6 ms·

I'm leaving Bitcoin

85 points by zhoutong 14y ago

ewillbefull 14y ago
This has no remarkable impact on Bitcoin or the community, it's just the founder of Bitcoinica (which was hacked several times) disassociating himself from Bitcoin because his reputation has been decimated.
- zhoutong 14y ago
  If I did something seriously wrong, I would definitely admit it. The recent hack is not my fault. It just destroyed the only reason that I stay in Bitcoinica.
  - ewillbefull 14y ago
    I am certainly not accusing you of any misbehavior, but even you would admit this incident did not serve your reputation well -- deservedly or not. And that is indeed your motivation for leaving.
    - berberous 14y ago
      It certainly doesn't inspire confidence in his ability to single-handedly securely run a financial company targeted by hackers, but I think he has handled himself quite well otherwise. His forthrightness with the incidents, covering of customer losses, etc. has made me respect him.
      - illumin8 14y ago
        +1. Please give him respect. It's not often that a 17 year old hacker builds a site in 4 and a half days that begins processing over $1M USD in volume. Of course it's going to be a target for hackers. Do you insult the local jewelry store owner because his diamonds got stolen?
        polyfractal 14y ago
        Perhaps, if that jewelry store owner had his diamonds sitting on a picnic table outside the store, unsupervised.
    - zhoutong 14y ago
      Reputation damage is never the motivation for leaving. I wanted to leave long ago. The income was too attractive for me to actually leave. Without money I can finally rationally re-think my destiny.
      - muyuu 14y ago
        I strongly disapprove of the recklessness you have displayed several times, but then again you're a kid and it's understandable. I hope you are successful and that you have banked well in the Bitcoinica deal.
      - guylhem 14y ago
        "generating value for society at large" struck a chord with me. This is also something I strongly resent in my line of work. Maybe rationally rethinking one's destiny requires having first solved the money problem? Congratulations on your insights.
  - malandrew 14y ago
    You said that you're leaving to pursue opportunities where you can "...build products that save people time, money and headaches." Why not make it easier for people to use bitcoins in day to day transactions? It feels to me like more effort in the bit coin community is going into making financial products for finance people than financial products for normal people doing normal things. Solutions such as those that make bitcoin transactions from one cell phone to another cell phone would be a valuable addition to the community.
  - skeptical 14y ago
    I'm not a bitcoin user, but I'll have to agree with ewillbefull. Not trying to take value of our contribution to bitcoin (I don't know much about it to be honest) but, as an outsider, my reaction is: Why does this person feels the need of making such an announcement? Why didn't you took your decision silently? Also... "leaving BITCOIN"??? Sounds a bit pretentios to me... maybe "leaving BITCONICA" would be a more apropriate title?
  - beosrocks 14y ago
    If I did something seriously wrong, I would definitely admit it. Trying to run a financial site without the chops to do it was seriously wrong. Of course, it was wrong of users not to do more due diligence on the service, its record, the team (you, I guess), etc - after all, it was (was) their money. The recent hack is not my fault. You've got a lot to learn.
    - dkersten 14y ago
      Trying to run a financial site without the chops to do it was seriously wrong. He was also warned when he announced Bitcoinica on HN, yet he chose to ignore those warnings.
      - koglerjs 14y ago
        eh. He chose to try anyway. That isn't ignoring advice, it's just being unable to apply it.
      - zhoutong 14y ago
        If everything the warning serves is to ask me shut down the site immediately after the launch, I have to say that I ignored them. However, I really did everything possible to prevent security attacks. I failed at trusting other partners too much - especially Linode. (You can say that the wallet wasn't securely stored, which could be my fault, but the hacker possessed the ability to log in to every single Linode server!) The recent email leak is because I added a guy who is responsible for security into our mailing list that was used for password resets. I would say that almost none of the comments in the original post provided the right warning or predicted the right cause of failure. Again, they are useful (and the described things could happen instead), but they are irrelevant. Any business can fail because of various reasons, and predicting something will eventually fail will always turn out right, just like predicting a baby will die one day. I appreciate the warnings because I didn't make any mistake they mentioned - no SQL injection, no mass assignments, no unauthorized back-end access, no CSRF/XSS, no firewall break-in (the hacker got the database from the server backups, not from the live database server). I think I've handled everything that I'm able to handle well.
Porter_423 14y ago
Despite all distrusts and controversies among some people, you still did a great job. I believe that Bitcoinica actually reduced the price volatility instead of increasing it, I also in my whole heart believe that Bitcoinica is much much more than just a place for people to speculate. You devoted a lot to the community and deserve appreciation.
javert 14y ago
zhoutong, you are definitely an inspiration. Sad to see you leaving bitcoin.
h2s 14y ago
These bitcoin hacks have amazed me every single time. The old-school financial industry goes to extreme lengths in order to protect the money it's in charge of. Physical money is stored securely and guarded. IT infrastructure is carefully guarded both physically and electronically. By comparison, these bitcoin folks seem quite content to store what is essentially money on run-of-the-mill servers in run-of-the-mill data centres. Linode? Rackspace? Are you people fucking serious? It keeps happening, and I keep wondering why any thinking person would trust plain old data centre security staff with their money like this.
