2 ms·

Thanks for posting, Tong, good luck with next. Might I suggest a post-mortem on the various security problems you dealt with, for those of us who weren't follo

Thanks for posting, Tong, good luck with next. Might I suggest a post-mortem on the various security problems you dealt with, for those of us who weren't following closely? I'm sure you learned a lot, even if what not to do. I don't think many programmers, especially web developers in the consumer startup scene, are faced with such security pressures as Bitcoinica was, so it would probably be very useful for many to read a behind-the-scenes accounting of that.

Estragon 15y ago
I would love to read that, too, but it's worth noting that the particular failure in this case appears to have been pretty boring. According to his account he was transferring operational control to a different group, and one member was relying on an insecure email server which was used to reset the root password on a Rackspace VPS.
zhoutong 15y ago
Unfortunately, I haven't encountered a single strong hacker (in terms of web). All my 3-year Rails experience was sufficient to prevent the most direct web attacks: Injection, CSRF, XSS, etc. The rest is simple, keep wallet.dat securely. It's just everything the hacker wants. So, the experience isn't very applicable to other startups, I think.