3 ms·

I'm not sure whether you're referring to a part of my comment or the whole comment. What I mean is, security is every financial platform owner's big challenge.

I'm not sure whether you're referring to a part of my comment or the whole comment. What I mean is, security is every financial platform owner's big challenge. This includes banks, escrow service providers, payment processors and e-commerce solution providers. Sometimes it's hard to know how secure a system is before anything happens. But I have already explained my experience, ability, current situation, my strategy, how my product works, my objectives and what I have done to the public to help everyone make informed choices. Not everyone will like every single product. I have been careful about everything I can.

tptacek 15y ago
I think you think these multi-paragraph responses you're writing are convincing. I think the best thing I can do for you is to be blunt about how unconvincing they are. Very few people with Rails or appsec experience will read them and think that you know what you're doing with regards to security. You should not be taking "thousands and thousands of dollars" from people. Full stop.
- zhoutong 15y ago
  Thank you for your guidance!
- timsally 15y ago
  I agree with everything that has been said so far, with the exception of the conclusion. I don't have a problem with zhoutong taking money. People putting their money in Bitcoin are investing in a currency that is two years old. Said another way, a currency that is younger than a $15 bottle of wine. All players in such a market by definition lack reputation, lack experience in handling currency, and lack experience in running a financial institution. Yes, zhoutong doesn't understand security and yes he is hand-waving. Yes, he needs to do his best to secure his app. Yes, he should invest money in an audit when it can afford it (if only because a security audit maps directly to better business for a financial institution). But do I feel bad for users who are putting their money into Bitcoinica? Not really. Trading in a currency that is only two years old is the NFL. Dealing with young and inexperienced financial institutions is part of the game if you chose to enter such a risky market.
rprasad 15y ago
tptacek is a security expert with almost as many years of experience in that area as you've been alive. Arguing with him about the merits of your security system would be like you arguing with an NBA veteran about the best way to slam dunk. To continue the basketball analogy, you're using a trampoline (Heroku) to reach the basket (a secure system) when you really should be learning how to jump (encryption, anti-intrusion, etc.).
- zhoutong 15y ago
  I have never argued with him about the merits of my security system. What I have done is to explain to everyone what I have done and why I think Bitcoinica still deserves some trust as a Bitcoin trading platform. He think it's unconvincing, I accepted. The security standard is very different. What I can say now is, compared to other Bitcoin exchanges which handle millions of dollars of transactions, it's likely that Bitcoinica has almost the same level of security.
  - rmc 15y ago
    BitCoin trading platforms have an abysmal record fuor security. MtGox was hacked hard. You have just told the world that you view yourself as as (in)secure as them. "we're just as good as the others" is not encouraging.
rmc 15y ago
Sometimes it's hard to know how secure a system is before anything happens However there are many ways to look at a system and see weak points, before you get hacked. Are you vulnerible to SQL Injection attacks? (You have already been shown that RoR sites can be vulnerible to SQL Injections attacks and your ignorance of that fact http://news.ycombinator.com/item?id=2973796 http://news.ycombinator.com/item?id=2973796 ). You cannot just say "Nothing in 100% secure" as a way to shut down conversation. Yes, there are unknown problems that could happen, but there are known security weaknesses. Are you covering for them?

tptacek 15y ago

I think you think these multi-paragraph responses you're writing are convincing. I think the best thing I can do for you is to be blunt about how unconvincing they are. Very few people with Rails or appsec experience will read them and think that you know what you're doing with regards to security. You should not be taking "thousands and thousands of dollars" from people. Full stop.

zhoutong 15y ago
Thank you for your guidance!
timsally 15y ago
I agree with everything that has been said so far, with the exception of the conclusion. I don't have a problem with zhoutong taking money. People putting their money in Bitcoin are investing in a currency that is two years old. Said another way, a currency that is younger than a $15 bottle of wine. All players in such a market by definition lack reputation, lack experience in handling currency, and lack experience in running a financial institution. Yes, zhoutong doesn't understand security and yes he is hand-waving. Yes, he needs to do his best to secure his app. Yes, he should invest money in an audit when it can afford it (if only because a security audit maps directly to better business for a financial institution). But do I feel bad for users who are putting their money into Bitcoinica? Not really. Trading in a currency that is only two years old is the NFL. Dealing with young and inexperienced financial institutions is part of the game if you chose to enter such a risky market.

rprasad 15y ago

tptacek is a security expert with almost as many years of experience in that area as you've been alive. Arguing with him about the merits of your security system would be like you arguing with an NBA veteran about the best way to slam dunk. To continue the basketball analogy, you're using a trampoline (Heroku) to reach the basket (a secure system) when you really should be learning how to jump (encryption, anti-intrusion, etc.).

zhoutong 15y ago
I have never argued with him about the merits of my security system. What I have done is to explain to everyone what I have done and why I think Bitcoinica still deserves some trust as a Bitcoin trading platform. He think it's unconvincing, I accepted. The security standard is very different. What I can say now is, compared to other Bitcoin exchanges which handle millions of dollars of transactions, it's likely that Bitcoinica has almost the same level of security.
- rmc 15y ago
  BitCoin trading platforms have an abysmal record fuor security. MtGox was hacked hard. You have just told the world that you view yourself as as (in)secure as them. "we're just as good as the others" is not encouraging.

rmc 15y ago

Sometimes it's hard to know how secure a system is before anything happens However there are many ways to look at a system and see weak points, before you get hacked. Are you vulnerible to SQL Injection attacks? (You have already been shown that RoR sites can be vulnerible to SQL Injections attacks and your ignorance of that fact http://news.ycombinator.com/item?id=2973796 http://news.ycombinator.com/item?id=2973796 ). You cannot just say "Nothing in 100% secure" as a way to shut down conversation. Yes, there are unknown problems that could happen, but there are known security weaknesses. Are you covering for them?