The code is ... interesting. Smells organic, not designed. Comments are rare but usually useful. Highly coupled. Static methods everywhere. Violates SOLID principles. Basically, ignores current best practices. Clearly not designed for any sort of automated testing, which should be the first damn thing you do when there's any sort of money involved. Hell, even when there isn't money involved. We'd already guessed that…
Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
71–80 of 157 posts
Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
#72Thought I'll quickly scan the source code... On the first screen: $bean->Coins = (int)round($info['balance'] * 100000000); Really? Currency as a float and rounding? Just so that he can later: $client->sendToAddress($addr, $bean->Coins / 100000000); I'm ready to believe in any error "due to a bug" they claim now.
Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?
A full explanation can be found here: http://stackoverflow.com/questions/3730019/why-not-use-doubl...
Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
#73Earlier quoted context omitted.
The main issue is operating on the value intended for display rather than the precise value you get. The floating point value may not be always what you expect. For example you cannot even represent 0.1 precisely. See http://stackoverflow.com/questions/3730019/why-not-use-doubl... In practice that means you can't be sure if `1/1000000` is higher or lower than the value you expect it to be. (to be pedantic, yes you ca…
If Bitcoin has x point precision and I multiply every amount by 1e^x. Won't that in essence gives me correct integer value to work with. Provided I haven't overflowed the integer max?
(even controlling inputs/outputs is not enough, since internally they sometimes split the values into 40%/60% for transfers)
Or you just stick to ints (or whatever type has unlimited integer range in a given language). Simple solution here is safer than the clever one. Especially if you're sometimes confused about the types and write `round(mt_rand($amount 0.4, $amount 0.6))` even though mt_rand returns ints.
Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
#74I'm fluent in Japanese. I listened to the beginning of the recording and it's legit. One of the voices is almost certainly Mark Karpeles' (based on hearing his voice in his recent public apology -- his Japanese is broken but reasonably proficient). It seems to be a recording of a Jan 30 2014 meeting where bankers from Mizuho Bank are asking Karpeles various questions about Bitcoin, the nature of his business, his par…
Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
#75* People who know how to properly right code, don't mess with bitcoin because they understand the involved complexity and high risk of error since money is at stake
* People who don't give a damn about the complexity and are prone to risk, but lack the technical skill to support their ventures (MtGox was 50% of the time not scaling well enough. The website was slow even when not under DDOS).
What MtGox shows, IMHO, is that there's a market out there for serious, professional-grade bitcoin exchangers.
Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
#76Earlier quoted context omitted.
Karpeles making mistakes with honorifics? That's odd, even though it would he incorrect, surely he could just -san suffix everyone and be done with it?
I don't know about honorifics, but he was using "ore," according to Reddit. If he wrote the letter on the front page of Mt Gox, there are some weird/offputting polite language mistakes, too. (I can't listen to the recording right now and wouldn't get much out of it even if I could, since I can't hear well enough. :-/)
Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
#77Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
#78Thought I'll quickly scan the source code... On the first screen: $bean->Coins = (int)round($info['balance'] * 100000000); Really? Currency as a float and rounding? Just so that he can later: $client->sendToAddress($addr, $bean->Coins / 100000000); I'm ready to believe in any error "due to a bug" they claim now.
Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?
If this is 64-bit PHP, any realistic bitcoin amount multiplied by 100000000 would still be within the integer range (2^63 - 1) and can be passed around without any loss of precision ...
... unless $info['balance'] has anything below the decimal point. As soon as you're dealing with fractional bitcoins, the amount will be converted to a float before it is multiplied by 100000000 and then back to an integer. So even in 64-bit PHP, the code can't avoid passing bitcoins around as a floating point number.
Realistically it is extremely unlikely in 64-bit PHP that the loss of precision caused by this single line of code (and the subsequent casting back into float) will ever round up to a satoshi. The (int)round() just makes sure that you get an integer rather than a double-precision float, because PHP loves to turn your values into other types behind your back. Nonetheless, if the program keeps casting numbers between int and float all over the place, eventually it may begin to lose a satoshi here and there. At the scale of Mt Gox, the errors will definitely add up. That's why you should never touch a float with a ten foot pole if you're dealing with money.
The correct way to handle monetary amounts in PHP is to use the bcmath extension, which enables arbitrary precision.
Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
#79Earlier quoted context omitted.
Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?
Using floats to represent currency is a big no-no. Floats have limited precision, and some numbers aren't representable by floats. Go try adding 0.1 to itself over and over again in your favorite implementation. It is better to represent as integers or fixed-precision numbers. That way, you are dealing with exact quantities.
Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
#80Earlier quoted context omitted.
Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?
Using floats to represent currency is a big no-no. Floats have limited precision, and some numbers aren't representable by floats. Go try adding 0.1 to itself over and over again in your favorite implementation. It is better to represent as integers or fixed-precision numbers. That way, you are dealing with exact quantities.
an infinite number of them in fact