5 ms·

Am I the only one to think that all this narrative to blame Bob is pathetic ? This is pure and simple Mr. Voorhees (CEO) incompetency. After all, Bob is a crim

by fasteo 11y ago

Am I the only one to think that all this narrative to blame Bob is pathetic ? This is pure and simple Mr. Voorhees (CEO) incompetency. After all, Bob is a criminal and he was just doing his "job".

pavel_lishin 11y ago
Are you suggesting that the criminal should not be blamed for his criminal actions or the losses that he knowingly and willingly incurred?
- fasteo 11y ago
  Not quite. I suggest that a CEO should assume his responsibilities. He is quick to trash Bob[1] several times, but I see assumption of any responsibility at all. [1] Despite our note to all employees to come into the office urgently, Bob, our head IT guy, the one responsible for security and infrastructure, arrives at 11:30am. Soon after, Bob decides it’s time for his lunch break, and we don’t see him for an hour, during the worst incident in ShapeShift’s history
  - RangerScience 11y ago
    It's the difference between heroic responsibility and actual causality. "Of course it's my fault. There's no-one else here who could possibly be responsible for anything". The whole subtext of this was "Here's how I fucked up in leading this company", but then the actual text is causality. It is his responsibility to make sure employees are trustworth? Yes. Is he the cause of employees abusing trust? No. He then also determined that his responsibility was to let people know what had happened, so that's what he did. He told us the things they used to figure out what happened in order to attempt (and fail, and then attempt again...) to prevent it from recurring.
danielvf 11y ago
The article seemed pretty open about major mistakes that ShapeShift made and lessons learned. It's a good postmortem to learn from, and far more open than most would have posted.
- tekklloneer 11y ago
  Their fundamental business model didn't account for and compensate for the incredible amount of risk involved in handling large amounts of money.
  - pessimizer 11y ago
    To the contrary - their business model depended on it. Spending money on security and procedures would make them unprofitable. It's gambling. And losing.
- illumin8 11y ago
  One of the striking things in this article was when he said they might have been compromised by their "CloudCo" (Cloud Provider). If I'm going to build any systems that handle money or bitcoin in a cloud provider, I will make damn sure I don't trust the cloud provider with anything. Everything should be fully encrypted such that even a breach of trust from the hosting provider would not compromise your data/funds. I know this is hard to do, but it's mandatory when you're handling digital currency.
  - pzxc 11y ago
    It's not just hard to do, it's impossible. For a cloud provider anyway. Given that your software has to be capable of executing Bitcoin transactions itself, and the VM manager sits at a higher level and controls allocation and access to your VM's memory (to isolate it from other VMs), you are at the very least trusting that (1) when your cloud provider says they are using VMware or whatever standard software they aren't lying, and (2) that VMware itself is securely designed to limit its own access (and access of its own operators) to the underlying VMs. If you don't want to trust your hosting provider with anything, you have to own the hardware.
  - gridspy 11y ago
    Encryption won't protect you - the cloud provider has access to executables (in ram and perhaps on disc), your keys (ram and disc) and the data both pre and post encryption (in ram). Because they control the hypervisor, they control everything. That means they have as much access and authority as the code that you are running on their servers have. So the only way to protect yourself from them is to limit what your servers (deployed on their cloud) can actually do. So for instance you could have a secure backend server on a dedicated host in a trusted environment, with the cloud servers using an API to the backend server. If the API is suitably secure then the cloud servers could be compromised without allowing them to directly issue invalid commands in the same way the backend server could. Then you could use the cloud to scale out your web frontend without compromising yourself. The same is true of hardware on the dedicated host (such as the "Trusted Computing" Module) that you do not control. If that (or the BIOS) gets compromised you might not even know that your host is no longer secure.
pessimizer 11y ago
No. There are Bobs everywhere. Do your job, and Bob doesn't rip you off. Leave Bob to the courts - blaming Bob is like blaming your dog for stealing your lunch, or a wave for soaking you on the shore. You will not hurt Bob's feelings. edit: Bob didn't betray you. Your friends and family betray you. Bob stole from you.
- vonklaus 11y ago
  Semantics aside, if this story is to be believed the unknown hacker theif was even a bit put out by Bob. Especially if they guy robbed his employer after compromising & sabotaging key infrastructure and tech, then selling that to other people to exploit. I mean, that's baseline treachery right there. I like shapeshift and have used it a bit. If you(generic) hate them, alt currency, or the CEO, I think it is fair to say that Bob is pretty shitty. Yes there are sociopaths and criminals everywhere. If you have met a sociopath in real life, it isn't simply a myth that they are charming and appear normal. So I agree with the sentiment that you should expect bad things at your company, but you seem to imply: 1. it should have been obvious Bob was a criminal 2. Bob is blameless?
  - pessimizer 11y ago
    1. You're reading something I didn't say. Edit: What should have been obvious is that some people are criminals. 2. This is a religious question. Whether Bob goes to hell or not is irrelevant to whether you've done your job well. Bob's responsibility was to be a good criminal. The CEOs responsibility was to be a good CEO. Both of them failed. edit: "If you have met a sociopath in real life, it isn't simply a myth that they are charming and appear normal." It's absurd to diagnose someone as a sociopath because they steal from you. The problem is not that there are thieves in the universe, it's that you handed one the keys to the henhouse. That they lie about it, and manipulate you, is evidence that they are rational, not that they are crazy. If you feel betrayed by people other than your friends and family, you have boundary issues. Blaming your own failures on others is a good way to repeat the same mistakes over and over again.
  - homero 11y ago
    Alts are the crime. Plain and simple and vorhees is to blame
ascorbic 11y ago
Are you really saying that criminals can't be blamed because "thieves gonna thieve"? Sure ShapeShift can take some blame for bad security, which he readily admits in the post, but the bulk of the blame is owed to the person who did the crime.
- rodgerd 11y ago
  Eh, when CEOs lay off tens of thousands of people to pocket a sweet bonus, they're "just doing their job", regardless of whether it ruins their ex-employees lives. I think it's a bit of a reach, but "just doing my job" seems to be a modern get-out-of-jail card for pretty much any action that harms others.

