6 ms·

>1. Submit fingerprints of all founders (and employees) to the FBI and disclose personal financial information of founders and officers to NY State. >2. Requir

>1. Submit fingerprints of all founders (and employees) to the FBI and disclose personal financial information of founders and officers to NY State. >2. Require them to hold an undetermined amount of U.S. dollar funds in bonds or trusts. Startups will not be able to predict the bonding or capitalization requirements until after they apply, making it difficult to project expenses or raise money. >3. Conduct expensive audits and security testing that no small startup could afford. >4. Hand over any untouched user assets to NY State after five years as “abandoned property.” If these four things deter you, please do everyone a favor and do not start any company that handles other peoples money.

Ryan_Singer 12y ago
There is a difference between: * Coinbase: A startup that holds millions of dollars worth of bitcoin for mostly consumers * The reddit tip bot: a non-profit community tool that explicitly discourages holding more than a dollar or two * Blockchain: A startup that holds no money for anyone, but writes and serves software that helps people hold their own money online. Do you think all three of these groups should go through this process?
- nmrm 12y ago
  Professional auditing and security testing should be necessary for any piece of software from which it's possible to drain large sums of money, regardless of who's running the software or holding the money. In fact, I'd argue anything less constitutes an ethical breach on the part of the lead engineer(s). I'm not really sure why that particular regulation is so onerous in any of these situations, since any responsible team would be thinking about security throughout, including and especially post-development. At least in principle (maybe you'd prefer different auditing standards or practices -- that's what I mean by in principle). edit: of course each of these is a different sort of service, and different levels of risk management are appropriate. In particular, the case of Blockchain seems like a real quagmire. I guess it would probably depend heavily on the revenue model. Really my only point is that I would have a really hard time sleeping at night if I had to sign off on not applying state-of-the-art auditing and testing techniques any of these, even Blockchain. Maybe I'm too crotchety and old-school for bitcoin.
  - Ryan_Singer 12y ago
    For the Reddit Tip Bot?
    - nmrm 12y ago
      The honest answer is that I don't know, because I don't know how much money the reddit tipbot handles or how long the money stays vulnerable to a potential bug in the software. This is criteria I suggest: > for any piece of software from which it's possible to drain large sums of money To which I might add "directly" or "quickly" or "covertly", but I think you get the intent. My edit to the parent comment also applies, since none of these is a binary value and risk management should match the assumed risk. edit: I would say that the fact that it's only a few bucks per user is not relevant, especially if that limit isn't hard-coded.
    - fred_durst 12y ago
      How about this https://github.com/vindimy/altcointip/blob/master/src/cointipbot.py#L457-L466 https://github.com/vindimy/altcointip/blob/master/src/cointi... with this https://github.com/vindimy/altcointip/blob/master/src/ctb/ctb_action.py#L154-L174 https://github.com/vindimy/altcointip/blob/master/src/ctb/ct... You don't think that might allow someone to do a bit of skimming by playing a little loose with the exchange rates?
  - starkness 12y ago
    We're in the process right now of writing up a more in-depth policy proposal, but you're spot on in terms of different levels of risk management. And we're not at all against security testing, which is also one of the great benefits of FOSS. ("Given enough eyeballs, all bugs are shallow.") And the audits comprise financial audits as well, which surely make sense for bitcoin exchanges and companies holding funds, but not so much for open source projects or technologies that are built around bitcoin but where no funds are held. That said, the actual regulatory proposal has many more requirements than even mentioned in the article (including quarterly reports to the NY State Superintendent, collecting of user data, and the possibility of being denied a license without a system for due process in place), and things that the creator of a Reddit tip bot surely couldn't comply with.
richcollins 12y ago
How about this? each Licensee must obtain the superintendent’s prior written approval for any plan or proposal to introduce or offer a new product, service, or activity, or to make a material change to an existing product, service, or activity
- chiph 12y ago
  Banks and other financial firms have the same requirement.
xorcist 12y ago
