworthy is beyond me. The richer you are, the more likely you'll consider 5k small change. Same reason why the big bet poker tables have non-experts sitting there.
matthewbauer 9y ago
The post mentions the psychology today article but I’d like to say it’s actually a pretty okay article: https://www.psychologytoday.com/blog/mind-in-the-machine/201712/how-fear-is-being-used-manipulate-cryptocurrency-markets https://www.psychologytoday.com/blog/mind-in-the-machine/201... (Author should disclose if he owns IOTA however)
- jeffwass 9y ago
  That's an interesting article into the psychology and mind-tactics of crypto fans. Not sure why you've been downvoted but the article is worth a look.
  - zik 9y ago
    The article does make some good points but it also comes over as a fluff piece for IOTA while tiptoeing around all IOTA's serious issues and implicitly labelling any criticism as "FUD".
  - jackstraw14 9y ago
    I think this is so much more interesting than all the yelling about these currencies that are not even being used like currencies. Why do people feel so personally and emotionally invested? I mean here in this thread l’m running around trying to correct toxic misinformation, but what’s making me doing that? And what’s making the guy who brought up Cardano casually mention the rankings on coinmarketcap as if that means anything except to instill FOMO. I hope we see more articles on the psychology and sociology behind fear cycles in crypto.
- aaronm14 9y ago
  Thanks for highlighting this, I'm going to share with all of my friends investing/thinking of investing in the crypto space. Always good to get a reminder to take everything you read with a grain of salt. Also rarely get to see these almost short-term post-mortems, which give the (seemingly) whole picture of what happened with the price increase and following decrease.
runeks 9y ago
As I understand it, the problem with IOTA is that — in order to execute an attack — attackers just need to verify more transactions than all honest participants combined. So, in other words, honest participants have no incentive to verify more transactions than required (because they don’t profit from it) while attackers have an incentive to verify more transactions, in order to successfully double spend.
- sandGorgon 9y ago
  And to deal with this problem, they have "trusted supernodes", with a promise to turn them off when the network is self sustaining. It introduces a high degree of centralisation - and we don't know the how network shapes up as a consequence. And the second problem is obviously the unaudited,"quantum resistant" function.
  - kbwt 9y ago
    > And the second problem is obviously the unaudited,"quantum resistant" function. Don't forget the ternary SHA-3.
  - runeks 9y ago
    > And to deal with this problem, they have "trusted supernodes", with a promise to turn them off when the network is self sustaining. I don’t see how the network can ever become self-sustaining if attackers only need to create more transactions than everyone else combined. Sure, as usage increases, the number of transactions an attacker would need to produce increases as well, but so does the attacker’s potential reward — since there will be more IOTA users against which he can double spend.
- seanwilson 9y ago
  Could an attacker not create lots of transactions between wallets they own so the attacker is given more transactions to verify as well?
  - Zarath 9y ago
    Yes, but I think what parent was pointing out was that an honest network user has no reason to do so.
AgentME 9y ago
Heh, this article barely even touches on the full insanity of IOTA. https://medium.com/@neha/cryptographic-vulnerabilities-in-iota-9a6a9ddc4367 https://medium.com/@neha/cryptographic-vulnerabilities-in-io... has a decent rundown on some of it. It's centralized on a central coordinator because it fundamentally can't work in a decentralized manner. It used a homebrew hash function that was vulnerable to trivial attacks. It uses ternary math just-because of some extremely doubtful efficiency claims for a lot of things, including the mentioned hash function. (Some fun not mentioned in the article: They later replaced the homebrew hash function with SHA-3 ... wrapped in ternary.) Also, it's centralized. That means it has the downsides of a centralized service (entirely halts if the central authority server has connectivity issues, including from DDOS attacks, or if the company ever decides it's not worth it to keep running; central authority could also censor transactions) without any of the upsides of a centralized service (centralized service could work with dollars instead of an artificial currency; centralized services don't need to broadcast transactions to the entire network to work; no kind of mining at all needs to exist; basically think Paypal) because it's a weird frankenstein made somewhat in Bitcoin's image. When the obvious vulnerabilities about their homebrew hash function came out, the responses on many cryptocurrency forums were disturbingly cult-like. Plenty criticized the people making the announcement as biased. There were many posts calling out people involved with other cryptocurrencies for spreading FUD because they're supposedly scared of competition from IOTA's "innovation". Apparently no one recognized Bruce Schneier; I saw posts calling him out as a small-time snake oil salesman. I've had at least a half-dozen people try to explain to me how IOTA is paving the way forward with ternary computation, optimizing their software for future ternary hardware. ... Man, if you thought general fandom sites were bad with blind frothing fans, then you should see what it's like when money is involved like this. >My next step was to go to the GitHub repository and take a brief look at the source code. The IOTA source code is written in JAVA instead of C++ like most professional cryptocurrencies are. That did not instill me with confidence. Heh, this is probably the only positive thing about IOTA I'd agree with. Using a memory-safe language like Java makes it exponentially harder for developers to accidentally write remote-code execution vulnerabilities, and makes it harder for malicious developers to hide remote-code execution vulnerabilities. Most cryptocurrencies are in C++ because they're forks of Bitcoin, which so far thankfully seems to have developers that can keep those issues out and review each other's work. (Granted, if IOTA were just a Bitcoin fork, they probably wouldn't have gone through the effort of making so many insane design choices of their own.)
steve_taylor 9y ago
> RULE 3: ALWAYS wait for a transaction to be confirmed before sending anything else. > Rule #3 is just another admission of a broken network. Really not much else to say. It sounds like an admission of vulnerability to double-spending.
- nebulous1 9y ago
  Not really. This isn't an actual vulnerability of the network to double spending, it's just a wallet (or wallets) issuing multiple transactions for the same coin (he may actually just mean the same address rather than the same coin, so that you don't come a cropper of the private key issue). This is possible in pretty much all cryptocurrencies, and their mechanisms for dealing with it (ie only honouring one of the transactions) is one for the core functions of any cryptocurrency.
  - nebulous1 9y ago
    Perhaps the downvoters can explain why that isn't the case.
chvid 9y ago
Honestly this article tells more about crypto currency investors in general than about this particular crypto currency.
tasubotadas 9y ago
>The IOTA source code is written in JAVA instead of C++ like most professional cryptocurrencies are. That did not instill me with confidence. This made me lose any confidence in a person's capabilities in evaluating the coin. If anything, Java is way more (or any language with modern memory management) robust choice than C++ where security is concerned. In any case, I am highly skeptical of the IOTA as well.
- planetjones 9y ago
  Me too. He may well have valid points but, as someone who has written mission critical software systems in Java, this destroys the credibility of the article for me.
  - acoye 9y ago
    He may be biased, but you may be too. Are you a Java developer (or android)? That said, I know some great software can be produced in Java, ElasticSearch been one on top of my mind. If Security is the goal, nor CPP nor Java is great. Proven Haskell or Rust might be more of a valid option.
    - seanwilson 9y ago
      I wonder if something like OCaml would be a good choice. It's a safe language with good performance plus it gives you an easier route to formally verify the important parts of it. Cross platform is going to be trickier though.
      - chrisco255 9y ago
        That's what Texas is supposed to use but it's wrapped up in lawsuits at the moment.
        chrisco255 9y ago
        Tezos, not Texas, auto correct...
DyslexicAtheist 9y ago
I've been tracking the IOTA controversy in the LinkedIn 'IoT Security' group in this thread[¹]. The centralized nature of the technology is a worry especially because they position themselves as a decentralized solution for IoT. Many other currencies suffer from implementation problems (buggy wallets, etc) but at least in BTC the used cryptography is well tested. In IOTA's case they managed to both reinvented the crypto (e.g. "Curl" / "Kerl" hashes) in a broken way AND made some very dangerous assumptions in the meaning of "decentralization". [¹] https://www.linkedin.com/groups/4807429/4807429-6344511215041015812 https://www.linkedin.com/groups/4807429/4807429-634451121504...
hmexx 9y ago
What about the other DAG technologies like the one used by ByteBall? I’m not crypto-intelligent enough to analyze them but could DAG be a credible replacement for the blockchain? Iota is just a very well marketed option in that space. Their execution seems shoddy.
- sdwisely 9y ago
  disclaimer: I own some of these so I'm not without some bias. Thus far I've been pretty impressed with Raiblocks (XRB). Near instant (1-5 seconds depending on the wallet in my tests so far) and fee-less. I'm pretty keen to check out the other DAG projects after this one.
  - rileyphone 9y ago
    The whitepaper (https://raiblocks.net/media/RaiBlocks_Whitepaper__English.pdf https://raiblocks.net/media/RaiBlocks_Whitepaper__English.pd...) is actually very readable, I really like it. Too bad it's almost impossible to buy right now.
    - wrinkl3 9y ago
      The author is also a LLVM engineer who's worked for Qualcomm, Dell and AMD.
- junk_f00d 9y ago
  I love ByteBall, but also likely the required crypto intelligence. But AFAIK they are a relatively mature DAG tech, with oracles and smart contracts already working (P2P UFC betting being a relatively popular example). XRB is another promising DAG tech (which I currently own), as mentioned. I suggest you look into both if you're interested. I'm big on DAG tech as I see it being the only form of crypto currency that I can buy my coffee with, without waiting so long for confirmation that it isn't worth it. Whether it can be a suitable replacement to blockchain though I don't know, it may be an apples to oysters type of comparison and one may have strengths where the other has weaknesses.
