Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BTC Stolen from Poloniex

bitcointalk.org

Post reply on HN
Print view View original

41–50 of 136 posts

Re: BTC Stolen from Poloniex

#41

Post by pessimizer »

Yver wrote: post #24
Cless wrote: post #11

X-Powered-By:PHP/5.5.9-1+sury.org~precise+1 Mt. Gox, Flexcoin, and Poloniex. What do they all have in common? It's not what you think. (:

What they have in common: they deal in Bitcoins, they're not banks, they have a "o" and an "x" in their name. Now if you're trying to bash PHP (or Ubuntu?) for banking software that does not take an exclusive lock on rows it reads then modifies and a daemon that does not check balances on withdrawal, try again.

What if you're trying to bash the likely competence of people who, when deciding to write a bank, decide that PHP is the best tool for the job.

To make that decision requires that you be insane, or don't know any other tools.

Re: BTC Stolen from Poloniex

#42

Post by rayiner »

fiatmoney wrote: post #23

"the auditing and security features were not explicitly looking for negative balances". WTF, who are these clowns that purport to be running the equivalent of a bank? It's like everyone running a BTC exchange either is corrupt or slept through the part of Databases 101 where they explained "this is why transactions are important, here is banking as an example". Seems likely both.

I think it's just the rush to be first on the scene and capture the perceived network advantages that arise from being first. These are MVP's.

Re: BTC Stolen from Poloniex

#43

Post by mildtrepidation »

mikeash wrote: post #34
mildtrepidation wrote: post #16

As some one who's almost entirely oblivious to the trappings of cryptocurrency... is it not possible to trade on sites like this with a local wallet? Or do you have to keep a balance with them separate from your wallet? It's invalid logic to assume that because some bitcoin sites have been hacked, all of them will be, but at this point it seems pretty clear the entire community needs to be a little more careful. Unti…

They need to have your money before they can execute a trade from you, otherwise they're opening themselves up for significant fraud. If it's trade-then-send, I could sell some bitcoin, then wait a few minutes to see whether the price went up or down before I send them. If the price went up, just refuse to send the bitcoin, and execute a new sale at the higher price. You can certainly put money in right before you ex…

That said, I don't understand why people keep significant balances in these places. Keep a small amount to trade with and save the rest yourself!

Yeah, that's what I mean.

You can certainly put money in right before you execute a trade, and pull it back out right after. But that introduces significant lag, up to an hour for bitcoin, depending on how many confirmations you wait for, and several days for USD.

Thanks, that's definitely something to consider. I can see it being very inconvenient, though I still agree that the idea of keeping a balance larger than your trade volume in a service like this is hard to fathom.

Re: BTC Stolen from Poloniex

#44

Post by unclebucknasty »

It's good that these guys appear to be very transparent and accept full responsibility for their error.

But, this is an outlandishly amateurish oversight. Race conditions and atomicity where balance-affecting transactions are concerned would seem to be one of the first considerations that pops to mind. That, along with sanity checks just before final execution of the transaction.

It's clear that there are a lot of people building exchanges with little to no experience in the financial/transactional software field. But, I am beginning to wonder how much experience they have building any software.

Re: BTC Stolen from Poloniex

#45

Post by brudgers »

The missing link for bitcoin is coverage under something like the Uniform Commercial Code- a system that specifies general principles governing transactions and the framework for their completion and resolution of conflicting claims. Caveat emptor is not a foundation for a currency.In practice bitcoin's very anonymity makes it a more attractive target for theft- bitcoins come pre-fenced. As Patio points out, the bitcoin community is inclined to build magic bullet software that assumes theft can be prevented and policies whereby the victims of theft are shit out of luck as in this case and Mt Gox. For an ordinary good citizen bitcoin is a bet that the people holding the funds are not only honest but the smartest people in the world or at least smarter than all the criminals.

Saying that a company has the most secure bitcoin system in the industry, even after proof it was the case, doesn't change the fundamental design tradeoff in bitcoin. Bitcoin offers anonymous possession in exchange for risk. Because the risk is high relative to normal forms of commercial exchange, bitcoin attracts rational actors for whom the rewards outweigh the risks and the distribution curve of interested parties has a tail that skews criminal.

The missing link for bitcoin is coverage under something like the Uniform Commercial Code- a system that specifies general principles governing transactions and the framework for their completion and resolution of conflicting claims. Caveat emptor is not a solid foundation for a banking system..

Re: BTC Stolen from Poloniex

#46

Post by jballanc »

mikeash wrote: post #31
spindritf wrote: post #26

Earlier quoted context omitted.

A percent of every card transaction goes to cover system's losses on fraud. There's value in the costs being predictable, stated up front, etc, but it's not fundamentally different.

IMO that predictability makes it fundamentally different. I can handle a regular 2% fee, but I can't really handle a sizable chance that I'll be completely wiped out.

Exactly! I know how to fire a gun, tie a tourniquet, extinguish a structure fire, and set aside an emergency fund. I also know that paying someone else to relieve me of having to worry about these things is money well spent. You call it regulation, I call it peace of mind.

Re: BTC Stolen from Poloniex

#47

Post by [deleted] »

curveship wrote: post #22
ck2 wrote: post #8

Dang it people. Race conditions. Security. I know it's not easy but it is important to get it right.

Seriously. I thought this bit of code from the MtGox leak was interesting. Sure looks like a potential double-spend race condition: $out = \DB::DAO('Money_Bitcoin_Block_Tx_Out')->searchOne(array('Hash' => $bean->Hash, 'N' => $bean->N)); if ($out) { if ($out->Claimed == 'Y') { $bean->Available = 'N'; $bean->commit(); continue; } } What if someone else claims $out between the read and commit? Is no one at BTC exchanges…

[deleted]

Re: BTC Stolen from Poloniex

#48

Post by gatehouse »

al2o3cr wrote: post #6

"We fucked up, so we're deducting the losses from everybody's accounts so that people don't immediately withdraw all their money." If my bank sent me this notice, the FIRST thing I'd do is withdraw all my money - there's every chance it may be "an absolute necessity" to steal more of it at any time...

Happens all the time http://en.wikipedia.org/wiki/2012%E2%80%9313_Cypriot_financi...

Re: BTC Stolen from Poloniex

#49

Post by asadlionpk »

"not looking for negative balances." If this caused the problem here, this shows that this is just the tip of the iceberg. Someone should start an open source project for BTC Exchange's back-end.

Re: BTC Stolen from Poloniex

#50

Post by krapp »

pessimizer wrote: post #41
Yver wrote: post #24

Earlier quoted context omitted.

What they have in common: they deal in Bitcoins, they're not banks, they have a "o" and an "x" in their name. Now if you're trying to bash PHP (or Ubuntu?) for banking software that does not take an exclusive lock on rows it reads then modifies and a daemon that does not check balances on withdrawal, try again.

What if you're trying to bash the likely competence of people who, when deciding to write a bank, decide that PHP is the best tool for the job. To make that decision requires that you be insane, or don't know any other tools.

There's nothing wrong with that decision up to the point where you start handling the money - beyond that point I agree with you.

Setting up a website which is secure and not vulnerable to SQL injection or basic BS is quite doable in PHP.

Post reply on HN