X-Powered-By:PHP/5.5.9-1+sury.org~precise+1
Mt. Gox, Flexcoin, and Poloniex. What do they all have in common? It's not what you think. (:
BTC Stolen from Poloniex
11–20 of 136 posts
Re: BTC Stolen from Poloniex
#12Gosh, it would be nice to have some sort of assurance that the group holding on to my monetary reserves met some sort of minimum level of competency in dealing with quantities of currency. Or, lacking competency, some guarantee that any bank screw-up wouldn't result in loss of funds from my account...I wonder why no one has thought of this before?
Oh, wait...
Seriously, if I was an economics or law professor today, I don't think I could come up with a better classroom to teach financial regulation than the mess that is the Bitcoin economy.
Re: BTC Stolen from Poloniex
#13Seems to be a recurring theme recently. Evidently too many developers inexperienced in proper security are building these things. You would have thought after everything that has happened so far that people would take a long hard look at their security measures.
Security is hard, especially computer security in the absence of trusted/trustable systems. (Yes, it's a deliberate devil's advocacy, but it should be said.) We should ask ourselves why the existing government banking systems are secure. In part, it's because nothing is simply trusted and everything is double checked. In part it's because criminals have tried all manner of things, giving the system a chance to develop collective experience dealing with all manner of attacks. In part, it's because the law makes it a poor economic choice to engage in many kinds of criminal activity.
Then ask, how many of these things are true for bitcoin? Then perhaps ask, could I provide these things, and make money while doing so?
Re: BTC Stolen from Poloniex
#14X-Powered-By:PHP/5.5.9-1+sury.org~precise+1 Mt. Gox, Flexcoin, and Poloniex. What do they all have in common? It's not what you think. (:
What they have in common is a bunch of keen individuals rushing in to cash in on the hype but in the process releasing some of the worst financial systems (if you can call them that) which I've ever seen because they don't follow the same strict regulations and testing processes that the rest of the financial industry have to go through.
Re: BTC Stolen from Poloniex
#15I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. (https://news.ycombinator.com/item?id=7340505) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for most people who deal with money.
If they had the settlement processed asynchronously on a different system, likely with human interaction, they'd be able to say "Hmm, it seems like account #944325 has convinced us to schedule a withdraw of $250,000 more money than he has on deposit. Well that would be a really bad idea, now wouldn't it. Denied. Now I think I'll sip a cocoa while leisurely planning my review of our withdraw scheduling code."
Re: BTC Stolen from Poloniex
#16As some one who's almost entirely oblivious to the trappings of cryptocurrency... is it not possible to trade on sites like this with a local wallet? Or do you have to keep a balance with them separate from your wallet?
It's invalid logic to assume that because some bitcoin sites have been hacked, all of them will be, but at this point it seems pretty clear the entire community needs to be a little more careful. Until that happens I don't think keeping a balance with a service like this makes sense.
Re: BTC Stolen from Poloniex
#17Let's not suggest this is just a race condition. Sure, it's a race condition, but whats the maximum damage you can do? c * your current balance, where c is a low number (10 is a very optimistic guess), since at some point the race concludes and you can't exploit it further.
But apparently they didn't even check or put a proper constraint into the database that your balance should be positive (and if you do find a negative balance, shut the system and investigate). Now that's not a "pretty stupid race condition", it's reckless.
Re: BTC Stolen from Poloniex
#18Dang it people. Race conditions. Security. I know it's not easy but it is important to get it right.
It's not as hard as these hacks make it seem.
Not checking for negative balance??? It doesn't get much more freshman CS than this.
Re: BTC Stolen from Poloniex
#19Dang it people. Race conditions. Security. I know it's not easy but it is important to get it right.
This is exactly what Erlang would excel at implementing. Not that one couldn't do it wrong in that language as well. Same goes for Go and Clojure and a number of other languages with advanced concurrency features.
Re: BTC Stolen from Poloniex
#20"We fucked up, so we're deducting the losses from everybody's accounts so that people don't immediately withdraw all their money." If my bank sent me this notice, the FIRST thing I'd do is withdraw all my money - there's every chance it may be "an absolute necessity" to steal more of it at any time...
Which I'd imagine would be illegal for more than one reason... but then this is one of the costs of an unregulated currency (not saying that makes it good or bad, just that it's there).
It's also why I don't understand maintaining a balance with a service like this. Unless you're doing very small trades, the 0.2% fee plus the network charge for a withdrawal seems like a small price to pay to be mostly safe from this kind of thing.