5 ms·

Bitcore – A pure JavaScript Bitcoin API

138 points by eordano 12y ago

PhrosTT 12y ago
Looks awesome. Cryptocurrency development has seemed pretty intimidating to me but this is probably the going to be the push that gets me started supporting tip sharing features on my site.
- billrobertson42 12y ago
  Coinbase has easy integration of that does it not?
- IkmoIkmo 12y ago
  Look into Coinbase's tip service: https://www.coinbase.com/tip https://www.coinbase.com/tip As well as ChangeTip: https://www.changetip.com/ https://www.changetip.com/ It might be what you're looking for, unless you want to custom build something. In that case also give Chain.com a look as well as Blockcypher.com. Coinbase also has some nice developer products, their api: coinbase.com/docs/api/overview and if you want to do anything relating to raw bitcoin data (the blockchain and all transactions) i.e., run a node, I'd recommend Toshi.io, an open-source node that is very easy to query. Quite a few people run this thing on an AWS tier. Hope that helps if you want to dabble with a bitcoin project for your site :)
panhandlr 12y ago
Looks like they built their NSA spy module out of coffeescript, neato
- knowaveragejoe 12y ago
  Huh?
  - panhandlr 12y ago
    In today's climate I would be extremely weary of npm installing any core bitcoin tech without a serious line by line audit of the source.
    - taylorwc 12y ago
      Why would this be more true of npm than any other package manager for any scripting language?
      - elif 12y ago
        I would guess his paranoia is more general than directed at npm directly. However, it's a fair point that NPM allows anyone to push projects with no oversight, whereas many other package manager inventories are maintained and curated.
jxm262 12y ago
This looks very well done! Starred on github :)
afandian 12y ago
This looks more like a library than an API. I wonder why the decision was made to market it this way.
- haakon 12y ago
  All libraries expose an API, which is its set of public functions.
  - afandian 12y ago
    Sure but it seems strange way to discuss it. Unless it's an API that wraps some existing library.
    - jxm262 12y ago
      I believe haakon is correct on this one, unless I'm missing something. We just got into an argument at my work over the correct usage of the term "api", but found this post to back up my arguments - http://stackoverflow.com/questions/8772746/difference-between-framework-vs-library-vs-ide-vs-api-vs-sdk-vs-toolkits http://stackoverflow.com/questions/8772746/difference-betwee... Anyway, I'm not trying to nitpick or keep this side-discussion alive. But I'm genuinely curious how most people classify the difference between api and library. Also on a sidenote, who's downvoting all the comments and the thread itself? This seems like a really cool project and it doesn't look like anyone's posted anything completely irrelevant here.
      - IkmoIkmo 12y ago
        > Also on a sidenote, who's downvoting all the comments and the thread itself? The thread itself, no clue, how can you even see that? I'd assume there's quite a bit of people who get tired of hearing about bitcoin though. It's a bit like how I really, really didn't feel like hearing about social media being the biggest thing ever years back, until it became something actually substantial recently. As for the comments, all I see is 'oh cool, awesome'. HN doesn't like that, you just use upvoting to show appreciation. Anyway, I can't help but say it's pretty awesome, too. Bitpay's definitely been doing some great open-source work to create a bitcoin library that works as well (and similarly) in the browser as server side, it's really nice to work with and very comprehensive, too. I wish they had a little showcase page going where they point you to projects that use it, though. Their own Copay does for example, a shared wallet which I've tried a couple times, works very nicely.
jonpaul 12y ago
It's an exciting time to be a JavaScript developer for Bitcoin. There are a number of JavaScript libraries for Bitcoin. Here is a comprehensive list of alternatives to Bitcore: - https://github.com/bitcoinjs/bitcoinjs-lib https://github.com/bitcoinjs/bitcoinjs-lib (one of the best) - https://github.com/indutny/bcoin https://github.com/indutny/bcoin (Indutny's work is found throughout Node.js and is the basis of elliptic curve cryptography in Bitcore) - https://github.com/ryanxcharles/fullnode https://github.com/ryanxcharles/fullnode (ex-developer of Bitcore and now engineer at Reddit behind Reddit's crypto currency initiative) - http://cryptocoinjs.com/ http://cryptocoinjs.com/ (disclosure: I started this one) Here is an older article that I wrote about understanding how an Address is created (still valid, but using an older version of bitcoinjs-lib): http://procbits.com/2013/08/27/generating-a-bitcoin-address-with-javascript http://procbits.com/2013/08/27/generating-a-bitcoin-address-... The cool thing is that you can use test Bitcoins without any risk to learn how to program for Bitcoin. Use these faucets: http://tpfaucet.appspot.com/ http://tpfaucet.appspot.com/ and http://faucet.xeno-genesis.com/ http://faucet.xeno-genesis.com/ Here is a very simple wallet that I built to demonstrate how easy it is to build one: https://github.com/coinbolt/simple-wallet https://github.com/coinbolt/simple-wallet Finally, an open source app to test the purchasing experience of Bitcoin: https://github.com/coinbolt/catshop https://github.com/coinbolt/catshop