That would depend entirely of "handle other people's money" actually mean. There's a huge difference between the different players in this space. Just because they're in the same ecosystem doesn't mean the same regulations should apply. I am personally intrigued by point 4, "any untouched asset after five years is abandoned property". So, if I deposit money in my account, it's not mine after five years? Where does it work like that?
- fred_durst 12y ago
  #4 does not mean New York State owns it forever. It is intended to prevent companies from having an incentive to create business practices based on the hope that people will forget about or abandon funds etc. A customer can claim those funds by going here: https://www.osc.state.ny.us/ouf/ https://www.osc.state.ny.us/ouf/ Your comment is kind of what I'm talking about. You do not know nearly enough about this stuff to start a Bitcoin startup judging by the fact that you don't even know what unclaimed property is. Therefore I hope regulations like this prevent you and other obviously unqualified people from handling other peoples money. EDIT: I came out a bit harsh on this and I apologize. I intended to use it as an example of you likely having the technical ability for such a project but not the financial knowledge, which in my opinion is the dangerous situation these regulations will hopefully prevent.
  - markburns 12y ago
    xorcist choosing to question a comment on a website does not necessarily put him in the same category as people wishing to start a bitcoin startup handling others money
    - fred_durst 12y ago
      That's a valid point. It came out wrong and unnecessarily harsh. I should have also added that although the person I was replying to(xorcist) was unqualified in the financial knowledge, I assume by way of being around HN, that they likely have more than enough technical aptitude for such an endeavor. These regulations, in my opinion work to protect the larger markets from exactly that type of dangerous situation.
3pt14159 12y ago
What is the US's obsession with fingerprint collection? The rest of it I can sorta understand, provided that society is viewing Bitcoin less as a weird internet thing, and more as a money thing, I can understand regulators wanting to treat Bitcoin institutions like financial institutions, but collecting fingerprints just to start a business seems so 1984.
- sliverstorm 12y ago
  They are a little dated these days of course, but off the top of my head fingerprints are used for banking, old fashioned wire transfers, and passports. They want to be able to connect you to those things, and the fingerprint was the private key signature [1] of the 20th century. Which, IMO, isn't "so 1984" because those are historically all major fraud avenues. [1]: http://en.wikipedia.org/wiki/Digital_signature http://en.wikipedia.org/wiki/Digital_signature
  - patio11 12y ago
    off the top of my head fingerprints are used for banking, old fashioned wire transfers, and passports Fingerprints are not routinely collected in the United States to open bank accounts, send or receive wire transfers, or request passports.
    - sliverstorm 12y ago
      Has policy changed? I could swear I had to give a fingerprint last time I opened a bank account in person, and when I got my passport. I suppose that was fifteen years ago...
      - georgemcbay 12y ago
        The only time I've ever been fingerprinted is for a license renewal at the California DMV, and I have a passport, a bank account, etc. AFAIK there has never been a fingerprint requirement for US passports.
      - 12y ago
avz 12y ago
Fingerprints requirement sounds a bit ludicrous. Is this standard practice applied to other financial services companies? Capital requirement is misplaced: Bitcoin startups are not generally fractional banking institutions. Also, they operate in Bitcoin, so why demand they hold assets denominated in USD? It's not like the customers can come back demanding to sale their Bitcoin at the same exchange rate they bought it at. Audits and security testing sound perfectly appropriate. Inactive assets handover also seems appropriate since it provides the most efficient way to manage and ultimately return abandoned property to its rightful owner.
- samstave 12y ago
  Fingerprints are required so that when they find a stolen bitcoin, they can dust it for prints to see if any of the founders were involved in its theft. That's pretty straightforward.
samstave 12y ago
>>4. Hand over any untouched user assets to NY State after five years as “abandoned property.” So if you hold bitcoin in an account for 5 years, the state will steal it from you by force?
- Philadelphia 12y ago
  No, if an account is inactive for five years, and the company is unable to contact the account holder, it's turned over to the state to hold. The state publishes a list of unclaimed property and provides a process that the owner or other appropriate party can use to claim their property. You can see how it works in New York at https://www.osc.state.ny.us/ouf/ https://www.osc.state.ny.us/ouf/.

