IOTA Blog

The IOTA Foundation has claimed to be working on removing their central coordinator since at least late 2018 [1]. As the expression goes, "rumors of its death are greatly exaggerated". [1]: https://blog.iota.org/coordinator-part-1-the-path-to-coordicide-ee4148…

So this [1] is where they announced their "partnership" (which, to me, remains obscure in nature) with Microsoft. The blog post is long and features many well-made graphs, including pictures of "Data Silos" with a pictogram of a lock on it, slogans like "Data is the new Oil" in a subsection "Crudely put, data is the new crude", the famous DIKW Pyramid (Wisdom, Knowledge, Information, Data) and, my favourite, the title of a subsection "Data wants to be free, but not for free.". All the alarms on my bullshit meter are ringing after reading this. [1] https://blog.iota.org/iota-data-marketplace-cb6be463ac7f

The coordinator will be open-sourced and in all seriousness, even bitcoin had a sort of coordinator in the beginning, people aren't even forced to use it/can bypass it, but it's recommended to use it for now. So your statement isn't 100% valid. Regarding crypto, you can read their response & reasoning here: https://blog.iota.org/curl-disclosure-beyond-the-headline-1814048d08ef "The replacement Kerl hash function is unmodified KECCAK-384 that only converts its input and output from/to 243 trits to 48 bytes using basic two’s complement. KECCAK-384 is well vetted and researched."

Also from IOTA foundation statement: "Whether intentional or not, DCI’s report and subsequent refusal to follow proper disclosure procedure have caused misinformation about IOTA to continue circulating on social media. The latest round of attacks on Twitter attempts to undermine our recently announced corporate relationships — we find these attacks equally reprehensible. There is a reason why following proper disclosure protocols is so important, and we can only speculate as to why DCI refuses to comply. We have spent much more time than we intended to on discussing this issue ad nauseum, and we would like to put it to bed. However, we can’t do that without help from the DCI team. To that end, we propose the following: We hereby formally request DCI to complete the proper disclosure protocols: we call on Ethan, Neha and their team to release any and all code, documentation, research, etc., they have developed in conjunction with their findings. If DCI are unable or unwilling to release all of the aforementioned documents, we call on them to retract their report fully and issue a brief apology, after which we will drop the subject entirely with no harm done. If DCI do clarify and disclose their results fully, and a substantial and legitimate vulnerability is found, we will happily eat a slice of humble pie. We will own up to our mistake and apologize for it, thank them for helping us to improve the IOTA protocol, and reiterate our offer of a bounty reward as a token of…

1. There have been no vulnerabilities in the past. Please read: https://blog.iota.org/official-iota-foundation-response-to-the-digital… 2. If people are unable to generate a simple seed (password) on their own. How can they even begin to understand cryptocurrency or even new tech based on IoT? Still, yes it should be in the wallet and it will be added, but only for investors, I guess?! 3. Please read the following from their AMA: https://www.reddit.com/r/Iota/comments/7goul4/iota_founders_ama_summar… and https://www.reddit.com/r/Iota/comments/7tltz2/live_interview_with_davi… Is their market cap justified? Is the entire crypto market cap justified? The whole idea is to invest in tech that can change the future. Who knows which party will be the winner. It's a dare to believe in something magical, like IOTA. Or put your luck into something more real like Bitcoin, for example. Alas, it's good to have doubts, but this blogpost is alarming and not IOTA. PS: A small portion of my crypto investments are in IOTA, but never press your luck on a single coin.

