4 ms·

If I did something seriously wrong, I would definitely admit it. Trying to run a financial site without the chops to do it was seriously wrong. Of course, it w

If I did something seriously wrong, I would definitely admit it. Trying to run a financial site without the chops to do it was seriously wrong. Of course, it was wrong of users not to do more due diligence on the service, its record, the team (you, I guess), etc - after all, it was (was) their money. The recent hack is not my fault. You've got a lot to learn.

dkersten 14y ago
Trying to run a financial site without the chops to do it was seriously wrong. He was also warned when he announced Bitcoinica on HN, yet he chose to ignore those warnings.
- koglerjs 14y ago
  eh. He chose to try anyway. That isn't ignoring advice, it's just being unable to apply it.
- zhoutong 14y ago
  If everything the warning serves is to ask me shut down the site immediately after the launch, I have to say that I ignored them. However, I really did everything possible to prevent security attacks. I failed at trusting other partners too much - especially Linode. (You can say that the wallet wasn't securely stored, which could be my fault, but the hacker possessed the ability to log in to every single Linode server!) The recent email leak is because I added a guy who is responsible for security into our mailing list that was used for password resets. I would say that almost none of the comments in the original post provided the right warning or predicted the right cause of failure. Again, they are useful (and the described things could happen instead), but they are irrelevant. Any business can fail because of various reasons, and predicting something will eventually fail will always turn out right, just like predicting a baby will die one day. I appreciate the warnings because I didn't make any mistake they mentioned - no SQL injection, no mass assignments, no unauthorized back-end access, no CSRF/XSS, no firewall break-in (the hacker got the database from the server backups, not from the live database server). I think I've handled everything that I'm able to handle well.
  - dkersten 14y ago
    Maybe my comment came off too harsh. I apologize. You are clearly quite skilled and I expect you will do great things in the future. I also admire your bravery in attempting an ambitious project like Bitcoinica. The warnings I referred to were the ones saying that it is guaranteed that you will be hacked. It was never a question of if it would happen - it was always a question of when. Thats simply the facts of running a service dealing with large amounts of money. For that I think you were ill-equipped, despite that you knew that this would happen. Now, I admit that I think you handled the fallout quite well, but I don't know if you were as prepared for it as you should have been. From my very distant view, it looks like you weren't, but I don't have all the facts, so... I would say that almost none of the comments in the original post provided the right warning or predicted the right cause of failure. I'm assuming this is where experience would have saved you (or if not prevented a hack, reduced the damage done). Its difficult to cover all angles at the best of times, so its doubly so when you are inexperienced. I'm not saying that the problems would definitely have been prevented and I think perhaps I'm being unfairly critical. If your service had been dealing with anything other than money, I honestly would have no problem at all with anything you did - like I said, I think you have skill and you did handle it well after problems occurred. Its just that if I entrust my money with someone, I expect that they are well prepared for anything that could go wrong. I think I've handled everything that I'm able to handle well. I agree, you probably have, but thats where the problem that I see is (or was, I guess). Its not the things that you're able to handle that I'm worried about - its the things that you're not able to handle. So with that said, let me close by saying that I'm glad you came out of this alive (ie not bankrupt - I hope!) and I wish you the best of luck in your future endeavors. I imagine you learned a hell of a lot running Bitcoinica.
    - zhoutong 14y ago
      Thanks a lot for the clarification. Now I understand your point. I have officially left the Bitcoin economy so my next project will not be anything financial related. The most important thing that I have learned is exactly what you said - "Its not the things that you're able to handle that I'm worried about - its the things that you're not able to handle." Also, trust is another issue. Almost the whole Bitcoinica system fell under the hacker's hands, except for one part - AML verification documents (customers' passports and other extremely confidential information). This is because this part of system is still solely under my control - not even the new owner could access the information. I didn't trust anyone with that data, and it turned out to be the most secure system after all. I should probably identify my strengths and weaknesses carefully next time.

dkersten 14y ago

Trying to run a financial site without the chops to do it was seriously wrong. He was also warned when he announced Bitcoinica on HN, yet he chose to ignore those warnings.

koglerjs 14y ago
eh. He chose to try anyway. That isn't ignoring advice, it's just being unable to apply it.
zhoutong 14y ago
If everything the warning serves is to ask me shut down the site immediately after the launch, I have to say that I ignored them. However, I really did everything possible to prevent security attacks. I failed at trusting other partners too much - especially Linode. (You can say that the wallet wasn't securely stored, which could be my fault, but the hacker possessed the ability to log in to every single Linode server!) The recent email leak is because I added a guy who is responsible for security into our mailing list that was used for password resets. I would say that almost none of the comments in the original post provided the right warning or predicted the right cause of failure. Again, they are useful (and the described things could happen instead), but they are irrelevant. Any business can fail because of various reasons, and predicting something will eventually fail will always turn out right, just like predicting a baby will die one day. I appreciate the warnings because I didn't make any mistake they mentioned - no SQL injection, no mass assignments, no unauthorized back-end access, no CSRF/XSS, no firewall break-in (the hacker got the database from the server backups, not from the live database server). I think I've handled everything that I'm able to handle well.
- dkersten 14y ago
  Maybe my comment came off too harsh. I apologize. You are clearly quite skilled and I expect you will do great things in the future. I also admire your bravery in attempting an ambitious project like Bitcoinica. The warnings I referred to were the ones saying that it is guaranteed that you will be hacked. It was never a question of if it would happen - it was always a question of when. Thats simply the facts of running a service dealing with large amounts of money. For that I think you were ill-equipped, despite that you knew that this would happen. Now, I admit that I think you handled the fallout quite well, but I don't know if you were as prepared for it as you should have been. From my very distant view, it looks like you weren't, but I don't have all the facts, so... I would say that almost none of the comments in the original post provided the right warning or predicted the right cause of failure. I'm assuming this is where experience would have saved you (or if not prevented a hack, reduced the damage done). Its difficult to cover all angles at the best of times, so its doubly so when you are inexperienced. I'm not saying that the problems would definitely have been prevented and I think perhaps I'm being unfairly critical. If your service had been dealing with anything other than money, I honestly would have no problem at all with anything you did - like I said, I think you have skill and you did handle it well after problems occurred. Its just that if I entrust my money with someone, I expect that they are well prepared for anything that could go wrong. I think I've handled everything that I'm able to handle well. I agree, you probably have, but thats where the problem that I see is (or was, I guess). Its not the things that you're able to handle that I'm worried about - its the things that you're not able to handle. So with that said, let me close by saying that I'm glad you came out of this alive (ie not bankrupt - I hope!) and I wish you the best of luck in your future endeavors. I imagine you learned a hell of a lot running Bitcoinica.
  - zhoutong 14y ago
    Thanks a lot for the clarification. Now I understand your point. I have officially left the Bitcoin economy so my next project will not be anything financial related. The most important thing that I have learned is exactly what you said - "Its not the things that you're able to handle that I'm worried about - its the things that you're not able to handle." Also, trust is another issue. Almost the whole Bitcoinica system fell under the hacker's hands, except for one part - AML verification documents (customers' passports and other extremely confidential information). This is because this part of system is still solely under my control - not even the new owner could access the information. I didn't trust anyone with that data, and it turned out to be the most secure system after all. I should probably identify my strengths and weaknesses carefully next time.