Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

191–200 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#191

Post by dreamdu5t »

vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

The market here IS protecting consumers by rewarding secure bitcoin exchanges through elimination of insecure ones.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#192

Post by moe »

tptacek wrote: post #47
bradleyland wrote: post #44

Earlier quoted context omitted.

This vulnerability went from disclosure to exploit extremely quickly. The CVE was published on the 8th. I can't speak for them, but in the process of trying to update, we ran in to some issues with therubyracer (a core component of the Rails asset pipeline) and libv8 (the library that therubyracer uses to embed the V8 engine). It was extraordinarily bad timing, and it slowed down our update process by almost a day wh…

You cannot leave your site open to a pre-auth remote code execution vulnerability while you wait for fixes to the asset pipeline or to any other component of Rails. I don't know that that's what you're saying you did but we need to be glacier-blue-ice-clear about this. Nobody gets to wait on bugs like this. You patch or workaround immediately or, most probably, you shut your app down.

You also cannot publish little known pre-auth remote code execution vulnerabilities for your web-framework without first publishing a mitigation patch that doesn't paint a BIG FAT RED ARROW onto the attack vector.

You also cannot leave 6 years of vulnerable Rails-versions up on rubygems.org without even backporting your patch (yes, they're still up there now).

It makes no sense to blame the users of a web-framework, most of which are not security experts, for not responding instantly with the perfectly correct procedure to an event of this magnitude.

Put the blame where it belongs, on the idiots who "handled" the issue by releasing a "recipe to exploit"-Advisory. The same idiots who ramble about "not breaking old apps" when asked why the vulnerable gems are still up on rubygems.org and continue to be quietly installed by any Gemfile referencing them...

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#193

Post by temphn »

redtexture wrote: post #158
temphn wrote: post #124

Well, with a Bitcoin bank, at least as a customer you have a chance of not being robbed. By contrast, if you keep your money with an FDIC bank in USD, you are having your funds diluted away every day (the latest proposal is to print a $1 trillion coin).

Trillion dollar coin or no coin, the debt ceiling attempts to regulate (in part) expenditures already authorized by Congress and signed into law. It's a tempest in a teapot for one party in Congress to argue that it's irresponsible to conduct authorized expenditures, because in fact, Congress did authorize the expenditures. The two transactions, debt providing cash to the government, and seigniorage (difference in va…

  are approximately equally inflationary, over time.
Exactly. Both terminate in the end of the US as the world's reserve currency, with the yuan as its obvious replacement. China has already signed deals with Russia, Australia, Brazil, Turkey, and the UAE to eliminate the USD from bilateral trade. [1]

Your arguments appear to be directed at people who support the Republican party or are concerned about the partisan points here. Bush, Obama, Bernanke, Greenspan, Krugman, and the whole gang are peas in a pod. Bush won reelection in 2004 by having Greenspan inflate a housing bubble with Krugman cheering[2] the Fed Chairman on. Obama won reelection in 2012 by having Bernanke re-inflate[3] a housing bubble with Krugman cheering the Fed Chairman on.

[1] http://www.forbes.com/sites/jackperkowski/2012/06/26/china-b...

[2] http://www.nytimes.com/2002/08/02/opinion/dubya-s-double-dip...

  To fight this recession the Fed needs more than a 
  snapback; it needs soaring household spending to offset 
  moribund business investment. And to do that, as Paul  
  McCulley of Pimco put it, Alan Greenspan needs to create a 
  housing bubble to replace the Nasdaq bubble.

  Paul Krugman: August 2, 2002
[3] http://www.bloomberg.com/news/2012-09-13/fed-plans-to-buy-40...

  The Federal Reserve said it will expand its holdings of 
  long-term securities with open-ended purchases of $40 
  billion of mortgage debt a month in a third round of 
  quantitative easing as it seeks to boost growth and reduce 
  unemployment.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#194

Post by makomk »

tomjen3 wrote: post #99
dougmccune wrote: post #86

Earlier quoted context omitted.

Claiming hotel regulation has no benefit to consumers is simply not true. Consider the perspective of a resident of San Francisco (like me). SF has a very limited amount of housing. We can debate all day about ways to fix that and impediments to building more (and more affordable) housing, but the simple facts right now are that there are a LOT more people who want to live in SF than there are housing units. Addition…

You may value that prioritization, but that isn't strange as you are a renter and so prefer things aligned as close as possible to your personal benefit. That is simple egoism, don't coat it in nice language.

