9 ms·

There's no acceptable middle ground really. Practically every Bitcoin service is full of incompetence of varying degrees. Coinbase for example uses MongoDB for

by nwh 13y ago

There's no acceptable middle ground really. Practically every Bitcoin service is full of incompetence of varying degrees. Coinbase for example uses MongoDB for their accounting and apparently was hacked (and the funds returned) as an effect of that. Every other service has issues with the founders (BTC-e is run by who?) or their security record (inputs.io had a cold wallet?) in some way. You can't trust much in this particular corner of the internet.

mateuszf 13y ago
Haven't heard of any problems with bitstamp. Did you?
- nwh 13y ago
  I have not either, beside the usual phishing and DDoS. That said I've not had any experience with them except for hearing the name in passing. Remember that a comment like this is possibly a false positive, they could be incompetent until we know that it's 100% true, we can't ever prove that they aren't incompetent.
  - mateuszf 13y ago
    Maybe, but that's like me calling you incompetent because there is no proof you always are competent.
    - nwh 13y ago
      True, but I'm not handling financial transactions.
      - mateuszf 13y ago
        It doesn't matter. With your definition of competence no one could be called that way ever.
        Dylan16807 13y ago
        It's quite possible to demonstrate robust systems. But you have to have robust systems first.
        nwh 13y ago
        A measure of competence is usually down to trust and demonstration of experience. We can take blockchain.info, a slightly similar service, and use them as an example. With no other knowledge I can see that their ready to go PHP developer examples have SQL injection vulnerabilities. That's not an issue with the service itself-that's closed source-but we now have a measure of the incompetence of the websites owner. There's no way of knowing what their system looks like internally, but that's enough to make me cautious relying on their data feeds as being 100% reliable.
  - runn1ng 13y ago
    I have heard that they are extremely well-run and everything works as it should - however, they ask a lot of questions if you make bigger transactions. For example, they need to know where do you get your money from, and if it's from mining, they want copies of bills for the mining rigs, and so on.
- lispsil 13y ago
  There is some problems funding for some people, as some banks consider Slovenia to be under financial embargo/blacklist. There is also the huge problem that they do not have MSB licenses in the US, so it's only a matter of time until Florida or NY sues them, or demands the arrest and extradition of the owners for not complying with US laws yet still allowing American customers.
  - ye 13y ago
    Bitstamp is outside of NY or FL jurisdiction.
    - lispsil 13y ago
      US law changed where nobody is outside their jurisdiction anymore with these new MSB laws, which is why a lot of foreign services stopped dealing with US residents. FL can petition whatever federal government agency to go after them like they did foreign Liberty Reserve exchangers.
      - gamblor956 13y ago
        Stop spreading FUD. The MSB rules only apply to exchanges incorporated or physically located in the US, including its outlying territories. They don't apply to foreign exchanges, i.e., MtGox or most other current major BTC exchanges. Foreign services stopped dealing with US residents because last year new FBAR and FATCA compliance rules went into effect, requiring US taxpayers to provide more information about their foreign assets, and the US signed numerous new agreements with most major nations to share data about U.S. account-holders (agreements under which either nation could demand specified information about account-holders in the other nation as if they were domestic institutions) Many European banks stopped doing business with Americans because it was a paperwork nightmare to deal with the compliance.
        lispsil 13y ago
        1 CFR 1010.100(ff). An entity may now qualify as a money services business (MSB) under the Bank Secrecy Act (BSA) regulations based on its activities within the United States, even if none of its agents, agencies, branches or offices are physically located in the United States. Relevant factors include whether the foreign-located person, whether or not on a regular basis or as an organized or licensed business concern, is providing services to customers located in the United States. The Final Rule requires each foreign-located MSB to appoint a person residing in the United States as an agent for service of legal process with respect to compliance with the BSA and its implementing regulations. Translation: Bitstamp, if they take $1 from an American customer are now required to register with FinCen, possibly apply for licenses (nobody has figured this out yet at the bitcoin foundation) and have an agent based in the US to oversee legal compliance. I haven't heard of Bitstamp doing this. Use at your own risk.
eknkc 13y ago
What is the link between MongoDB and them getting hacked?
- d23 13y ago
  MongoDB is the accepted thing to hate around here. That being said, I don't think a schemaless database is really appropriate for carefully considered (or what should be carefully considered) financial data.
