5 ms·

Note: there was a lot of discussion about security etc last time Bitcoinica came up (http://news.ycombinator.com/item?id=2973301 http://news.ycombinator.com/ite

Note: there was a lot of discussion about security etc last time Bitcoinica came up (http://news.ycombinator.com/item?id=2973301 http://news.ycombinator.com/item?id=2973301). patio11: "My semi-amateurish opinion is that as a non-registered securities dealer with all accounts having margin capabilities the (near 100%) likelihood of your Rails app exploitably broken is not the key source of risk to your business." (http://news.ycombinator.com/item?id=2974695 http://news.ycombinator.com/item?id=2974695) See also e.g. http://news.ycombinator.com/item?id=2974032 http://news.ycombinator.com/item?id=2974032 and http://news.ycombinator.com/item?id=2973429 http://news.ycombinator.com/item?id=2973429 plus tptacek's reply to http://news.ycombinator.com/item?id=2973732 http://news.ycombinator.com/item?id=2973732. On the other hand, Bitcoinica may not be less secure than Mt. Gox...

zhoutong 15y ago
I'm actually quite serious about security. But I still feel that the security-related discussions are too overwhelming. Of course I know that nothing is 100% secure, but I can make my bottom-line high. This is not my first project. I have been coding in Rails for almost 3 years, with some failed projects. I also know some security basics because I have hacked websites before (non-destructive). There is always relative security. Ruby on Rails itself is a relatively secure framework. Rails sites have been much less frequently hacked than PHP sites. (Because everything is well wrapped.) I'm also very conservative about using Rails (rarely override methods myself, not even toughing find_by_sql even when it's the easy way). Passwords are stored hashed and salted using BCrypt. Although no explicit security auditing has been done, all the Rails app logs (including requests and IP addresses) are extracted and backed up nightly. Soft-deleting is enabled for all operations, etc. I'm not distracting myself from the real problem, but I have to say that I'm not that kind of random kids who write crappy apps for fun. My use of Heroku is also partly because of security. I use Mac and know a bit of Linux, but I know I can't really set up a Linux box and be sure about the security. Instead I have chosen Heroku's integrated, read-only and cloud-based platform. Sorry for not replying most of the security-related comments. Not because I can't face opposing arguments, but instead, I think they are valuable. However, I hope everyone can be a little bit more reasonable and realistic. Since nothing is secure, security is everyone's problem. Although I don't have anything to prove my security experience, at least this is not the first time I deal with money. I once developed a mini payment gateway (PayPal and credit card) for my friend who used it to process transactions totaling more than $50,000. There're a lot of fraudulent orders, which means that people have an incentive to steal, but the payment system itself has been safe. I can understand that people are skeptical considering my age (or even my Chinese name). But will the Bitcoin community be better off if I shut down the project now? I have chosen Bitcoin because its low barrier to entry and open community, not because I have no bottom-line or security concerns. What I really want to disagree is the view that I must end this project now. There are basically too many people emailing me just to thank me for delivering the features that the big guys (Mt. Gox and TradeHill) can't finish in months. I have taken the extreme minimalistic approach in development of Bitcoinica - no Bitcoin wallets and no unusable features. I make it a pure trading platform - you can't even do money laundering on Bitcoinica. System wise, I don't have to SSH the server to configure anything, and I don't have to even see the database credentials myself. Anyway, I completely accept all the negative viewpoints about Bitcoinica, but I just want to explain clearly that I may not be the person everyone's thinking about.
- tptacek 15y ago
  The term of art for responses like this is "jazz hands". Sorry. Security isn't "everybody's job". You've chosen to advertise a financial application. Security is your job. In a very real sense: sucks to be you.
  - zhoutong 15y ago
    I'm not sure whether you're referring to a part of my comment or the whole comment. What I mean is, security is every financial platform owner's big challenge. This includes banks, escrow service providers, payment processors and e-commerce solution providers. Sometimes it's hard to know how secure a system is before anything happens. But I have already explained my experience, ability, current situation, my strategy, how my product works, my objectives and what I have done to the public to help everyone make informed choices. Not everyone will like every single product. I have been careful about everything I can.
    - tptacek 15y ago
      I think you think these multi-paragraph responses you're writing are convincing. I think the best thing I can do for you is to be blunt about how unconvincing they are. Very few people with Rails or appsec experience will read them and think that you know what you're doing with regards to security. You should not be taking "thousands and thousands of dollars" from people. Full stop.
      - zhoutong 15y ago
        Thank you for your guidance!
      - timsally 15y ago
        I agree with everything that has been said so far, with the exception of the conclusion. I don't have a problem with zhoutong taking money. People putting their money in Bitcoin are investing in a currency that is two years old. Said another way, a currency that is younger than a $15 bottle of wine. All players in such a market by definition lack reputation, lack experience in handling currency, and lack experience in running a financial institution. Yes, zhoutong doesn't understand security and yes he is hand-waving. Yes, he needs to do his best to secure his app. Yes, he should invest money in an audit when it can afford it (if only because a security audit maps directly to better business for a financial institution). But do I feel bad for users who are putting their money into Bitcoinica? Not really. Trading in a currency that is only two years old is the NFL. Dealing with young and inexperienced financial institutions is part of the game if you chose to enter such a risky market.
steve8918 15y ago
Guys, if you are seriously thinking of using this platform, and even forget security from a technical aspect for a moment, there are a lot of very basic trading and social-engineering questions that need to be answer by zhoutong and bitcoinica before you deposit money into this account: 1) Who are zhoutong and bitoinica? Where is this based out of? I went through the web site and it doesn't seem to mention this. Is he really who he says he is? A 17-year old who built a sophisticated web site in 1 week by himself? Why did he say that he built the web site himself, but in the blog of bitcoinica, it's written as "we"? 2) Why do they deposit everyone's money into a single account? Who owns this account? How do they keep track of everyone's money? REAL brokerages have people's money in segregated accounts, meaning that the brokerage firm CAN'T TOUCH THE MONEY even if they collapse. How do we know they won't one day turn around, transfer the money to China or Singapore and disappear? How do we know this isn't another Madoff case? 3) How the heck does he afford to give everyone 5:1 margin? The simple story of using the money that no one else is using doesn't fly, it's not that easy. You need to have excess capital in order to do this. What is bitcoinica's excess capital? 4) They do NOTHING to ensure counter-party risk!! What if Bitcoinica implodes and goes under? Again, what is their excess capital to ensure that customers don't share in any losses? If they suffer a catastrophic loss from bad trades, is that loss divided amongst all the customers? I'm not saying they are crooks. I'm very interested in their platform, because I do a lot of algorithmic trading, so I'm familiar with this. I just want answers to these very basic questions before I deposit any money into this thing.
- zhoutong 15y ago
  I understand your concerns. Many people coming from Forex trading have such concerns. But the Bitcoin market is very different. Many people choose to be anonymous. There're currently no explicit laws regulating Bitcoin transactions and Bitcoin trading. All these points apply to Mt. Gox or TradeHill as well. There are no law restrictions on this kind of trading. I use "we" because I represent my company xWaylab Inc. (registered in US). I'm the sole developer and project manager but I'm not the only shareholder. For margin part, since we offer short selling, generally the combined portfolio is quite balanced. Currently our finances are quite healthy. We will never bet against our clients. I don't really hope anyone will set a double standard in the Bitcoin market. I think everyone is a fair player. You can choose not to trust Bitcoinica if you're skeptical. But a few dozens of people have chosen to give us a try and they have deposited thousands and thousands of dollars. Believe it or not, Bitcoinica is currently the third largest Bitcoin Trading Platform, following Mt. Gox and TradeHill. (8000+ BTC traded within merely 48 hours of establishment.) I still believe in time. If Bitcoinica is still around after a few months, maybe there will be more people joining in.

