Status as of Monday, January 15, 2018

[Steve Sokolowski]

Good morning!

• We've been using the support tickets to determine where our effort should be concentrated. We've seen one ticket per day concerned with mining issues recently, which seems to indicate to me that the two months of focus on the mining server has nearly eliminated its issues. On the other hand, it seems that all the tickets now are from customers who didn't get paid in one coin or another, so that's where our focus will shift for the next week.
• Over the weekend, I fixed issues with the block explorer indexer. There were some race conditions that would cause coins to stop indexing. However, it looks like the indexer is still stopping its indexing for an unknown reason, so today I will resume work on it.
• We also focused on Coinbase payouts over the weekend. First, we found that too little money was being sent to Coinbase, which would sometimes delay payouts due to insufficient funds, so we corrected that. Then, we noticed that a die(); statement had been placed for testing and was never removed, causing only one customer to have dollar payouts sold at a time, so we removed that and now all customers have dollar payouts sold every day. We also discovered a problem that caused bitcoin payouts at Coinbase less than $10 to fail to send, and resolved that as well. I also added a logo and changed the name of the business on Coinbase. We now believe that all Coinbase issues have been resolved.
• Chris resolved bugs with withdrawals from Cryptopia and Livecoin that sometimes caused payout problems when the failed withdrawals caused us to have too little money to send from our wallets.
• Chris completed the restarts of all services yesterday, and now the Meltdown vulnerability is patched on all servers. That will allow him to add new mining coins and update the mining coins that have forked.
• We determined that we will be sending forms 1099-MISC for 2018, in January of next year, and will not be sending forms for 2017. We'll post a more detailed explanation on this decision at some point in the future. The site was already designed in this manner, so there are no changes to the way the system works. There are some customers who would like a review of their earnings for 2017, and for those customers, since the forms will not be sent, we are exploring a PDF or CSV report that provides an overview of the year.
• We put out an offer for a trader developer and are waiting for an answer before proceeding further. Should the offer be declined, we'll make a public post calling for applications. We are also still considering hiring the student to improve the support ticket times, but are concerned that the student will not make answering the tickets his or her top priority, as we have often found with part-time employees in the past. That's why we may just distribute the ticket load and stuck with only full-time employees for now. Chris believes that 90% of tickets result from bugs in the system that can be resolved automatically, and the fact that ticket numbers have fallen from 70 per day down to 25, despite having more customers, may bear that out.

[gestalt]

I went to go give the Coinbase bitcoin payout thing a try. Unless I was misunderstanding how to set it up, it was asking for authorization to sell bitcoin. I ended up not trying it. Why is that necessary? Actually, why is any api authorization necessary for that on our end? I'm pretty sure you can just do that with an email address from us and an api key on your account with a send authorization. Any chance of changing how this is handled?

[Steve Sokolowski]

I went to go give the Coinbase bitcoin payout thing a try. Unless I was misunderstanding how to set it up, it was asking for authorization to sell bitcoin. I ended up not trying it. Why is that necessary? Actually, why is any api authorization necessary for that on our end? I'm pretty sure you can just do that with an email address from us and an api key on your account with a send authorization. Any chance of changing how this is handled?

It would require a redesign of the way external payouts are handled to remove the "sell bitcoin" permission for users who only want payouts in bitcoins, rather than dollars. For security reasons, the part of the website handling bitcoin payouts doesn't have access to the Coinbase account information to make a decision about which permissions it needs. Even if someone were able to achieve SQL injection, the lack of database permission to those tables protects the OAuth2 tokens from any website access.

We could fix this immediately by allowing queries to the database to determine what type of access is needed, but we don't want to do that. In the future, maybe we'll devote time to fixing this issue permanently. For those who are concerned in the meantime, perhaps there is a way for the customer to revoke one type of permissions and not the other on Coinbase's end, since sales won't be attempted anyway?

[gestalt]

Thanks. That put me on the right track. I don't know if there is a way to individually manage permission from Coinbase without revoking everything. However, I did find a way to prevent that scope from being authorized in the first place. It seems like it's all linked up. I guess I will see if it functions in this state next time there is a payout.

[gestalt]

So far, it seems like it doesn't work. The payout threshold didn't change and there hasn't been any payout since setting it up.

[Steve Sokolowski]

So far, it seems like it doesn't work. The payout threshold didn't change and there hasn't been any payout since setting it up.

Did you remove the permission that allows us to obtain account information? If so, then there's no way to figure out who to pay. You should only remove the "sell" permission.

[gestalt]

I only removed the sell bitcoin scope. Under the third party applications section in Coinbase it lists "Prohashing Mining Pool" with "View your basic account information" as the only permission.