51–60 of 136 posts
"We fucked up, so we're deducting the losses from everybody's accounts so that people don't immediately withdraw all their money." If my bank sent me this notice, the FIRST thing I'd do is withdraw all my money - there's every chance it may be "an absolute necessity" to steal more of it at any time...
Happens all the time http://en.wikipedia.org/wiki/2012%E2%80%9313_Cypriot_financi...
The missing link for bitcoin is coverage under something like the Uniform Commercial Code- a system that specifies general principles governing transactions and the framework for their completion and resolution of conflicting claims. Caveat emptor is not a foundation for a currency.In practice bitcoin's very anonymity makes it a more attractive target for theft- bitcoins come pre-fenced. As Patio points out, the bitc…
If someone with ill intent has the ability to wire money from your account, they can do so with ease. Bitcoin really isn't that unique in that sense.
The real story in the bitcoin world is a recurring tale of gross, epic levels of incompetence, largely because a bunch of people who know some PHP have become the ones building financial systems. People who lack even the most rudimentary of knowledge necessary (this particular "exploit" for instance....good God. This is literally usually the very first "learning databases" lesson because it is so obvious of a weakness).
"the auditing and security features were not explicitly looking for negative balances". WTF, who are these clowns that purport to be running the equivalent of a bank? It's like everyone running a BTC exchange either is corrupt or slept through the part of Databases 101 where they explained "this is why transactions are important, here is banking as an example". Seems likely both.
I think it's just the rush to be first on the scene and capture the perceived network advantages that arise from being first. These are MVP's.
I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. ( https://news.ycombinator.com/item?id=7340505 ) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for…
This is the most fascinating part of the Bitcoin story: watching a group of people who are philosophically opposed to most elements of the modern economy discover, one by one, why all those elements exist.
The missing link for bitcoin is coverage under something like the Uniform Commercial Code- a system that specifies general principles governing transactions and the framework for their completion and resolution of conflicting claims. Caveat emptor is not a foundation for a currency.In practice bitcoin's very anonymity makes it a more attractive target for theft- bitcoins come pre-fenced. As Patio points out, the bitc…
Also the fact that the people making software seem incompetant when it comes to technology.
However, has anyone stopped to ask why so many exchanges are poorly-coded? No, it's not because everyone in Bitcoin adores PHP. I've met some of the most capable coders among cryptocurrency enthusiasts. Go check out Conformal's btcd, or any of Jeff Garzik or Warren Togami's projects, or the amazing talents of the Bitcoin core dev team. (If you decide to denigrate the abilities of any of these Bitcoin/cryptocurrency developers in a response, please be sure to include a link to your own github)
No, it's not because there's no talent. Rather, it's because nobody who is competent in the Bitcoin world is willing to risk their hides or the welfare of their families on something they know the authorities will eventually crack down on. You see, competent people actually learn about the space, and the relevant regulations before jumping in. And they understand that -- absent several million in start-up funding -- there is no way to legally open an exchange at this point.
So by process of elimination, the only ones left to open exchanges are either scammers, or ignorant, incompetent coders who can barely code up a PHP site, or a very few brave, mostly-competent individuals who have the money and lawyers to at least (hopefully!) keep them out of jail when the inevitable crackdown occurs.
I know personally of several extremely competent entrepreneur-developers who have abandoned Bitcoin projects out of regulatory concerns. And I'm sure that's just a small sample.
So that's the reason for the prevalence of poor coders among Bitcoin exchanges. Your solution to this problem will of course be a function of your worldview.
The difference between Bitcoin companies and cat sharing companies isn't fly-by-night operational practices (although in some cases, sure).
The difference is that when a cat sharing company gets owned up, you don't hear about it. Only a small subset of security compromises involve password hashes dumped to pastebin. A quiet security incident at a cat sharing company doesn't end that company; they patch the bug, (hopefully) reimage their servers, and get on with their lives.
Even payment companies have incidents. But (perhaps counterintuitively) incidents at payment companies aren't company-ending events. Payment companies don't hold bearer-bonds, for magic cards or anything else, on their servers. Attackers might get a few thousand credit cards out of the rolling transaction feed of a payment company. Why bother? Those attackers can just acquire massive dumps of credit card numbers from major retail compromises. Attackers report flaws to payment companies! They're better off trying to score a $500 payday from a bug bounty than trying to monetize those breakins illegally.
Not so at a Bitcoin company. When Bitcoin companies get owned up, whatever "hot" assets they have get taken. Bitcoin companies aren't stepping stones for attackers the way cat sharing companies sometimes are; they're the intended target.
It bothers me when people caution that Bitcoin companies are scary because they're "targets", because I think the people saying that only grok 75% of what's happening. It's not that Bitcoin companies get owned up because attackers spend more effort targeting them. No. Attackers expend effort on everyone's companies, and are usually successful. The difference is what happens after the attacker succeeds.
People considering starting (or funding) Bitcoin companies need to understand this. I feel like there may be a memetic belief that competent security teams can reliably stave off security flaws if they're just careful with two-factor auth and parameterized SQL queries. That meme is false. When you start a new software service, you need to build it on the assumption that you are going to get owned up, if not by a stupid password compromise than by a memory corruption bug deep in V8 or MRI or CPython or nginx that only a few dozen people in the world know about. It is going to happen. If you give custody of cash-equivalents to a startup, you should be doing it with that in mind.
"the auditing and security features were not explicitly looking for negative balances". WTF, who are these clowns that purport to be running the equivalent of a bank? It's like everyone running a BTC exchange either is corrupt or slept through the part of Databases 101 where they explained "this is why transactions are important, here is banking as an example". Seems likely both.
I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. ( https://news.ycombinator.com/item?id=7340505 ) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for…
This is the most fascinating part of the Bitcoin story: watching a group of people who are philosophically opposed to most elements of the modern economy discover, one by one, why all those elements exist.
The people who are interested in cryptocurrencies come from all walks of life and share different views on many topics, just like the citizens of a country. Nothing's ever black or white.
I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. ( https://news.ycombinator.com/item?id=7340505 ) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for…
This is the most fascinating part of the Bitcoin story: watching a group of people who are philosophically opposed to most elements of the modern economy discover, one by one, why all those elements exist.