Why I find IOTA alarming

  “In 2017, leaving your crypto algorithm vulnerable to 
  differential cryptanalysis is a rookie mistake. It says 
  that no one of any calibre analyzed their system, and that 
  the odds that their fix makes the system secure is low,” 
   

  Bruce Schneier, renowned security technologist, 
  about IOTA when we shared our attack.



  We discovered a vulnerability in IOTA after reviewing 
  their code on GitHub in July. We disclosed what we found 
  to the IOTA team on July 14th, and have been in contact 
  with them since then as we discovered new issues and 
  exploits. IOTA issued a patch that addresses the 
  vulnerabilities we found on August 7th. IOTA no longer has 
  the vulnerabilities we found, they have been fixed. To 
  learn more about the details of our attack, you can view 
  the full disclosure and review our attack examples.

https://github.com/mit-dci/tangled-curl

2. If every other cryptocurrency software team can impliment seed generation in their wallet software, why does IOTA refuse to?

3. Please read this comment from the CEO of IOTA, David Sønstebø on why he doesn't care if you lose money using IOTA: https://reddit.com/r/CryptoCurrency/comments/7gwl38/hello_gu...

The MIT-DCI are not credible..

Thank you. This article was useful for me, it showed what details of IOTA haven’t been highlighted yet. Below I list incorrect things from the article, if you find time it would be great if you paid more attention to them and shared your thoughts:

“IOTA has no limit on transactions and therefore, it has no limit on bandwidth requirements or disk space.” — In the future the majority of the nodes will be swarm nodes forming clusters and using Swarm Intelligence. A swarm can process more transactions than a single full node.

“This means, if you run a full IOTA node, anyone on the IOTA network can write data to your hard drive with just a small, extremely low cost proof-of-work.” — IOTA was created for the Internet-of-Things with network-bound PoW in mind, the current state of things is temporary.

“Over time, the IOTA transaction set size can grow unbounded, leaving only storage farms with the resources required to host the data.” — This is incorrect even for Bitcoin because of pruning techniques.

“My past experience working at companies that develop hardware products tells me this does not make sense in any other way but a marketing bullet.” — While this thing is likely correct I decided to list it here. IOTA team has experience working at companies developing hardware products too. Even more, I bet your smartphone contains a chip developed by one of our advisors.

“IOTA claims their Ternary-based Proof-of-Work function will work with IOT because it uses minimal power, but I contend that any power usage more significant than signing a transaction is too much because there is another alternative approach.” — As I already said, IOTA will be using network-bound PoW, which will be consuming less energy than required for a transaction signing.

“Contacting a central server run by the company that built the IOT device, announcing the need to submit a transaction at which point the centralized server will submit the transaction on the device’s behalf.” — You described the Internet, not the IoT. Please, refer to “Connectivity” section of https://iot.ieee.org/newsletter/march-2017/three-major-chall..., it explains why you are very wrong.

“In the case of IOTA the client software design intends to kick nodes off the network that do not participate enough, so being even just a passive listener is not an option.” — And again you talk about the Internet, not about the IoT. Googling for reasons of not using IP(v4/v6) should show you the mistake.

I don’t mention insignificant mistakes in your reasoning, all those seem to be caused by the lack of information about IOTA. This is an issue that the IOTA team is working on.

Getting a decentralized swarm to implement transaction processing is highly non-trivial, especially when (as the OP highlights) incentives are delicate and the entire system must be extremely secure.