- eli 14y ago
  I agree with what you're saying. I'd argue that Bitcoin sites are at even higher risk than old-school financial sites because (I assume) the FBI actively investigates bank hacks, but not Bitcoin trading site hacks. If I were a bad guy, I know which I'd target.
- soup10 14y ago
  I keep wondering why any thinking person would buy bitcoins. Could be related.
  - skeptical 14y ago
    It's rather difficult to make money these days without notifying a shitload of institutionalized entities. I'm not saying that I disagree with taxpaying, but things got to a ridiculous level where everything is set up to make sure you have very little opportunities to make money with your work, and if you succeed after all, you're only entitle to a rather small slice. About the original post, I couldn't agree more.
- icebraining 14y ago
  They go through great lengths, except apparently verifying if you're authorized to access an account, as in the Citigroup hack. Or having two-factor auth. Or being able to use passwords with decent length. Or providing a better payment system than a single set of codes that you have to hope no company leaks, or you'll have to get a new CC (see the Global Payments hack), when even fucking Twitter knows how to develop an authorization scheme that can be individually revoked. Seriously, the banking industry is hardly a paragon of security. Many startups give you better ways to protect your cat pictures than the average bank gives you to protect your money.
SkyMarshal 14y ago
Thanks for posting, Tong, good luck with next. Might I suggest a post-mortem on the various security problems you dealt with, for those of us who weren't following closely? I'm sure you learned a lot, even if what not to do. I don't think many programmers, especially web developers in the consumer startup scene, are faced with such security pressures as Bitcoinica was, so it would probably be very useful for many to read a behind-the-scenes accounting of that.
- Estragon 14y ago
  I would love to read that, too, but it's worth noting that the particular failure in this case appears to have been pretty boring. According to his account he was transferring operational control to a different group, and one member was relying on an insecure email server which was used to reset the root password on a Rackspace VPS.
- zhoutong 14y ago
  Unfortunately, I haven't encountered a single strong hacker (in terms of web). All my 3-year Rails experience was sufficient to prevent the most direct web attacks: Injection, CSRF, XSS, etc. The rest is simple, keep wallet.dat securely. It's just everything the hacker wants. So, the experience isn't very applicable to other startups, I think.
panarky 14y ago
"Spectacular failure is your destiny." I thought jellicle's advice to Zhou Tong was insightful 248 days ago. Time has proven its wisdom. http://news.ycombinator.com/item?id=2973803 http://news.ycombinator.com/item?id=2973803 -- systems that work with money are attacked hard and often, by intelligent skilled people -- in fact some of the people who attack your system are likely to be both more skilled and more intelligent than you are -- systems that work with money that fail, fail spectacularly ("What do you mean someone withdrew $8 million last night?") -- banking websites, Paypal, etc. are all like icebergs - you don't see 9/10ths of the things they've done to prevent spectacular failure -- spectacular failure is your destiny if you don't work very hard to prevent it -- spectacular failure may be your destiny even if you do work very hard to prevent it You should plan accordingly.
- beosrocks 14y ago
  Wow - didn't realize on first reading that the comment was actually directed to Zhou Tong, who replied that he would "definitely pay attention to every single detail." Forensic's response was prophetic: http://news.ycombinator.com/item?id=2976031 http://news.ycombinator.com/item?id=2976031 EDIT: panarky has now updated his post above to make it clear that the advice was to Zhou Tong.
- zhoutong 14y ago
  Thank you for your original advice. It's definitely useful. But it's not relevant today. I don't wish to link the Bitcoinica fiasco with my leave because I sold Bitcoinica a few months ago. And I lost my control in January. Basically everything didn't go as I planned. (I'm VERY conservative about wallet security.) I wanted to build an independent exchange system to replace hedging, so that most funds can stay offline. But the new owner didn't like the idea. I know it failed like predicted, but my involvement in the failure is highly limited. I sold the site for the same reasons: What if someday I'm hacked, or caught? (The valuation (P/E) was less than 1!) I'm a web developer, not a security expert. I know how to protect the API keys but I'm not good at encrypting a wallet.dat. That's all I thought since day one.
  - palish 14y ago
DiabloD3 14y ago
I hope this thing with Zhou and Bitcoinica isn't going to screw up my company's all Bitcoin IPO: https://glbse.com/asset/view/DMC https://glbse.com/asset/view/DMC We're seeking 200k BTC for a self-green powered mining farm at our own DC up here in Maine, so we profit from the mining farm itself, having nearly no cooling needs for the DC, selling power generated back to the grid, and also renting excess space to other companies who want out of the way DC space in a quiet part of the country.
pixie_ 14y ago
I still suspect he stole the 18k bitcoins, the guy is slippery.
- dkersten 14y ago
  Why would you think this?
  - dkersten 14y ago
    I was genuinely curious why grandparent would think that "I still suspect he stole the 18k bitcoins, the guy is slippery.". Why is the guy "slippery"? What makes you think that he stole the bitcoins? Why would someone downvote for asking for clarification..?