cromwellian 9y ago
Why do people persist in the idea that a deliberately deflationary currency is a good idea. It might be a good investment, but as a currency, it doesn't promote commerce and trade, it just promotes hoarding. Much of crypto-currency holders today either seem to be people seeking to get in at the top of the ponzi pyramid and sell before collapse, or people who need to avoid some legal issue, be it capital controls, drug laws, etc. Many people are using it as an investment vehicle mainly, and rarely as a exchange of value mechanism for payments, except where they actually need to. But would pay Uber with BTC, or buy a coffee? Why? if you simply way a few days, you'll make a lot more money not spending it. A deflationary currency to replace fiat currency or centralized banking and credit seems like a contradiction. I mean, if my cash is growing at 10%-1000%, but my Visa fee is 3%, and my inflated USD is 2% inflation, I'm gonna go with the fiat currency or Visa fee.
- homakov 9y ago
  The problem is not just deflation but uncontrolled issuance. Ie miners produce too much or too little coins to keep them stable.
  - sunshinerag 9y ago
    Is this for IOTA? As far as bitcoin is concerned the coin issuance is built into the protocol and there is no case of too much or too less.
- kybernetikos 9y ago
  There's a game theory problem which is that if you have a choice of cryptocurrencies at an early stage to play with, and you think they have a similar chance of success, it makes sense to invest in the cryptocurrencies with a limited supply. The fact that this will make them bad in the long run as a medium of exchange is not of interest to the early stage speculator.
  - victor106 9y ago
    > The crypto-currency crowd has this libertarian streak I wish they did. Unfortunately the buyers who owned bitcoin the past few years are all in just coz the price is growing up. They are not in bacause the believe in anything.
AJRF 9y ago
The new UCL wallet is even worse. It’s supposed to be launched within the next few weeks. It made me lose $2000 worth of iota because of a loop in the code that resent transactions if you put the app in a background state. You know, a violation of the one canonical rule of using iota, I.e reusing an address. The iota foundation is a nefarious and bad intentioned bunch of crooks.
- sansteep 9y ago
  You lost $2000 with the UCL wallet? How did you do that if the wallet hasn't even been launched yet? Were you dumb enough to put $2000 into a beta wallet? Then I'd say you deserved it.
- degif 9y ago
  One of the developers for the UCL wallet here. Can you elaborate more on how did you lose money using a wallet that is not released publicly yet and is available only for a closed group of alpha testers who all have been instructed not to use the wallet with their accounts holding significant amount of iotas?
  - weiland 9y ago
    Lol, of course he can't elaborate. He's a troll. HN has really gone down the drain in the past couple years.
- jackstraw14 9y ago
  So then it goes without saying that you reported this bug, before calling people nefarious, bad-intentioned crooks?
- vinnymac 9y ago
  Why would you use a wallet that is in active development and has an alpha group working on finding bugs and huge issues like this with your REAL seed/account? This sounds like either you were tricked into using this wallet because someone said you would be better off, or you just went against all the warnings the devs have repeatedly made.
- 9y ago
hidiegomariani 9y ago
I can just totally agree with the author. I had more or less the same experience. IOTA is totally immature in terms of development, technology and PR (see fake partnerships and absence of public statement for the network status). Apart from this it just look like a nice and interesting white paper but that does not actually work in reality yet
- sansteep 9y ago
  I'm loving all you people's overblown emotional reactios to the "fake partnerships". Please keep selling your IOTA so I can buy them ever cheaper. I guarantee you'll be kicking yourself in 5 years time.
fiatjaf 9y ago
These days it's absolutely impossible to get any serious conversation about any of these cryptocurrencies. Maybe you can do something with Bitcoin and Ethereum, but for any of the others all the foruns and chats are just flooded with crazy people.
- pimeys 9y ago
  Tell me about it. I need to follow the tech and communities as part of my job, and sometimes it's seriously hard to have any discussions e.g. in IOTA's Slack channels. On the contrary, Monero uses IRC for their communication and maybe because of that I've seen more adult discussions in their community. Of course lots of money being on the table, things can get pretty sour everywhere.
  - Gargoyle 9y ago
    It's a shame, quality conversation can help a coin project in the long run. But it's clear that right now IOTA is in the pump-or-you're-a-fud-shill phase and communication is impossible.
    - degif 9y ago
      Communication is possible if you talk to the right people. Keep in mind that the people who are actually working on the technology itself or it's adaptation and implementation are not hanging all day around on reddit or #speculation channels. I'm running an iota network statistics page, so people assume i'm more educated about iota and I receive clarification, technological or simple development questions on Slack on daily basis. I do answer all of them as best as I can, a lot of them have been evolved in pretty long discussions and I have received the same attitude from other iota community members.
knocte 9y ago
While I agree with the majority of the criticisms of this post (I also posted a criticism here[1]), one has to recognise that it's perfectly possible that a cryptocurrency requires no-address-reuse. This may not be a bug but a limitation which is a consequence of its design. I know other cryptocurrency that suffers this problem: Mimblewimble. But I sincerely hope the wallet developers of mimblewimble are smarter enough to never expose addresses, in order to prevent the user to make this mistake (yes, it can be done requiring QR-code-pairing everytime you want to both send and receive funds). To finish, let me state that I'm not defending IOTA, which I still think is a joke. Maybe I'm wrong but I cannot tell if I'm wrong or not until they shut down the coordinators (the very thing that makes IOTA centralised). [1] https://news.ycombinator.com/item?id=15860046 https://news.ycombinator.com/item?id=15860046
- tromp 9y ago
  Mimblewimble doesn't have addresses [1] [1] https://github.com/ignopeverell/grin/blob/master/doc/grin4bitcoiners.md https://github.com/ignopeverell/grin/blob/master/doc/grin4bi...
  - knocte 9y ago
    Well, see? mimblewimble developers hid this characteristic in a "no addresses" fashion, because they are smarter than IOTA devs. When they say "transactions have to be built interactively, with 2 (or more) wallets exchanging data with one another" this is what I meant when I mentioned QR codes for every amount reception/sending.
chris_wot 9y ago
From the white paper: “As a transaction receives additional approvals, it is accepted by the system with a higher level of confidence. In other words, it will be difficult to make the system accept a double-spending transaction. It is important to observe that we do not impose any rules for choosing which transactions a node will approve. Instead, we argue that if a large number of nodes follow some “reference” rule, then for any fixed node it is better to stick to a rule of the same kind4. This seems to be a reasonable assumption, especially in the context of IoT, where nodes are specialized chips with pre-installed firmware.” Is this for real?
syllogism 9y ago
Maybe the best strategy for designing a cryptocurrency today is actually to make it really stupid? It's kind of like the scam logic, where you only want to get good marks in the door from the start. If your cryptocurrency is really stupid, then only the true believers buy in, and then they all hodl. You don't want anyone too influential, and you definitely don't want people to say "okay I was tricked, I fodl".
- deleted 9y ago
  [deleted]
jondubois 9y ago
I think that there are still problems with the algorithm. The tangle was in a bad shape a few days ago and I considered selling my IOTA but I decided to hold because based on my understanding of how the tangle works, these problems are fixable. Until I find something fundamentally wrong with the idea of the tangle, I'm going to hold.
ricardobeat 9y ago
> as if this was a JavaScript some 12 year old was writing for his homebrew website. Who can tell the difference? > Look, let's be very clear. IOTA is a live cryptocurrency with a market cap in the billions of dollars. Real people have large amounts of value tied up on that network. It is hosted on several exchanges. This is a naive misconception, and one of the most dangerous aspects of cryptocurrencies right now - these are NOT FINANCIAL ENTITIES, there are no bank guarantees or fiduciary rules, no technical standards or oversight, no clear liability (especially when authors/network owners may just be virtual characters). There is 100% risk involved and nobody to blame but yourself.
- TFortunato 9y ago
  I'm missing what the misconception is in this quote? I don't see him saying they are regulated / guarenteed or anything like that, only that people have poured a stupid amount of money into this thing.
  - ricardobeat 9y ago
    He implies that being “live” with “real money” and a billion dollar market cap means something. It doesn’t. He says: “You do not release financial software to the general public in such a buggy state. You do not blame the victims for your software failing to function.” When in fact, you do _whatever the hell you want_. This is not “financial software” in the original sense. The fact that people put significant amounts of cash in these altcoins is astounding. You only have [some] guarantees where the system itself enforces them, like BitCoin, and even then no one entity is liable for your losses because of de-centralization. I own bits of four cryptocurrencies, and take the risk of 100% loss as a real possibility.
    - nebulous1 9y ago
      There's still no misconception, and you can't redefine "financial software" on the fly. He didn't state anything about there being a regulation against it, he's just implying an ethical "can't release in a buggy state". I'm not sure why you're arguing with him though, you seem to be in agreement!
jayjay13 9y ago
