Live data from Hacker News

BTC Stolen from Poloniex

bitcointalk.org

71–80 of 136 posts

Re: BTC Stolen from Poloniex

#71
The comments on the bitcointalk thread are interesting. Here you have a bunch of people who have just lost 12% of their funds and most of them are totally ok with that. If you are looking for evidence that bitcoin supporters are driven more by ideological reasons than economical ones, here is a pretty good example.

Re: BTC Stolen from Poloniex

#72
post #57

Look: every startup gets owned up somehow in its first year or so. If you think your company hasn't, I have an adage about the sucker at the poker table for you. I'm not sure how many people on HN really understand this, because every thread I read about Bitcoin companies having security problems features highly-voted comments expressing shock at how bad their security must have been. No: this problem is universal. T…

Bitcoin companies create additional attention from criminals because people engaged in illegal activity are a targeted market segment. Near the median there's just ordinary getting away with something; an AirBnB rental in Milwaukee that takes bitcoin to facilitate reporting less taxable income. The long tail of bitcoin use probably leverages anonymity move money that facilitates the most extreme nastiness.

Using bitcoin is a strong nexus between an individual and the long tail and it puts the individual on their radar. The long tail is being nice when they only steal my bitcoin.

Re: BTC Stolen from Poloniex

#73
post #57

Look: every startup gets owned up somehow in its first year or so. If you think your company hasn't, I have an adage about the sucker at the poker table for you. I'm not sure how many people on HN really understand this, because every thread I read about Bitcoin companies having security problems features highly-voted comments expressing shock at how bad their security must have been. No: this problem is universal. T…

cat sharing companies

Off-topic, but as someone with too many cats I would like this idea to take off pronto. I could use a full night's sleep.

I'll show myself out.

Re: BTC Stolen from Poloniex

#74
post #34

Earlier quoted context omitted.

They need to have your money before they can execute a trade from you, otherwise they're opening themselves up for significant fraud. If it's trade-then-send, I could sell some bitcoin, then wait a few minutes to see whether the price went up or down before I send them. If the price went up, just refuse to send the bitcoin, and execute a new sale at the higher price. You can certainly put money in right before you ex…

That said, I don't understand why people keep significant balances in these places. Keep a small amount to trade with and save the rest yourself! Yeah, that's what I mean. You can certainly put money in right before you execute a trade, and pull it back out right after. But that introduces significant lag, up to an hour for bitcoin, depending on how many confirmations you wait for, and several days for USD. Thanks, t…

I can only guess that people have become so used to solid financial institutions that present little risk for deposited money. Even non-FDIC institutions, like stock brokerages, usually have extremely low risk for deposited cash. If you're thinking like that, why not let them hold onto it? It's less effort. Of course, we see the answer to "why not?" here.

Re: BTC Stolen from Poloniex

#75
post #15

I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. ( https://news.ycombinator.com/item?id=7340505 ) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for…

This is the most fascinating part of the Bitcoin story: watching a group of people who are philosophically opposed to most elements of the modern economy discover, one by one, why all those elements exist.

In technical terms, we are witnessing the transition from a circle jerk of libertarian ideolgy to a clusterfuck of libertarian ideology.

Re: BTC Stolen from Poloniex

#76
post #4

Sounds like somebody used an eventually consistent nosql database to handle monetary transactions and discovered why that's a bad idea...

And also skipped on testing that basic business rules can't be trivially violated.

Re: BTC Stolen from Poloniex

#77
post #15

I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. ( https://news.ycombinator.com/item?id=7340505 ) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for…

This is the most fascinating part of the Bitcoin story: watching a group of people who are philosophically opposed to most elements of the modern economy discover, one by one, why all those elements exist.

When are they going to rediscover double-entry bookkeeping?

Re: BTC Stolen from Poloniex

#78
The hacker discovered that if you place several withdrawals all in practically the same instant, they will get processed at more or less the same time. This will result in a negative balance, but valid insertions into the database, which then get picked up by the withdrawal daemon.

When I was a kid I imagined that banks were incredibly vulnerable to this.

Later I discovered transactions and thought my kid-self was just silly.

I've learned that my kid-self understood things pretty well, sometimes.

Re: BTC Stolen from Poloniex

#79

Earlier quoted context omitted.

Happens all the time http://en.wikipedia.org/wiki/2012%E2%80%9313_Cypriot_financi...

Those things are called crises because they actually happen quite rarely. When such episodes become a regular occurrence people tend to abandon the system in question. I keep seeing this attitude among Bitcoin fans. Of course, there have been many financial crises with regular currencies and banking systems. But that doesn't mean they're the norm. When you look at the number of crisis against the number of different…

I agree that most Bitcoin service providers are total bullshit. Satoshi does backflips to create a decentralized system, and the first thing these idiots do it to try to centralize it in all sorts of ways. If the people doing the transaction can agree on a trusted 3rd party, then you don't need Bitcoin. But credit card fraud happens every day, large bankruptcies happen every year, and sovereign default happens every decade, because people are unreliable.

Re: BTC Stolen from Poloniex

#80
The major problem here is that the auditing and security features were not explicitly looking for negative balances. They add deposits and withdrawals and check that accounts are in balance. If you have 2 BTC, withdraw 10 BTC, and are left with -8 BTC, the software would see that you deposited 2, withdrew 10, and have exactly what you should: -8.

Another design flaw is that withdrawals should be queued at every step of the way. This could not have happened if withdrawals requests were processed sequentially instead of simultaneously.

Oops!

Post reply on HN