15 ms·
Bitcoin withdrawal processing suspended
- Scorpion 13y agoSo, did bitstamp also implement incorrectly despite warnings?
- patio11 13y agoIt appears that Bitstamp did indeed use the creation transaction API in bitcoind which returns a transaction ID and they made the incorrect decision that the transaction ID returned had properties many programmers associate with IDs, like "meaning anything at all." What they should have done was waited an hour then done an O(n) scan of all transactions globally in history to find the transaction by inspecting for parameters which exactly matched the ones they provided. That is, the Bitcoin developers now say, the correct use of the create transaction API. Let me use an example programmers may be familiar with. Twilio lets you do SMS messages with three parameters: from_number, to_number, message. You are given back an SMS ID, which you can query to see the results of the SMS message (like, say, was it delivered successfully or did it fail with an error like "that telephone number did not exist"). Here's a discussion with Twilio in the bizarro world where it's like Bitcoin. Me: "Hey Twilio I created an SMS message but when I try to query it for the results it 404s." Them: "Are you sure you created the message?" Me: "Yep pretty sure." Them: "Are you sure you are looking for the right message ID in /messages/:id?" Me: "Yep, I'm using the one that I got back when I created it." Them: "Maybe it changed." Me: "... What?" Them: "Message IDs can change." Me: "They don't usually change." Them: "Of course, they don't usually change. Why have an ID if they usually changed? They only change some of the time." Me: "What determines if a message ID changes?" Them: "Oh, anyone globally can change your message IDs." Me: "That sounds a bit insecure for a system which is, by its nature, deployed in a hostile environment." Them: "Don't worry, they can't change after about an hour. Well, probably. It would be pretty expensive for an attacker to change them after an hour. Don't worry though, you'll never need an ID." Me: "I find IDs useful for querying things. Like, say, messages. Which I have to do. To see whether the message was successful or not." Them: "Well you're already downloading every message ever. Just scan through for one which matches the same from number, to number, and message contents." Me: "... You're serious." Them: "Don't worry though: they can't touch the from number, to number, or the message contents." Me: "... Does this sound a little problematic to anyone else?" Them: "It's on our wiki, noob!" [Edit: Maybe somebody thinks I'm joking. Let me point you to one of the dangerous functions. https://en.bitcoin.it/wiki/Original_Bitcoin_client/API_calls_list https://en.bitcoin.it/wiki/Original_Bitcoin_client/API_calls... Name: sendtoaddress Parameters: <bitcoinaddress> <amount> [comment] [comment-to] Comments: <amount> is a real and is rounded to 8 decimal places. Returns the transaction ID <txid> if successful. You should naturally, upon reading this documentation, figure "I should immediately discard that transaction ID, because it could be changed instantaneously after this message call. If I instead rely on that transaction ID, I will allow malicious users to break the software I am building."]
- latchkey 13y agoComment of the year award. Seriously.
- eterm 13y agoFunnily enough, I've had a similar situation to that in my line of work. It wasn't twilio, but it turned out that when we submitted a SMS message of over 160 characters, the provider split it into 160 chunks and sent out as multiple SMS. So far, so normal. But what happened when the first chunk sent successfully and the second chunk failed? We got back a notification to say "MessageID: 4ACB-etc Result: OK" but the customer never got the message, and scanning the report on the provider's site showed the customer number, time and message as having failed. But then the representative agreed it was a problem and set out to fix it rather than blaming our dependence on the ID!
- carlio 13y agoI normally enjoy reading your posts here but this one I have to say I find a bit gleefully FUD-tastic. Given that you describe BitCoin as "magic Internet money" [0] I can't help but feel you simply rejoice in BitCoin failures as vindication of your belief that crytocurrency will never work. There seem to be two prevailing extremes of opinion which appear a lot on Hacker News and many other places, as extremes are wont to do while those in the middle don't feel strongly enough to contribute. Those are 1) BitCoin will replace government control of money and fix freedom, dude! and 2) What fucking morons, can't wait until you crash and burn. I love this whole thing. It's fascinating, it's an interesting solution to a problem, and watching DogeCoin take off is fun to watch. In my opinion, BitCoin is kind of like when a naïve programmer decides to rewrite an existing library themselves, and comes up against the brutal reality that led the original developers to the compromises and apparently necessary hacks to get the thing working. The analogy here being regulation, insurance, all that jazz. It's educational, and I haven't been this interested in a technology for a while. I'm picking on your reply here because it is one of many that exemplifies a "haha told you so" rather than really digging into the interesting technical and sociological aspects. * Message IDs from one API do not equate to IDs from the other, so your example is a bit flawed; there's no way to check with Twilio except the ID. * Is "ID" even the term used? I don't know for sure, but "Tx Hash" seems to be more widely spread. [Edit: patio11 edited his comment while I was typing mine; I withdraw this point!] * "It's on our wiki noob" - someone running the 3rd largest exchange should hardly be a "noob" * "O(n) scan of all transactions globally" - that's not particularly hard, nor is it necessary (why scan all transactions from all time?), nor is it unexpected (the entire thing requires everyone to have the complete ledger, so you have the data anyway) There are valid points to be made that the BitCoin protocol needs improvements, and these are even acknowledged by the core devs. This whole situation is a bit ludicrous. But I wish we were talking about "what have we learned", not "told you so". When it comes to BitCoin, the conversation seems to be full of radicals and optimists when success happens, and gloaters when it doesn't. I don't feel either add to the conversation, we could be talking about how to improve this as a currency or (as I believe the long term actual application to be) how this can influence distributed trust, especially important in the current climate. [0] https://twitter.com/patio11/status/431347845031940096 https://twitter.com/patio11/status/431347845031940096
- yetfeo 13y agoIt depends. There's a small issue with the reference client that is also causing chains of double spent transactions in merchant wallets: http://www.reddit.com/r/Bitcoin/comments/1xm49o/due_to_active_malleable_transaction_relayers_it/ http://www.reddit.com/r/Bitcoin/comments/1xm49o/due_to_activ... I would be more inclined to believe that the majority of sites use the reference client and this is why issues are appearing.