the recent network issues are really annoying but if you run your own full node tx are confirmed in max 20min. something that should be kept in mind IOTA is in early beta and was always promoted as that. when people start to pump it and without reading an announcement right, why should that be iotas fault? and about the usability of iota, when have you started with cryptos? go back to 2011 and look for a good usable wallet (hint: you won't find anything). iri is a reference implementation a C and Rust Version is in developement. IOTA is clearly about to proof that their protocol works, here some brain food: https://arxiv.org/pdf/1712.05385.pdf https://arxiv.org/pdf/1712.05385.pdf
- tfha 9y ago
  They are about to prove their network works after making unreasonable assumptions as prerequisites to the proof.
  - jayjay13 9y ago
    can you spot me to this unreasonable assumptions?
unholywars 9y ago
My god. So many amateurs commenting on this. Whoever wrote this has no idea that IOTA has been planning from the beginning to write both a C++ and a Rust implementation of the IRI, so his Java argument is already invalid. Do you guys even know who writes the IOTA code? Do you guys even know what Proof-of-stake is? Dear lord. Please keep selling your iotas so I can buy them real cheap.
xg15 9y ago
Pardon for off-topic, but the arguments he makes about double-spending (the third "rule" from that linked forum post) made me realize I have some gaps in my understanding how Bitcoin handles overlapping transactions. Suppose I have an address with 0BTC balance. (i.e. I have the private key of it on my PC. There isn't yet anything about that address in the blockchain.) Some other person sends 100mBTC to that address. I can see that the transaction has spread through the network but it hasn't been added to a block yet. Because I'm overly trusting and/or in a hurry, I don't wait until it's confirmed but I immediately send another transaction that sends the 100mBTC to some other account. If a miner first picked transaction #1, added it to a block, then added transaction #2 to the following block, both transactions would be valid. However if a miner tried to process transaction #2 first, it would be invalid. So what would happen? Would miners bring the transactions into correct order and validate both, only validate #1 and reject #2 or reject both?
- izzle49 9y ago
  I could be wrong but I thought miners were always in sync, miners are effectively writers to the ledger and single threaded. They all mine the same transactions in the same order. The first to find the hash with correct difficulty gets the block, which triggers the other miners to stop and verify. Once verified the new block becomes the seed for the next block. So the first transaction will always be processed before the second transaction. The second transaction would be committed as long as you had enough balance remaining after the first transaction.
  - rane 9y ago
    Not true. Each miner may choose by whatever logic which transactions to include in the block they are mining. They are however are likely to prefer those which pay higher fee.
- kochthesecond 9y ago
  This is not an issue in bitcoin. #2 is never valid until #1 has commited, so #2 would not be included in any block.
- deleted 9y ago
rootsudo 9y ago
I went to the IOTA meetup in Chicago, which was hosted and presented by the IOTA team. Never before did I see an entire audience be wowed by a women engineer. They ignored the whole Microsoft partnership idea; anyone that asked just was given the answer "it'd be explained in a future PR release." The drama was IOTA lied about microsoft partnership and deemed hosting on azure == partnership with microsoft. In talks with different microsoft teams == sending support tickets on azure for different services.
- doktrin 9y ago
  > The drama was IOTA lied about microsoft partnership and deemed hosting on azure == partnership with microsoft I wonder if this is a recurring theme in "crypto". At one point I followed NEO, and they pulled the exact same stunt.
- jackstraw14 9y ago
  Microsoft claimed the partnership with IOTA -- not the other way around: https://blog.iota.org/iotas-data-marketplace-setting-the-record-straight-576fbf0b4513 https://blog.iota.org/iotas-data-marketplace-setting-the-rec... The quote that set off this confusion: > We are excited to partner with IOTA foundation and proud to be associated with its new data marketplace initiative. This next generation technology will accelerate the connected, intelligent world and go beyond blockchain that will foster innovation real world solutions, applications and pilots for our customers. --Omkar Naik, Microsoft
  - watoc 9y ago
    It's difficult to trust that Microsoft claimed it when you only provide a link to iota website.
    - jackstraw14 9y ago
      IOTA made the announcement on their official blog, so as far as I know it's the source. If you're saying you don't trust the devs, then I guess we're talking about something different than I thought. Here's the quote from the Microsoft guy involved, that caused the confusion: > We are excited to partner with IOTA foundation and proud to be associated with its new data marketplace initiative. This next generation technology will accelerate the connected, intelligent world and go beyond blockchain that will foster innovation real world solutions, applications and pilots for our customers. --Omkar Naik
dangero 9y ago
I also recently wrote an article about IOTA and got a crowd of negative flak. https://medium.com/@thedrbits/why-i-also-find-iota-deeply-alarming-99d4f2da3282 https://medium.com/@thedrbits/why-i-also-find-iota-deeply-al...
- wslh 9y ago
  There is an army of trolls connected to IOTA. You can find them very easily because they cannot defend their position. Here in HN there are plenty also.
- jackstraw14 9y ago
  > So… Your response to why I’m wrong is that you’re going to change everything in the future? Well, you got a reply from Come-from-Beyond who wrote the damn thing. You've got some attention from the developer and you couldn't handle your emotions, so I'm not sure what your angle is here. Do you mind if I ask, why didn't you engage them and evaluate your own understanding? Why did you resort to a snarky one liner?
wyldfire 9y ago
Bruce Schneier had this to say about IOTA: > In 2017, leaving your crypto algorithm vulnerable to differential cryptanalysis is a rookie mistake. It says that no one of any calibre analyzed their system, and that the odds that their fix makes the system secure is low
- Ballie 9y ago
  How is it vulnerable to differential analysis?
  - nhooyr 9y ago
    Google "MIT finds vulnerability in IOTA".
andr 9y ago
It's pretty understandable that fanboys are badgering skeptics on social networks. If I had a few hundred thousand pop out of the blue from a cryptocurrency fad, maybe I would be doing it as well. And that's a big problem, because mainstream journalists are guilty of that as well. MIT Technology Review, to pick one example, wrote an article about IOTA, mentioning their partnerships with mainstream companies, even though IOTA refuted the partnership notion the same day. Clearly, the author didn't reach out to any of those companies for confirmation. I can't help but think that many of those articles are written by people, influenced by their own cryptocurrency assets. In fact, this conflict of interest for journalists could be one of the key driving forces of the bubble.
nadam 9y ago
IOTA is the only big cryptocurrency that seems extremely fishy to me. The trick is that even a fairly technical person (like me) cannot easily refute it based on the whitepaper, because the whitepaper is intentionally indecipherable, and does not have enough information to evaluate the project anyway. The average person sees such a whitepaper, and is amazed by the complicated scientific formulas. A good engineer/scientist on the other hand gets uneasy about it I think. I don't understand how a huge network of full nodes, nodes which are small indusrtrial devices can scalably reach consensus in a fast way. Even storing the full state is impossible, not to speak about history. It is independnet on whether we use the DAG or blockchain. That is why scalability plans on other networks go into the direction of sharding, or have a smaller number of powerful nodes, or use layer 2, etc... Crypto communities fight each other (BTC vs. BCASH, DASH vs. Monero, Ethereum vs. EOS) but these are all serious projects. The whole community should speak up about IOTA instead.
- CyberDildonics 9y ago
  What is BCASH? Do you mean Bitcoin Cash?
  - nadam 9y ago
    Yes.
  - Roger_Ver 9y ago
    Stop calling it BCASH. I find that insulting.
- JohnJamesRambo 9y ago
  We try but there is an army of IOTA shills that drown us out.
  - amenod 9y ago
    Interesting... My first reaction to your post was "meh - surely he's exagerrating". But reading other replies to GP that were posted later made me reconsider. Very unconstructive replies, trying to bully the well articulated opinion... I have never seen anything like it on HN (though that's just my observation of course, maybe I was just lucky). Do you think the people behind this are truly convinced of their cause or are they paid "web-fighters"?
wslh 9y ago
BTW, administrative issues: I wonder why my previous post with the same link less than 1 day ago was not reused for this thread https://news.ycombinator.com/item?id=15935601 https://news.ycombinator.com/item?id=15935601 is this a HN bug? Just today I tried to post an article already posted three days ago and I was directed to the first post thread.
- watoc 9y ago
  There is a query parameter "m=1" at the end of this URL. I guess that's why it wasn't marked as duplicate.
  - wslh 9y ago
    That is a HN bug since the canonical page is without that suffix: <link href='http://codesuppository.blogspot.com/2017/12/iota-tangled-mess.html' rel='canonical'/>
JonasJSchreiber 9y ago
Great post, I was wondering why transactions were disabled to binance...appreciate the info. And the warnings.
mcguire 9y ago
"IOTA is deflationary (has a fixed number of tokens, there will never be any more, and has no inflation at all, no issuance schedule for new tokens). All tokens which will ever exist were created on day one and pre-distributed to people who signed onto the project very early." Yeah, I'd push that pretty hard, too.
It3ration 9y ago
This guy is blaming the Iota founders because he doesn't understand computer science? Their whitepaper is organized like any other publication in computer science. As for the Java vs C++ comment, he's simply uninformed. Not to mention there are many ports in various languages. I wish he'd done some research before posting bogus rhetoric.
deleted 9y ago
[deleted]
cjhanks 9y ago
This is possibly the best bug report of all time. https://github.com/iotaledger/wallet/issues/762 https://github.com/iotaledger/wallet/issues/762
mycall 9y ago
> You do not release financial software to the general public in such a buggy state and there it is, the inherent confusion between public expectations and programmers WRT cryptocurrencies.
incredimike 9y ago
Where did this post go? Did the author get a takedown?
- forvelin 9y ago
  I am also curious about that...
deleted 9y ago
[deleted]