  - AndyNemmity 13y ago
    Why does MongoDB have a bad reputation here?
    - justinsb 13y ago
      It's been repeatedly discussed (ad nauseam?) - I recommend checking out hnsearch.com. I dislike MongoDB, but if I had to try to summarize objectively: 1) It is marketed very heavily, including to use cases to which it is poorly suited 2) It can be very complicated to run in production, I think because it actually wasn't originally designed to be distributed. 3) It has a history of data loss. I think this is because it generally favors performance over reliability, combined with #1 and #2
    - camus2 13y ago
      MongoDB has been marketed as something it is not ,that's why.
      - doyoulikeworms 13y ago
        Would you care to provide a brief rundown on this? I'm not doubting you. I'm simply ignorant. What about other NoSQL solutions?
        fennecfoxen 13y ago
        MongoDB is a clever wrapper to a mmap()'d hash table of linked lists of BSON documents that's naive as anything but fast as long as everything's always in memory. (Well, "fast" is a strong word where Mongo is concerned. "not horribly slow".) MOST other NoSQL solutions actually do things like treat their index differently than their bulk data so that it isn't accidentally swapped out, ruining performance. Many also do important things like supplying durable writes. (Your data may not be consistent at any one given moment, but it'll get there.)
lispsil 13y ago
You left out Bitomat, the incompetent exchange that deleted their own amazon instance accidentally which contained all their keys, and thus customer funds.
- nwh 13y ago
  I wasn't aware, that's obscene.
- pbhjpbhj 13y ago
  Perfect[ish] cover story?
  - judk 13y ago
    Victims can monitor the blockchain to determine if their coins were spent? (Of the victims know their coins public keys, I guess)
    - pbhjpbhj 13y ago
      Indeed that's what made me temper it with an -ish. Whilst you can monitor it that doesn't really help if the perps have escaped beyond the reaches of the relevant laws. How many people are monitoring the blockchain in that way - sounds like an app idea.
    - jnbiche 13y ago
      Yeah, but the problem is that once you deposit your money into an exchange, you no longer have a public key -- it's all in the wallet of the exchange.
- yogo 13y ago
  Ouch.. that's worse than being hacked.
ultramancool 13y ago
> BTC-e is run by who? Some people view this as a problem, personally I view this as a benefit. Because of them being a little bit sketchy, they don't ask for ID verification and offer some services, margin trading for example that other exchanges do not due to legal complications. As long as you use it as an exchange and not as storage I think it's perfectly fine.
deleted 13y ago
[deleted]
1qaz2wsx3edc 13y ago
Trust is fickle on the internet. These young, inexperience companies are hurting consumers by poor practises. That however doesn't restrict an experienced party from providing services safely. For instance, we may trust amazon or github and a plethora of other services online. It appears we generally trust them because they have a solid record of support & are transparent about issues. What I'm trying to convey is that a reputable party could in time be a trusted. This doesn't negate an individual from taking protective measures such as paper wallets, vaults, backups and spreading your wealth across wallets. Right now it's a kin to the wild west. And the law-men are coming, they just haven't arrived. I feel in time, the dust will settle. Trust is a slow process.
asperous 13y ago
This is one reason why I think forcing exchanges to register as money transmitters and regulating them as such might have a positive effect. These exchanges have to have a certain amount of capital set aside and can't simply disappear with account holder's money if they get hacked due to incompetence.
jnbiche 13y ago
I would submit that Bitstamp is running a very professional operation, and that owner Nejc Kodric is very competent and not at all anonymous. They've been occasionally overwhelmed by large amounts of new clients, but all of my interactions with their support staff have been very impressive. Through these giant waves of expansion, they've kept their trade engine running quickly (people have described a few brief periods of slower operation, but it never affected me). A lot of folks discount them because they're in Eastern/Central Europe, but really Slovenia's business environment shares more with Germany than it does the rest of Eastern Europe. All in all, I think Bitstamp is doing a great job.
- barmstrong 13y ago
  Coinbase CEO here - can confirm it was not us. Checked with the team and we couldn't find any interaction matching that description. http://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_roughly_100_btc_from_an_exchange_and/ http://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_... We work with a community of security researchers who help us test these sort of things https://coinbase.com/whitehat https://coinbase.com/whitehat including quite a lot on race conditions. We use a variety of datastores for different parts of the app where they are best suited.
catwell 13y ago
Bitcoin Central is relatively good. They have been hacked before, but the exploit was actually against their hosting provider's dashboard...

