Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

211–220 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#211

Post by ynniv »

sskates wrote: post #188
tptacek wrote: post #155

Earlier quoted context omitted.

You're effectively asking whether apartments rented to unchecked strangers for days at a time are more prone to abuse than apartments rented months or years at a time. There is a reason hotels require "special use" zoning exceptions in cities, and it's not because Mariott and Hyatt have captured the city council; it's often the residents who create uproars when those exceptions are granted.

I'm not sure if we're talking about the same thing, we might be, we might not be. You are talking about renting apartments to unchecked strangers for days and I am talking about people renting out their apartment on AirBnB. There's some relationship between the two sets but I don't think they're equivalent. Regardless, is there evidence for the claim that crime and abuse of non-tenants is higher for either the set yo…

I haven't looked, but my intuition is that the differences are so pronounced that finding data should not be difficult. I would not want my neighbors regularly renting their apartment while they are out of town. There is already a substantial enough difference in decorum and responsibility between owners and renters that condo associations as well as the mortgage industry (as well as FHA) establish maximum renter to owner ratios.

I live in a high rise that also contains a hotel, but with different lobbies and elevators, and that doesn't bother me. I think this is because a hotel has a management staff that maintains common area decorum and holds occupants responsible for their actions during their stay. An apartment rented on airbnb has no similar oversight or responsibility for common facilities.

[http://delmar.typepad.com/brianbrady/2011/06/owner-occupancy...]

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#212

Post by DanBC »

acslater00 wrote: post #75
vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

> There is no plausible 'consumer protection' story that would explain why building codes for permanent residence are not good enough for temporary residence as well.

Your home is your home, so if you die in a fire it's your look out.

But a hotel, or a temporary residence, is not your home, and if you pay money to someone to provide a service they should meet minimum standards for safety.

This is a good thing. It allows small businesses to compete but without using "safety" as an area which can be cut.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#213

Post by moe »

m0nastic wrote: post #210
moe wrote: post #207

Earlier quoted context omitted.

No. A thousand times. A bit more creativity should be allowed when handling a vulnerability of this magnitude. For example, publish a patch that escapes all input in curious ways, presumably to prevent SQL injection. Pad it, obfuscate the actual fix with code-noise, make it annoying to read. Then release it as some handwavy, semi-plausible "follow-up" to the previous SQL-injection, urging everyone to upgrade in small…

So you're advocating releasing a "decoy" patch that's intentionally obtuse and doesn't actually fix the issue? And then downplaying the severity by not encouraging developers to take the follow-up patch seriously? That's a flat out terrible idea.

No. I was advocating to release a patch that fixes the issue in an obfuscated, non-obvious way. And labeling it as a boring-yet-important follow-up to the previous SQL-injection vulnerability, rather than yelling "LOOK, REMOTE CODE INJECTION HERE -->.<-- !!" on all available news-channels.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#214

Post by w1ntermute »

cube13 wrote: post #185
malandrew wrote: post #177

Earlier quoted context omitted.

The problem you described has a very simple solution. Grant more permits to increase the number of brand new housing units added to the market each year. The rate at which SF adds housing units given demand is absurd. In fact, you'd probably have many more small business opportunities in SF if the city were willing to add residential units faster.

Where would you put them? The demand is IN SF, not in the hills outside, or in Oakland.

How about building upwards? Learn to think in three dimensions.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#215

Post by m0nastic »

moe wrote: post #213
m0nastic wrote: post #210

Earlier quoted context omitted.

So you're advocating releasing a "decoy" patch that's intentionally obtuse and doesn't actually fix the issue? And then downplaying the severity by not encouraging developers to take the follow-up patch seriously? That's a flat out terrible idea.

No. I was advocating to release a patch that fixes the issue in an obfuscated, non-obvious way. And labeling it as a boring-yet-important follow-up to the previous SQL-injection vulnerability, rather than yelling "LOOK, REMOTE CODE INJECTION HERE -->.<-- !!" on all available news-channels.

Would you invest time in a framework where the developers knowingly lie about security vulnerabilities and provide fixes that are intentionally complicated?

That seems like something that would ruin any future credibility of the project. No further security vulnerabilities could be trusted as being accurate (and any further patches would just be begging for additional scrutiny).

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#216

Post by cube13 »

w1ntermute wrote: post #214
cube13 wrote: post #185

Earlier quoted context omitted.

Where would you put them? The demand is IN SF, not in the hills outside, or in Oakland.

How about building upwards? Learn to think in three dimensions.

Earthquake territory, which severely limits how far up you can go.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#217

Post by w1ntermute »

cube13 wrote: post #216
w1ntermute wrote: post #214

Earlier quoted context omitted.

How about building upwards? Learn to think in three dimensions.

Earthquake territory, which severely limits how far up you can go.

Bullshit. That isn't a problem for Tokyo: http://upload.wikimedia.org/wikipedia/en/c/cd/Tokyo_Panorama...

I remember someone from Vancouver saying the same thing about that city in a previous HN thread on this topic.

Earthquakes are just an excuse used by NIMBYs who want to preserve their oh so precious "bay view".

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#218

Post by kawsper »

bstar77 wrote: post #8

I can't get to the article at the moment, but I'd love to know why they failed to update their app especially since it handles financial transactions. I had several apps to update and the process took very little time and effort.

They should have pulled the plug on it, if they couldn't manage to upgrade in time.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#219

Post by moe »

m0nastic wrote: post #215
moe wrote: post #213

Earlier quoted context omitted.

No. I was advocating to release a patch that fixes the issue in an obfuscated, non-obvious way. And labeling it as a boring-yet-important follow-up to the previous SQL-injection vulnerability, rather than yelling "LOOK, REMOTE CODE INJECTION HERE -->.<-- !!" on all available news-channels.

Would you invest time in a framework where the developers knowingly lie about security vulnerabilities and provide fixes that are intentionally complicated? That seems like something that would ruin any future credibility of the project. No further security vulnerabilities could be trusted as being accurate (and any further patches would just be begging for additional scrutiny).

That "concern" is absurd. You're making no sense.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#220

Post by smhinsey »

runeks wrote: post #202
politician wrote: post #128

Earlier quoted context omitted.

Bitcoin supports "cold storage" which is effectively a wallet that can receive funds, but is offline so you cannot transfer funds out of it. That is, the private key is stored offline. There is really no excuse for exchanges not using cold storage.

I think this will require too much manual intervention to be viable. Customers not being able to withdraw their funds because they've been sent to the cold wallet makes them unhappy with the service.

You could handle withdrawals out of a float fund, without actually reconciling against the user funds until an offline process completes. This way, at most, your float is at risk, and it's your money, not the customer's.
Post reply on HN