I've looked a bit into IOTA over the past weeks because I was trying to understand how it actually works. I still do not fully understand how the Tangle structure actually functions as a process and/or how it solves scalability issues. If someone smarter than me could enlighten me on this, i would be very thankful. As far as I understand, one main difference between IOTA and classic blockchains is that there are no explicit mining nodes in the system who confirm all the transactions. Instead, if you issue a new transaction, you have to confirm (sign) 2 prior transactions first and do a little round of Proof-of-Work. These 2 prior transactions are called "tips" and are selected by a random walk. I'm not sure who exactly selects the tips (can you select the same ones over and over?) and if the correct tip selection is somehow enforced. There was a controversy about the homebrew "Curl-P" hash function (P supposedly means Prototype according to the author Come-From-Beyond, previously involved with NXT). After a bumpy responsible disclosure process, MIT researchers Neha Narula et al published these findings: https://github.com/mit-dci/tangled-curl/blob/master/vuln-iota.md and an accompanying Medium post. IOTA Foundation dismissed the vulnerability as non-practical, but switched part of their crypto to Keccak instead: https://blog.iota.org/curl-disclosure-beyond-the-headline-1814048d08ef So in the IOTA codebase, there is now "curl" (not to be confused with the HTTP library),…

IOTA Stiftung | Remote, Berlin, Tel Aviv | Full Time | https://blog.iota.org and https://iota.org The IOTA Foundation is a registered non-profit organisation based out of Berlin, Germany with the goal of promoting Distributed Ledger Technology (DLT) research and development - the current focus being the IOTA token and ecosystem. We are currently looking for: Ecosystem Software Engineer (f/m) You'll be involved in the development of PoCs with various industry partners. Most of our PoCs are currently done using React including the occasional server side component and you'll be able to make a serious impact on enabling widespread adoption of IOTA. Embedded experience is a plus. Systems Engineer (f/m) You'll be involved in the development of our current node software and further iterations on top of that. For a rough outline of these see [1]. The current node implementation is written in Java, but we're writing the next iteration in C11/C++14. Embedded experience is a plus. Email: [email protected] [1] https://blog.iota.org/iota-development-roadmap-74741f37ed01

The problem comes down to this; at the current stage, an attacker could very easily amass 33% of the hashpower of the network, because hashing only happens at the instants when new transactions are being added to the tree, and is completed in a second using a normal laptop. I was unable to find any information on how IOTA resolves this seemingly disturbing security issue on their website or in their whitepaper, but I did find the following information in two non-affiliated blogs (1, 2) after a lot of searching: > Milestones: Milestone is a special transaction issued by a special node called Coordinator. The Coordinator is run by Iota Foundation, its main purpose is to protect the network until it grows strong enough to sustain against a large scale attack from those who own GPUs. Milestones set general direction for the tangle growth and do some kind of checkpointing. Transactions (in)directly referenced by milestones are considered as confirmed. This means that IOTA in its current form does not provide any censorship resistance, since the path of the tree is centrally directed through a Coordinator node run by the IOTA Foundation. As such, IOTA is no more decentralized than an Apache Kafka cluster, or Ripple and their Unique Node List. I would argue that this is crucial information a user needs to know, yet I have no idea how the average person is intended to learn about this, since it’s nowhere to be found in the IOTA whitepaper or on their website. (EDIT: Since this…

After +1 hour reading things start to be surreal. IOTA team swapped their in-house hash algorithm "Curl" for their new in-house hash algorithm "Kerl" in https://github.com/iotaledger/iri/commit/539e413352a77b1db2042f46887e4… , while at the same day blogging about it and claiming their new in-house hash algorithm is actually SHA-3: https://blog.iota.org/upgrades-updates-d12145e381eb > "Therefore we have made the simple decision to temporarily switch Curl with Keccak (SHA-3) for cryptographic signing in IOTA."

I read the article. It's a technical overview of a website designed to scam users. It doesn't reflect in any way that IOTA as a tech is insecure. Your claims are not related in any way to the contents of the article, are overreaching and biased. The allegations you've mentioned have been debunked [1]. Seed is basically a password so it's understandable it's not generated by the client software but many tutorials exist on how to create a secure one [2][3]. [1] https://blog.iota.org/official-iota-foundation-response-to-the-digital… [2] https://iotasupport.com/gui-newseed.shtml [3] https://iota.guide/seed/how-to-generate-iota-wallet-seed/

You can read more concerns about IOTA and ternary in this thread: https://news.ycombinator.com/item?id=15980675 IOTA rebutted MIT here: https://blog.iota.org/official-iota-foundation-response-to-the-digital…

I value the MIT Media Lab and its DCI group pretty highly. There is nothing about the Media Lab or the DCI in that first link of yours. [1] So what were you trying to say? What I did find in that first link of yours [1] is this gem though: > The IOTA hash function, Curl-P, was designed to allow for practical collisions. The IOTA protocol’s security depends solely upon the one-wayness of the function, not its collision resistance. The rationale behind the design of Curl-P is a much more complicated question which we explain in detail. This statement is alarming on so many levels. [1] https://blog.iota.org/official-iota-foundation-response-to-the-digital… // edit: oops, I see now that it's a multipart post, so I'll have a look there. // edit: yeah okay, nothing of substance in the other parts either.