by nwh 13y ago

mateuszf 13y ago

Haven't heard of any problems with bitstamp. Did you?

nwh 13y ago
I have not either, beside the usual phishing and DDoS. That said I've not had any experience with them except for hearing the name in passing. Remember that a comment like this is possibly a false positive, they could be incompetent until we know that it's 100% true, we can't ever prove that they aren't incompetent.
- mateuszf 13y ago
  Maybe, but that's like me calling you incompetent because there is no proof you always are competent.
  - nwh 13y ago
    True, but I'm not handling financial transactions.
    - mateuszf 13y ago
      It doesn't matter. With your definition of competence no one could be called that way ever.
      - Dylan16807 13y ago
        It's quite possible to demonstrate robust systems. But you have to have robust systems first.
      - nwh 13y ago
        A measure of competence is usually down to trust and demonstration of experience. We can take blockchain.info, a slightly similar service, and use them as an example. With no other knowledge I can see that their ready to go PHP developer examples have SQL injection vulnerabilities. That's not an issue with the service itself-that's closed source-but we now have a measure of the incompetence of the websites owner. There's no way of knowing what their system looks like internally, but that's enough to make me cautious relying on their data feeds as being 100% reliable.
- runn1ng 13y ago
  I have heard that they are extremely well-run and everything works as it should - however, they ask a lot of questions if you make bigger transactions. For example, they need to know where do you get your money from, and if it's from mining, they want copies of bills for the mining rigs, and so on.
lispsil 13y ago
There is some problems funding for some people, as some banks consider Slovenia to be under financial embargo/blacklist. There is also the huge problem that they do not have MSB licenses in the US, so it's only a matter of time until Florida or NY sues them, or demands the arrest and extradition of the owners for not complying with US laws yet still allowing American customers.
- ye 13y ago
  Bitstamp is outside of NY or FL jurisdiction.
  - lispsil 13y ago
    US law changed where nobody is outside their jurisdiction anymore with these new MSB laws, which is why a lot of foreign services stopped dealing with US residents. FL can petition whatever federal government agency to go after them like they did foreign Liberty Reserve exchangers.
    - gamblor956 13y ago
      Stop spreading FUD. The MSB rules only apply to exchanges incorporated or physically located in the US, including its outlying territories. They don't apply to foreign exchanges, i.e., MtGox or most other current major BTC exchanges. Foreign services stopped dealing with US residents because last year new FBAR and FATCA compliance rules went into effect, requiring US taxpayers to provide more information about their foreign assets, and the US signed numerous new agreements with most major nations to share data about U.S. account-holders (agreements under which either nation could demand specified information about account-holders in the other nation as if they were domestic institutions) Many European banks stopped doing business with Americans because it was a paperwork nightmare to deal with the compliance.
      - lispsil 13y ago
        1 CFR 1010.100(ff). An entity may now qualify as a money services business (MSB) under the Bank Secrecy Act (BSA) regulations based on its activities within the United States, even if none of its agents, agencies, branches or offices are physically located in the United States. Relevant factors include whether the foreign-located person, whether or not on a regular basis or as an organized or licensed business concern, is providing services to customers located in the United States. The Final Rule requires each foreign-located MSB to appoint a person residing in the United States as an agent for service of legal process with respect to compliance with the BSA and its implementing regulations. Translation: Bitstamp, if they take $1 from an American customer are now required to register with FinCen, possibly apply for licenses (nobody has figured this out yet at the bitcoin foundation) and have an agent based in the US to oversee legal compliance. I haven't heard of Bitstamp doing this. Use at your own risk.

eknkc 13y ago

What is the link between MongoDB and them getting hacked?