Ryan_Singer 12y ago

There is a difference between: * Coinbase: A startup that holds millions of dollars worth of bitcoin for mostly consumers * The reddit tip bot: a non-profit community tool that explicitly discourages holding more than a dollar or two * Blockchain: A startup that holds no money for anyone, but writes and serves software that helps people hold their own money online. Do you think all three of these groups should go through this process?

nmrm 12y ago
Professional auditing and security testing should be necessary for any piece of software from which it's possible to drain large sums of money, regardless of who's running the software or holding the money. In fact, I'd argue anything less constitutes an ethical breach on the part of the lead engineer(s). I'm not really sure why that particular regulation is so onerous in any of these situations, since any responsible team would be thinking about security throughout, including and especially post-development. At least in principle (maybe you'd prefer different auditing standards or practices -- that's what I mean by in principle). edit: of course each of these is a different sort of service, and different levels of risk management are appropriate. In particular, the case of Blockchain seems like a real quagmire. I guess it would probably depend heavily on the revenue model. Really my only point is that I would have a really hard time sleeping at night if I had to sign off on not applying state-of-the-art auditing and testing techniques any of these, even Blockchain. Maybe I'm too crotchety and old-school for bitcoin.
- Ryan_Singer 12y ago
  For the Reddit Tip Bot?
  - nmrm 12y ago
    The honest answer is that I don't know, because I don't know how much money the reddit tipbot handles or how long the money stays vulnerable to a potential bug in the software. This is criteria I suggest: > for any piece of software from which it's possible to drain large sums of money To which I might add "directly" or "quickly" or "covertly", but I think you get the intent. My edit to the parent comment also applies, since none of these is a binary value and risk management should match the assumed risk. edit: I would say that the fact that it's only a few bucks per user is not relevant, especially if that limit isn't hard-coded.
  - fred_durst 12y ago
    How about this https://github.com/vindimy/altcointip/blob/master/src/cointipbot.py#L457-L466 https://github.com/vindimy/altcointip/blob/master/src/cointi... with this https://github.com/vindimy/altcointip/blob/master/src/ctb/ctb_action.py#L154-L174 https://github.com/vindimy/altcointip/blob/master/src/ctb/ct... You don't think that might allow someone to do a bit of skimming by playing a little loose with the exchange rates?
- starkness 12y ago
  We're in the process right now of writing up a more in-depth policy proposal, but you're spot on in terms of different levels of risk management. And we're not at all against security testing, which is also one of the great benefits of FOSS. ("Given enough eyeballs, all bugs are shallow.") And the audits comprise financial audits as well, which surely make sense for bitcoin exchanges and companies holding funds, but not so much for open source projects or technologies that are built around bitcoin but where no funds are held. That said, the actual regulatory proposal has many more requirements than even mentioned in the article (including quarterly reports to the NY State Superintendent, collecting of user data, and the possibility of being denied a license without a system for due process in place), and things that the creator of a Reddit tip bot surely couldn't comply with.

richcollins 12y ago

How about this? each Licensee must obtain the superintendent’s prior written approval for any plan or proposal to introduce or offer a new product, service, or activity, or to make a material change to an existing product, service, or activity

chiph 12y ago
Banks and other financial firms have the same requirement.

xorcist 12y ago

That would depend entirely of "handle other people's money" actually mean. There's a huge difference between the different players in this space. Just because they're in the same ecosystem doesn't mean the same regulations should apply. I am personally intrigued by point 4, "any untouched asset after five years is abandoned property". So, if I deposit money in my account, it's not mine after five years? Where does it work like that?

