Market report on Antica, Courtesy of VasCo

[vasroe]

Market report, Courtesy of VasCo

VasCo financial analysts and currency brokers have determined that, unfortunately, the Antican economy is now dead. Their online bank has been shut down by the Archon because, as he claims, it is insecure--meaning no one can access their electronic accounts--, and the new Treasury Minister, Braden Indianensis, has made an almost complete dereliction of his responsibilities. There have been almost no monetary transactions since the resignation of Mateu Vasroe last month over the Antican government's failure to prosecute a citizen who hacked the bank.

VasCo started pulling its money out and converting it to Small Commonwealth currency as soon as the government failed to prosecute the bank attacks; it knew right then that the Antican people, or their government at least, perhaps did not really have their heart in maintaining a successful economy. Perhaps Andreas the Wise somehow sensed too (because he is so wise) that things were going downhill; after a time, he refused to do another, larger currency conversion transaction with VasCo. Indeed, Antican currency is now almost worthless, as the earlier fears have become a reality.

A side note, perhaps of interest to geopolitical strategists, as opposed to financiers: Now that Braden has just been elected Speaker in Antica, one wonders whether their legislative branch will also experience inactivity problems. More than likely, Archon Octavius will just fill in for Braden as Speaker 90% of the time.

[Jonas]

Hhmm. A proof that only the big economies, like the one of the SC, has a chance of surviving. With a bit of luck, the SCUE will become as integrated within micronational economics as the MCS is now for making maps.

[Andreas the Wise]

I only feel slightly cheated ....

[vasroe]

Though not very optimistic, I still held out hope that at least a minimally operational economy could still exist in Antica. Treasury Minister Braden Indianensis even appeared at first to have at least some interest in handling economic affairs when he promised a 1000 P economic stimulus to any company doing business in Antica. Thus I carefully withheld judgment until now.

[Chrimigules]

Their online bank has been shut down by the Archon because, as he claims, it is insecure

Yes, because the passwords aren't encrypted by design so that the person who runs it can read and change passwords readily. I wonder who could have chosen to design it like that...

[vasroe]

Technologically speaking, there are a lot of reasons why that is so, Octavius. The main one is that it would take a complete technological overhaul of the bank, taking at least several months, to make it utilize the encrypted passwords that you want.

So why was this not implemented in the first place? Suffice to say, I thought that the Treasury Minister ideally should be a trustworthy individual, so entrusting him with the passwords would not be a problem. Certainly, I never misused the passwords, and nor has, to my knowledge, the current Treasury Minister Braden Indianensis ever done so.

My suggestion to you is to set up phpBank. Truth be told, I don't know for sure whether phpBank also encrypts passwords from the view of the administrator though. I have never been on the administrative end of phpBank, so I wouldn't know. Octavius, have you considered this option?

[Chrimigules]

I've been trying to find a copy of it.

[Andreas the Wise]

Erik's bank encrypts passwords. His code didn't seem that hard (well, it might be hard to convert, but after that ...)

Anyway, I maintain hope that VBNC will be able access their funds somehow - whether an economic resurrection, or because Antica uses existing Antican funds to convert into SC funds if/when they join the SCUE.

[Erik Mortis]

Encryption is easy to put in place. Just encrypt the password when you make an account, store that encrypted password. Then any time you want to check the password entered against the account password, encrypt the password you are trying to use, in the same way as you encrypt stored passwords. Then compare. I could send you the function I use to do it. Come by the Church of the Machine God and ask questions. I'd be more then willing to help. Or someone else there could proly offer pointers.

[vasroe]

Yes, Erik, I would like to see that function because unfortunately I do not see, from your description of it, whether it would be secure enough for Octavius. Octavius wants things so that not even the database administrator can change anything in the database. Octavius wants an strong, additional layer of security between the Treasury Minister and the database, such that the bank would still be secure even with Billy the Kid as the Treasury Minister and database administrator.

[Erik Mortis]

umm... it uses md5 to encrypt.. which is pretty good for what we got. I'm not sure what you want. In theory anyone with admin can do whatever you made the bank capable of.

Like I said. Come to the Church of the Machine God and start up a conversation on encryption and I'll be happy to help out. I'm sure Ari would have words too.

