🔥 FlexFarmer 2.0 Release - A massive upgrade under the hood: reduced I/O disk load, less power use, lookup times down by up to 50%, and support for all hardware

[AnyFarmer]

Yeah, I know. I assume that’s why they went with the _sk (secret key) _pk (public key) suffixes.

[Chris22]

@AnyFarmer

don’t have time the next several weeks, but when I do, I’ll try that on a clean flashed RPi, using just my farmer_sk.

Run it in a container with ports closed. I think that’s pretty secure, more so than running the node.

[impuls]

The problem with hpool is that you have no idea what us in the key they generated. It potentially could contain your mnemonic although hpool claims it does not.

With flexfarmer you ate able to review the python script script that extracts the farmer_sk and confirm that it not leaks your mnemonic.

[aurelius]

@Aspy68

If a pool signs blocks on your behalf, it has your master key (from which ALL other keys can be derived)

It was my understanding that signing a block only required the farmer_sk and not the master keys. Does flex farmer require to enter the mnemonic or master keys in order to function, or can you simply give them the farmer keys?

@Aspy68

Gene Hoffman - COO & President - Chia Network

“If the pool signs the block for you they have your private key and they can spend any of your money associated with it. Just because they do not have the 24 word seed doesn’t mean they do not have the private key. It is the private key that signs half of the two signatures necessary to win a block award.
So if anybody is trying to tell you that they dont have your private key but they are going to sign a block on your behalf, they are dangerously lying.”

When he says “your private key”, it’s singular, so I’m assuming it’s farmer_sk, right?

[Aspy68]

Gene Hoffman: "But to get the farmer private key, the software has access to the master private key.”

[Bones]

The software in this case it would seem is the open source program used to extract those keys.
From what ppl are saying it looks like this done on your pc, so the all important spend keys remain secure.

[Aspy68]

The Chia Devs occasionally visit ChiaForum to post when they feel it important.

I wish they would just come here and settle the facts and issue.

I’m really tired of defending their quotes.

[aurelius]

@Aspy68

Gene Hoffman: "But to get the farmer private key, the software has access to the master private key.”

You can get the farmer sk from the master keys, but you can’t get the master keys from the farmer sk. So if you only need the farmer_sk, and you give flexfarmer only the farmer_sk, that would be secure.

@Aspy68

The Chia Devs occasionally visit ChiaForum to post when they feel it important.

I wish they would just come here and settle the facts and issue.

I wish they could clarify on that, because it’s not clear at this point and we look like fools who can’t read code to get the answers ourselves

[Aspy68]

Same conversation with new peeps round and round.

I’m pretty much done with the issue until we have Chia clarification.

[Bones]

I doubt they’ll bother.
They have stated they don’t encourage / support closed source pools not using the official pool protocol iirc.

[Chris22]

@Bones

They have stated they don’t encourage / support closed source pools not using the official pool protocol iirc.

The opposite they don’t support pools using the reference code. It was meant as a reference.

Though yes they do prefer pools use the NFT pool protocol. Every one of which is generally closed source since you can’t check what they are running on the backend.

[Bones]

Well have to agree to disagree… you could be correct, but I feel not.

[Chris22]

Its called the " Pool Reference V1" as in it was meant to be referred to not actually used.

The summary also states “While this is a fully functional implementation, it requires some work in scalability and security to run in production.” as in its not meant to be run.

link

[impuls]

@Aspy68

Gene Hoffman: "But to get the farmer private key, the software has access to the master private key.”

Genes response is accurate but ignoring the fact that there are two parts of the software:
1/ A python script that extracts the farmer private key from the master private key.
2 /The actual flexfarmer that uses the farmer private key to sign blocks on yor behalf.

1/ Is open source, you can verify that it does not do anything but extract the farmer private key.
2/ Is closed source and should not be trusted, but it does NOT have access to your master private key (assuming you are smart enough to not run it on the same machine as Chia).

[aurelius]

@aurelius

I wish they could clarify on that, because it’s not clear at this point and we look like fools who can’t read code to get the answers ourselves

@sargonas sorry to @you but could you please chime in and give a confirmation that this is true on a technical level ?

[Aspy68]

I agree.

I think Chia do not wish to disclose the basis of this security issue they have claimed. I also think they do not wish to point fingers, name names, or enter into public debate.

Chia says a third party client cannot sign your blocks, or really function at all, without access to your master private key.

Many have pointed out that the master private key is NOT provided to Flexpool.

If Chia is correct, then how does FlexFarmer gain access to the master private key that it needs to function?

I do not know the answer to this question.

I have initiated and responded too many times now and I have nothing useful left to contribute.

Waiting for Chia Inc to answer the question and/or FlexFarmer to open its code … Until then we will not have a definitive answer …

Please read the entire thread and watch at least the first half of the AMA video before asking me about already covered topics. I’m in sleep mode on this topic anywaze, so don’t expect me to reply before Chia does or FlexFarmer opens its code.

[aurelius]

@Aspy68

Many have pointed out that the master private key is NOT provided to Flexpool.

If Chia is correct, then how does FlexFarmer gain access to the master private key that it needs to function?

Are you aware that there are multiple key pairs with Chia ? Unlike other cryptocurrencies where there is only one set of keys, with Chia you have wallet and farmer key (and the old “pool” key which deprecated) that are derived from the master key (which is itself derived from the seed). See key architecture

[Bones]

It seems we’re discussing different things.
They may well not support reference pools.
However that’s not the statement i was referring to.

[aurelius]

@impuls

Genes response is accurate but ignoring the fact that there are two parts of the software:
1/ A python script that extracts the farmer private key from the master private key.
2 /The actual flexfarmer that uses the farmer private key to sign blocks on yor behalf.

As someone who has never used flexfarmer, is it possible to give flexfarmer only the farmer_sk?

[Bones]

@AnyFarmer

When it comes to the second bit in your statement, how Flexfarmer gets hold of my master key, you are wrong. I have no concerns since I have never shared my master key nor my mnemonic with Flexfarmer. All I have shared is my farmer_sk.

The open source python script provided to extract farmer_sk from my mnemonic is entirely separate from Flexfarmer.

It would appear so ( 20 chrs )