I'm leaving Bitcoin

https://bitcointalk.org/index.php?topic=81581.0

by zhoutong • 14 years ago

85 47 14 years ago

ewillbefull2• 14 years ago

This has no remarkable impact on Bitcoin or the community, it's just the founder of Bitcoinica (which was hacked several times) disassociating himself from Bitcoin because his reputation has been decimated.

zhoutong7• 14 years ago

If I did something seriously wrong, I would definitely admit it.

The recent hack is not my fault. It just destroyed the only reason that I stay in Bitcoinica.

ewillbefull2• 14 years ago

I am certainly not accusing you of any misbehavior, but even you would admit this incident did not serve your reputation well -- deservedly or not. And that is indeed your motivation for leaving.

malandrew• 14 years ago

You said that you're leaving to pursue opportunities where you can "...build products that save people time, money and headaches."

Why not make it easier for people to use bitcoins in day to day transactions? It feels to me like more effort in the bit coin community is going into making financial products for finance people than financial products for normal people doing normal things. Solutions such as those that make bitcoin transactions from one cell phone to another cell phone would be a valuable addition to the community.

beosrocks2• 14 years ago

If I did something seriously wrong, I would definitely admit it.

Trying to run a financial site without the chops to do it was seriously wrong. Of course, it was wrong of users not to do more due diligence on the service, its record, the team (you, I guess), etc - after all, it was (was) their money.

The recent hack is not my fault.

You've got a lot to learn.

javert• 14 years ago

zhoutong, you are definitely an inspiration. Sad to see you leaving bitcoin.

h2s4• 14 years ago

These bitcoin hacks have amazed me every single time. The old-school financial industry goes to extreme lengths in order to protect the money it's in charge of. Physical money is stored securely and guarded. IT infrastructure is carefully guarded both physically and electronically.

By comparison, these bitcoin folks seem quite content to store what is essentially money on run-of-the-mill servers in run-of-the-mill data centres. Linode? Rackspace? Are you people fucking serious? It keeps happening, and I keep wondering why any thinking person would trust plain old data centre security staff with their money like this.

soup10• 14 years ago

I keep wondering why any thinking person would buy bitcoins. Could be related.

icebraining• 14 years ago

They go through great lengths, except apparently verifying if you're authorized to access an account, as in the Citigroup hack. Or having two-factor auth. Or being able to use passwords with decent length. Or providing a better payment system than a single set of codes that you have to hope no company leaks, or you'll have to get a new CC (see the Global Payments hack), when even fucking Twitter knows how to develop an authorization scheme that can be individually revoked.

Seriously, the banking industry is hardly a paragon of security. Many startups give you better ways to protect your cat pictures than the average bank gives you to protect your money.

rplnt2• 14 years ago

I have not seen an online banking without two factor auth though.

h2s4• 14 years ago

You're right, but you're talking about application security, not the security of the infrastructure itself. For most endeavours, it's enough to have a securely written app hosted in an average data centre. When you're looking after currency, there's so much more incentive for people to break in, and you have to put some extra resources into securing your infrastructure too. By the sounds of it Bitcoinica has completely neglected to do this and has been operating as if they were just a startup storing my cat pictures on S3.

jarek• 14 years ago

Very true, the difference is banks will give you back your money after you're/they're hacked.

Nelson69• 14 years ago

There is a flip side to that. You ever hear of an actual customer losing their money in one of these attacks on banks?

It's all about the cost of doing vs. the cost of fixing it and who ends up paying.

eli2• 14 years ago

I agree with what you're saying. I'd argue that Bitcoin sites are at even higher risk than old-school financial sites because (I assume) the FBI actively investigates bank hacks, but not Bitcoin trading site hacks. If I were a bad guy, I know which I'd target.

lhnn• 14 years ago

There's really not any problem with hosting servers at a cloud provider that isn't shady. Encrypt the data on the drive, use a reasonable firewall policy, then all you have to be concerned about is application layer breaches.

Trust me, lots of payment data goes through secure servers at Rackspace.