Hey, one of the authors here. Short answer - yes. Together with some meta data, the published content is signed by the author, encrypted (read more here on how exactly https://blog.iota.org/introducing-masked-authenticated-messaging-e55c1… and stored on the Tangle. Fog CMS helps with the content publishing and is one of the ways on how to read and display the content from the Tangle.

1: By using a ternary number system, the amount of devices and cycles can be reduced significantly. In contrast to two-state devices, multistate devices provide better radix economy with the option for further scaling 2: Why is explained here: https://blog.iota.org/the-transparency-compendium-26aa5bb8e260 - CyberCrypt is hired to review and audit it. 3: The wallet is secure and does what it needs to do, no, it's not very pretty or user friendly but it works. A new wallet (Trinity wallet) will be released very soon.

Every cryptocurrency have had their vulnerabilities at some time in the history, I don't see how this is relevant to the topic. Also he claims have been debunked by the IOTA team - https://blog.iota.org/curl-disclosure-beyond-the-headline-1814048d08ef…

Microsoft claimed the partnership with IOTA -- not the other way around: https://blog.iota.org/iotas-data-marketplace-setting-the-record-straig… The quote that set off this confusion: > We are excited to partner with IOTA foundation and proud to be associated with its new data marketplace initiative. This next generation technology will accelerate the connected, intelligent world and go beyond blockchain that will foster innovation real world solutions, applications and pilots for our customers. --Omkar Naik, Microsoft

* Coordinator is a mechanism put in place to aid the network in its infancy. Same as with Bitcoin. * I don't see the correlation between pre-mined and scammy. Please elaborate. In my view it eliminates greed/TX costs because there is no mining. * Has been discussed ad nauseam months ago, but here it is again https://blog.iota.org/upgrades-updates-d12145e381eb * ?

So much misinformation, where to begin. IOTA is using Keccak/SHA-3, then they are developing a new kind of LIGHTWEIGHT cryptographic primitive together with the world leaders of this field https://blog.iota.org/iota-foundation-hires-cybercrypt-615d2df79001

It's funny how they make a big deal about having a link to Microsoft, but Microsoft doesn't mention them at all. https://www.google.com/search?q=site:microsoft.com+iota The quote they have from Microsoft https://blog.iota.org/iota-data-marketplace-cb6be463ac7f appears to be from a sales guy https://www.linkedin.com/in/omkareshwar

The response of sorts from IOTA team, https://blog.iota.org/curl-disclosure-beyond-the-headline-1814048d08ef

Nope, all the coins have already been created (and I got some!!!). You will however be able to buy them on an exchange soon: https://blog.iota.org/exchange-launch-2d38c654349a

Imagine that Bitcoin Core Devs requested of Satoshi to move his coins to a new address or lose them, and then took away the mechanism to do so and went dark. Well, this is exactly what happened with IOTA. On Sep 15, 2023, IOTA.org stated that "once the smart contracts-based migration solution is established, the network will continue to service migrations for another two years before the ability to migrate tokens from the legacy network will end." (https://blog.iota.org/stardust-upgrade-iota-tokenomics/). However, on May 13, 2025, The IOTA Legacy Migration Tool repo maintainer announced that "Since the network upgrade on 5/5/2025 the legacy migrations are stopped and we'll share more information on how to proceed soon, the legacy migration tool is deprecated and doesn't work anymore, we will communicate next steps over official channels" (https://github.com/iotaledger/legacy-migration-tool/issues/158). This never happened. No response on when migrations will be reenabled has been provided. The repo itself has been locked. Email and Twitter messages are ignored. Reddit messages are not published. The following are sample user reports: timhoehner: https://github.com/iotaledger/legacy-migration-tool/issues/158 emotion_chip: https://www.reddit.com/r/Iota/comments/1kp8gap/iota_legacy_migration_t… Just-Job-6960: https://www.reddit.com/r/Iota/comments/1luyweh/have_a_paper_wallet_wit… iotamigrator:…