by fasteo 11y ago

Am I the only one to think that all this narrative to blame Bob is pathetic ? This is pure and simple Mr. Voorhees (CEO) incompetency. After all, Bob is a criminal and he was just doing his "job".

pavel_lishin 11y ago

Are you suggesting that the criminal should not be blamed for his criminal actions or the losses that he knowingly and willingly incurred?

fasteo 11y ago
Not quite. I suggest that a CEO should assume his responsibilities. He is quick to trash Bob[1] several times, but I see assumption of any responsibility at all. [1] Despite our note to all employees to come into the office urgently, Bob, our head IT guy, the one responsible for security and infrastructure, arrives at 11:30am. Soon after, Bob decides it’s time for his lunch break, and we don’t see him for an hour, during the worst incident in ShapeShift’s history
- RangerScience 11y ago
  It's the difference between heroic responsibility and actual causality. "Of course it's my fault. There's no-one else here who could possibly be responsible for anything". The whole subtext of this was "Here's how I fucked up in leading this company", but then the actual text is causality. It is his responsibility to make sure employees are trustworth? Yes. Is he the cause of employees abusing trust? No. He then also determined that his responsibility was to let people know what had happened, so that's what he did. He told us the things they used to figure out what happened in order to attempt (and fail, and then attempt again...) to prevent it from recurring.

danielvf 11y ago

The article seemed pretty open about major mistakes that ShapeShift made and lessons learned. It's a good postmortem to learn from, and far more open than most would have posted.