zhoutong 15y ago

I'm actually quite serious about security. But I still feel that the security-related discussions are too overwhelming. Of course I know that nothing is 100% secure, but I can make my bottom-line high. This is not my first project. I have been coding in Rails for almost 3 years, with some failed projects. I also know some security basics because I have hacked websites before (non-destructive). There is always relative security. Ruby on Rails itself is a relatively secure framework. Rails sites have been much less frequently hacked than PHP sites. (Because everything is well wrapped.) I'm also very conservative about using Rails (rarely override methods myself, not even toughing find_by_sql even when it's the easy way). Passwords are stored hashed and salted using BCrypt. Although no explicit security auditing has been done, all the Rails app logs (including requests and IP addresses) are extracted and backed up nightly. Soft-deleting is enabled for all operations, etc. I'm not distracting myself from the real problem, but I have to say that I'm not that kind of random kids who write crappy apps for fun. My use of Heroku is also partly because of security. I use Mac and know a bit of Linux, but I know I can't really set up a Linux box and be sure about the security. Instead I have chosen Heroku's integrated, read-only and cloud-based platform. Sorry for not replying most of the security-related comments. Not because I can't face opposing arguments, but instead, I think they are valuable. However, I hope everyone can be a little bit more reasonable and realistic. Since nothing is secure, security is everyone's problem. Although I don't have anything to prove my security experience, at least this is not the first time I deal with money. I once developed a mini payment gateway (PayPal and credit card) for my friend who used it to process transactions totaling more than $50,000. There're a lot of fraudulent orders, which means that people have an incentive to steal, but the payment system itself has been safe. I can understand that people are skeptical considering my age (or even my Chinese name). But will the Bitcoin community be better off if I shut down the project now? I have chosen Bitcoin because its low barrier to entry and open community, not because I have no bottom-line or security concerns. What I really want to disagree is the view that I must end this project now. There are basically too many people emailing me just to thank me for delivering the features that the big guys (Mt. Gox and TradeHill) can't finish in months. I have taken the extreme minimalistic approach in development of Bitcoinica - no Bitcoin wallets and no unusable features. I make it a pure trading platform - you can't even do money laundering on Bitcoinica. System wise, I don't have to SSH the server to configure anything, and I don't have to even see the database credentials myself. Anyway, I completely accept all the negative viewpoints about Bitcoinica, but I just want to explain clearly that I may not be the person everyone's thinking about.

