by Christian Murray and Christopher Allen with Jo
Price feeds for Bitcoin can be a privacy hole when wallets, users, or automated tools access them without using Tor or a secure proxy. If a user's wallets or tools access a preconfigured price feed, the user is potentially vulnerable to Sybil attacks. Spotbit's purpose is to allow users to access price feeds in a customisable way that preserves privacy and mitigate the reliance on a single source of data.
Spotbit is a portable API for Bitcoin price data and candles. It can aggregate data from over 100 exchanges and serve them from a single URL or using Tor as an onion hidden service. It is configurable so that the user can decide which base currencies to use (USDT, USD, EUR etc), and which exchanges to use for price data.
Users may choose to run their own local Spotbit server, or to connect to a hosted Spotbit service.
- Privacy. Spotbit can work as a Tor hidden service.
- Reliability. Spotbit aggregrates information using the exchanges/sources you configure, making your pricing data more trustworthy.
- Self-sovereignty. Spotbit can run from your server.
- Fetch Bitcoin prices from a set of exchanges.(See the API documentation here)
- Produce a beancount report of the transactions associated with a Bitcoin descriptor.
- Web front-end with price data visualisation.
- Spotbit depends on the CCXT which provides an abstraction for API access to cryptocurrency exchanges.
A spotbit instance is currently running at http://r5sru63gzyrnaayaua2ydo32f4hf6vd33bq6qmtktx3wjoib2cwi2gqd.onion. This instance is on a dedicated Blockchain Commons server.
Spotbit is intended for integration with the Gordian system, which consists of Tor-gapped components such as Gordian Wallet and a Gordian Server or other server installed by Bitcoin Standup scripts.
Spotbit is a microservice intended to help realise the Gordian Principles underpinning Blockchain Commons' Gordian technology stack and the Gordian Architecture. These principles are:
- Independence. Users can choose which applications to use within an open ecosystem.
- Privacy. Airgaps provide data with strong protection, while torgaps do the same for networked interactions.
- Resilience. The paritioned design minimizes Single Points of Compromise.
- Openness. Airgaps and torgaps are connected via standard specifications such as URs, which allow anyone to add apps to the ecosystem.
Blockchain Commons apps do not phone home and do not run ads. Some are available through various app stores; all are available in our code repositories for your usage.
Spotbit is currently under active development and in the late alpha testing phase. It should not be used for production tasks until it has had further testing and auditing.
- Beancount reporting improvements
- Ref. #61
- Spotbit should process transaction records as CSVs from:
- Fee estimation API
- Ref. BlockchainCommons/Community#22 (comment))
- Spotbit should connect to an Esplora in order to obtain fee estimates
- Connect via Tor-gap to Esplora/Core
- Add a configuration option that specifies Tor proxy URL and port .
- Test that Tor client is installed on the server.
- Modify requests to use a Tor proxy.
- Add a configuration option that specifies Tor proxy URL and port .
- Front-end improvements
- Ref. #59
- The front-end should visualize useful data from the API and allow the user to query the API.
- Show the current configuration of the Spotbit instance.
- Migrate front-end to current API.
- Show current prices from configured exchanges.
- Display relevant (to be determined by what is useful) data from existing API endpoints.
- Improve releases and builds.
Requirements
- Python3.10+
- Nodejs
Create a virtual environment
python -m venv env/
Activate virtual environment
source env/bin/activate
Install dependencies
python -m pip install -r requirements.txt
Run
python app.py
Spotbit includes a script called installSpotbit.sh which installs Spotbit and configures Tor on a Debian-based linux system.
$ git clone https://github.com/BlockchainCommons/spotbit.git
$ cd spotbit
$ chmod +x installSpotbit.sh
$ sudo -s source ./installSpotbit.sh The installer will:
- Install and setup tor on your system,
- Create a user named
spotbitin aspotbitgroup that controls the hidden service directory location at/var/lib/tor/spotbit. - Copy Spotbit sourcecode to
/home/spotbit/source- The user should update the default
spotbit.configwith their desired configuration.
- The user should update the default
- Create a
systemdservice unit file in/etc/systemd/system. - Set up a Tor hidden service for Spotbit.
To run the server, run sudo systemctl start spotbit.
You can check on a spotbit's status at any time by running sudo systemctl status spotbit, or take a look at the log file in /home/spotbit/source/spotbit.log.
The Spotbit API schema can be found by browsing to: http://localhost:5000/docs
Unless otherwise noted (either in this /README.md or in the file's header comments) the contents of this repository are Copyright © 2020 by Blockchain Commons, LLC, and are licensed under the spdx:BSD-2-Clause Plus Patent License.
In most cases, the authors, copyright, and license for each file reside in header comments in the source code. When it does not, we have attempted to attribute it accurately in the table below.
This table below also establishes provenance (repository of origin, permalink, and commit id) for files included from repositories that are outside of this repo. Contributors to these files are listed in the commit history for each repository, first with changes found in the commit history of this repo, then in changes in the commit history of their repo of their origin.
| File | From | Commit | Authors & Copyright (c) | License |
|---|---|---|---|---|
| exception-to-the-rule.c or exception-folder | https://github.com/community/repo-name/PERMALINK | https://github.com/community/repo-name/commit/COMMITHASH | 2020 Exception Author | MIT |
To use Spotbit you'll need to use the following tools:
- Python3.8 or higher (some libraries don't work as needed on older versions of Python)
- Pip
- Flask
- CCXT -
All of these Python libraries can be installed via pip and Python3.8 can be installed for you in the install script.