Thank you for your reply (and I don't understand the downvotes), but I can't say it really changed my view on the currency. >1. There have no vulnerabilities in the past. Please read: https://blog.iota.org/official-iota-foundation-response-to-t... Let's have a look then. It's in 4 parts, the first two are not about the purported vulnerability but rather complaining that the people behind the discovery didn't disclose it properly and might have a hidden agenda. Fair enough I guess, but it's odd to start with that, it would make a much better point if it came after a strong rebuttal regarding the technical aspects of the vulnerability. Then we get to the meat of the issue in the middle of page 3: >2. IOTA Protocol Security and Tangle Reliability So they start by addressing the "IOTA's coordinator is a single point of failure". Their reply is that... It's true but they never pretended that it was otherwise and that it's temporary: >IOTA node operators, understanding the importance of the Coordinator’s role in securing the network while it is still young, voluntarily suspended operations during this time. >The purpose of the Coordinator in the infancy stage of the IOTA network has been transparently communicated throughout the history of IOTA. As the team has explained at length, the Coordinator is a temporary measure to help bootstrap the network and protect it during its infancy. Once there are enough full nodes and transactions to secure and sustain the IOTA network,…

I expect more from the HN community. Are you guys doing your homework before commenting? Doesn't seem so. 1. about crypto Every time there is some news about iota here the usual 'don't roll your own crypto' comes up. Yes, I think everyone agrees that doing that, if you don't know what you are doing, is dangerous. This is especially the case for you app and web developers. You guys have no business rolling your own crypto. But think about it, if nobody rolls their own crypto then how will crypto progress? Their use case is valid, they need something lightweight for IoT. They are trying to push the current state of the art. They hired a company to help them improve their algorithms. https://blog.iota.org/iota-foundation-hires-cybercrypt-615d2df79001 2. about 'fake' corporate partnerships There is already so much clarification to be found via google but let me repeat. We had this blog post announcing the data marketplace: https://blog.iota.org/iota-data-marketplace-cb6be463ac7f where some quotes from companies can be found. The mass media took this and interpreted it the way they wanted to. I mean just check headlines in newspapers etc. They are 90% bullshit. And because of that you give the iota people so much flack? You denounce them as liars and whatnot. Very unprofessional. They never themselves said 'we have a formal partnership with Microsoft'. It's the people writing news articles, writing reddit comments, doing YouTube videos that interpret things, and other…

I feel like sharing a curious e-mail encounter I had with IOTA founder David Sønstebø. After writing a blog post about the limitations of the Bitcoin blockchain, which got some attention on HN[1], I received an e-mail by someone named David (I didn't know who he was at the time), asking me: > Hey Rune, > I read your interesting article analysis of Bitcoin limitations. I was wondering if you have had any time to check out IOTA (www.iota.org) and the p2p Flash Network within it (https://blog.iota.org/instant-feeless-flash-channels-88572d9a4385)? > [..] Assuming this was just some random person asking for my opinion on IOTA, I replied with a critique, pointing out two weaknesses I was familiar with: > The only thing I know about IOTA is that it’s centralized, through the so-called Coordinator. This makes it uninteresting to me. As I understand, the IOTA team argues that this is just a preliminary precaution, which will change as the size of the network grows, but I’m skeptical of this claim. In any case, until it actually becomes decentralized, I don’t think I will have enough interest in it to learn how it works. So I think I will wait for this to happen before taking the time to learn about the system. Also, I know that the IOTA team designed their own hash function, which turned out to be vulnerable to collision attacks, which sounds rather amateurish to me. He promptly replied to this critique -- which I thought I was offering someone seeking advice on the soundness…