Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BTC Stolen from Poloniex

bitcointalk.org

Post reply on HN
Print view View original

121–130 of 136 posts

Re: BTC Stolen from Poloniex

#121

Post by dscrd »

PeterisP wrote: post #108
dscrd wrote: post #88

Earlier quoted context omitted.

Moreover, these things should be built upon the certainty that somebody smarter than you, the coder, might be interested in free money, and that the software will be broken. Only with that mindset can one build a system that doesn't screw over every legit customer when it happens.

Ahh, the default finance mindset is a bit different - first, assume that your own employees, managers, sysadmins and developers would be interested in free money. Design the system, processes, checks and audits according to that - and it covers most of the precautions against outside hackers as a natural consequence. If you start a BTC exchange, write half of the initial code yourself, have access to the servers and…

Even better.

Re: BTC Stolen from Poloniex

#122

Post by jnbiche »

danielweber wrote: post #95
jnbiche wrote: post #91

Earlier quoted context omitted.

Perhaps, in the case of the most cautious developers. But right now, I'd be happy with just competent developers. And to me, at least, it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions.

it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions Where's 'rayiner? He'll love this. Writing bitcoin software is like writing crypto. You need to get it exactly right. But instead of starting with a spec written down that the crypto community tears to pieces, instead the developers eat their own dogfood. No, change that…

The arrogance here is unfortunate. First, you start out with a remark reminiscent of a high school bully. Do you really need a co-conspirator to share in your attempt to ridicule someone?

Also, you're pretty uninformed about the history of Bitcoin. Satoshi did start with a spec, or at least a white paper (yes, the lack of a proper spec for Bitcoin has been a major problem). Satoshi presented the white paper to the cryptography e-mail list several months before releasing the software. He got some feedback at that time, and then he got significant feedback when upon his initial release, which he integrated into the protocol.

This list included many of the top cryptographers in the cryptocurrency space, including Hal Finney and Adam Back.

You can find all these discussions, and the original release at: http://nakamotoinstitute.org/

Finally, with the exception of the transaction malleability issue, the failures in exchanges have had nothing to do with cryptography, but rather with basic secure software development practices and architectures.

Re: BTC Stolen from Poloniex

#123

Post by jnbiche »

bunderbunder wrote: post #96
jnbiche wrote: post #91

Earlier quoted context omitted.

Perhaps, in the case of the most cautious developers. But right now, I'd be happy with just competent developers. And to me, at least, it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions.

Is it really just government sanctions? Or do regulatory cost and exposure to liability have something to do with it, too? I think that in the USA at least, government sanctions are far from guaranteed - the courts have confirmed that BTC is a currency. What that means is that there is no longer a question of if you can legally start a Bitcoin exchange in the USA - it's a question of what hoops you have to jump throu…

>It'd be more realistic to just say that competent people are staying out because the regulatory environment results in an excessive cost of doing business for anyone who wants to make sure they're operating on the up-and-up

That's exactly what I meant. Apologies if I made it sound like anything else. It costs millions to start up a money transmission business in all 50 states (like an online exchange would need to), and the federal government has been explicit that they consider a Bitcoin exchange a money transmitter.

Re: BTC Stolen from Poloniex

#124

Post by jnbiche »

mpyne wrote: post #113
jnbiche wrote: post #91

Earlier quoted context omitted.

Perhaps, in the case of the most cautious developers. But right now, I'd be happy with just competent developers. And to me, at least, it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions.

> And to me, at least, it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions. I don't think that's clear at all. In fact I think bunderbunder has it right. Those who make the best products will require a large enough expense for formal design, implementation, secure hardware acquisition, physical security (i.e. no simply ru…

But here's where I disagree with you: it costs literally millions of dollars to get the needed state money licenses to legally operate a Bitcoin exchange[1]. FinCEN has been very explicit that they consider Bitcoin exchanges to be money transmitters.

So those millions are money that could go toward building the infrastructure you describe. Bitcoin companies like Coinbase who have finished their Series A have to spend their runway on licenses instead of developers or infrastructure.

It's a huge problem, whether or not people are willing to admit it.

But thank you for arguing in a rational and non-bullying/non-contemptuous manner.

1. http://payment-systems.quora.com/The-Money-Transmitter-Licen...

Re: BTC Stolen from Poloniex

#125

Post by danielweber »

jnbiche wrote: post #122
danielweber wrote: post #95

Earlier quoted context omitted.

it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions Where's 'rayiner? He'll love this. Writing bitcoin software is like writing crypto. You need to get it exactly right. But instead of starting with a spec written down that the crypto community tears to pieces, instead the developers eat their own dogfood. No, change that…

The arrogance here is unfortunate. First, you start out with a remark reminiscent of a high school bully. Do you really need a co-conspirator to share in your attempt to ridicule someone? Also, you're pretty uninformed about the history of Bitcoin. Satoshi did start with a spec, or at least a white paper (yes, the lack of a proper spec for Bitcoin has been a major problem). Satoshi presented the white paper to the cr…

I'm talking about exchanges, not the protocol itself.