Spotbit aims to provide an easy option for aggregating exchange data that does not require the use of a third party data website like Coinmarketcap. These data can be used inside of other apps or for personal use / analysis. Acquiring data across many exchanges can be a pain because normally one would need write slightly different code in order to interact with each API.
This Spotbit project is either derived from or was inspired by the need of Fully Noded 2 to display realtime price info in-app:
- FullyNoded 2 — The mobile app for managing a BTC node via Tor, by Fonta1n3.
Spotbit is a project of Blockchain Commons. We are proudly a "not-for-profit" social benefit corporation committed to open source & open development. Our work is funded entirely by donations and collaborative partnerships with people like you. Every contribution will be spent on building open tools, technologies, and techniques that sustain and advance blockchain and internet security infrastructure and promote an open web.
To financially support further development of Spotbit and other projects, please consider becoming a Patron of Blockchain Commons through ongoing monthly patronage as a GitHub Sponsor. You can also support Blockchain Commons with bitcoins at our BTCPay Server.
We encourage public contributions through issues and pull requests! Please review CONTRIBUTING.md for details on our development process. All contributions to this repository require a GPG signed Contributor License Agreement.
The best place to talk about Blockchain Commons and its projects is in our GitHub Discussions areas.
Gordian Developer Community. For standards and open-source developers who want to talk about interoperable wallet specifications, please use the Discussions area of the Gordian Developer Community repo. This is where you talk about Gordian specifications such as Gordian Envelope, bc-shamir, Sharded Secret Key Reconstruction, and bc-ur as well as the larger Gordian Architecture, its Principles of independence, privacy, resilience, and openness, and its macro-architectural ideas such as functional partition (including airgapping, the original name of this community).
Gordian User Community. For users of the Gordian reference apps, including Gordian Coordinator, Gordian Seed Tool, Gordian Server, Gordian Wallet, and SpotBit as well as our whole series of CLI apps. This is a place to talk about bug reports and feature requests as well as to explore how our reference apps embody the Gordian Principles.
Blockchain Commons Discussions. For developers, interns, and patrons of Blockchain Commons, please use the discussions area of the Community repo to talk about general Blockchain Commons issues, the intern program, or topics other than those covered by the Gordian Developer Community or the Gordian User Community.
As an open-source, open-development community, Blockchain Commons does not have the resources to provide direct support of our projects. Please consider the discussions area as a locale where you might get answers to questions. Alternatively, please use this repository's issues feature. Unfortunately, we can not make any promises on response time.
If your company requires support to use our projects, please feel free to contact us directly about options. We may be able to offer you a contract for support from one of our contributors, or we might be able to point you to another entity who can offer the contractual support that you need.
The following people directly contributed to this repository. You can add your name here by getting involved. The first step is learning how to contribute from our CONTRIBUTING.md documentation.
| Name | Role | Github | GPG Fingerprint | |
|---|---|---|---|---|
| Christopher Allen | Principal Architect | @ChristopherA | <[email protected]> | FDFE 14A5 4ECB 30FC 5D22 74EF F8D3 6C91 3574 05ED |
| Christian Murray | Lead Developer | @watersnake1 | <[email protected]> | 9A44 D707 5580 A022 8A99 8CEC 0178 C17E 95C7 BA35 |
| Jo | Install Script Developer | @jodobear | <> | EE06 0B4A 9AED 976B 7CBD B3A0 3A9C 7E87 3028 4351 |
| Gautham Ganesh Elango | Developer, Integration with Gordian Wallet, Testing | @gg2001 | <[email protected]> | AB93 8223 226D 9511 4499 A6E5 420E 32E3 5B3F DBA2 |
We want to keep all of our software safe for everyone. If you have discovered a security vulnerability, we appreciate your help in disclosing it to us in a responsible manner. We are unfortunately not able to offer bug bounties at this time.
We do ask that you offer us good faith and use best efforts not to leak information or harm any user, their data, or our developer community. Please give us a reasonable amount of time to fix the issue before you publish it. Do not defraud our users or us in the process of discovery. We promise not to bring legal action against researchers who point out a problem provided they do their best to follow the these guidelines.
Please report suspected security vulnerabilities in private via email to [email protected] (do not use this email for support). Please do NOT create publicly viewable issues for suspected security vulnerabilities.
The following keys may be used to communicate sensitive information to developers:
| Name | Fingerprint |
|---|---|
| Christopher Allen | FDFE 14A5 4ECB 30FC 5D22 74EF F8D3 6C91 3574 05ED |
| Christian Murray | 9A44 D707 5580 A022 8A99 8CEC 0178 C17E 95C7 BA35 |
You can import a key by running the following command with that individual’s fingerprint: gpg --recv-keys "<fingerprint>" Ensure that you put quotes around fingerprints that contain spaces.