- dublinben 13y agoThis is terrible news for Bitcoin. The currency will die without the exchanges.
- weavejester 13y agoBecause of an easily fixed bug in the software of some exchanges?
- watty 13y agoYes, confidence in a currency is very important to its survival. The crazy volatility, the inability to withdraw sometimes, the competitors, the uncertainty everywhere. Bitcoin is not helping itself.
- weavejester 13y agoIt seems unlikely to me that, after surviving all the things you mention, Bitcoin's downfall would be the result of some temporary downtime from a couple of exchanges. I guess you could argue it's the proverbial final straw on the camel's back, though.
- Phlarp 13y agoBecause of the massive (and justified) collapse of confidence in everyone building web servies for this space. It shouldn't surprise anyone that after months (years!) of BTC services absconding with millions of dollars worth of users money and now the exchanges starting to collapse in a similar fashion (users can't get money out) that the wider user base of bitcoin would begin to default toward not trusting services that purport to store coins 'securely'. This is bad in the short term as the remaining exchanges prices show, but likely a positive progression in the safe use of crypto currencies going forward--
- weavejester 13y agoI generally agree that this is bad in the short term, but likely a net positive in the long run. Bitcoin's delivering some very harsh lessons in crypto-currency security.
- dpanah 13y agoThis has to stop!
- mbreese 13y ago> This is a denial-of-service attack made possible by some misunderstandings in Bitcoin wallet implementations So... they didn't handle transaction processing correctly either. Are there any exchanges that are handling this properly?
- psykovsky 13y ago> Are there any exchanges that are handling this properly? I very much doubt it ;)
- waterlesscloud 13y agoProbably due to the code they reused from back when they were a site to trade Magic cards.
- mcantelon 13y agoWrong exchange.
- waterlesscloud 13y agoI know. I'm mocking the ridiculous thread yesterday that was so insistent that was a factor in the Gox problems.
- 650REDHAIR 13y agoCan someone give me a ELI5 breakdown of what's happening in the bitcoin world right now? First MtGox and now Bitstamp. Any reading material on the subject (for a newbie) would be greatly appreciated.
- smacktoward 13y agoIt looks a lot like a bank run to me: http://en.wikipedia.org/wiki/Bank_run http://en.wikipedia.org/wiki/Bank_run EDIT: See this for a more thorough description of what I mean: http://www.dailytech.com/Mt+Gox+Bitcoin+Bank+Run+Intensifies+1+Million+Customers+at+Risk/article34293.htm http://www.dailytech.com/Mt+Gox+Bitcoin+Bank+Run+Intensifies...
- celticninja 13y agoit is nothing like a bank run. A bank run is where the bank does not hold enough money to cover everyones deposits. Bitstamp have enough BTC to cover everyones deposits they just are delaying withdrawals for 72 hours. Think of it like you rbank telling you you need to wait 3 days for a transaction to go through, not that unlikely and in fact quite common in traditional banking. It seems longer in bitcoin though because of the usually quick transactions.
- lucb1e 13y ago> Think of it like you rbank telling you you need to wait 3 days for a transaction to go through Moreover, with banks you have this every weekend.
- smm2000 13y agoATMs and credit cards work 24/7 so no, banks do not close every weekend
- Mtinie 13y agoYou must not have ever tried to deposit a check for a moderate or significant amount on a Friday afternoon. Unless you've already set up a process with your bank, you'll only have access to part of the funds for 24 to 72 hours.
- chrisBob 13y agoIf only there was some regulation. Then maybe I would consider trusting these exchanges.
- snitko 13y agoAhh, yes, regulation. Like when big exchanges lobby the government, then monopolize the market and do whatever the hell they want while charging high fees? Great idea. What you want is an independent audit, not regulation.
- api 13y agoPolitics is often about finding bad solutions to worse problems.
