Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193] helo=mx.sourceforge.net) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1UwVti-0006My-Qs for bitcoin-development@lists.sourceforge.net; Tue, 09 Jul 2013 11:15:54 +0000 Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of fastmail.co.uk designates 66.111.4.25 as permitted sender) client-ip=66.111.4.25; envelope-from=jim618@fastmail.co.uk; helo=out1-smtp.messagingengine.com; Received: from out1-smtp.messagingengine.com ([66.111.4.25]) by sog-mx-3.v43.ch3.sourceforge.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.76) id 1UwVtg-0001T1-MC for bitcoin-development@lists.sourceforge.net; Tue, 09 Jul 2013 11:15:54 +0000 Received: from compute5.internal (compute5.nyi.mail.srv.osa [10.202.2.45]) by gateway1.nyi.mail.srv.osa (Postfix) with ESMTP id D4D2920527; Tue, 9 Jul 2013 07:15:44 -0400 (EDT) Received: from web1.nyi.mail.srv.osa ([10.202.2.211]) by compute5.internal (MEProxy); Tue, 09 Jul 2013 07:15:44 -0400 Received: by web1.nyi.mail.srv.osa (Postfix, from userid 99) id BAA70F00005; Tue, 9 Jul 2013 07:15:44 -0400 (EDT) Message-Id: <1373368544.9057.140661253540582.544AB3A2@webmail.messagingengine.com> X-Sasl-Enc: LCc5XnAYhkImquBOaSwJYaYlFWMWRQsNSFW9jojNHNhJ 1373368544 From: Jim To: Mike Hearn MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain X-Mailer: MessagingEngine.com Webmail Interface - ajax-cea5092a In-Reply-To: References: <1372353053.10405.140661249237317.77984E1F@webmail.messagingengine.com> <1372605569.4937.140661250186789.39404E47@webmail.messagingengine.com> <51DB6548.5070909@lavabit.com> <1373367371.4283.140661253533454.0D7E544E@webmail.messagingengine.com> Date: Tue, 09 Jul 2013 12:15:44 +0100 X-Spam-Score: -0.3 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (jim618[at]fastmail.co.uk) -0.0 SPF_PASS SPF: sender matches SPF record 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (jim618[at]fastmail.co.uk) -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 1.0 FREEMAIL_REPLY From and body contain different freemails X-Headers-End: 1UwVtg-0001T1-MC Cc: Bitcoin Dev Subject: Re: [Bitcoin-development] Proposal: MultiBit as default desktop client on bitcoin.org X-BeenThere: bitcoin-development@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2013 11:15:55 -0000 Currently there are about 2,500 downloads a day for MultiBit. There are download stats here: https://multibit.org/awstats/awstats.pl?config=multibit.org With a mirror from Mike and perhaps another instance at multibit.org that would get us to 100K per day so probably nothing to worry about. I think the highest daily download stats I have seen were in the April 2013 'boom' where Bitcoin-QT downloads hit 30K per day as I recall. The 30-40 MB including a JVM is based on the download sizes for CharlesProxy.com which does this for their Windows downloads. The sizes are here: http://www.charlesproxy.com/download/ This is a Java codebase too. Yes there must be an auto-update framework (but without ECDSA signing most likely). I haven't spent much time on this yet. On Tue, Jul 9, 2013, at 12:04 PM, Mike Hearn wrote: > How many downloads/day do we see currently? I think you said it's on the > order of a few thousand, so nowhere near 30k I'd guess. Anyway I can > mirror > it if we need to. > > The JavaFX packager is supposed to delete parts of the JVM that aren't > used. Is the 30-40mb figure based on using that tool or something else? > Note that you don't need to use the JFX widget toolkit to use the bundler > tool. > > We could also invest in a copy of JET, which does native compilation down > to self contained Windows binaries. It might create smaller bundles. But, > it's a proprietary tool and I don't know how reproducible its outputs > are. > > For the auto update, is there an existing auto update framework that we > can > modify to support threshold signed updates? I'm sure such a thing must > exist. The updates would download in the background and then the app can > just ask the user to restart it once the update is locally available, as > Chrome does. > > > > On Tue, Jul 9, 2013 at 12:56 PM, Jim wrote: > > > Yes I would like to bundle a JVM as it would simplify the user > > experience. > > > > There are a few downsides though: > > + all the build packaging will need redoing and retesting. > > + it will bump up the MultiBit download from about 11MB to 30-40MB > > (I think). This drops the maximum copies of MultiBit the multibit.org > > server can deliver per day from around 90,000 to 30,000ish. > > The multibit.org server maxes out at 1 TB of bandwidth per day. > > > > Currently there is no provision to update anything automatically. > > I would like to start