353 points by wglb 9y ago

IOTA wallet is full of really bad bugs, just look how bad it is on first pages, the more pages you skip, the worse it is. It still doesn't work on Linux, for many users wallet crashes or shows green screen and nothing more. Doesn't work through Wine either. https://github.com/iotaledger/wallet/issues https://github.com/iotaledger/wallet/issues Issues on github have no responses from developers since early November and there were no commits since than, what's surprising, there were a lot of blog posts on their domain and many subreddits how great they are (!!??) BitFinex two week ago had problems paying out IOTAs, payouts were cancelled without any reason. Didn't try again since that time. A lot of domains explaining how to buy IOTA look dodgy, like they were made by 14yo in '90s. There are dozens of domains like supportiota, forumiota, iotasupport.com, howtobuyiota.co.uk ? Why do they all exist and duplicate content? Watch out out there.

cjhanks 9y ago
I have never seen a GitHub issues page quite like that. Pages and pages of issues ranging from; "Somebody stole thousands of dollars from me" to "My money is stuck and I can't get it out".
- tfha 9y ago
  I've also read that the devs have seized funds from users. Specifically, if you use the same address twice in IOTA (extremely common habit in cryptocurrency), you reveal your secret key, and the devs will take your money. Among many other wallet related issues.
  - jackstraw14 9y ago
    Citation for your claim? The story I've read is that the IOTA Foundation will hold your funds so you can reclaim them.
    - Rarebox 9y ago
      The system is clearly not decentralized, if one organization can hold your funds for "misbehavior".
      - SAI_Peregrinus 9y ago
        The idea that they'd let you reclaim your funds is also ridiculous. Your private key was compromised, they have no way to identify you.
  - markatkinson 9y ago
    This is radically inaccurate. If you send from an address, trash that address and never use it again. You can receive to an address as many times as you want but once you send from it you gotta move to a new address. The desktop wallet does this automatically so no need to worry about doing it yourself.
  - drewm1980 9y ago
    "All tokens which will ever exist were created on day one and pre-distributed to people who signed onto the project very early." It sounds to me like they are pretty up front about their intention to take all of your money. That is how they started. Same for Bitcoin, only Bitcoin hides it behind a schedule of mining fees so it is more Ponzi scheme while this is more television priest.
jayjay13 9y ago
As far as I know there are no bugs in the wallet it's just not completly self explaining. tbh from my view there are just the wrong people in the whole space... 95% of the people are here to get rich quick and not for the developement and it's excatly these people who have problems with Key reuses and so on.. the people have to do their research in such a young space..
- zaphar 9y ago
  If your software is expected to have bugs then you shouldn't allow people to put money in it. You should be setting the expectation that the chain will get regular resets while you work out the kinks. You should be discouraging exchanges at every opportunity and shouting loudly at the world not to put money in your alpha release software. It doesn't appear that IOTA is doing any of those things.
- akerro 9y ago
  >95% of the people are here to get rich quick and not for the developement You're saying that application and developers came completely unprepared for the market?
  - jackstraw14 9y ago
    No, the market was unprepared for an application that is still in alpha.
    - ultraluminous 9y ago
      Still in alpha but accepts real-money deposits in the tens of thousands. I think the market was unprepared for anyone being that brazen.
      - jackstraw14 9y ago
        Who is accepting deposits, and why tens of thousands? Real money is deposited into exchange accounts to buy crypto assets. No one is making fiat deposits into an IOTA organization. You should examine your reality if you think developers of alpha software have any obligation to provide non-technical folks with a way to use it. It's open source, nothing is stopping you from building your own wallet if you want something better. But they don't owe you anything on the basis of the protocol simply existing. Ask yourself, why do you expect that?
jackstraw14 9y ago
> It still doesn't work on Linux What are you talking about? I haven't used the wallet on anything but Linux, and I've had no problems.
- akerro 9y ago
  https://github.com/iotaledger/wallet/issues/631 https://github.com/iotaledger/wallet/issues/631 https://github.com/iotaledger/wallet/issues/577 https://github.com/iotaledger/wallet/issues/577 https://github.com/iotaledger/wallet/issues/511 https://github.com/iotaledger/wallet/issues/511 https://github.com/iotaledger/wallet/issues/416 https://github.com/iotaledger/wallet/issues/416