fred_durst 12y ago
#4 does not mean New York State owns it forever. It is intended to prevent companies from having an incentive to create business practices based on the hope that people will forget about or abandon funds etc. A customer can claim those funds by going here: https://www.osc.state.ny.us/ouf/ https://www.osc.state.ny.us/ouf/ Your comment is kind of what I'm talking about. You do not know nearly enough about this stuff to start a Bitcoin startup judging by the fact that you don't even know what unclaimed property is. Therefore I hope regulations like this prevent you and other obviously unqualified people from handling other peoples money. EDIT: I came out a bit harsh on this and I apologize. I intended to use it as an example of you likely having the technical ability for such a project but not the financial knowledge, which in my opinion is the dangerous situation these regulations will hopefully prevent.
- markburns 12y ago
  xorcist choosing to question a comment on a website does not necessarily put him in the same category as people wishing to start a bitcoin startup handling others money
  - fred_durst 12y ago
    That's a valid point. It came out wrong and unnecessarily harsh. I should have also added that although the person I was replying to(xorcist) was unqualified in the financial knowledge, I assume by way of being around HN, that they likely have more than enough technical aptitude for such an endeavor. These regulations, in my opinion work to protect the larger markets from exactly that type of dangerous situation.

3pt14159 12y ago

What is the US's obsession with fingerprint collection? The rest of it I can sorta understand, provided that society is viewing Bitcoin less as a weird internet thing, and more as a money thing, I can understand regulators wanting to treat Bitcoin institutions like financial institutions, but collecting fingerprints just to start a business seems so 1984.

sliverstorm 12y ago
They are a little dated these days of course, but off the top of my head fingerprints are used for banking, old fashioned wire transfers, and passports. They want to be able to connect you to those things, and the fingerprint was the private key signature [1] of the 20th century. Which, IMO, isn't "so 1984" because those are historically all major fraud avenues. [1]: http://en.wikipedia.org/wiki/Digital_signature http://en.wikipedia.org/wiki/Digital_signature
- patio11 12y ago
  off the top of my head fingerprints are used for banking, old fashioned wire transfers, and passports Fingerprints are not routinely collected in the United States to open bank accounts, send or receive wire transfers, or request passports.
  - sliverstorm 12y ago
    Has policy changed? I could swear I had to give a fingerprint last time I opened a bank account in person, and when I got my passport. I suppose that was fifteen years ago...
    - georgemcbay 12y ago
      The only time I've ever been fingerprinted is for a license renewal at the California DMV, and I have a passport, a bank account, etc. AFAIK there has never been a fingerprint requirement for US passports.
    - 12y ago

avz 12y ago

Fingerprints requirement sounds a bit ludicrous. Is this standard practice applied to other financial services companies? Capital requirement is misplaced: Bitcoin startups are not generally fractional banking institutions. Also, they operate in Bitcoin, so why demand they hold assets denominated in USD? It's not like the customers can come back demanding to sale their Bitcoin at the same exchange rate they bought it at. Audits and security testing sound perfectly appropriate. Inactive assets handover also seems appropriate since it provides the most efficient way to manage and ultimately return abandoned property to its rightful owner.

samstave 12y ago
Fingerprints are required so that when they find a stolen bitcoin, they can dust it for prints to see if any of the founders were involved in its theft. That's pretty straightforward.

samstave 12y ago

>>4. Hand over any untouched user assets to NY State after five years as “abandoned property.” So if you hold bitcoin in an account for 5 years, the state will steal it from you by force?

Philadelphia 12y ago
No, if an account is inactive for five years, and the company is unable to contact the account holder, it's turned over to the state to hold. The state publishes a list of unclaimed property and provides a process that the owner or other appropriate party can use to claim their property. You can see how it works in New York at https://www.osc.state.ny.us/ouf/ https://www.osc.state.ny.us/ouf/.