Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

dzoba.com

Post reply on HN
Print view View original

111–120 of 157 posts

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#111

Post by viraptor »

bennyg wrote: post #101
viraptor wrote: post #73

Earlier quoted context omitted.

Sure, you can prove that, then verify your language complies over the whole range, then add validation that your values never go over the range provided and no input outside of the range can be accepted and then figure out a way to guarantee none of that will change in the future. (even controlling inputs/outputs is not enough, since internally they sometimes split the values into 40%/60% for transfers) Or you just s…

So if one of us were to create something dealing with BTC we should just store the data as the smallest discrete amount (satoshis) and then run calculations on that to display info to the user?

Sure - is there a reason not to? That's similar to what you should be doing with dates too - store as UTC at the highest precision you'll need and present in local timezone/format.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#112

Post by skj »

thaumasiotes wrote: post #92
skj wrote: post #84

Earlier quoted context omitted.

Could make all the same arguments against integers: - Limited precision, - Some numbers aren't representable, - Go try adding 1 to itself over and over again. That said, yes, floats are a bad idea for financial arithmetic.

You can make the same arguments against integers, but you'd need to be willfully blind to the context of the discussion. There are no monetary quantities that can't be represented as integers. Using a scheme that can't represent 1/3 to record numbers for which 1/3 is an illegal value doesn't present any practical or theoretical problems.

My point was that the arguments presented were not the reasons that using floats to handle finance was a bad idea. Since, as I showed, they also applied to integers.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#113

Post by [deleted] »

Blahah wrote: post #76
sdrothrock wrote: post #47

Earlier quoted context omitted.

I don't know about honorifics, but he was using "ore," according to Reddit. If he wrote the letter on the front page of Mt Gox, there are some weird/offputting polite language mistakes, too. (I can't listen to the recording right now and wouldn't get much out of it even if I could, since I can't hear well enough. :-/)

I usually hear 'ore' from people who learned their Japanese by watching shonen anime. Even outside of a business meeting, in normal conversation, it would be offensive to most people I think.

[deleted]

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#114

Post by ufo »

skj wrote: post #112
thaumasiotes wrote: post #92

Earlier quoted context omitted.

You can make the same arguments against integers, but you'd need to be willfully blind to the context of the discussion. There are no monetary quantities that can't be represented as integers. Using a scheme that can't represent 1/3 to record numbers for which 1/3 is an illegal value doesn't present any practical or theoretical problems.

My point was that the arguments presented were not the reasons that using floats to handle finance was a bad idea. Since, as I showed, they also applied to integers.

Sheesh, stop being so pedantic. Unlike computers, humans can infer extra meaning from the context around a sentence.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#115

Post by jedschmidt »

gklitt wrote: post #51
sdrothrock wrote: post #47

Earlier quoted context omitted.

I don't know about honorifics, but he was using "ore," according to Reddit. If he wrote the letter on the front page of Mt Gox, there are some weird/offputting polite language mistakes, too. (I can't listen to the recording right now and wouldn't get much out of it even if I could, since I can't hear well enough. :-/)

Yes, he was saying "ore", which is an incredibly rude and amateur mistake. In English, that would be like be entering an important business meeting with a bank and saying, "Yo dude, wassup?"

Are you sure he was saying "ore"? Given the fact that his grammar is otherwise pretty tight, I wouldn't be surprised if he were instead using "ware".

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#116

Post by bennyg »

viraptor wrote: post #111
bennyg wrote: post #101

Earlier quoted context omitted.

So if one of us were to create something dealing with BTC we should just store the data as the smallest discrete amount (satoshis) and then run calculations on that to display info to the user?

Sure - is there a reason not to? That's similar to what you should be doing with dates too - store as UTC at the highest precision you'll need and present in local timezone/format.

Only one I can think of is 32 bit architectures, but those are phasing out pretty fast. I wasn't being incendiary at all with my comment - just a general question from a novice software engineer.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#117

Post by ck2 »

quickpost wrote: post #3

> Nanashi also said they group plans on not releasing the huge store of passport scans they found… Hopefully this group has the public’s best interests at heart. Good lord. Lose all your bitcoins AND your identity. Mt. Gox can't go away fast enough!

WTF is all that doing on a web-accessible server.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#118

Post by jimktrains2 »

negamax wrote: post #70
viraptor wrote: post #69

Earlier quoted context omitted.

The main issue is operating on the value intended for display rather than the precise value you get. The floating point value may not be always what you expect. For example you cannot even represent 0.1 precisely. See http://stackoverflow.com/questions/3730019/why-not-use-doubl... In practice that means you can't be sure if `1/1000000` is higher or lower than the value you expect it to be. (to be pedantic, yes you ca…

If Bitcoin has x point precision and I multiply every amount by 1e^x. Won't that in essence gives me correct integer value to work with. Provided I haven't overflowed the integer max?

As a side note: 1e^x reads as the natural log base to the x power all times 1.

1ex or 10^x is what you probably want.

Why e was chosen to represent that may be due to 7-segment-only displays on (some) (early) calculators. I still think it was a bad choice because of this very issue.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#119

Post by klibertp »

reikonomusha wrote: post #68
negamax wrote: post #67

Earlier quoted context omitted.

Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?

Using floats to represent currency is a big no-no. Floats have limited precision, and some numbers aren't representable by floats. Go try adding 0.1 to itself over and over again in your favorite implementation. It is better to represent as integers or fixed-precision numbers. That way, you are dealing with exact quantities.

Works in Racket (and should in other Schemes):

  -> (for/sum ([_ (in-range 10)]) (/ 1 10))
  1
Yeah, I know, I'm cheating - `(/ 1 10)` returns a rational? which is not flonum?. Using `0.1` makes it inexact like it should be:

  -> (for/sum ([_ (in-range 10)]) 0.1)
  0.9999999999999999

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#120

Post by kens »

McGlockenshire wrote: post #53
kens wrote: post #42

Earlier quoted context omitted.

How is the exception handling? For instance, if something goes wrong when generating a new private key, could they still attempt the transaction but with a null key? (cf the earlier bug that lost 2609 bitcoins.)

Unfortunately I don't know enough about the bitcoin innards to give you an informative answer, and the answer isn't clear from a plain reading of the code. The leaked code seems to just be an internal API for twiddling wallets. There doesn't seem to be any logic here for either the txid conflict retry bits or the hot/cold transfer bits.

Thanks for the reply. If you look at each method that can return failure, and then look at the code that calls these methods, do the callers check for failure or just keep going with the transaction? (This would both indicate the quality of the code and show a path that could generate bad transactions.)
Post reply on HN