bsamuels 9y ago

why would you dump $2,000 dollars into a crypto coin you don't understand

yorwba 9y ago
Because you don't understand any crypto coin, but know or have heard of people who have dumped large sums into some coin and brag about their returns, so you want in on the gold rush. FOMO, essentially.
- dahdum 9y ago
  Let's be fair, the author did do more research than 95% of other investors before buying...
  - matthewbauer 9y ago
    True but he’s still playing with fire. No one knows when the bull market will dry up but lots of people will end up losing money.
    - patrickaljord 9y ago
      He's not playing with fire if he invested what he can afford to lose, he's just having fun like people do when they bet on horses or similar gambling (as longs as it's done responsibly obviously).
kogepathic 9y ago
The author dumped a lot more than $2,000 into IOTA. They mention buying 26,000MI at $0.85, which would be a $22,100 investment. Just 5,600MI was worth $28,000 at $5/MI. Why anyone would put that amount into a cryptocurrency they don't find trustworthy is beyond me.
- dmichulke 9y ago
  > Why anyone would put that amount into a cryptocurrency they don't find trustworthy is beyond me. The richer you are, the more likely you'll consider 5k small change. Same reason why the big bet poker tables have non-experts sitting there.

matthewbauer 9y ago

The post mentions the psychology today article but I’d like to say it’s actually a pretty okay article: https://www.psychologytoday.com/blog/mind-in-the-machine/201712/how-fear-is-being-used-manipulate-cryptocurrency-markets https://www.psychologytoday.com/blog/mind-in-the-machine/201... (Author should disclose if he owns IOTA however)

jeffwass 9y ago
That's an interesting article into the psychology and mind-tactics of crypto fans. Not sure why you've been downvoted but the article is worth a look.
- zik 9y ago
  The article does make some good points but it also comes over as a fluff piece for IOTA while tiptoeing around all IOTA's serious issues and implicitly labelling any criticism as "FUD".
- jackstraw14 9y ago
  I think this is so much more interesting than all the yelling about these currencies that are not even being used like currencies. Why do people feel so personally and emotionally invested? I mean here in this thread l’m running around trying to correct toxic misinformation, but what’s making me doing that? And what’s making the guy who brought up Cardano casually mention the rankings on coinmarketcap as if that means anything except to instill FOMO. I hope we see more articles on the psychology and sociology behind fear cycles in crypto.
aaronm14 9y ago
Thanks for highlighting this, I'm going to share with all of my friends investing/thinking of investing in the crypto space. Always good to get a reminder to take everything you read with a grain of salt. Also rarely get to see these almost short-term post-mortems, which give the (seemingly) whole picture of what happened with the price increase and following decrease.

runeks 9y ago

As I understand it, the problem with IOTA is that — in order to execute an attack — attackers just need to verify more transactions than all honest participants combined. So, in other words, honest participants have no incentive to verify more transactions than required (because they don’t profit from it) while attackers have an incentive to verify more transactions, in order to successfully double spend.

sandGorgon 9y ago
And to deal with this problem, they have "trusted supernodes", with a promise to turn them off when the network is self sustaining. It introduces a high degree of centralisation - and we don't know the how network shapes up as a consequence. And the second problem is obviously the unaudited,"quantum resistant" function.
- kbwt 9y ago
  > And the second problem is obviously the unaudited,"quantum resistant" function. Don't forget the ternary SHA-3.
- runeks 9y ago
  > And to deal with this problem, they have "trusted supernodes", with a promise to turn them off when the network is self sustaining. I don’t see how the network can ever become self-sustaining if attackers only need to create more transactions than everyone else combined. Sure, as usage increases, the number of transactions an attacker would need to produce increases as well, but so does the attacker’s potential reward — since there will be more IOTA users against which he can double spend.
seanwilson 9y ago
Could an attacker not create lots of transactions between wallets they own so the attacker is given more transactions to verify as well?
- Zarath 9y ago
  Yes, but I think what parent was pointing out was that an honest network user has no reason to do so.

AgentME 9y ago

Heh, this article barely even touches on the full insanity of IOTA. https://medium.com/@neha/cryptographic-vulnerabilities-in-iota-9a6a9ddc4367 https://medium.com/@neha/cryptographic-vulnerabilities-in-io... has a decent rundown on some of it. It's centralized on a central coordinator because it fundamentally can't work in a decentralized manner. It used a homebrew hash function that was vulnerable to trivial attacks. It uses ternary math just-because of some extremely doubtful efficiency claims for a lot of things, including the mentioned hash function. (Some fun not mentioned in the article: They later replaced the homebrew hash function with SHA-3 ... wrapped in ternary.) Also, it's centralized. That means it has the downsides of a centralized service (entirely halts if the central authority server has connectivity issues, including from DDOS attacks, or if the company ever decides it's not worth it to keep running; central authority could also censor transactions) without any of the upsides of a centralized service (centralized service could work with dollars instead of an artificial currency; centralized services don't need to broadcast transactions to the entire network to work; no kind of mining at all needs to exist; basically think Paypal) because it's a weird frankenstein made somewhat in Bitcoin's image. When the obvious vulnerabilities about their homebrew hash function came out, the responses on many cryptocurrency forums were disturbingly cult-like. Plenty criticized the people making the announcement as biased. There were many posts calling out people involved with other cryptocurrencies for spreading FUD because they're supposedly scared of competition from IOTA's "innovation". Apparently no one recognized Bruce Schneier; I saw posts calling him out as a small-time snake oil salesman. I've had at least a half-dozen people try to explain to me how IOTA is paving the way forward with ternary computation, optimizing their software for future ternary hardware. ... Man, if you thought general fandom sites were bad with blind frothing fans, then you should see what it's like when money is involved like this. >My next step was to go to the GitHub repository and take a brief look at the source code. The IOTA source code is written in JAVA instead of C++ like most professional cryptocurrencies are. That did not instill me with confidence. Heh, this is probably the only positive thing about IOTA I'd agree with. Using a memory-safe language like Java makes it exponentially harder for developers to accidentally write remote-code execution vulnerabilities, and makes it harder for malicious developers to hide remote-code execution vulnerabilities. Most cryptocurrencies are in C++ because they're forks of Bitcoin, which so far thankfully seems to have developers that can keep those issues out and review each other's work. (Granted, if IOTA were just a Bitcoin fork, they probably wouldn't have gone through the effort of making so many insane design choices of their own.)