85 points by zhoutong 14y ago

This has no remarkable impact on Bitcoin or the community, it's just the founder of Bitcoinica (which was hacked several times) disassociating himself from Bitcoin because his reputation has been decimated.

zhoutong 14y ago
If I did something seriously wrong, I would definitely admit it. The recent hack is not my fault. It just destroyed the only reason that I stay in Bitcoinica.
- ewillbefull 14y ago
  I am certainly not accusing you of any misbehavior, but even you would admit this incident did not serve your reputation well -- deservedly or not. And that is indeed your motivation for leaving.
  - berberous 14y ago
    It certainly doesn't inspire confidence in his ability to single-handedly securely run a financial company targeted by hackers, but I think he has handled himself quite well otherwise. His forthrightness with the incidents, covering of customer losses, etc. has made me respect him.
    - illumin8 14y ago
      +1. Please give him respect. It's not often that a 17 year old hacker builds a site in 4 and a half days that begins processing over $1M USD in volume. Of course it's going to be a target for hackers. Do you insult the local jewelry store owner because his diamonds got stolen?
      - polyfractal 14y ago
        Perhaps, if that jewelry store owner had his diamonds sitting on a picnic table outside the store, unsupervised.
  - zhoutong 14y ago
    Reputation damage is never the motivation for leaving. I wanted to leave long ago. The income was too attractive for me to actually leave. Without money I can finally rationally re-think my destiny.
    - muyuu 14y ago
      I strongly disapprove of the recklessness you have displayed several times, but then again you're a kid and it's understandable. I hope you are successful and that you have banked well in the Bitcoinica deal.
    - guylhem 14y ago
      "generating value for society at large" struck a chord with me. This is also something I strongly resent in my line of work. Maybe rationally rethinking one's destiny requires having first solved the money problem? Congratulations on your insights.
- malandrew 14y ago
  You said that you're leaving to pursue opportunities where you can "...build products that save people time, money and headaches." Why not make it easier for people to use bitcoins in day to day transactions? It feels to me like more effort in the bit coin community is going into making financial products for finance people than financial products for normal people doing normal things. Solutions such as those that make bitcoin transactions from one cell phone to another cell phone would be a valuable addition to the community.
- skeptical 14y ago
  I'm not a bitcoin user, but I'll have to agree with ewillbefull. Not trying to take value of our contribution to bitcoin (I don't know much about it to be honest) but, as an outsider, my reaction is: Why does this person feels the need of making such an announcement? Why didn't you took your decision silently? Also... "leaving BITCOIN"??? Sounds a bit pretentios to me... maybe "leaving BITCONICA" would be a more apropriate title?
- beosrocks 14y ago
  If I did something seriously wrong, I would definitely admit it. Trying to run a financial site without the chops to do it was seriously wrong. Of course, it was wrong of users not to do more due diligence on the service, its record, the team (you, I guess), etc - after all, it was (was) their money. The recent hack is not my fault. You've got a lot to learn.
  - dkersten 14y ago
    Trying to run a financial site without the chops to do it was seriously wrong. He was also warned when he announced Bitcoinica on HN, yet he chose to ignore those warnings.
    - koglerjs 14y ago
      eh. He chose to try anyway. That isn't ignoring advice, it's just being unable to apply it.
    - zhoutong 14y ago