having Bitcoin signed files that MultiBit can > > check > > and update (initially the checkpoints file, I18N files - NOT code > > at first because of the security implications). I think this needs to be > > in place before bundling a JVM so that users don't have to > > keep redownloading it. > > > > Having lists of all the artifacts signed and them having SHA256 hashes > > then makes it practical/ safe to start mirroring the code. I can see > > each mirror crosschecking the others that the SHA256s are correct > > for instance. This would increase the maximum number of > > downloads we could cope with. > > > > > > On Tue, Jul 9, 2013, at 11:36 AM, Mike Hearn wrote: > > > Modern Java versions let you bundle the app with a stripped down JVM. I > > > don't know if Jim does that, but I think it's an obvious step towards > > > making MultiBit friendlier and easier to use. > > > > > > BTW I believe most secure browsers (Chrome, Firefox) have banned the > > > applet > > > plugin or severely restrained it anyway. So even if you install the JVM > > > and > > > plugin together there is not an issue. > > > > > > > > > On Tue, Jul 9, 2013 at 3:20 AM, Caleb James DeLisle < > > > calebdelisle@lavabit.com> wrote: > > > > > > > Java (Applet) security is indeed abysmal but lets compare apples to > > apples. > > > > With an applet some random guy with a website makes up some Java code > > and > > > > your browser automatically executes it. > > > > With Multibit you're only executing highly trusted code (so trusted > > that it > > > > handles your money). > > > > There has almost never been a Java exploit against secure trusted code. > > > > > > > > The idea of discouraging use of java apps just because people would be > > > > tricked into activating the browser plugin when installing the JVM is > > > > probably valid but Multibit is the only reasonably complete client > > outside > > > > of bitcoinqt and I think client diversity is more important than > > stamping > > > > out java. > > > > > > > > Thanks, > > > > Caleb > > > > > > > > > > > > On 07/08/2013 08:22 PM, Robert Backhaus wrote: > > > > > But... Multibit is Java. Java's security problems has made it an > > instant > > > > uninstall item on windows PCs for about a year now. Java exploits are a > > > > dime a dozen. > > > > > > > > > > Yes, you can reduce some of the problems by manually disabling the > > > > browser plugin, but how many users will do that? > > > > > > > > > > Recommending a fast SPV client as a first wallet - yes, of course. > > > > Recommending users open such a huge attack interface on their > > computers by > > > > installing Java - No go. Until Multibit is provided as a compiled > > binary > > > > without a Java dependency, it is DOA. > > > > > > > > > > > > > > > On 1 July 2013 02:39, Gary Rowe > > > g.rowe@froot.co.uk>> wrote: > > > > > > > > > > I've beefed up the supporting documentation for the website to > > make > > > > it more accessible for developers who wish to contribute. It's a Java > > > > application serving HTML. > > > > > > > > > > It can be found here: https://github.com/jim618/multibit-website > > > > > > > > > > > > > > > On 30 June 2013 16:19, Jim > > > jim618@fastmail.co.uk>> wrote: > > > > > > > > > > Yeah "email jim' was never going to work so I have > > > > > bumped up MultiBit support (a bit) by: > > > > > > > > > > + having a dedicated Support page on the website > > > > > https://multibit.org/support.html > > > > > It has fixes and support notes for the most common > > gotchas. > > > > > + the in-app help also now has a 'Support' section with > > > > > "Troubleshooting' and the commonest gotchas. > > > > > I've also written more help to cover as much as possible. > > > > > + Failing that people are directed first to > > > > bitcoin.stackchange.com > > > > > (I have a notification set up for the 'multibit' keyword. > > > > > + Then finally users are directed to the github issues to > > search > > > > > existing or raise a new issue. Gary and Tim often chip in > > on > > > > there to > > > > > close > > > > > issues down as well as me. > > > > > > > > > > > > > > > > > > > > On Sun, Jun 30, 2013, at 12:42 PM, Mike Hearn wrote: > > > > > > Sounds like we have consensus, Saivann, shall we do it? > > > > > > > > > > > > I'm also going to ask Theymos again to relax the newbie > > > > restrictions > > > > > > for the alt client forums. It's probably too hard to get > > > > support at > > > > > > the moment and "email jim" doesn't scale at all. > > > > > > > > > > > > On Fri, Jun 28, 2013 at 4:24 PM, Gavin Andresen < > > > > gavinandresen@gmail.com > > > > > > > wrote: > > > > > > > I vote "yes" to have MultiBit replace