And someone will Always have database access. Whether the webmaster or whoever.

With the SC bank the admin doesn't have database access so all he can do is what the bank software lets him. Which would allow him to change user passwords so that if someone forgets their password. But no direct database access.

[vasroe]

Before we start that conversation, Octavius, after the bank is up and running, would you be comfortable being the only one with access to the bank database, the one you originally set up for me to administrate? I ask because, earlier, you were not--at least not until you shut down the bank.

[Ari Rahikkala]

Yes, Erik, I would like to see that function because unfortunately I do not see, from your description of it, whether it would be secure enough for Octavius. Octavius wants things so that not even the database administrator can change anything in the database. Octavius wants an strong, additional layer of security between the Treasury Minister and the database, such that the bank would still be secure even with Billy the Kid as the Treasury Minister and database administrator.

What, I guess next he will want the bank software itself to be untrusted too, and then we'll have to implement micronational banking on BitCoin

Seriously. You can't implement proper information security on an untrusted database. Well, OK, you can do confidentiality. But that's easy, everyone does that (for passwords) and so should you. Integrity's maybe theoretically possible but the end result won't look like using a relational database. And availability, well, there's little you can do about a database administrator who decides to DROP DATABASE on you .

I recommend the approach Erik used, that is, the Treasury Minister has no database access, and can only modify the system with logged transactions. Whoever does have database access (developers, webmaster, etc.) is just trusted but should have as little involvement in any financial operations as possible.

[vasroe]

That does sound like the approach that I will use, if I do start working on Antica's bank. Archon Octavius would be the administrator--the only person with access to the database, and the Treasury Minister would be basically shielded from any database management.

Perhaps if Antica joins the SC, which, now, and to my surprise, is being debated in their Assembly, it might not even need a new bank.

[Erik Mortis]

I can always give you the software we use... It won't install itself... (though I could arrange for it to.. but I'm lazy), but it's easy to configure.

[vasroe]

We're interested. I could probably install it. (I have real-life paid experience in debugging large amounts of someone else's PHP spaghetti code.) Upload it to your server as a ZIP and send me the link via PM.

[Erik Mortis]

Spaghetti code! I never use goto in any of my code!

[vasroe]

Most of this site's code was either poorly documented or simply not documented. Variable names and function names were very confusing. After experiencing some problems with it, the person who hired me admitted that it was "spaghetti," and of course that was the right word for it. If you made a change in all the logical places, you couldn't expect it to have the right effect across the whole site. But it was a learning experience. While the site's design did have problems, the problems taught me to use trial and error and multiple approaches in order to get the code to work as best as possible. Now, I can better understand any level quality PHP code now, whether it is organized or is "spaghetti" code.

[Erik Mortis]

Well.. hopefully my code is... good.

[vasroe]

I am looking at the bank code for the first time now. It looks good

[Erik Mortis]

Yay!

[vasroe]

UPDATE:

In a surprising twist of fate, Antica's economy is now on the path to recovery. This is mainly due to improvements to the AntiBank, Antica's online bank ( http://bank.nafticon.org) . The Bank now uses encrypted passwords, has a revamped appearance, and had more administrative tools. As a result of the improvements in the Bank, several individuals, such as Aryeztur and Malliki, have taken part in large transactions. There is even discussion of restarting currency exchange between Antica and Shireroth. (My hope is to re-engage Andreas at some point.)

However there do remain certain important realities for the Antican economy to contend with, such as vocal and violent public opposition to any taxation, and strong intervention by the Archon in the development and maintenance of its online Bank. Notwithstanding these important realities, as recently elected Treasury Minister of Antica (serving a new term), I am working to please as many of the Anticans as possible. As we Anticans are notoriously arguers (something that we have a strange sense of pride about at times), this task will be interesting to say the least.

In conclusion, while I would not say to abandon all caution, it appears that Antica may be safe for Shirerithian investment once again.

[Malliki Tosha]

Eh, what's my login?

[vasroe]

I believe I sent it to you via a PM on the Antican forums.

[Malliki Tosha]

Ah, found it. Thanks.

[Erik Mortis]

So, able to make use of my software?
I would be interested in seeing your banks software if that was possible.

(Why do some pages give one version number and other pages give yet another?)