tekklloneer 11y ago
Their fundamental business model didn't account for and compensate for the incredible amount of risk involved in handling large amounts of money.
- pessimizer 11y ago
  To the contrary - their business model depended on it. Spending money on security and procedures would make them unprofitable. It's gambling. And losing.
illumin8 11y ago
One of the striking things in this article was when he said they might have been compromised by their "CloudCo" (Cloud Provider). If I'm going to build any systems that handle money or bitcoin in a cloud provider, I will make damn sure I don't trust the cloud provider with anything. Everything should be fully encrypted such that even a breach of trust from the hosting provider would not compromise your data/funds. I know this is hard to do, but it's mandatory when you're handling digital currency.
- pzxc 11y ago
  It's not just hard to do, it's impossible. For a cloud provider anyway. Given that your software has to be capable of executing Bitcoin transactions itself, and the VM manager sits at a higher level and controls allocation and access to your VM's memory (to isolate it from other VMs), you are at the very least trusting that (1) when your cloud provider says they are using VMware or whatever standard software they aren't lying, and (2) that VMware itself is securely designed to limit its own access (and access of its own operators) to the underlying VMs. If you don't want to trust your hosting provider with anything, you have to own the hardware.
- gridspy 11y ago
  Encryption won't protect you - the cloud provider has access to executables (in ram and perhaps on disc), your keys (ram and disc) and the data both pre and post encryption (in ram). Because they control the hypervisor, they control everything. That means they have as much access and authority as the code that you are running on their servers have. So the only way to protect yourself from them is to limit what your servers (deployed on their cloud) can actually do. So for instance you could have a secure backend server on a dedicated host in a trusted environment, with the cloud servers using an API to the backend server. If the API is suitably secure then the cloud servers could be compromised without allowing them to directly issue invalid commands in the same way the backend server could. Then you could use the cloud to scale out your web frontend without compromising yourself. The same is true of hardware on the dedicated host (such as the "Trusted Computing" Module) that you do not control. If that (or the BIOS) gets compromised you might not even know that your host is no longer secure.

pessimizer 11y ago

No. There are Bobs everywhere. Do your job, and Bob doesn't rip you off. Leave Bob to the courts - blaming Bob is like blaming your dog for stealing your lunch, or a wave for soaking you on the shore. You will not hurt Bob's feelings. edit: Bob didn't betray you. Your friends and family betray you. Bob stole from you.

vonklaus 11y ago
Semantics aside, if this story is to be believed the unknown hacker theif was even a bit put out by Bob. Especially if they guy robbed his employer after compromising & sabotaging key infrastructure and tech, then selling that to other people to exploit. I mean, that's baseline treachery right there. I like shapeshift and have used it a bit. If you(generic) hate them, alt currency, or the CEO, I think it is fair to say that Bob is pretty shitty. Yes there are sociopaths and criminals everywhere. If you have met a sociopath in real life, it isn't simply a myth that they are charming and appear normal. So I agree with the sentiment that you should expect bad things at your company, but you seem to imply: 1. it should have been obvious Bob was a criminal 2. Bob is blameless?
- pessimizer 11y ago
  1. You're reading something I didn't say. Edit: What should have been obvious is that some people are criminals. 2. This is a religious question. Whether Bob goes to hell or not is irrelevant to whether you've done your job well. Bob's responsibility was to be a good criminal. The CEOs responsibility was to be a good CEO. Both of them failed. edit: "If you have met a sociopath in real life, it isn't simply a myth that they are charming and appear normal." It's absurd to diagnose someone as a sociopath because they steal from you. The problem is not that there are thieves in the universe, it's that you handed one the keys to the henhouse. That they lie about it, and manipulate you, is evidence that they are rational, not that they are crazy. If you feel betrayed by people other than your friends and family, you have boundary issues. Blaming your own failures on others is a good way to repeat the same mistakes over and over again.
- homero 11y ago
  Alts are the crime. Plain and simple and vorhees is to blame

ascorbic 11y ago

Are you really saying that criminals can't be blamed because "thieves gonna thieve"? Sure ShapeShift can take some blame for bad security, which he readily admits in the post, but the bulk of the blame is owed to the person who did the crime.

rodgerd 11y ago
Eh, when CEOs lay off tens of thousands of people to pocket a sweet bonus, they're "just doing their job", regardless of whether it ruins their ex-employees lives. I think it's a bit of a reach, but "just doing my job" seems to be a modern get-out-of-jail card for pretty much any action that harms others.