- alexeisadeski3 13y agoPolitics is often about making bad problems worse.
- snitko 13y agoNo. This should never be an excuse for finding a better solution because people would not want to look for it and because it is extremely difficult to undo a regulation put in place. You're saying regulation would work better than an independent audit? How so? Show me the mechanism.
- ceejayoz 13y agoWho's going to pay for an independent audit without regulation requiring it? They're clearly not doing it on their own currently.
- snitko 13y agoI personally would be very much willing to pay for an audit of an exchange before I make the choice of which exchange to use. As many other Bitcoin traders. Who else do you think?
- IgorPartola 13y agoI am lucky that about two months ago I moved over to Coinbase from both Mt Gox and BitStamp. I wonder now if Coinbase is going to start having issues.
- mason55 13y agoCoinbase has stated they're not affected by this issue
- sillysaurus2 13y agoYou should consider moving your coins out right now, since there's no benefit to keeping them in Coinbase unless you're trading. (This is always true regardless of the current problems.)
- wcummings 13y ago>unless you're trading Not even, since Coinbase is a webwallet not an exchange... People generally keep them there because its an easy way to manage/spend them (esp on a phone)
- IgorPartola 13y agoWell, it does let you trade. It also seems to have some merchanting abilities.
- wcummings 13y agoIt lets you buy. That's not the same as trading, you can only execute market orders so its trading functionality is extremely limited.
- IgorPartola 13y agoAh, you are right. For the type of trading I do now (buy when shit hits the fan, sell when things calm down), it's good enough.
- slg 13y agoI have a feeling that people in the Bitcoin community are going to start learning the results of a truly free market, lack of regulations, and the dangers of dealing with a bank that you can't trust.
- deleted 13y ago[deleted]
- celticninja 13y agountil you can transfer fiat money, either USD/GBP/EURO, into a decentralised exchange it just wil not work. A decentralised exchange would work for pure crypto currency to cryptocurrency trading but never for fiat exchanges as they will always need to be tied to a bank account somewhere.
- celticninja 13y agoI thunk that is scaremongering nonsense. This is nothing to do with a free market, this is a software bug that has been well known but until yesterday it didnt affect many people. Someone is now trying to use it to obtain some sort of advantage but it doesnt actually allow them to steal any bitcoins. Quite how you manage to link it to be a result of a "truly free market" is beyond me.
- schrodinger 13y agoWhen it's a bank, the bug and liability is on them
- celticninja 13y agoSo what? This is an exchange not a bank. There are no missing bitcoins so there is no liability issue. All that has happened is that there has been an introduction of a delay in withdrawing. Because that delay is 72 hours it seems like a long time in bitcoin because of usually instant transactions. Compared to traditional banking it is relatively normal length of time to access funds.
- nmeofthestate 13y agoI may be misremembering, but when MtGox was getting it in the neck for having this bug in their ridiculous terrible custom wallet implementation, someone asked "are there any reliable exchanges" and someone else answered "bitstamp". Just goes to show, there's no use looking at a website (when that site is effectively a black-box) and judging its competency from a general vibe.
- smackfu 13y agoProbably thinking of this comment: https://news.ycombinator.com/item?id=7212862 https://news.ycombinator.com/item?id=7212862
- jnbiche 13y agoI stand by that comment. I'm disappointed that Bitstamp didn't take this issue into account when designing their exchange, but unlike Gox, their communication about the issue has been very good, and my confidence in Bitstamp remains unshaken. Also, it appears that the Bitcoin network is under global attack by some large entity, so blame for the current exchange issues lie ultimately at the hands of some attacker who doesn't like Bitcoin, or wishes to plunge the price.
- pmorici 13y agoThe difference between Gox and BitStamp is pretty easy to see take Gox they have had constant problems the most recent of which has been this which has been going on for multiple weeks now and their reaction was we are just going to suspend all withdrawals indefinitely. On the other hand Bitstamp identified a problem within 24 hours of it starting to happen says they know how to fix it and will have everything back to normal shortly. Personally I'd rather have my money with the latter.
- dscrd 13y agoSo it wasn't just mtgox being incompetent, then?
- deleted 13y ago[deleted]
- aestra 13y agoDoes this relate to why coinedup suspended bitcoin withdraws and deposits for around 14 hours yesterday? http://www.reddit.com/r/CoinedUp/comments/1xkft8/why_are_bitcoin_depositswithdrawals_offline/ http://www.reddit.com/r/CoinedUp/comments/1xkft8/why_are_bit...
- gtirloni 13y agoStarting a new financial system is proving to be very difficult. Who would have thought.
- baddox 13y agoIs there another currency or financial system, virtual or crypto or fiat or otherwise, that has started from scratch and been more successful 5 years after it was created?
- Fizzadar 13y agoSo another exchange which ignored the known 'bug' in bitcoin and which as a result made them open to exploitation. Why can't bitstamp just admit they have a software issue and are fixing it?
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]