steve_taylor 9y ago

> RULE 3: ALWAYS wait for a transaction to be confirmed before sending anything else. > Rule #3 is just another admission of a broken network. Really not much else to say. It sounds like an admission of vulnerability to double-spending.

nebulous1 9y ago
Not really. This isn't an actual vulnerability of the network to double spending, it's just a wallet (or wallets) issuing multiple transactions for the same coin (he may actually just mean the same address rather than the same coin, so that you don't come a cropper of the private key issue). This is possible in pretty much all cryptocurrencies, and their mechanisms for dealing with it (ie only honouring one of the transactions) is one for the core functions of any cryptocurrency.
- nebulous1 9y ago
  Perhaps the downvoters can explain why that isn't the case.

chvid 9y ago

Honestly this article tells more about crypto currency investors in general than about this particular crypto currency.

tasubotadas 9y ago

>The IOTA source code is written in JAVA instead of C++ like most professional cryptocurrencies are. That did not instill me with confidence. This made me lose any confidence in a person's capabilities in evaluating the coin. If anything, Java is way more (or any language with modern memory management) robust choice than C++ where security is concerned. In any case, I am highly skeptical of the IOTA as well.

planetjones 9y ago
Me too. He may well have valid points but, as someone who has written mission critical software systems in Java, this destroys the credibility of the article for me.
- acoye 9y ago
  He may be biased, but you may be too. Are you a Java developer (or android)? That said, I know some great software can be produced in Java, ElasticSearch been one on top of my mind. If Security is the goal, nor CPP nor Java is great. Proven Haskell or Rust might be more of a valid option.
  - seanwilson 9y ago
    I wonder if something like OCaml would be a good choice. It's a safe language with good performance plus it gives you an easier route to formally verify the important parts of it. Cross platform is going to be trickier though.
    - chrisco255 9y ago
      That's what Texas is supposed to use but it's wrapped up in lawsuits at the moment.
      - chrisco255 9y ago
        Tezos, not Texas, auto correct...

DyslexicAtheist 9y ago

I've been tracking the IOTA controversy in the LinkedIn 'IoT Security' group in this thread[¹]. The centralized nature of the technology is a worry especially because they position themselves as a decentralized solution for IoT. Many other currencies suffer from implementation problems (buggy wallets, etc) but at least in BTC the used cryptography is well tested. In IOTA's case they managed to both reinvented the crypto (e.g. "Curl" / "Kerl" hashes) in a broken way AND made some very dangerous assumptions in the meaning of "decentralization". [¹] https://www.linkedin.com/groups/4807429/4807429-6344511215041015812 https://www.linkedin.com/groups/4807429/4807429-634451121504...

hmexx 9y ago

What about the other DAG technologies like the one used by ByteBall? I’m not crypto-intelligent enough to analyze them but could DAG be a credible replacement for the blockchain? Iota is just a very well marketed option in that space. Their execution seems shoddy.

sdwisely 9y ago
disclaimer: I own some of these so I'm not without some bias. Thus far I've been pretty impressed with Raiblocks (XRB). Near instant (1-5 seconds depending on the wallet in my tests so far) and fee-less. I'm pretty keen to check out the other DAG projects after this one.
- rileyphone 9y ago
  The whitepaper (https://raiblocks.net/media/RaiBlocks_Whitepaper__English.pdf https://raiblocks.net/media/RaiBlocks_Whitepaper__English.pd...) is actually very readable, I really like it. Too bad it's almost impossible to buy right now.
  - wrinkl3 9y ago
    The author is also a LLVM engineer who's worked for Qualcomm, Dell and AMD.
junk_f00d 9y ago
I love ByteBall, but also likely the required crypto intelligence. But AFAIK they are a relatively mature DAG tech, with oracles and smart contracts already working (P2P UFC betting being a relatively popular example). XRB is another promising DAG tech (which I currently own), as mentioned. I suggest you look into both if you're interested. I'm big on DAG tech as I see it being the only form of crypto currency that I can buy my coffee with, without waiting so long for confirmation that it isn't worth it. Whether it can be a suitable replacement to blockchain though I don't know, it may be an apples to oysters type of comparison and one may have strengths where the other has weaknesses.

cromwellian 9y ago

Why do people persist in the idea that a deliberately deflationary currency is a good idea. It might be a good investment, but as a currency, it doesn't promote commerce and trade, it just promotes hoarding. Much of crypto-currency holders today either seem to be people seeking to get in at the top of the ponzi pyramid and sell before collapse, or people who need to avoid some legal issue, be it capital controls, drug laws, etc. Many people are using it as an investment vehicle mainly, and rarely as a exchange of value mechanism for payments, except where they actually need to. But would pay Uber with BTC, or buy a coffee? Why? if you simply way a few days, you'll make a lot more money not spending it. A deflationary currency to replace fiat currency or centralized banking and credit seems like a contradiction. I mean, if my cash is growing at 10%-1000%, but my Visa fee is 3%, and my inflated USD is 2% inflation, I'm gonna go with the fiat currency or Visa fee.

homakov 9y ago
The problem is not just deflation but uncontrolled issuance. Ie miners produce too much or too little coins to keep them stable.
- sunshinerag 9y ago
  Is this for IOTA? As far as bitcoin is concerned the coin issuance is built into the protocol and there is no case of too much or too less.
kybernetikos 9y ago
There's a game theory problem which is that if you have a choice of cryptocurrencies at an early stage to play with, and you think they have a similar chance of success, it makes sense to invest in the cryptocurrencies with a limited supply. The fact that this will make them bad in the long run as a medium of exchange is not of interest to the early stage speculator.
- victor106 9y ago
  > The crypto-currency crowd has this libertarian streak I wish they did. Unfortunately the buyers who owned bitcoin the past few years are all in just coz the price is growing up. They are not in bacause the believe in anything.

AJRF 9y ago

The new UCL wallet is even worse. It’s supposed to be launched within the next few weeks. It made me lose $2000 worth of iota because of a loop in the code that resent transactions if you put the app in a background state. You know, a violation of the one canonical rule of using iota, I.e reusing an address. The iota foundation is a nefarious and bad intentioned bunch of crooks.

sansteep 9y ago
You lost $2000 with the UCL wallet? How did you do that if the wallet hasn't even been launched yet? Were you dumb enough to put $2000 into a beta wallet? Then I'd say you deserved it.
degif 9y ago
One of the developers for the UCL wallet here. Can you elaborate more on how did you lose money using a wallet that is not released publicly yet and is available only for a closed group of alpha testers who all have been instructed not to use the wallet with their accounts holding significant amount of iotas?
- weiland 9y ago
  Lol, of course he can't elaborate. He's a troll. HN has really gone down the drain in the past couple years.
jackstraw14 9y ago
So then it goes without saying that you reported this bug, before calling people nefarious, bad-intentioned crooks?
vinnymac 9y ago
Why would you use a wallet that is in active development and has an alpha group working on finding bugs and huge issues like this with your REAL seed/account? This sounds like either you were tricked into using this wallet because someone said you would be better off, or you just went against all the warnings the devs have repeatedly made.
9y ago

hidiegomariani 9y ago

I can just totally agree with the author. I had more or less the same experience. IOTA is totally immature in terms of development, technology and PR (see fake partnerships and absence of public statement for the network status). Apart from this it just look like a nice and interesting white paper but that does not actually work in reality yet

sansteep 9y ago
I'm loving all you people's overblown emotional reactios to the "fake partnerships". Please keep selling your IOTA so I can buy them ever cheaper. I guarantee you'll be kicking yourself in 5 years time.

