zhoutong

27 ms·

211.
by zhoutong 15y ago
When you browse the web, you don't GET the pages. Your browser does much more than that. If you really GET the page and parse the HTML yourself, you won't get these ads, for sure. If Facebook uses POST in their JavaScript, then what's wrong
212.
by zhoutong 15y ago
No. Prefetching a webpage doesn't execute the JavaScript. GET itself is still safe. But web browsing != GET requests
213.
by zhoutong 15y ago
If it's only a protocol violation, I guess Facebook can use JavaScript to generate a POST request instead. And in fact, they should be doing so. The permissions and responsibilities of a user should not be associated with the type of requ
214.
by zhoutong 15y ago
It's my bid. Impressed by the design. I'll add a bit of Ruby and business model.
215.
Our Promise(blog.bitcoinica.com)
4 points by zhoutong 15y ago|0 comments
216.
by zhoutong 15y ago
I have never argued with him about the merits of my security system. What I have done is to explain to everyone what I have done and why I think Bitcoinica still deserves some trust as a Bitcoin trading platform. He think it's unconvincing,
217.
by zhoutong 15y ago
No, never. This is the first time, that's why I built BTCUSD not EURUSD. Changes in transaction records do not directly result in financial losses because all the money is stored in more reputable exchanges and banks. Yes, integrity check o
218.
by zhoutong 15y ago
Thank you for your guidance!
219.
by zhoutong 15y ago
Everything is automated, of course. We can control the risk level any time. Running out of either currency has never happened since launch at least, because our reserves are huge now.
220.
by zhoutong 15y ago
I'm not sure whether you're referring to a part of my comment or the whole comment. What I mean is, security is every financial platform owner's big challenge. This includes banks, escrow service providers, payment processors and e-commerce
221.
by zhoutong 15y ago
"We never bet against our clients." - The most repeated sentence regarding Bitcoinica. There are people who long and people short. If these positions were opened at the same time and price, they can be canceled out directly. Otherwise, we w
222.
by zhoutong 15y ago
I respect all these views, really. But now I have a big question, if your users love your product and they keep investing, but there are many people out there who may never have tried to understand how the product works are yelling at you t
223.
by zhoutong 15y ago
I understand your concerns. Many people coming from Forex trading have such concerns. But the Bitcoin market is very different. Many people choose to be anonymous. There're currently no explicit laws regulating Bitcoin transactions and Bitc
224.
by zhoutong 15y ago
I'm actually quite serious about security. But I still feel that the security-related discussions are too overwhelming. Of course I know that nothing is 100% secure, but I can make my bottom-line high. This is not my first project. I have b
225.
by zhoutong 15y ago
That's the common downside of all Bitcoin Trading Platforms. Currently it's virtually impossible to have all three criteria of a good online payment system other than Bitcoin: - Instantly available - Reliable (maybe law-regulated, bank-oper
226.
by zhoutong 15y ago
The request is not transmitted in JSON. So it's not JSON-RPC at least. http://en.wikipedia.org/wiki/Representational_state_transfer... - The URI is RESTful. (Explicit collection and member actions, with common namespace.) - Supports both
227.
Introducing Bitcoinica API (The first RESTful Bitcoin Trading API)(blog.bitcoinica.com)
49 points by zhoutong 15y ago|57 comments
228.
In 24 Hours(blog.bitcoinica.com)
2 points by zhoutong 15y ago|0 comments
229.
by zhoutong 15y ago
Devise has too many features that I don't really need. I followed Ryan Bates's advice - use nifty:authentication generator.
230.
by zhoutong 15y ago
Most actions are RESTful, and CSRF is Rails' default.
231.
by zhoutong 15y ago
I have already been using salted BCrypt since day one. I know how important security is.
232.
by zhoutong 15y ago
1. We can almost never be a registered broker for Bitcoin trading. There's almost no law regulating this market either. If you can't trust me now, it's all okay. I have never asked for trust. What I do is to write apps in the way that peopl
233.
by zhoutong 15y ago
Yes, we have. I admit that I didn't make it visible on the site itself. But the system checks every single user every 5 seconds. We have two metrics: net value and minimum net value. When NV < MNV, all positions are immediately liquidat
234.
by zhoutong 15y ago
I have replied several comments about the security issues. Maybe you can take a look at them. For the margin trading problem, we liquidate positions by force when the user's net value falls below maintenance. All data is transparent and you
235.
by zhoutong 15y ago
Sorry for the confusion. I realized that I gave the wrong example. I should use ["created_at <= ?", @time] rather than "created_at <= #{@time}" This is what I meant actually...
236.
by zhoutong 15y ago
When I first decided to disclose my age, I have considered this problem. Actually this is a psychological paradox: proving myself honest doesn't always make me more trustworthy. It's just like the warranty of your gadgets. Getting a wonderf
237.
by zhoutong 15y ago
Yeah, I understand your point. I have never ever used #{} in my code. When I first learned Rails, I know this should be avoided at all cost. I would prefer "String 1: " + string1 rather than "String 1: #{string1}"
238.
by zhoutong 15y ago
Thank you for your feedback! It's easy to make tooltips with Twitter Bootstrap. I have written Javascript to enable all the "title" attributes. I will definitely put more tooltips here and there and launch a new version in probably a few da
239.
by zhoutong 15y ago
Thank you for your feedback! Yes, I have to admit that during testing, I have spotted several errors and these may cause financial losses. Because of this, I have even deleted some features which many people consider useful (such as BTC dep
240.
by zhoutong 15y ago
Currently our only non-trivial security challenges are as follows: - SQL Injection - Source being viewed - Financial attacks I believe that Rails has no problems with SQL injection? All my database queries are going through ActiveRecord. He

More ›