tptacek 15y ago
The term of art for responses like this is "jazz hands". Sorry. Security isn't "everybody's job". You've chosen to advertise a financial application. Security is your job. In a very real sense: sucks to be you.
- zhoutong 15y ago
  I'm not sure whether you're referring to a part of my comment or the whole comment. What I mean is, security is every financial platform owner's big challenge. This includes banks, escrow service providers, payment processors and e-commerce solution providers. Sometimes it's hard to know how secure a system is before anything happens. But I have already explained my experience, ability, current situation, my strategy, how my product works, my objectives and what I have done to the public to help everyone make informed choices. Not everyone will like every single product. I have been careful about everything I can.
  - tptacek 15y ago
    I think you think these multi-paragraph responses you're writing are convincing. I think the best thing I can do for you is to be blunt about how unconvincing they are. Very few people with Rails or appsec experience will read them and think that you know what you're doing with regards to security. You should not be taking "thousands and thousands of dollars" from people. Full stop.
    - zhoutong 15y ago
      Thank you for your guidance!
    - timsally 15y ago
      I agree with everything that has been said so far, with the exception of the conclusion. I don't have a problem with zhoutong taking money. People putting their money in Bitcoin are investing in a currency that is two years old. Said another way, a currency that is younger than a $15 bottle of wine. All players in such a market by definition lack reputation, lack experience in handling currency, and lack experience in running a financial institution. Yes, zhoutong doesn't understand security and yes he is hand-waving. Yes, he needs to do his best to secure his app. Yes, he should invest money in an audit when it can afford it (if only because a security audit maps directly to better business for a financial institution). But do I feel bad for users who are putting their money into Bitcoinica? Not really. Trading in a currency that is only two years old is the NFL. Dealing with young and inexperienced financial institutions is part of the game if you chose to enter such a risky market.

steve8918 15y ago

Guys, if you are seriously thinking of using this platform, and even forget security from a technical aspect for a moment, there are a lot of very basic trading and social-engineering questions that need to be answer by zhoutong and bitcoinica before you deposit money into this account: 1) Who are zhoutong and bitoinica? Where is this based out of? I went through the web site and it doesn't seem to mention this. Is he really who he says he is? A 17-year old who built a sophisticated web site in 1 week by himself? Why did he say that he built the web site himself, but in the blog of bitcoinica, it's written as "we"? 2) Why do they deposit everyone's money into a single account? Who owns this account? How do they keep track of everyone's money? REAL brokerages have people's money in segregated accounts, meaning that the brokerage firm CAN'T TOUCH THE MONEY even if they collapse. How do we know they won't one day turn around, transfer the money to China or Singapore and disappear? How do we know this isn't another Madoff case? 3) How the heck does he afford to give everyone 5:1 margin? The simple story of using the money that no one else is using doesn't fly, it's not that easy. You need to have excess capital in order to do this. What is bitcoinica's excess capital? 4) They do NOTHING to ensure counter-party risk!! What if Bitcoinica implodes and goes under? Again, what is their excess capital to ensure that customers don't share in any losses? If they suffer a catastrophic loss from bad trades, is that loss divided amongst all the customers? I'm not saying they are crooks. I'm very interested in their platform, because I do a lot of algorithmic trading, so I'm familiar with this. I just want answers to these very basic questions before I deposit any money into this thing.

zhoutong 15y ago
I understand your concerns. Many people coming from Forex trading have such concerns. But the Bitcoin market is very different. Many people choose to be anonymous. There're currently no explicit laws regulating Bitcoin transactions and Bitcoin trading. All these points apply to Mt. Gox or TradeHill as well. There are no law restrictions on this kind of trading. I use "we" because I represent my company xWaylab Inc. (registered in US). I'm the sole developer and project manager but I'm not the only shareholder. For margin part, since we offer short selling, generally the combined portfolio is quite balanced. Currently our finances are quite healthy. We will never bet against our clients. I don't really hope anyone will set a double standard in the Bitcoin market. I think everyone is a fair player. You can choose not to trust Bitcoinica if you're skeptical. But a few dozens of people have chosen to give us a try and they have deposited thousands and thousands of dollars. Believe it or not, Bitcoinica is currently the third largest Bitcoin Trading Platform, following Mt. Gox and TradeHill. (8000+ BTC traded within merely 48 hours of establishment.) I still believe in time. If Bitcoinica is still around after a few months, maybe there will be more people joining in.