fiatjaf 9y ago

These days it's absolutely impossible to get any serious conversation about any of these cryptocurrencies. Maybe you can do something with Bitcoin and Ethereum, but for any of the others all the foruns and chats are just flooded with crazy people.

pimeys 9y ago
Tell me about it. I need to follow the tech and communities as part of my job, and sometimes it's seriously hard to have any discussions e.g. in IOTA's Slack channels. On the contrary, Monero uses IRC for their communication and maybe because of that I've seen more adult discussions in their community. Of course lots of money being on the table, things can get pretty sour everywhere.
- Gargoyle 9y ago
  It's a shame, quality conversation can help a coin project in the long run. But it's clear that right now IOTA is in the pump-or-you're-a-fud-shill phase and communication is impossible.
  - degif 9y ago
    Communication is possible if you talk to the right people. Keep in mind that the people who are actually working on the technology itself or it's adaptation and implementation are not hanging all day around on reddit or #speculation channels. I'm running an iota network statistics page, so people assume i'm more educated about iota and I receive clarification, technological or simple development questions on Slack on daily basis. I do answer all of them as best as I can, a lot of them have been evolved in pretty long discussions and I have received the same attitude from other iota community members.

knocte 9y ago

While I agree with the majority of the criticisms of this post (I also posted a criticism here[1]), one has to recognise that it's perfectly possible that a cryptocurrency requires no-address-reuse. This may not be a bug but a limitation which is a consequence of its design. I know other cryptocurrency that suffers this problem: Mimblewimble. But I sincerely hope the wallet developers of mimblewimble are smarter enough to never expose addresses, in order to prevent the user to make this mistake (yes, it can be done requiring QR-code-pairing everytime you want to both send and receive funds). To finish, let me state that I'm not defending IOTA, which I still think is a joke. Maybe I'm wrong but I cannot tell if I'm wrong or not until they shut down the coordinators (the very thing that makes IOTA centralised). [1] https://news.ycombinator.com/item?id=15860046 https://news.ycombinator.com/item?id=15860046

tromp 9y ago
Mimblewimble doesn't have addresses [1] [1] https://github.com/ignopeverell/grin/blob/master/doc/grin4bitcoiners.md https://github.com/ignopeverell/grin/blob/master/doc/grin4bi...
- knocte 9y ago
  Well, see? mimblewimble developers hid this characteristic in a "no addresses" fashion, because they are smarter than IOTA devs. When they say "transactions have to be built interactively, with 2 (or more) wallets exchanging data with one another" this is what I meant when I mentioned QR codes for every amount reception/sending.

chris_wot 9y ago

From the white paper: “As a transaction receives additional approvals, it is accepted by the system with a higher level of confidence. In other words, it will be difficult to make the system accept a double-spending transaction. It is important to observe that we do not impose any rules for choosing which transactions a node will approve. Instead, we argue that if a large number of nodes follow some “reference” rule, then for any fixed node it is better to stick to a rule of the same kind4. This seems to be a reasonable assumption, especially in the context of IoT, where nodes are specialized chips with pre-installed firmware.” Is this for real?

syllogism 9y ago

Maybe the best strategy for designing a cryptocurrency today is actually to make it really stupid? It's kind of like the scam logic, where you only want to get good marks in the door from the start. If your cryptocurrency is really stupid, then only the true believers buy in, and then they all hodl. You don't want anyone too influential, and you definitely don't want people to say "okay I was tricked, I fodl".

deleted 9y ago
[deleted]

jondubois 9y ago

I think that there are still problems with the algorithm. The tangle was in a bad shape a few days ago and I considered selling my IOTA but I decided to hold because based on my understanding of how the tangle works, these problems are fixable. Until I find something fundamentally wrong with the idea of the tangle, I'm going to hold.

ricardobeat 9y ago

> as if this was a JavaScript some 12 year old was writing for his homebrew website. Who can tell the difference? > Look, let's be very clear. IOTA is a live cryptocurrency with a market cap in the billions of dollars. Real people have large amounts of value tied up on that network. It is hosted on several exchanges. This is a naive misconception, and one of the most dangerous aspects of cryptocurrencies right now - these are NOT FINANCIAL ENTITIES, there are no bank guarantees or fiduciary rules, no technical standards or oversight, no clear liability (especially when authors/network owners may just be virtual characters). There is 100% risk involved and nobody to blame but yourself.

TFortunato 9y ago
I'm missing what the misconception is in this quote? I don't see him saying they are regulated / guarenteed or anything like that, only that people have poured a stupid amount of money into this thing.
- ricardobeat 9y ago
  He implies that being “live” with “real money” and a billion dollar market cap means something. It doesn’t. He says: “You do not release financial software to the general public in such a buggy state. You do not blame the victims for your software failing to function.” When in fact, you do _whatever the hell you want_. This is not “financial software” in the original sense. The fact that people put significant amounts of cash in these altcoins is astounding. You only have [some] guarantees where the system itself enforces them, like BitCoin, and even then no one entity is liable for your losses because of de-centralization. I own bits of four cryptocurrencies, and take the risk of 100% loss as a real possibility.
  - nebulous1 9y ago
    There's still no misconception, and you can't redefine "financial software" on the fly. He didn't state anything about there being a regulation against it, he's just implying an ethical "can't release in a buggy state". I'm not sure why you're arguing with him though, you seem to be in agreement!

jayjay13 9y ago

the recent network issues are really annoying but if you run your own full node tx are confirmed in max 20min. something that should be kept in mind IOTA is in early beta and was always promoted as that. when people start to pump it and without reading an announcement right, why should that be iotas fault? and about the usability of iota, when have you started with cryptos? go back to 2011 and look for a good usable wallet (hint: you won't find anything). iri is a reference implementation a C and Rust Version is in developement. IOTA is clearly about to proof that their protocol works, here some brain food: https://arxiv.org/pdf/1712.05385.pdf https://arxiv.org/pdf/1712.05385.pdf

tfha 9y ago
They are about to prove their network works after making unreasonable assumptions as prerequisites to the proof.
- jayjay13 9y ago
  can you spot me to this unreasonable assumptions?

unholywars 9y ago

My god. So many amateurs commenting on this. Whoever wrote this has no idea that IOTA has been planning from the beginning to write both a C++ and a Rust implementation of the IRI, so his Java argument is already invalid. Do you guys even know who writes the IOTA code? Do you guys even know what Proof-of-stake is? Dear lord. Please keep selling your iotas so I can buy them real cheap.

xg15 9y ago

Pardon for off-topic, but the arguments he makes about double-spending (the third "rule" from that linked forum post) made me realize I have some gaps in my understanding how Bitcoin handles overlapping transactions. Suppose I have an address with 0BTC balance. (i.e. I have the private key of it on my PC. There isn't yet anything about that address in the blockchain.) Some other person sends 100mBTC to that address. I can see that the transaction has spread through the network but it hasn't been added to a block yet. Because I'm overly trusting and/or in a hurry, I don't wait until it's confirmed but I immediately send another transaction that sends the 100mBTC to some other account. If a miner first picked transaction #1, added it to a block, then added transaction #2 to the following block, both transactions would be valid. However if a miner tried to process transaction #2 first, it would be invalid. So what would happen? Would miners bring the transactions into correct order and validate both, only validate #1 and reject #2 or reject both?

