As you all know, once we are out of beta, there will be two markets: Absolem and Havana. Absolem is the main market consisting of drugs and drug paraphernalia, while Havana is a naturals only filter of Absolem. No, vendors will not need to log into two sites every day; Absolem and Havana are the same market, but if you use the Havana URL, any "hard" drugs will be filtered out. This means that you can use the same account for both sites and you can control everything on your account from one site. It also means vendors that deal with natural drugs will only need to upload their listings on one market to be displayed on both.
Now to some questions:
Why is the market USA only?
Havana is USA only just for beta. We have done this so that we can make sure we have the infrastructure we need before we let everyone on. Once we are out of beta, we will begin rolling out to more and more countries until we are positive our site can handle the traffic. After that, we will open our doors to every country.
Why is one of the vendor requirements a 4.7 rating? That's not very good
The 4.7 rating is just a requirement so that we don't have a bunch of 1-4 star vendors flooding us with invite requests. Just because a vendor has at least a 4.7 rating doesn't mean they are automatically invited. We do research on the vendor before we decide whether or not to invite them.
When you say that multisig is "effortless and transparent from the buyer's side of the transaction" do you mean multi-sig in general, or specifically as implemented on Havana/Absolem?
There is one main flaw that we believe is holding Multi-Sig back; there has been no good user interface. This is what we are trying to fix with BitSigner, an open-source, offline javascript applet based on the popular Coinb.in. With this app you are easily able to generate a keypair with a username/password, verify the redeem script, and verify/sign transaction scripts. The best feature (and the feature we are most proud of) is verifying/signing transaction scripts. What we have done is made it possible to quickly verify and sign multiple transactions in succession. Also, if you are skeptical about using a username/password to generate your keypair, you can use your own keypair and still use the verification/signing function!
Wait, isn't javascript unsafe?
It is true that malicious Javascript has been used in the past to deanonymize users. However, this requires that 1, the Javascript is malicious and 2, the user is online. It is for these reasons we have made BitSigner open-source and recommend that BitSigner be used offline. If you use BitSigner offline, it is impossible to deanonymize you, even if it is a malicious version. IMPORTANT: Only download BitSigner from the official BitSigner repository below over HTTPS. If you download it from somewhere else it is most likely a malicious version.
If you want to be super safe you can use md5sums to verify the integrity of the download. From version 1.0.1 and on I will include a pgp signed message with the md5sums SHA256sums, SHA512sums, and Whirlpool sums for the .zip and the .tar.gz downloads. You can find my PGP key here.
BitSigner: https://github.com/ProbableFire/BitSigner/releases/latest
So, not to be a hater, but there's a couple of
SERIOUS RED FLAGS
here.
Owner/operator of a market (i.e., extremely high-value target in LE's eyes) has doxxed their own GitHub username, and most of GitHub's functions (at least in the www interface) require JavaScript in the browser... sure, hopefully you're using the command line, but something tells me you're not... If not, this is basically an easy-peasy means for LE to bag you - they just send a "lawful request" to GitHub to serve some malicious, malware-loading JavaScript to whoever logs in to the site as "ProbableFire."
MD5, dawg? Seriously? You're gonna use a hash that's been horrendously broken and insecure for nearly ten years, that government agencies have already been known to exploit the weaknesses of in order to serve malware to high-value targets? Seriously? That's what you're doing? Do you even know what you're doing? If you want to go this kind of route (though there's no reason; see below), at least use some member of SHA-2 (sha256, sha512, etc.) and/or Whirlpool or something. Ideally, though, you should provide multiple hashes from multiple families, like how Gentoo signs their release digests.
But what you're doing is a stupid and awful hack, anyway, because Git supports directly GPG-signed tags and commits. You should use them, and then for the less technical users, you can still provide multiple digests (like sha256 and whirlpool) for the archive downloads, as a GPG-signed message, in your release comments, (un)like you do now.
This:
Is total bullshit, and you need to stop saying it to anyone, right now. A malicious JS download, even executed offline, can infect a machine with a loader that will download a complete malware package at the first chance it gets at being online. It can be content to wait.
There's more, too, but I don't have time to get into it all.
In all honesty, yo, all this points to two very troubling problems with your operator(s):
Way too cocky, and,
Don't know shit about real infosec and netsec.
Among random users of this sub, I don't mind that (although I try to improve it). Among a supposed marketplace operator, those two things are a really fucking serious problem.
In my opinion, you really need to shape up, or this stuff will come back to bite you and/or your users in the ass - unless that's what you're going for?