d23 13y ago
MongoDB is the accepted thing to hate around here. That being said, I don't think a schemaless database is really appropriate for carefully considered (or what should be carefully considered) financial data.
- AndyNemmity 13y ago
  Why does MongoDB have a bad reputation here?
  - justinsb 13y ago
    It's been repeatedly discussed (ad nauseam?) - I recommend checking out hnsearch.com. I dislike MongoDB, but if I had to try to summarize objectively: 1) It is marketed very heavily, including to use cases to which it is poorly suited 2) It can be very complicated to run in production, I think because it actually wasn't originally designed to be distributed. 3) It has a history of data loss. I think this is because it generally favors performance over reliability, combined with #1 and #2
  - camus2 13y ago
    MongoDB has been marketed as something it is not ,that's why.
    - doyoulikeworms 13y ago
      Would you care to provide a brief rundown on this? I'm not doubting you. I'm simply ignorant. What about other NoSQL solutions?
      - fennecfoxen 13y ago
        MongoDB is a clever wrapper to a mmap()'d hash table of linked lists of BSON documents that's naive as anything but fast as long as everything's always in memory. (Well, "fast" is a strong word where Mongo is concerned. "not horribly slow".) MOST other NoSQL solutions actually do things like treat their index differently than their bulk data so that it isn't accidentally swapped out, ruining performance. Many also do important things like supplying durable writes. (Your data may not be consistent at any one given moment, but it'll get there.)

lispsil 13y ago

You left out Bitomat, the incompetent exchange that deleted their own amazon instance accidentally which contained all their keys, and thus customer funds.

nwh 13y ago
I wasn't aware, that's obscene.
pbhjpbhj 13y ago
Perfect[ish] cover story?
- judk 13y ago
  Victims can monitor the blockchain to determine if their coins were spent? (Of the victims know their coins public keys, I guess)
  - pbhjpbhj 13y ago
    Indeed that's what made me temper it with an -ish. Whilst you can monitor it that doesn't really help if the perps have escaped beyond the reaches of the relevant laws. How many people are monitoring the blockchain in that way - sounds like an app idea.
  - jnbiche 13y ago
    Yeah, but the problem is that once you deposit your money into an exchange, you no longer have a public key -- it's all in the wallet of the exchange.
yogo 13y ago
Ouch.. that's worse than being hacked.

ultramancool 13y ago

> BTC-e is run by who? Some people view this as a problem, personally I view this as a benefit. Because of them being a little bit sketchy, they don't ask for ID verification and offer some services, margin trading for example that other exchanges do not due to legal complications. As long as you use it as an exchange and not as storage I think it's perfectly fine.

deleted 13y ago

[deleted]

1qaz2wsx3edc 13y ago

Trust is fickle on the internet. These young, inexperience companies are hurting consumers by poor practises. That however doesn't restrict an experienced party from providing services safely. For instance, we may trust amazon or github and a plethora of other services online. It appears we generally trust them because they have a solid record of support & are transparent about issues. What I'm trying to convey is that a reputable party could in time be a trusted. This doesn't negate an individual from taking protective measures such as paper wallets, vaults, backups and spreading your wealth across wallets. Right now it's a kin to the wild west. And the law-men are coming, they just haven't arrived. I feel in time, the dust will settle. Trust is a slow process.

asperous 13y ago

This is one reason why I think forcing exchanges to register as money transmitters and regulating them as such might have a positive effect. These exchanges have to have a certain amount of capital set aside and can't simply disappear with account holder's money if they get hacked due to incompetence.

jnbiche 13y ago

I would submit that Bitstamp is running a very professional operation, and that owner Nejc Kodric is very competent and not at all anonymous. They've been occasionally overwhelmed by large amounts of new clients, but all of my interactions with their support staff have been very impressive. Through these giant waves of expansion, they've kept their trade engine running quickly (people have described a few brief periods of slower operation, but it never affected me). A lot of folks discount them because they're in Eastern/Central Europe, but really Slovenia's business environment shares more with Germany than it does the rest of Eastern Europe. All in all, I think Bitstamp is doing a great job.

barmstrong 13y ago
Coinbase CEO here - can confirm it was not us. Checked with the team and we couldn't find any interaction matching that description. http://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_roughly_100_btc_from_an_exchange_and/ http://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_... We work with a community of security researchers who help us test these sort of things https://coinbase.com/whitehat https://coinbase.com/whitehat including quite a lot on race conditions. We use a variety of datastores for different parts of the app where they are best suited.

catwell 13y ago

Bitcoin Central is relatively good. They have been hacked before, but the exploit was actually against their hosting provider's dashboard...