Bitcoin-Qt as the > > > > recommended > > > > > > > desktop wallet app. I think most users will be happier > > with > > > > it. > > > > > > > > > > > > > > If I'm wrong, it is easy to change back. > > > > > > > > > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > > > > > This SF.net email is sponsored by Windows: > > > > > > > > > > > > > > Build for Windows Store. > > > > > > > > > > > > > > http://p.sf.net/sfu/windows-dev2dev > > > > > > > _______________________________________________ > > > > > > > Bitcoin-development mailing list > > > > > > > Bitcoin-development@lists.sourceforge.net > > > Bitcoin-development@lists.sourceforge.net> > > > > > > > > > > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > > > > > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > > > > This SF.net email is sponsored by Windows: > > > > > > > > > > > > Build for Windows Store. > > > > > > > > > > > > http://p.sf.net/sfu/windows-dev2dev > > > > > > _______________________________________________ > > > > > > Bitcoin-development mailing list > > > > > > Bitcoin-development@lists.sourceforge.net > > > Bitcoin-development@lists.sourceforge.net> > > > > > > > > > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > > > > > > > > > > > > > -- > > > > > https://multibit.org Money, reinvented > > > > > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > > > This SF.net email is sponsored by Windows: > > > > > > > > > > Build for Windows Store. > > > > > > > > > > http://p.sf.net/sfu/windows-dev2dev > > > > > _______________________________________________ > > > > > Bitcoin-development mailing list > > > > > Bitcoin-development@lists.sourceforge.net > > > Bitcoin-development@lists.sourceforge.net> > > > > > > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > > > > > > > > > > > > > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > > > This SF.net email is sponsored by Windows: > > > > > > > > > > Build for Windows Store. > > > > > > > > > > http://p.sf.net/sfu/windows-dev2dev > > > > > _______________________________________________ > > > > > Bitcoin-development mailing list > > > > > Bitcoin-development@lists.sourceforge.net > > > Bitcoin-development@lists.sourceforge.net> > > > > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > > > See everything from the browser to the database with AppDynamics > > > > > Get end-to-end visibility with application monitoring from > > AppDynamics > > > > > Isolate bottlenecks and diagnose root cause in seconds. > > > > > Start your free trial of AppDynamics Pro today! > > > > > > > > > > > http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > Bitcoin-development mailing list > > > > > Bitcoin-development@lists.sourceforge.net > > > > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > > > > > > > > > > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > > See everything from the browser to the database with AppDynamics > > > > Get end-to-end visibility with application monitoring from AppDynamics > > > > Isolate bottlenecks and diagnose root cause in seconds. > > > > Start your free trial of AppDynamics Pro today! > > > > > > http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk > > > > _______________________________________________ > > > > Bitcoin-development mailing list > > > > Bitcoin-development@lists.sourceforge.net > > > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > > > > > > > ------------------------------------------------------------------------------ > > > See everything from the browser to the database with AppDynamics > > > Get end-to-end visibility with application monitoring from AppDynamics > > > Isolate bottlenecks and diagnose root cause in seconds. > > > Start your free trial of AppDynamics Pro today! > > > > > http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk > > > _______________________________________________ > > > Bitcoin-development mailing list > > > Bitcoin-development@lists.sourceforge.net > > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > > > > -- > > https://multibit.org Money, reinvented > > > > > > ------------------------------------------------------------------------------ > > See everything from the browser to the database with AppDynamics > > Get end-to-end visibility with application monitoring from AppDynamics > > Isolate bottlenecks and diagnose root cause in seconds. > > Start your free trial of AppDynamics Pro today! > > http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk > > _______________________________________________ > > Bitcoin-development mailing list > > Bitcoin-development@lists.sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > -- https://multibit.org Money, reinvented