Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BitPay Integrates Bitcoin with Fulfillment by Amazon

marketwatch.com

Post reply on HN
Print view View original

21–30 of 39 posts

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#21

Post by tquai »

muyuu wrote: post #20
eric_bullington wrote: post #16

Earlier quoted context omitted.

To be honest, bitcoind, the original Bitcoin client has a very accessible json-rpc API [0]. This is the same daemon that runs behind the QT front-end of the "official" Bitcoin client. RPC is not my favorite (gotten spoiled by RESTful), but bitcoind's implementation is easy-to-use, and most languages have nice, easy-to-use json-rpc libraries [1]. You run bitcoind as a headless client on your server. It's pretty robust…

That's the kind of set-up that has been hacked to high hell several times. It's not that hard to understand why. Having a computer connected to the net to run bitcoind means that if you get it rooted by any chance, you just lost the entirety of your hot wallet. Please, please stop doing that.

One of bitcoin's strengths is decentralization, and you just told people not to manage their own wallets.

How do you accept bitcoin? Please enlighten us.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#22

Post by rishimoko »

kseudo wrote: post #11
dangrossman wrote: post #4

Earlier quoted context omitted.

It shouldn't really matter to Amazon. Their fulfillment service is just an API for saying "take this item from your warehouse and ship it to this address". Amazon doesn't know that you're shipping things in response to a BitCoin payment, versus goodies for KickStarter backers, versus holiday gifts for customers. All BitPay is doing is integrating their API with Amazon's API for you so that receiving a payment can kic…

Cool, thanks for the clarification. So I guess its only a matter of time there are electronics stores accepting BTC online

There are already many electronics for sale for bitcoins:

https://en.bitcoin.it/wiki/Trade#Electronics

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#23

Post by muyuu »

tquai wrote: post #21
muyuu wrote: post #20

Earlier quoted context omitted.

That's the kind of set-up that has been hacked to high hell several times. It's not that hard to understand why. Having a computer connected to the net to run bitcoind means that if you get it rooted by any chance, you just lost the entirety of your hot wallet. Please, please stop doing that.

One of bitcoin's strengths is decentralization, and you just told people not to manage their own wallets. How do you accept bitcoin? Please enlighten us.

Non-hot wallets.

I didn't say you shouldn't use wallets, just don't use the naive approach of having a plain wallet in a computer that's exposed via bitcoind. That's asking for it.

Cryptography is hard, but you can use this for instance:

http://bitcoinarmory.com/using-offline-wallets-in-armory/

It's already prepackaged for you. Give it a good read if you don't know it. Free, Open Source, etc. And the author is a nice chap.

It's not the only way. But whatever you do, just don't keep a massive hot wallet in a server that's online. They will find it and if you move enough money they will put massive amounts of effort into hacking it.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#24

Post by eric_bullington »

muyuu wrote: post #20
eric_bullington wrote: post #16

Earlier quoted context omitted.

To be honest, bitcoind, the original Bitcoin client has a very accessible json-rpc API [0]. This is the same daemon that runs behind the QT front-end of the "official" Bitcoin client. RPC is not my favorite (gotten spoiled by RESTful), but bitcoind's implementation is easy-to-use, and most languages have nice, easy-to-use json-rpc libraries [1]. You run bitcoind as a headless client on your server. It's pretty robust…

That's the kind of set-up that has been hacked to high hell several times. It's not that hard to understand why. Having a computer connected to the net to run bitcoind means that if you get it rooted by any chance, you just lost the entirety of your hot wallet. Please, please stop doing that.

Oh my gosh you don't expose it to the public Internet. RPC is just an API -- just because it runs over an IP address doesn't mean you run it exposed to the whole world. I thought that would go without saying, but clearly I was wrong. It's just like anything you connect to via IP...including simple databases like many of the NoSQL databases. You run it on a secure internal network, and connect it to your web server, and expose the web server to the public, via a reverse proxy. This is no different.

And if you send the balance to an off-site wallet every hour, or less, then you aren't exposing much of your balance anyway. If you're an exchange, it gets a lot harder since you have to figure out how much to keep on a hot wallet. But if you're just accepting Bitcoins, there's little to no risk, as long as you regularly send your balance off-site to a cold wallet.

And if your web server is rooted, then they've got any balance you've exposed to your web app, regardless of whether you are running it on bitcoind or some third-party web service.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#25

Post by craftkiller »

implr wrote: post #13

For those who haven't noticed, a single bitcoin is worth almost 47 dollars now, over 30% more than two days ago: http://bitcoincharts.com/charts/mtgoxUSD#rg5ztgSzm1g10zm2g25...

I really wish it would crash already. I don't feel comfortable buying any right now for day-to-day purchases because the crash has to be coming.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#26

Post by eric_bullington »

muyuu wrote: post #23
tquai wrote: post #21

Earlier quoted context omitted.