Every exchange seems to be a bespoke system and that is just begging for trouble.

They should publish their architecture, then publish their source code, and then make sure that smart people have tried as hard as they can to find all the weaknesses in their stuff, and then turn it into a business.

Of course, there are business reasons not to do that: someone else can use your verified source, someone else can get a first-mover advantage, you might not get the smart people to pay attention, you might not know when it's ever good enough, and (the more pernicious idea) is the worry that seeing the source will give the attackers ways of attacking your stuff.

They fail for the same reasons that secret crypto systems fail. I fully understand why they are doing it, but it's still doomed to failure.

Re: BTC Stolen from Poloniex

#126

Post by mpyne »

jnbiche wrote: post #124
mpyne wrote: post #113

Earlier quoted context omitted.

> And to me, at least, it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions. I don't think that's clear at all. In fact I think bunderbunder has it right. Those who make the best products will require a large enough expense for formal design, implementation, secure hardware acquisition, physical security (i.e. no simply ru…

But here's where I disagree with you: it costs literally millions of dollars to get the needed state money licenses to legally operate a Bitcoin exchange[1]. FinCEN has been very explicit that they consider Bitcoin exchanges to be money transmitters. So those millions are money that could go toward building the infrastructure you describe. Bitcoin companies like Coinbase who have finished their Series A have to spend…

Well as long as the cost is fairly applied to new entrants then I don't see that as being problematic per se (as after all, any new entrant will have to deal with the same selectivity). In fact that's practically the point, to ensure that the "fly by night" Bitcoin exchange shops that couldn't survive a theft of 50 Bitcoins without going under don't actually make it into legit business.

Yes, this is unfortunate for those devs out there who could solve the problem of making a good Bitcoin exchange if only the cost-of-entry were cheaper, but that happens in tons of other industries too (and not always due to the government), and it already has an answer.

Re: BTC Stolen from Poloniex

#127

Post by pjc50 »

o_nate wrote: post #89
tptacek wrote: post #86

Earlier quoted context omitted.

I don't think you should handwave this. Companies have hot bitcoins because they need them to cover transaction volume. Their "hot" liability scales with their business. When you're six months old, a 50k loss (more accurately: the requirement to redeem BTC that start with a market value of 50k) kills your company (or the rational incentive to continue pursuing your company). When you're a year old, 100k does the tric…

I didn't mean that to come off as hand-waving. I think this is a very serious issue that is going to require a complete rethinking of security practices. Perhaps it won't ever be solved satisfactorily, but I wouldn't rule out ingenuity of developers to at least reduce the risk to manageable levels.

The loss rate is extremely high; I don't think people would be willing to pay an extra 20% spread on their exchange to cover it.

Much higher levels of isolation (such as running the transaction engine in some kind of HSM) would help, but I suspect that anyone smart enough and cautious enough to do it properly is too smart and cautious to go anywhere near the prospect of running a bitcoin exchange.

Re: BTC Stolen from Poloniex

#128

Post by pjc50 »

dsleno wrote: post #120
smacktoward wrote: post #29

Earlier quoted context omitted.

This is the most fascinating part of the Bitcoin story: watching a group of people who are philosophically opposed to most elements of the modern economy discover, one by one, why all those elements exist.

So you think we should never tear down anything because there's no possible way we could ever rebuild it better than it is? Our financial system couldn't ever be any better than right now? And I thought I was a pessimist.

Those are two different propositions. Tearing things down inevitably breaks vital things and should only be a last resort. But that says nothing about whether incremental improvement is possible.

However, nobody wants to put the effort into organising politically to cause improvements to the existing system. Because they don't trust anyone, and only care for the increase of their own wallet.

Re: BTC Stolen from Poloniex

#129

Post by pjc50 »

anigbrowl wrote: post #70
gatehouse wrote: post #48

Earlier quoted context omitted.

Happens all the time http://en.wikipedia.org/wiki/2012%E2%80%9313_Cypriot_financi...

Those things are called crises because they actually happen quite rarely. When such episodes become a regular occurrence people tend to abandon the system in question. I keep seeing this attitude among Bitcoin fans. Of course, there have been many financial crises with regular currencies and banking systems. But that doesn't mean they're the norm. When you look at the number of crisis against the number of different…

I'm working on an analogy between Bitcoin evangelists and anti-vaxxers:

- something bad happens to someone doing the conventional thing (vaccination, banking)

- people panic about it on the internet

- there is a lack of trust in other people and institutions

- people pull away from the conventional system

- in the short term it's fine

- then there is an epidemic (measles, fraud/loss)

- this is much worse than the system they rejected, so they resort to denial

- everyone else says "I told you so"

Re: BTC Stolen from Poloniex

#130

Post by pjc50 »

minimax wrote: post #71

The comments on the bitcointalk thread are interesting. Here you have a bunch of people who have just lost 12% of their funds and most of them are totally ok with that . If you are looking for evidence that bitcoin supporters are driven more by ideological reasons than economical ones, here is a pretty good example.

The volatility has been high enough that people are used to losing/gaining that much in a day.
Post reply on HN