Well, in the long term turning the housing into hotels screws everyone because the people who work at and maintain the hotels need somewhere to live too, as do the employees of businesses that bring tourists into the city...

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#195

Post by temp453463343 »

xxpor wrote: post #154
temp453463343 wrote: post #121

Earlier quoted context omitted.

Thank god they aren't building more housing in SF - a temporary fix (b/c eventually you'll run out of housing again) to a non-problem. The NewYorkification of San Francisco would ruin the city. I talked about it more here http://news.ycombinator.com/item?id=4815087 http://news.ycombinator.com/item?id=4815247 http://news.ycombinator.com/item?id=4815537

You are literally arguing for the destruction of the planet when you argue against density. More people living in a smaller space is much more efficient, and therefore less polluting energy. San Francisco might be "ruined" by your definition, but how is it any of your right to tell people what they can and can not build on their land? Zoning is central planning at it's worst.

> You are literally arguing for the destruction of the planet when you argue against density.

Sure cramming people in like sardines makes it easier to make things efficient - but it's very realistic to make less dense populations efficient/sustainable too. Urban developement isn't some kind of ecological optimization problem. There are factors you are completely dismissing, like overall happiness, contribution to the community and the nation as a whole, cultural value generated etc.

> but how is it any of your right to tell people what they can and can not build on their land?

Are you serious? There is the whole idea of community and sustainability. If a community deems a certain construction project detrimental to the overall health and wellbeing of its members then they can stop projects. If I don't want to live next to a highrise and the accompanying noise, traffic, pollution, I have a say in what my neighbor can build.

I'm not personally telling people what to do (because I have no authority). I'm engaging in a public debate over the SF community's values and priorities.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#197

Post by makomk »

jspthrowaway2 wrote: post #109
Eliezer wrote: post #82

Earlier quoted context omitted.

Legitimate banks don't get hacked? Is that true?

You don't hear of any high-profile bank disclosures, which I imagine is probably because they have security teams that keep up with everything religiously. Most old brick banks have internal systems architected in ways that a younger intruder in the Anonymous mold wouldn't know anything about, as well; you're starting to get into big iron Cobol land. That said, I don't think it's an impossible task (is anything?), an…

There was actually a high-profile incident not too long ago with one of the big banks' online banking system. Users could view other people's account information just by incrementing an integer in the URL as I recall. It's not necessarily so much that banks are secure, but hacking them is much riskier than hacking Bitcoin sites, especially for white-hats.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#198

Post by k2enemy »

cs702 wrote: post #105

Imagine that a thief breaks and enters into a warehouse which is holding physical gold for its customers, and the thief steals all their gold. The warehouse and/or its customers will suffer losses, but every single ounce of the gold stolen by the thief will continue to be as valuable as any other ounce of gold. In other words, gold will continue to be the same exact commodity. Essentially the same thing has happened…

> The moral of this story: if you own bitcoins, make sure they are stored in a truly secure system. Many Bitcoin exchanges claim to be -- but really aren't -- truly secure!

Then how do you know what storage locations are truly secure? If you have to be a computer security expert to safely use bitcoins, then that will surely decrease the demand for the currency and therefore reduce its value.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#199

Post by jacquesm »

TallboyOne wrote: post #90

And this is why I would NEVER in 10,000 years trust an anonymous form of money that can't be recovered or tracked to a group of average developers who in this case are obviously are amateur and don't even respond to massive critical security updates. I'm sure all the rest are like that to some degree as well. No thanks, I'll stick with cash under my matress before ever using that. I feel bad for anyone that actually…

You're confusing several things there. Bitcoin the protocol and rails the framework are not the same thing. Bitcoin was never compromised, rails was, and if these devs would have done their work and patched their servers they'd have been fine.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#200

Post by Tichy »

thomasz wrote: post #141
cs702 wrote: post #105

Imagine that a thief breaks and enters into a warehouse which is holding physical gold for its customers, and the thief steals all their gold. The warehouse and/or its customers will suffer losses, but every single ounce of the gold stolen by the thief will continue to be as valuable as any other ounce of gold. In other words, gold will continue to be the same exact commodity. Essentially the same thing has happened…

> its integrity has NOT been compromised Shesh. A Bitcoin has no inherent value. If such incidents become common enough, nobody will be willing to buy bitcoins for dollars or accept bitcoins as payments for goods,which means that the thieves will sit on a bunch of useless bits.

Gold does not have that much of inherent value either.
Post reply on HN