- lectrick 12y ago
  Since you'd be the most likely person to know here, what javascript VM's will give you known-secure PRNG's, and which won't? I think that's a pretty important thing to clarify if you're creating/signing transactions via JS.
  - bgfuller 12y ago
    A deterministic K is used in many of these libraries, so randomness isn't needed at the time of signing transactions. window.crypto and the Node.js crypto library are often used for private key generation.
deleted 12y ago
[deleted]
omarforgotpwd 12y ago
Awesome project. Hopefully nobody makes anything serious using it in the browser.
jordanbaucke 12y ago
I am wondering if anyone has some thoughts on the security of this in a web-application? Storing the private keys in a database connected to one's web-app is just a bad idea right? So than it just becomes a proxy to the Bitcoind installation via JSON-RPC? Would it be considered safe to encrypt user's private keys via their password+hash+salt the same way I'm storing their passwords?
- eordano 12y ago
  Yep, storing your bitcoins in a plain web app is definitely a bad idea. The current trend in the bitcoin space is a mixture of: * Discouraging the use of the webapp (if any available) in favor of a browser application (chrome app, firefox app, etc) * 2 factor auth to login * Bitcoin "multisig" transactions: require at least N out of M valid private keys (allowing the storage of these keys to be on different devices/services/media) before releasing funds And of course encryption before storage.
ytimoschenko 12y ago
Core Bitcoin: https://github.com/oleganza/CoreBitcoin https://github.com/oleganza/CoreBitcoin Bitcoin Core: https://github.com/bitcoin/bitcoin https://github.com/bitcoin/bitcoin Now it is Bitcore. Project names are hardly distinguishable, feels kind of messy.
Humjob 12y ago
I have a question about bitcoin in general - how do transactions on the network get verified? Does it mostly happen through miners? If so, what happens when mining reaches the point where it becomes economically worthless to everyone except a few electricity thieves? Will there just be a massive backlog of unprocessed transactions? Unless I'm wrong somehow, I could see this becoming especially problematic as bitcoin becomes more popular and the daily transaction volume grows. How does the bitcoin foundation/community plan to tackle this issue?
- gus_massa 12y ago
  Transaction Fees: http://bitcoinfees.com/ http://bitcoinfees.com/ > The fees go to the miners to incentivise them to keep mining, which in turn keeps the Bitcoin network secure. They already get a reward of 25 XBT for each block they mine, but this reward halves every 4 years. The plan is that as the block reward diminishes over the time, it will be replaced by transaction fees.
- rockyleal 12y ago
  This is clearly not the place to ask this question about mining. This is a thread about a software development on a whole different side of Bitcoin. If you are genuinely curious about the theme of your question, and not just interested in derailing threads, you are very welcome to educate yourself at bitcointalk, the main Bitcoin forum. There have been thousands -if not millions- of man hours in thinking, development, research and debate about the topics you enquire about. Head there and find the answers, and if still in doubt don't be afraid to ask (on an appropriate thread).
- Arnavion 12y ago
  >If so, what happens when mining reaches the point where it becomes economically worthless to everyone except a few electricity thieves? The difficulty of mining is represented by a certain target number. The process of mining involves finding another number (the nonce) such that the hash of the transactions and that nonce together is less than the target. The smaller the target is, the less possible solutions exist, and the more nonces you'd have to guess before you find one that satisfies the condition. This difficulty is self-adjusting based on how long it took to find the previous 2016 blocks (at an average of 1 block every 10 minutes this is 2 weeks). If the previous 2016 blocks were found faster than an average of 1 every 10 minutes, then the difficulty will be increased so that the next 2016 go closer to 1 every 10 minutes, and vice versa. (There is a clamp on the change of 25% if I remember correctly, so it won't change drastically.) The assumption in the end is that these few electricity thieves will not have so much hashpower that they will be able to drive up the difficulty so high the rest of the non-thieves can get profits from their miners.