One of bitcoin's strengths is decentralization, and you just told people not to manage their own wallets. How do you accept bitcoin? Please enlighten us.

Non-hot wallets. I didn't say you shouldn't use wallets, just don't use the naive approach of having a plain wallet in a computer that's exposed via bitcoind. That's asking for it. Cryptography is hard, but you can use this for instance: http://bitcoinarmory.com/using-offline-wallets-in-armory/ It's already prepackaged for you. Give it a good read if you don't know it. Free, Open Source, etc. And the author is a nice…

Did you read my original comment? You basically just described a solution that mirrors my own, which was to send x percentage of your balance to an off-site wallet (maximizing x to the extent possible, obviously). I didn't get into how to securely store your coins off-site, since that wasn't the question.

EDIT: BTW, you do realize that Armory is a front-end to bitcoind, right? You still have to run bitcoind for Armory to work.

From their Github page:

"Armory has no independent networking components built in. Instead, it relies on on the Satoshi client to securely connect * to peers, validate blockchain data, and broadcast transactions * for us. Although it was initially planned to cut the umbilical * cord to the Satoshi client and implement independent networking, * it has turned out to be an inconvenience worth having. * Reimplementing all the networking code would be fraught with bugs, * security holes, and possible blockchain forking. The reliance * on Bitcoin-Qt right now is actually making Armory more secure!"

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#27

Post by muyuu »

eric_bullington wrote: post #24
muyuu wrote: post #20

Earlier quoted context omitted.

That's the kind of set-up that has been hacked to high hell several times. It's not that hard to understand why. Having a computer connected to the net to run bitcoind means that if you get it rooted by any chance, you just lost the entirety of your hot wallet. Please, please stop doing that.

Oh my gosh you don't expose it to the public Internet. RPC is just an API -- just because it runs over an IP address doesn't mean you run it exposed to the whole world. I thought that would go without saying, but clearly I was wrong. It's just like anything you connect to via IP...including simple databases like many of the NoSQL databases. You run it on a secure internal network, and connect it to your web server, a…

That's better but still this is what bitfloor ran and it got hacked.

I recommend cold wallets instead. You can have your server rooted and not lose a satoshi.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#28

Post by eric_bullington »

muyuu wrote: post #27
eric_bullington wrote: post #24

Earlier quoted context omitted.

Oh my gosh you don't expose it to the public Internet. RPC is just an API -- just because it runs over an IP address doesn't mean you run it exposed to the whole world. I thought that would go without saying, but clearly I was wrong. It's just like anything you connect to via IP...including simple databases like many of the NoSQL databases. You run it on a secure internal network, and connect it to your web server, a…

That's better but still this is what bitfloor ran and it got hacked. I recommend cold wallets instead. You can have your server rooted and not lose a satoshi.

That has nothing to do with why Bitfloor lost such a large sum -- they stored unencrypted keys to a wallet holding a large sum on a server that was hacked. They could have used whatever solution you or I propose and if they stored unencrypted copies of the keys to a wallet holding $250,000 worth of btc on an online computer that was hacked, the same thing would have happened.

At the time, Roman Shtylman, the founder of Bitfloor, described it: “last night, a few of our servers were compromised. As a result, the attacker gained accesses to an unencrypted backup of the wallet keys (the actual keys live in an encrypted area). Using these keys they were able to transfer the coins. This attack took the vast majority of the coins BitFloor was holding on hand.”

So it was a storage issue and had nothing to do with what we're discussing, which is how to process Bitcoin transactions. Which brings me to the question: how would you process transactions on this cold wallet you speak of? Somewhere, you have to have either bitcoind or libbitcoin running (and most business will avoid the latter because it's AGPL, unlike bitcoind which is under MIT license).

To be clear, I strongly agree with the suggestion to keep as much money as possible on cold wallets. If you are just accepting Bitcoins for payment, this can be virtually 100% of your coins. As long as you are regularly moving your coins off of the bitcoind daemon connected to your web app, you are risking very little. Hell, you can transfer the balance off-server every minute if it makes you sleep better.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#29

Post by SilasX »

craftkiller wrote: post #25
implr wrote: post #13

For those who haven't noticed, a single bitcoin is worth almost 47 dollars now, over 30% more than two days ago: http://bitcoincharts.com/charts/mtgoxUSD#rg5ztgSzm1g10zm2g25...

I really wish it would crash already. I don't feel comfortable buying any right now for day-to-day purchases because the crash has to be coming.

... and, back to $34.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#30

Post by nazgulnarsil »

SilasX wrote: post #29
craftkiller wrote: post #25

Earlier quoted context omitted.

I really wish it would crash already. I don't feel comfortable buying any right now for day-to-day purchases because the crash has to be coming.

... and, back to $34.

and back to $43

this is not a market for weak hands.

Post reply on HN