5 ms·
Wait, what? Private keys were stored in unprotected plaintext files regularly opened by multiple people at the company? WTF? That crosses the line and goes dee
by cs702 4y ago
Wait, what? Private keys were stored in unprotected plaintext files regularly opened by multiple people at the company? WTF?
That crosses the line and goes deep into "willful negligence" territory, in my view.
The physical equivalent would be stacking customer assets like dollar bills and gold bars in big piles inside a heavily trafficked room that has no lock.
The term "irresponsible" doesn't quite do justice to it.
Unbelievable.
- albatross13 4y agoThe fact that you're surprised by this is the most alarming thing in all of this.
- berkle4455 4y agoYet FTX wasn’t hacked. Their own irresponsible bets lost it all instead.
- danielvf 4y agoI mean FTX had over 300 million dollars moved out of company funds, without company authorization, by parties unknown, and with insufficient monitoring to even know it happened until third parties let them know. So kind of depends on your definition of hacked, I guess.
- tough 4y agoSounds like really nice plausible deniability for whomever came up with such a blatant wrong way of storing secrets/value
- notfed 4y agoNov. 11 — Friday: SBF resigns, FTX goes bankrupt Nov. 12 — Saturday: FTX hacked for most of its remaining crypto Y'all be the judge.
- tough 4y agoLet's hope he doesn't buy the judge with the stolen funds...
- HDThoreaun 4y agoThey may have already been hacked and the hackers were laying low. Seems more likely that insiders stole it though yea.
- panarky 4y agoWhy not both? https://www.bbc.com/news/business-64313624 https://www.bbc.com/news/business-64313624
- matthewdgreen 4y agoMy understanding from that document is that the bankruptcy managers are just beginning to piece together an accounting of what happened to the money at FTX, and even that accounting is incomplete because personal laptops belonging to executives are being held back by Bahamian authorities. So “FTX wasn’t hacked” is just a hypothesis at this point. Hacking probably wasn’t the major contributing factor to the exchange’s financial problems would probably be a more accurate statement.
- AlexandrB 4y agoOne way to look at FTX is as a horse race between multiple catastrophic failure modes. In this case the financial malfeasance "won". Maybe in another universe where interest rates stayed low for another year we'd see FTX go down to a hack instead.
- causality0 4y agoPersonally I believe there's a strong correlation between how crazy you act on social media and how competent your internal security is.
- codyb 4y agoThat does not bode well for Twitter....
- clueless 4y agoman, then look out for elon's companies
- deleted 4y ago[deleted]
- michaelsshaw 4y agoTrue competent professionals tend to keep quiet
- WeylandYutani 4y agoThere's a reason why all bankers from Nigeria to Japan wear boring gray suits in commercials. Never understood what people saw in SBF.
- arcticbull 4y ago> That crosses the line and goes deep into "willful negligence" territory, in my view. Er, that's the thing that pushed you over the line? Not all the fraud and crime?
- mnky9800n 4y agoi was okay with the fraud and the crime. it was the hierarchical polyamory that pushed me over the line.
- h2odragon 4y ago> the hierarchical polyamory that pushed me over the line. Really. At that point one should have the decency to declare your outfit a religion, and stop paying taxes.
- mnky9800n 4y agoyou are obviously too clever to have been employed at FTX.
- EGreg 4y agoThat was just ironic I am sure Just like the “very easy math” that they all touted that was all that was needed to manage the entire thing
- mrguyorama 4y agoThe math gets REALLY easy when you do none of it.
- Waterluvian 4y agoHierarchical polyamory? I thought they meant spreadsheets, not spreading the sheets.
- A4ET8a8uTh0 4y agoBoth are bad. Crime is bad, but this is an argument for making software engineering more like a medical doctor's guild. Some things simply should not be done. There is an expectation of competence for some things like finance and medicine.
- logicalmonster 4y ago> That crosses the line and goes deep into "willful negligence" territory, in my view. A lot of people are making the assumption that gross incompetence reigned supreme with FTX, and that does seem like the likeliest explanation, but another potential explanation is deeply devious criminal activity. They could have preplanned this behavior. If they were ever caught doing anything really bad, they had "plausible deniability" by being so loosy-goosy with security and best practices. Everybody from a rogue employee to hackers could be blamed by them if the shit ever hit the fan and they could have some kind of defense that they were so disorganized that they didn't really know what happened. You might be able to distinguish this by looking at how SBF's own personal crypto funds were managed. If he knew enough to manage his own crypto in a saner way, then you could probably make a case that dysfunction in FTX was by design because he knew better and didn't do it.
- gleenn 4y agoWhile I agree with most of this, keeping a small number of things secure for yourself is far easier than doing it for thousands/millions of accounts in an automated way. That's true of almost everything in software. For instance, just because I know how to use a password manager doesn't mean it's easy to get my whole family using a password manager. They were clearly dysfunctional and there may be some of this at play but Occam's Razor says it was just easier to store less securely.
- roundandround 4y agoI think that is what is so hilarious about the situation. The US is forever creating situations where companies want to be first in and fastest scaling at any cost, offering free everything to begin. If they were a bank they would realize their growth is beyond their competence and bring in boring big bank security experts with some of the huge profits on the even more massive holdings.. But there were no legal profits on holding all these assets because they promised to be something better than a bank, making its money from risking your assets, so that was just done illegally leaving no above the table accounts for legitimate operation costs. (A friend of SBF with an illegal loan will obviously keep your keys safe.) How could an honest company that takes negligence seriously compete? It is like the opposite of regulations as barrier to entry. How do you sell things for less than the Mafia's laundering operation?
- AnimalMuppet 4y ago"Sufficiently advanced incompetence is indistinguishable from malice." I don't recall who said it, but it seems to fit.
- unaesthetic 4y agoHanlon's razor is an adage or rule of thumb that states, "Never attribute to malice that which is adequately explained by stupidity."
- AnimalMuppet 4y agoRight. My comment is a reverse of that, expressed in a similar form to Clarke's Law that "Sufficiently advanced technology is indistinguishable from magic." But I stole it. I didn't make it up.
- burnished 4y agoYeah, this is sort of the teleological view. I think Hanlon's razor is a great first guess when trying to figure out people's motivations, but this inverse is probably more appropriate when thinking about what your defenses/reactions should be.
- panarky 4y ago> Wait, what? ... WTF? ... Unbelievable. You sound shocked! shocked! to find gross incompetence going on in a place where the accounting system is an Excel spreadsheet manually maintained by the CEO himself, with entries like "Hidden, poorly internally labled fiat@ account" (sic) purportedly worth $8 billion. Private keys in plaintext in the shared Google Drive that the entire company has access to? That is the least surprising news I've heard today.
- AlexandrB 4y agoI wonder if this reaction is so strong because the readership here are generally more knowledgeable on software and software security than banking. If there was a Hacker News for banking experts, they probably had this reaction to the "accounting" spreadsheet SBF released previously.
- paulcole 4y ago> That crosses the line and goes deep into "willful negligence" territory This is FTX we're talking about. That line is far far far in the rear-view mirror.