61–70 of 222 posts
Earlier quoted context omitted.
Sounds like really nice plausible deniability for whomever came up with such a blatant wrong way of storing secrets/value
Nov. 11 — Friday: SBF resigns, FTX goes bankrupt Nov. 12 — Saturday: FTX hacked for most of its remaining crypto Y'all be the judge.
As the tweet points out the bad practice and doesn't comment on the good practice how _should_ one store their keys? Specifically the tweet states that using a secret manager or password vault is a problem, so what is the solution?
Analogy in a old bank with cash or gold is hot wallet = cash that tellers have on hand, cold wallet = vault in the back that has everything else.
It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…
It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…
Wait, what ? Private keys were stored in unprotected plaintext files regularly opened by multiple people at the company? WTF? That crosses the line and goes deep into "willful negligence" territory, in my view. The physical equivalent would be stacking customer assets like dollar bills and gold bars in big piles inside a heavily trafficked room that has no lock. The term "irresponsible" doesn't quite do justice to it…
> That crosses the line and goes deep into "willful negligence" territory, in my view. Er, that's the thing that pushed you over the line? Not all the fraud and crime?
When reading crypto clownworld stories like this, it is easy and fun to observe that cryptocurrency is a satire of the real (or "fiat", if you prefer) financial system. Less fun, but far more important, is to note how incredibly (infinitely?) subtle this satire is: https://news.ycombinator.com/item?id=22352840
One thinks about crypto as a clownworld only until one had to work with or inside the real financial system. Techincally, it is in no way better than crypto. The only difference is that in real financial system there is a strong legal cover for all the technical and security fuckups. Like, stealing from bank by exploiting their 10-years old Windows XP ATM connected to the internet is 10-years-in-jail offence, while s…
This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too.
Asking people whose salaries are paid for with tax dollars to help you recover stolen crypto while simultaneously trying to avoid taxes and government oversight is so ironic.
It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…
But the current system works well enough in the vast majority of cases. And the fixes to the problems you list would add considerable complexity. I don’t think it’s actually that clear that fixing these problems would have a net positive effect on the world.
Earlier quoted context omitted.
Both are bad. Crime is bad, but this is an argument for making software engineering more like a medical doctor's guild. Some things simply should not be done. There is an expectation of competence for some things like finance and medicine.
Storing your keys in plain text is hardly software engineering. Plenty of people who don't know the first thing about coding do it all the time. This is a failure of security and risk management. Making a guild or licensing requirements for software engineers may or may not be a good idea, but it wouldn't have addressed this problem. But even if it would have in the abstract, FTX played fast and loose with so many ot…
I know what the real answer is, but I am curious of the response.