/Not a rackspace employee, but I know

h2s4• 14 years ago

I get what you're saying, but my point is this: This hack happened because Bitcoinica doesn't own the bare metal servers on which the money is hosted. The break in was possible because somebody abused Rackspace's password reset functionality. The last time Bitcoinica got owned, it was because somebody managed to exploit Linode's customer service portal. To me this trend would strongly suggest the need to outright own the production hardware so that attackers have to attack you directly or physically break in to your data centre.

SkyMarshal• 14 years ago

Thanks for posting, Tong, good luck with next.

Might I suggest a post-mortem on the various security problems you dealt with, for those of us who weren't following closely? I'm sure you learned a lot, even if what not to do.

I don't think many programmers, especially web developers in the consumer startup scene, are faced with such security pressures as Bitcoinica was, so it would probably be very useful for many to read a behind-the-scenes accounting of that.

Estragon• 14 years ago

I would love to read that, too, but it's worth noting that the particular failure in this case appears to have been pretty boring. According to his account he was transferring operational control to a different group, and one member was relying on an insecure email server which was used to reset the root password on a Rackspace VPS.

zhoutong7• 14 years ago

Unfortunately, I haven't encountered a single strong hacker (in terms of web).

All my 3-year Rails experience was sufficient to prevent the most direct web attacks: Injection, CSRF, XSS, etc.

The rest is simple, keep wallet.dat securely. It's just everything the hacker wants.

So, the experience isn't very applicable to other startups, I think.

panarky• 14 years ago

"Spectacular failure is your destiny."

I thought jellicle's advice to Zhou Tong was insightful 248 days ago. Time has proven its wisdom.

http://news.ycombinator.com/item?id=2973803

-- systems that work with money are attacked hard and often, by intelligent skilled people

-- in fact some of the people who attack your system are likely to be both more skilled and more intelligent than you are

-- systems that work with money that fail, fail spectacularly ("What do you mean someone withdrew $8 million last night?")

-- banking websites, Paypal, etc. are all like icebergs - you don't see 9/10ths of the things they've done to prevent spectacular failure

-- spectacular failure is your destiny if you don't work very hard to prevent it

-- spectacular failure may be your destiny even if you do work very hard to prevent it

You should plan accordingly.

beosrocks2• 14 years ago

Wow - didn't realize on first reading that the comment was actually directed to Zhou Tong, who replied that he would "definitely pay attention to every single detail." Forensic's response was prophetic: http://news.ycombinator.com/item?id=2976031

EDIT: panarky has now updated his post above to make it clear that the advice was to Zhou Tong.

zhoutong7• 14 years ago

Thank you for your original advice. It's definitely useful. But it's not relevant today.

I don't wish to link the Bitcoinica fiasco with my leave because I sold Bitcoinica a few months ago. And I lost my control in January. Basically everything didn't go as I planned. (I'm VERY conservative about wallet security.)

I wanted to build an independent exchange system to replace hedging, so that most funds can stay offline. But the new owner didn't like the idea.

I know it failed like predicted, but my involvement in the failure is highly limited. I sold the site for the same reasons: What if someday I'm hacked, or caught? (The valuation (P/E) was less than 1!)

I'm a web developer, not a security expert. I know how to protect the API keys but I'm not good at encrypting a wallet.dat. That's all I thought since day one.

palish• 14 years ago

May I ask how much money in total you personally netted from making Bitcoinica? I'm intensely curious, but I'd understand if you'd prefer not to tell.

DiabloD3• 14 years ago

I hope this thing with Zhou and Bitcoinica isn't going to screw up my company's all Bitcoin IPO: https://glbse.com/asset/view/DMC

We're seeking 200k BTC for a self-green powered mining farm at our own DC up here in Maine, so we profit from the mining farm itself, having nearly no cooling needs for the DC, selling power generated back to the grid, and also renting excess space to other companies who want out of the way DC space in a quiet part of the country.

pixie_• 14 years ago

I still suspect he stole the 18k bitcoins, the guy is slippery.

dkersten4• 14 years ago

Why would you think this?

dkersten4• 14 years ago

I was genuinely curious why grandparent would think that "I still suspect he stole the 18k bitcoins, the guy is slippery.". Why is the guy "slippery"? What makes you think that he stole the bitcoins?

Why would someone downvote for asking for clarification..?

I'm leaving Bitcoin

Related Stories