      If everything the warning serves is to ask me shut down the site immediately after the launch, I have to say that I ignored them. However, I really did everything possible to prevent security attacks. I failed at trusting other partners too much - especially Linode. (You can say that the wallet wasn't securely stored, which could be my fault, but the hacker possessed the ability to log in to every single Linode server!) The recent email leak is because I added a guy who is responsible for security into our mailing list that was used for password resets. I would say that almost none of the comments in the original post provided the right warning or predicted the right cause of failure. Again, they are useful (and the described things could happen instead), but they are irrelevant. Any business can fail because of various reasons, and predicting something will eventually fail will always turn out right, just like predicting a baby will die one day. I appreciate the warnings because I didn't make any mistake they mentioned - no SQL injection, no mass assignments, no unauthorized back-end access, no CSRF/XSS, no firewall break-in (the hacker got the database from the server backups, not from the live database server). I think I've handled everything that I'm able to handle well.

Porter_423 14y ago

Despite all distrusts and controversies among some people, you still did a great job. I believe that Bitcoinica actually reduced the price volatility instead of increasing it, I also in my whole heart believe that Bitcoinica is much much more than just a place for people to speculate. You devoted a lot to the community and deserve appreciation.

javert 14y ago

zhoutong, you are definitely an inspiration. Sad to see you leaving bitcoin.

h2s 14y ago

These bitcoin hacks have amazed me every single time. The old-school financial industry goes to extreme lengths in order to protect the money it's in charge of. Physical money is stored securely and guarded. IT infrastructure is carefully guarded both physically and electronically. By comparison, these bitcoin folks seem quite content to store what is essentially money on run-of-the-mill servers in run-of-the-mill data centres. Linode? Rackspace? Are you people fucking serious? It keeps happening, and I keep wondering why any thinking person would trust plain old data centre security staff with their money like this.

eli 14y ago
I agree with what you're saying. I'd argue that Bitcoin sites are at even higher risk than old-school financial sites because (I assume) the FBI actively investigates bank hacks, but not Bitcoin trading site hacks. If I were a bad guy, I know which I'd target.
soup10 14y ago
I keep wondering why any thinking person would buy bitcoins. Could be related.
- skeptical 14y ago
  It's rather difficult to make money these days without notifying a shitload of institutionalized entities. I'm not saying that I disagree with taxpaying, but things got to a ridiculous level where everything is set up to make sure you have very little opportunities to make money with your work, and if you succeed after all, you're only entitle to a rather small slice. About the original post, I couldn't agree more.
icebraining 14y ago
They go through great lengths, except apparently verifying if you're authorized to access an account, as in the Citigroup hack. Or having two-factor auth. Or being able to use passwords with decent length. Or providing a better payment system than a single set of codes that you have to hope no company leaks, or you'll have to get a new CC (see the Global Payments hack), when even fucking Twitter knows how to develop an authorization scheme that can be individually revoked. Seriously, the banking industry is hardly a paragon of security. Many startups give you better ways to protect your cat pictures than the average bank gives you to protect your money.