138 points by eordano 12y ago

Looks awesome. Cryptocurrency development has seemed pretty intimidating to me but this is probably the going to be the push that gets me started supporting tip sharing features on my site.

billrobertson42 12y ago
Coinbase has easy integration of that does it not?
IkmoIkmo 12y ago
Look into Coinbase's tip service: https://www.coinbase.com/tip https://www.coinbase.com/tip As well as ChangeTip: https://www.changetip.com/ https://www.changetip.com/ It might be what you're looking for, unless you want to custom build something. In that case also give Chain.com a look as well as Blockcypher.com. Coinbase also has some nice developer products, their api: coinbase.com/docs/api/overview and if you want to do anything relating to raw bitcoin data (the blockchain and all transactions) i.e., run a node, I'd recommend Toshi.io, an open-source node that is very easy to query. Quite a few people run this thing on an AWS tier. Hope that helps if you want to dabble with a bitcoin project for your site :)

panhandlr 12y ago

Looks like they built their NSA spy module out of coffeescript, neato

knowaveragejoe 12y ago
Huh?
- panhandlr 12y ago
  In today's climate I would be extremely weary of npm installing any core bitcoin tech without a serious line by line audit of the source.
  - taylorwc 12y ago
    Why would this be more true of npm than any other package manager for any scripting language?
    - elif 12y ago
      I would guess his paranoia is more general than directed at npm directly. However, it's a fair point that NPM allows anyone to push projects with no oversight, whereas many other package manager inventories are maintained and curated.

jxm262 12y ago

This looks very well done! Starred on github :)

afandian 12y ago

This looks more like a library than an API. I wonder why the decision was made to market it this way.

haakon 12y ago
All libraries expose an API, which is its set of public functions.
- afandian 12y ago
  Sure but it seems strange way to discuss it. Unless it's an API that wraps some existing library.
  - jxm262 12y ago
    I believe haakon is correct on this one, unless I'm missing something. We just got into an argument at my work over the correct usage of the term "api", but found this post to back up my arguments - http://stackoverflow.com/questions/8772746/difference-between-framework-vs-library-vs-ide-vs-api-vs-sdk-vs-toolkits http://stackoverflow.com/questions/8772746/difference-betwee... Anyway, I'm not trying to nitpick or keep this side-discussion alive. But I'm genuinely curious how most people classify the difference between api and library. Also on a sidenote, who's downvoting all the comments and the thread itself? This seems like a really cool project and it doesn't look like anyone's posted anything completely irrelevant here.
    - IkmoIkmo 12y ago
      > Also on a sidenote, who's downvoting all the comments and the thread itself? The thread itself, no clue, how can you even see that? I'd assume there's quite a bit of people who get tired of hearing about bitcoin though. It's a bit like how I really, really didn't feel like hearing about social media being the biggest thing ever years back, until it became something actually substantial recently. As for the comments, all I see is 'oh cool, awesome'. HN doesn't like that, you just use upvoting to show appreciation. Anyway, I can't help but say it's pretty awesome, too. Bitpay's definitely been doing some great open-source work to create a bitcoin library that works as well (and similarly) in the browser as server side, it's really nice to work with and very comprehensive, too. I wish they had a little showcase page going where they point you to projects that use it, though. Their own Copay does for example, a shared wallet which I've tried a couple times, works very nicely.

jonpaul 12y ago

It's an exciting time to be a JavaScript developer for Bitcoin. There are a number of JavaScript libraries for Bitcoin. Here is a comprehensive list of alternatives to Bitcore: - https://github.com/bitcoinjs/bitcoinjs-lib https://github.com/bitcoinjs/bitcoinjs-lib (one of the best) - https://github.com/indutny/bcoin https://github.com/indutny/bcoin (Indutny's work is found throughout Node.js and is the basis of elliptic curve cryptography in Bitcore) - https://github.com/ryanxcharles/fullnode https://github.com/ryanxcharles/fullnode (ex-developer of Bitcore and now engineer at Reddit behind Reddit's crypto currency initiative) - http://cryptocoinjs.com/ http://cryptocoinjs.com/ (disclosure: I started this one) Here is an older article that I wrote about understanding how an Address is created (still valid, but using an older version of bitcoinjs-lib): http://procbits.com/2013/08/27/generating-a-bitcoin-address-with-javascript http://procbits.com/2013/08/27/generating-a-bitcoin-address-... The cool thing is that you can use test Bitcoins without any risk to learn how to program for Bitcoin. Use these faucets: http://tpfaucet.appspot.com/ http://tpfaucet.appspot.com/ and http://faucet.xeno-genesis.com/ http://faucet.xeno-genesis.com/ Here is a very simple wallet that I built to demonstrate how easy it is to build one: https://github.com/coinbolt/simple-wallet https://github.com/coinbolt/simple-wallet Finally, an open source app to test the purchasing experience of Bitcoin: https://github.com/coinbolt/catshop https://github.com/coinbolt/catshop

