Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BTC Stolen from Poloniex

bitcointalk.org

Post reply on HN
Print view View original

31–40 of 136 posts

Re: BTC Stolen from Poloniex

#31

Post by mikeash »

spindritf wrote: post #26
jballanc wrote: post #12

Gosh, it would be nice to have some sort of assurance that the group holding on to my monetary reserves met some sort of minimum level of competency in dealing with quantities of currency. Or, lacking competency, some guarantee that any bank screw-up wouldn't result in loss of funds from my account...I wonder why no one has thought of this before? Oh, wait... Seriously, if I was an economics or law professor today, I…

A percent of every card transaction goes to cover system's losses on fraud. There's value in the costs being predictable, stated up front, etc, but it's not fundamentally different.

IMO that predictability makes it fundamentally different. I can handle a regular 2% fee, but I can't really handle a sizable chance that I'll be completely wiped out.

Re: BTC Stolen from Poloniex

#33

Post by mildtrepidation »

smacktoward wrote: post #29
patio11 wrote: post #15

I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. ( https://news.ycombinator.com/item?id=7340505 ) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for…

This is the most fascinating part of the Bitcoin story: watching a group of people who are philosophically opposed to most elements of the modern economy discover, one by one, why all those elements exist.

Perhaps "all" is an overstatement. An overhaul starting from zero may not be a very realistic or efficient answer, but it seems a little optimistic to suggest that there is nothing our financial systems do that couldn't be changed or dropped.

Re: BTC Stolen from Poloniex

#34

Post by mikeash »

mildtrepidation wrote: post #16

As some one who's almost entirely oblivious to the trappings of cryptocurrency... is it not possible to trade on sites like this with a local wallet? Or do you have to keep a balance with them separate from your wallet? It's invalid logic to assume that because some bitcoin sites have been hacked, all of them will be, but at this point it seems pretty clear the entire community needs to be a little more careful. Unti…

They need to have your money before they can execute a trade from you, otherwise they're opening themselves up for significant fraud. If it's trade-then-send, I could sell some bitcoin, then wait a few minutes to see whether the price went up or down before I send them. If the price went up, just refuse to send the bitcoin, and execute a new sale at the higher price.

You can certainly put money in right before you execute a trade, and pull it back out right after. But that introduces significant lag, up to an hour for bitcoin, depending on how many confirmations you wait for, and several days for USD.

That said, I don't understand why people keep significant balances in these places. Keep a small amount to trade with and save the rest yourself!

Re: BTC Stolen from Poloniex

#36

Post by tomp »

patio11 wrote: post #15

I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. ( https://news.ycombinator.com/item?id=7340505 ) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for…

> This incident is an example of the Bitcoin community's best practices "working."

It's also an example of all the best engineering practices missing.

I thought that checking the account balances and wrapping the withdrawal in a transaction was an introductory example of concurrency issues. What were they thinking, handling money while allowing negative balances?!

Re: BTC Stolen from Poloniex

#37

Post by jeremysmyth »

smacktoward wrote: post #29
patio11 wrote: post #15

I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. ( https://news.ycombinator.com/item?id=7340505 ) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for…

This is the most fascinating part of the Bitcoin story: watching a group of people who are philosophically opposed to most elements of the modern economy discover, one by one, why all those elements exist.

I wish I could upvote this comment more than once.

Many complex systems are complex because they solve complex problems, not just because they have evolved over time from different simple conditions. You can't always (if ever) replace a complex system with a simple one. You can't escape complexity by coding around it. This is the attitude that killed Netscape and kills many Enterprise projects.

Re: BTC Stolen from Poloniex

#38

Post by cognivore »

Who in the heck is writing this stuff? Are they just hacking together crappy sites in an effort to get things running as soon as possible?

Bitcoin isn't going anywhere until the people who trade in it approach competence.

Re: BTC Stolen from Poloniex

#39

Post by [deleted] »

fiatmoney wrote: post #23

"the auditing and security features were not explicitly looking for negative balances". WTF, who are these clowns that purport to be running the equivalent of a bank? It's like everyone running a BTC exchange either is corrupt or slept through the part of Databases 101 where they explained "this is why transactions are important, here is banking as an example". Seems likely both.

[deleted]

Re: BTC Stolen from Poloniex

#40

Post by krapp »

Cless wrote: post #28
Yver wrote: post #24

Earlier quoted context omitted.

What they have in common: they deal in Bitcoins, they're not banks, they have a "o" and an "x" in their name. Now if you're trying to bash PHP (or Ubuntu?) for banking software that does not take an exclusive lock on rows it reads then modifies and a daemon that does not check balances on withdrawal, try again.

I'm not bashing PHP. I love PHP. Many PHP developers, on the other hand...

It's a strawman, though. The problem isn't PHP developers per se, it seems to be a lack of awareness that dealing with money is in any different than dealing with, say, any other CRUD operation (see - Mt.Gox just casting things to floats, it's just numbers, right?.)

Just wait until people start announcing their exchanges and business written in Rails or Python, or "anything but PHP" but still turning out to have been written by webapp developers with no idea how to actually deal with currency transactions or basic security.

Post reply on HN