SkyMarshal 14y ago

Thanks for posting, Tong, good luck with next. Might I suggest a post-mortem on the various security problems you dealt with, for those of us who weren't following closely? I'm sure you learned a lot, even if what not to do. I don't think many programmers, especially web developers in the consumer startup scene, are faced with such security pressures as Bitcoinica was, so it would probably be very useful for many to read a behind-the-scenes accounting of that.

Estragon 14y ago
I would love to read that, too, but it's worth noting that the particular failure in this case appears to have been pretty boring. According to his account he was transferring operational control to a different group, and one member was relying on an insecure email server which was used to reset the root password on a Rackspace VPS.
zhoutong 14y ago
Unfortunately, I haven't encountered a single strong hacker (in terms of web). All my 3-year Rails experience was sufficient to prevent the most direct web attacks: Injection, CSRF, XSS, etc. The rest is simple, keep wallet.dat securely. It's just everything the hacker wants. So, the experience isn't very applicable to other startups, I think.

panarky 14y ago

"Spectacular failure is your destiny." I thought jellicle's advice to Zhou Tong was insightful 248 days ago. Time has proven its wisdom. http://news.ycombinator.com/item?id=2973803 http://news.ycombinator.com/item?id=2973803 -- systems that work with money are attacked hard and often, by intelligent skilled people -- in fact some of the people who attack your system are likely to be both more skilled and more intelligent than you are -- systems that work with money that fail, fail spectacularly ("What do you mean someone withdrew $8 million last night?") -- banking websites, Paypal, etc. are all like icebergs - you don't see 9/10ths of the things they've done to prevent spectacular failure -- spectacular failure is your destiny if you don't work very hard to prevent it -- spectacular failure may be your destiny even if you do work very hard to prevent it You should plan accordingly.

beosrocks 14y ago
Wow - didn't realize on first reading that the comment was actually directed to Zhou Tong, who replied that he would "definitely pay attention to every single detail." Forensic's response was prophetic: http://news.ycombinator.com/item?id=2976031 http://news.ycombinator.com/item?id=2976031 EDIT: panarky has now updated his post above to make it clear that the advice was to Zhou Tong.
zhoutong 14y ago
Thank you for your original advice. It's definitely useful. But it's not relevant today. I don't wish to link the Bitcoinica fiasco with my leave because I sold Bitcoinica a few months ago. And I lost my control in January. Basically everything didn't go as I planned. (I'm VERY conservative about wallet security.) I wanted to build an independent exchange system to replace hedging, so that most funds can stay offline. But the new owner didn't like the idea. I know it failed like predicted, but my involvement in the failure is highly limited. I sold the site for the same reasons: What if someday I'm hacked, or caught? (The valuation (P/E) was less than 1!) I'm a web developer, not a security expert. I know how to protect the API keys but I'm not good at encrypting a wallet.dat. That's all I thought since day one.
- palish 14y ago

DiabloD3 14y ago

I hope this thing with Zhou and Bitcoinica isn't going to screw up my company's all Bitcoin IPO: https://glbse.com/asset/view/DMC https://glbse.com/asset/view/DMC We're seeking 200k BTC for a self-green powered mining farm at our own DC up here in Maine, so we profit from the mining farm itself, having nearly no cooling needs for the DC, selling power generated back to the grid, and also renting excess space to other companies who want out of the way DC space in a quiet part of the country.

pixie_ 14y ago

I still suspect he stole the 18k bitcoins, the guy is slippery.

dkersten 14y ago
Why would you think this?
- dkersten 14y ago
  I was genuinely curious why grandparent would think that "I still suspect he stole the 18k bitcoins, the guy is slippery.". Why is the guy "slippery"? What makes you think that he stole the bitcoins? Why would someone downvote for asking for clarification..?