lectrick 12y ago
Since you'd be the most likely person to know here, what javascript VM's will give you known-secure PRNG's, and which won't? I think that's a pretty important thing to clarify if you're creating/signing transactions via JS.
- bgfuller 12y ago
  A deterministic K is used in many of these libraries, so randomness isn't needed at the time of signing transactions. window.crypto and the Node.js crypto library are often used for private key generation.

deleted 12y ago

[deleted]

omarforgotpwd 12y ago

Awesome project. Hopefully nobody makes anything serious using it in the browser.

jordanbaucke 12y ago

I am wondering if anyone has some thoughts on the security of this in a web-application? Storing the private keys in a database connected to one's web-app is just a bad idea right? So than it just becomes a proxy to the Bitcoind installation via JSON-RPC? Would it be considered safe to encrypt user's private keys via their password+hash+salt the same way I'm storing their passwords?

eordano 12y ago
Yep, storing your bitcoins in a plain web app is definitely a bad idea. The current trend in the bitcoin space is a mixture of: * Discouraging the use of the webapp (if any available) in favor of a browser application (chrome app, firefox app, etc) * 2 factor auth to login * Bitcoin "multisig" transactions: require at least N out of M valid private keys (allowing the storage of these keys to be on different devices/services/media) before releasing funds And of course encryption before storage.

ytimoschenko 12y ago

Core Bitcoin: https://github.com/oleganza/CoreBitcoin https://github.com/oleganza/CoreBitcoin Bitcoin Core: https://github.com/bitcoin/bitcoin https://github.com/bitcoin/bitcoin Now it is Bitcore. Project names are hardly distinguishable, feels kind of messy.

Humjob 12y ago

I have a question about bitcoin in general - how do transactions on the network get verified? Does it mostly happen through miners? If so, what happens when mining reaches the point where it becomes economically worthless to everyone except a few electricity thieves? Will there just be a massive backlog of unprocessed transactions? Unless I'm wrong somehow, I could see this becoming especially problematic as bitcoin becomes more popular and the daily transaction volume grows. How does the bitcoin foundation/community plan to tackle this issue?

gus_massa 12y ago
Transaction Fees: http://bitcoinfees.com/ http://bitcoinfees.com/ > The fees go to the miners to incentivise them to keep mining, which in turn keeps the Bitcoin network secure. They already get a reward of 25 XBT for each block they mine, but this reward halves every 4 years. The plan is that as the block reward diminishes over the time, it will be replaced by transaction fees.
rockyleal 12y ago
This is clearly not the place to ask this question about mining. This is a thread about a software development on a whole different side of Bitcoin. If you are genuinely curious about the theme of your question, and not just interested in derailing threads, you are very welcome to educate yourself at bitcointalk, the main Bitcoin forum. There have been thousands -if not millions- of man hours in thinking, development, research and debate about the topics you enquire about. Head there and find the answers, and if still in doubt don't be afraid to ask (on an appropriate thread).
Arnavion 12y ago
>If so, what happens when mining reaches the point where it becomes economically worthless to everyone except a few electricity thieves? The difficulty of mining is represented by a certain target number. The process of mining involves finding another number (the nonce) such that the hash of the transactions and that nonce together is less than the target. The smaller the target is, the less possible solutions exist, and the more nonces you'd have to guess before you find one that satisfies the condition. This difficulty is self-adjusting based on how long it took to find the previous 2016 blocks (at an average of 1 block every 10 minutes this is 2 weeks). If the previous 2016 blocks were found faster than an average of 1 every 10 minutes, then the difficulty will be increased so that the next 2016 go closer to 1 every 10 minutes, and vice versa. (There is a clamp on the change of 25% if I remember correctly, so it won't change drastically.) The assumption in the end is that these few electricity thieves will not have so much hashpower that they will be able to drive up the difficulty so high the rest of the non-thieves can get profits from their miners.