izzle49 9y ago
I could be wrong but I thought miners were always in sync, miners are effectively writers to the ledger and single threaded. They all mine the same transactions in the same order. The first to find the hash with correct difficulty gets the block, which triggers the other miners to stop and verify. Once verified the new block becomes the seed for the next block. So the first transaction will always be processed before the second transaction. The second transaction would be committed as long as you had enough balance remaining after the first transaction.
- rane 9y ago
  Not true. Each miner may choose by whatever logic which transactions to include in the block they are mining. They are however are likely to prefer those which pay higher fee.
kochthesecond 9y ago
This is not an issue in bitcoin. #2 is never valid until #1 has commited, so #2 would not be included in any block.
deleted 9y ago

rootsudo 9y ago

I went to the IOTA meetup in Chicago, which was hosted and presented by the IOTA team. Never before did I see an entire audience be wowed by a women engineer. They ignored the whole Microsoft partnership idea; anyone that asked just was given the answer "it'd be explained in a future PR release." The drama was IOTA lied about microsoft partnership and deemed hosting on azure == partnership with microsoft. In talks with different microsoft teams == sending support tickets on azure for different services.

doktrin 9y ago
> The drama was IOTA lied about microsoft partnership and deemed hosting on azure == partnership with microsoft I wonder if this is a recurring theme in "crypto". At one point I followed NEO, and they pulled the exact same stunt.
jackstraw14 9y ago
Microsoft claimed the partnership with IOTA -- not the other way around: https://blog.iota.org/iotas-data-marketplace-setting-the-record-straight-576fbf0b4513 https://blog.iota.org/iotas-data-marketplace-setting-the-rec... The quote that set off this confusion: > We are excited to partner with IOTA foundation and proud to be associated with its new data marketplace initiative. This next generation technology will accelerate the connected, intelligent world and go beyond blockchain that will foster innovation real world solutions, applications and pilots for our customers. --Omkar Naik, Microsoft
- watoc 9y ago
  It's difficult to trust that Microsoft claimed it when you only provide a link to iota website.
  - jackstraw14 9y ago
    IOTA made the announcement on their official blog, so as far as I know it's the source. If you're saying you don't trust the devs, then I guess we're talking about something different than I thought. Here's the quote from the Microsoft guy involved, that caused the confusion: > We are excited to partner with IOTA foundation and proud to be associated with its new data marketplace initiative. This next generation technology will accelerate the connected, intelligent world and go beyond blockchain that will foster innovation real world solutions, applications and pilots for our customers. --Omkar Naik

dangero 9y ago

I also recently wrote an article about IOTA and got a crowd of negative flak. https://medium.com/@thedrbits/why-i-also-find-iota-deeply-alarming-99d4f2da3282 https://medium.com/@thedrbits/why-i-also-find-iota-deeply-al...

wslh 9y ago
There is an army of trolls connected to IOTA. You can find them very easily because they cannot defend their position. Here in HN there are plenty also.
jackstraw14 9y ago
> So… Your response to why I’m wrong is that you’re going to change everything in the future? Well, you got a reply from Come-from-Beyond who wrote the damn thing. You've got some attention from the developer and you couldn't handle your emotions, so I'm not sure what your angle is here. Do you mind if I ask, why didn't you engage them and evaluate your own understanding? Why did you resort to a snarky one liner?

wyldfire 9y ago

Bruce Schneier had this to say about IOTA: > In 2017, leaving your crypto algorithm vulnerable to differential cryptanalysis is a rookie mistake. It says that no one of any calibre analyzed their system, and that the odds that their fix makes the system secure is low

Ballie 9y ago
How is it vulnerable to differential analysis?
- nhooyr 9y ago
  Google "MIT finds vulnerability in IOTA".

andr 9y ago

It's pretty understandable that fanboys are badgering skeptics on social networks. If I had a few hundred thousand pop out of the blue from a cryptocurrency fad, maybe I would be doing it as well. And that's a big problem, because mainstream journalists are guilty of that as well. MIT Technology Review, to pick one example, wrote an article about IOTA, mentioning their partnerships with mainstream companies, even though IOTA refuted the partnership notion the same day. Clearly, the author didn't reach out to any of those companies for confirmation. I can't help but think that many of those articles are written by people, influenced by their own cryptocurrency assets. In fact, this conflict of interest for journalists could be one of the key driving forces of the bubble.

nadam 9y ago

IOTA is the only big cryptocurrency that seems extremely fishy to me. The trick is that even a fairly technical person (like me) cannot easily refute it based on the whitepaper, because the whitepaper is intentionally indecipherable, and does not have enough information to evaluate the project anyway. The average person sees such a whitepaper, and is amazed by the complicated scientific formulas. A good engineer/scientist on the other hand gets uneasy about it I think. I don't understand how a huge network of full nodes, nodes which are small indusrtrial devices can scalably reach consensus in a fast way. Even storing the full state is impossible, not to speak about history. It is independnet on whether we use the DAG or blockchain. That is why scalability plans on other networks go into the direction of sharding, or have a smaller number of powerful nodes, or use layer 2, etc... Crypto communities fight each other (BTC vs. BCASH, DASH vs. Monero, Ethereum vs. EOS) but these are all serious projects. The whole community should speak up about IOTA instead.

CyberDildonics 9y ago
What is BCASH? Do you mean Bitcoin Cash?
- nadam 9y ago
  Yes.
- Roger_Ver 9y ago
  Stop calling it BCASH. I find that insulting.
JohnJamesRambo 9y ago
We try but there is an army of IOTA shills that drown us out.
- amenod 9y ago
  Interesting... My first reaction to your post was "meh - surely he's exagerrating". But reading other replies to GP that were posted later made me reconsider. Very unconstructive replies, trying to bully the well articulated opinion... I have never seen anything like it on HN (though that's just my observation of course, maybe I was just lucky). Do you think the people behind this are truly convinced of their cause or are they paid "web-fighters"?

wslh 9y ago

BTW, administrative issues: I wonder why my previous post with the same link less than 1 day ago was not reused for this thread https://news.ycombinator.com/item?id=15935601 https://news.ycombinator.com/item?id=15935601 is this a HN bug? Just today I tried to post an article already posted three days ago and I was directed to the first post thread.

watoc 9y ago
There is a query parameter "m=1" at the end of this URL. I guess that's why it wasn't marked as duplicate.
- wslh 9y ago
  That is a HN bug since the canonical page is without that suffix: <link href='http://codesuppository.blogspot.com/2017/12/iota-tangled-mess.html' rel='canonical'/>

JonasJSchreiber 9y ago

Great post, I was wondering why transactions were disabled to binance...appreciate the info. And the warnings.

mcguire 9y ago

"IOTA is deflationary (has a fixed number of tokens, there will never be any more, and has no inflation at all, no issuance schedule for new tokens). All tokens which will ever exist were created on day one and pre-distributed to people who signed onto the project very early." Yeah, I'd push that pretty hard, too.

It3ration 9y ago

This guy is blaming the Iota founders because he doesn't understand computer science? Their whitepaper is organized like any other publication in computer science. As for the Java vs C++ comment, he's simply uninformed. Not to mention there are many ports in various languages. I wish he'd done some research before posting bogus rhetoric.

deleted 9y ago

[deleted]

cjhanks 9y ago

This is possibly the best bug report of all time. https://github.com/iotaledger/wallet/issues/762 https://github.com/iotaledger/wallet/issues/762

mycall 9y ago

> You do not release financial software to the general public in such a buggy state and there it is, the inherent confusion between public expectations and programmers WRT cryptocurrencies.

incredimike 9y ago

Where did this post go? Did the author get a takedown?

forvelin 9y ago
I am also curious about that...

deleted 9y ago

[deleted]