The problem with java-based apps is that launching by doing “torsocks Bitsquare” does not work. Java apps uniquely have a problem with transparent proxies for some reason, and Bitsquare in particular fails to find the Tor network.
Like all java apps, I had to take a leap of faith and launch without the transparent proxy and without having any commandline proxy options. This is nakedness is unnerving because you don’t know what non-Tor connections an app might make. I have netstat running but when it shows a leak it’s too late.
It turns out that by default, Bitsquare has a leak. I had to go to the config and tick the “Use Tor for Bitcoin network” box, which was unchecked by default.
There seems to be no way to tell Bitsquare my SOCKS4a port, or my HTTP proxy port. Whatever Bitsquare is doing, there may still be a leak despite ticking the box above. Netstat shows Bitsquare is connecting directly to an external IP address.
did you read the pop up when you click on tor experimental feature? (i will wait when out of experimental stage)
to specify your own socks proxy its via the command line.
you may not be able to see the price feed because of cloudflaire.
i havnt tried it.
if you are that paranoid use a stores wifi or hack next door.
when we are not using tor for bitcoin network.
can the public at large find your IP when we make a transaction? or just the bitcoin node we may be connected to at the time.
.Bitsquare --help
Option Description
–appDataDir Application data directory (default:
/home/balls/.local/share/Bitsquare)
–appName Application name (default: Bitsquare)
–banList Nodes to exclude from network
connections. (default: )
–bitcoinNetwork Bitcoin network (default: MAINNET)
–bitcoinRegtestHost (default: LOCALHOST)
–btcSeedNodes Custom seed nodes used for BitcoinJ.
(default: )
–dumpStatistics If set to true the trade statistics
are stored as json file in the data
dir. (default: false)
–help This help text
–ignoreDevMsg If set to true all signed messages
from Bitsquare developers are
ignored (Global alert, Version
update alert, Filters for offers,
nodes or payment account data)
(default: false)
–logLevel Log level [OFF, ALL, ERROR, WARN,
INFO, DEBUG, TRACE] (default: INFO)
–maxConnections Max. connections a peer will try to
keep (default: 12)
–maxMemory Max. permitted memory (used only at
headless versions) (default: 600)
–myAddress My own onion address (used for
botstrap nodes to exclude itself)
(default: )
–nodePort Port to listen on (default: 9999)
–seedNodes Override hard coded seed nodes as
comma separated list: E.g.
rxdkppp3vicnbgqt.onion:8002,
mfla72c4igh5ta2t.onion:8002
(default: )
–socks5ProxyBtcAddress A proxy address to be used for Bitcoin
network. [host:port] (default: )
–socks5ProxyHttpAddress A proxy address to be used for Http
requests (should be non-Tor). [host:
port] (default: )
–useLocalhost Use localhost network for development
(default: false)
–useTorForBtc If set to true BitcoinJ is routed over
tor (socks 5 proxy). (default: )
–useTorForHttp If set to true all http traffic
(expect Poloniex) is routed over tor
(socks 5 proxy) (default: )
–userDataDir User data directory (default:
/home/balls/.local/share)
BitcoinJ is not by default routed over Tor as it needs more dev work to get it more stable.
The only clear-net connection is the Poloniex price feed requests because Cloudflare prevents Tor usage here. You can set a proxy though by program arg if you want.
I appreciate all the feedback. I didn’t know there were any CLI options, so I’m glad to see the rich manpage from using --help. I didn’t read the whole warning dialog… after it said experimental, I figured I’d go back and read it before committing any funds.
Non-cloudflare price quoting sites are easier to find than exchange sites. Is there a particular reason why bitsquare needs Poloniex?
I’ll be tempted to DNS override Poloniex with 127.0.0.1 in /etc/hosts, because I prefer to be cut-off from Cloudflare sites even if that means getting my quotes manually. I’ll report back whether it works or not.
Poloniex is one of the biggest exchanges and as we use the price feed for defining the trade price in case the percentage based price is used a price feed with low volume would carry higher risks.
When bitcoin was introduced there was a significant price variance between all the exchanges at any given moment, making it possible for someone to exploit these differences. Years ago there was a project underway to have a centralized trading robot operating on the various exchanges to stabilize the prices for everyone’s benefit. I’m not sure where we are with that, but when that thing goes live it would seem not to matter where the quotes come from.
Until then, can you explain what would happen if someone were to build their own bitsquare client that goes elsewhere for price quoting? Presumably it’s the bitcoin seller whose node calculates the absolute ask price from the quote and offset, correct? Would buyers potentially see absolute quotes that are not mutually pinned to the same market data?
Also, is there risk that Poloniex downtime degrades the availability of service to bitsquare.io users?
I would rather have a quoting engine that obtains quotes from a variety of non-Cloudflare sources, and computes a weighted average based on trading volumes.
Security risk-- we have to assume that CloudFlare collects data and monotizes it by selling it to data brokers. I don’t want to feed that monster and I hope you don’t either. Not to mention the general destruction CloudFlare does to the web. We need a plan to break away from that dependancy.
The prices is calculated at both traders and the offerer will reject if the takers price is outside a small tolerance range. To have a aggregated price service like BitcoinAverage would be best but we don’t have resources to build that.
I completely agree to what you said about CloudFlare and if we see a viable alternative I am happy to switch. Beside a healthy volume it also should support many altcoins.
Regarding privacy protection: There are worse issues than getting price feed data from a provider using CloudFlare. The Bloomfilters used for SPV clients are pretty much broken, so any full node gets quite a lot of info about your addresses. Furthermore CoinJoin is badly missing and people don’t care about merging their addresses or trades.
There are plans for a fix for the bloomfilter issue (see Github) but thats quite a lot of effort.
CoinJoin will be another important step. But atm I need to get the synergetic cooperation implemented otherwise we don’t get the resources to build all that…