OneEyed: mircea_popescu: but the investigation gets started pretty fast usually

OneEyed: mircea_popescu: it is to get a final decision

OneEyed: mircea_popescu: not even, a simple letter is enough, which describes the facts

OneEyed: mircea_popescu: I pressed charges when he didn't answer by PM nor reimburse me (it's free to start criminal charges here, no need for a lawyer)

OneEyed: mircea_popescu: yeah, for around 27 BTC

OneEyed: mircea_popescu: a defaulting loan doesn't affect the existing number of shares of GLBSE assets, only the net value of the fund

OneEyed: mircea_popescu: he still plans to reimburse everything

OneEyed: mircea_popescu: you're late

OneEyed: mircea_popescu: this is the first time I come to this channel, are you saying the volume of financial discussion went up recently?

OneEyed: mircea_popescu: yeah, but some of them had a chance to make a profit before. I think vescudero was just entering the btc game, so no profit to reinvest there.

OneEyed: mircea_popescu: yeah, probably

OneEyed: mircea_popescu: https://docs.google.com/spreadsheet/pub?key=0AkzS_thDsmwudHVKcFdMRXg5cjY3eklqNmxHeGlIeXc&single=true&gid=0&output=html

OneEyed: mircea_popescu: I already notice you seem to think that uppercase letters are useless, now accented characters. 26 letters ought to be enough for everybody

OneEyed: mircea_popescu: you're wasting space, use "…" instead, Unicode rules :)

OneEyed: Oh, MPOE-PR is mircea_popescu girlfriend? I haven't followed the sitcom apparently, I thought it was Mircea himself.

OneEyed: mircea_popescu: not much, I don't like the "real" finance world much :)

OneEyed: Oops, I mean mircea_popescu's implementation, not himself, I don't know him :)

OneEyed: jurov: mircea_popescu is pretty sane as far as I can see!

OneEyed: mircea_popescu: no, I have just read the FAQ, 20 BTC would eat much more than what I would gain, since I don't have much to trade (I just bought a couple hundreds BTC to play with)

OneEyed: mircea_popescu: if answers are signed, then you cannot pretend an order never arrived, and if duplicates are not accepted, you cannot pretend an order was submitted twice, and everyone's safe :)

OneEyed: mircea_popescu: but right now you *could* produce duplicate if you wanted

OneEyed: mircea_popescu: yeah, that's why you can't trust the date, I'm with you on this one, it makes no sense

OneEyed: mircea_popescu: you don't have to! The signature date just ensures that signed messages won't be the same, by construction

OneEyed: mircea_popescu: no, you don't need to add anything

OneEyed: mircea_popescu: so how do you distinguish between two identical orders and a replayed order then?

OneEyed: mircea_popescu: why so? Do you check the signature date and require that it is unique?

OneEyed: mircea_popescu: why? I am talking about intercepting the message as submitted, that is signed by the customer key and encrypted with mpex key.

OneEyed: mircea_popescu: as far as security is concerned, I haven't seen anything against replay attack. Maybe the attacker should have the possibility to add a "serial" or "uid" extra field, to ensure a signed message cannot be submitted again without being regenerated (it would require a new UID).

OneEyed: mircea_popescu: what I had in mind, was a "gpg --refresh-keys" on an internet-connected server, then send the updated keyring to the non-internet machine, and have gpg merge both keyrings (keys being in append-only mode, this cannot remove any information or inject any bogus unsigned information, especially if no new keys are imported during the merge)

OneEyed: mircea_popescu: it gets fed the PGP signed orders in some way (serial link? private Ethernet connection? whatever), so the key updates could enter the same way. Anyway, I was just curious about it, I'm not requesting a change :)

OneEyed: mircea_popescu: the only risk is a DOS, since you cannot remove anything from a key, only add to it - and if someone manages to sign a revocation certificate for someone else, well, that someone else will be happy to have the revocation added to his key!

OneEyed: mircea_popescu: out of curiosity, why don't you offer the possibility to update a key (expiration date, revocation)? It could be transferred the same way orders are, and that would make the system only more secure, wouldn't it?

OneEyed: mircea_popescu: television?

OneEyed: mircea_popescu: do you plan to have a promotional period where registration of a new PGP key is free by any chance?