BTC Stolen from Poloniex
bitcointalk.org
BTC Stolen from Poloniex
1–10 of 136 posts
Re: BTC Stolen from Poloniex
#2Seems to be a recurring theme recently. Evidently too many developers inexperienced in proper security are building these things. You would have thought after everything that has happened so far that people would take a long hard look at their security measures.
Re: BTC Stolen from Poloniex
#3[deleted]
Re: BTC Stolen from Poloniex
#4Sounds like somebody used an eventually consistent nosql database to handle monetary transactions and discovered why that's a bad idea...
Re: BTC Stolen from Poloniex
#5Sounds like somebody used an eventually consistent nosql database to handle monetary transactions and discovered why that's a bad idea...
To me it sounded like a pretty stupid race condition. Anyway, at least they reacted better than MtGox.
Re: BTC Stolen from Poloniex
#6"We fucked up, so we're deducting the losses from everybody's accounts so that people don't immediately withdraw all their money."
If my bank sent me this notice, the FIRST thing I'd do is withdraw all my money - there's every chance it may be "an absolute necessity" to steal more of it at any time...
Re: BTC Stolen from Poloniex
#7It's the same kind of exploit that plagued many web games in the past; it's just something most programmers do wrong, because it's not a requirement in most cases.
Re: BTC Stolen from Poloniex
#8Dang it people. Race conditions. Security.
I know it's not easy but it is important to get it right.
Re: BTC Stolen from Poloniex
#9Sounds like somebody used an eventually consistent nosql database to handle monetary transactions and discovered why that's a bad idea...
Their supposed fix doesn't seem like it would address the problem anyway. They should use optimistic locking.
edit: optimistic
Re: BTC Stolen from Poloniex
#10Sounds like somebody used an eventually consistent nosql database to handle monetary transactions and discovered why that's a bad idea...
Sounds more like he forgot to wrap multiple mutually dependent queries in a transaction. It doesn't require advanced technology to make a mistake.