News for hackers. Stuff that matters.
Re:BTC Stolen from Poloniex by jnbiche on Tuesday March 04, 2014 @01:45PM (#7342168)
Perhaps, in the case of the most cautious developers. But right now, I'd be happy with just competent developers.

And to me, at least, it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions.

Re:BTC Stolen from Poloniex by mpyne on Tuesday March 04, 2014 @04:34PM (#7343343)
> And to me, at least, it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions.

I don't think that's clear at all.

In fact I think bunderbunder has it right. Those who make the best products will require a large enough expense for formal design, implementation, secure hardware acquisition, physical security (i.e. no simply running your exchange on someone else's cloud without a lot of oversight), the works. This requires tons of time and resource investment.

Because if any part of that chain is improperly coded, designed, implemented, etc. it will eventually be exploited and you'll be no better than the Poloniex type exchanges of the world.

In the meantime there will be those "incompetent" developers you mention with a shipping product already on the market. And theirs will be much cheaper as they don't need to devote "Space Shuttle computer software" levels of development design and implementation effort. So you'll be both late to market and more expensive.

If you're talking about financial security here then you effectively need to be building a Bentley instead of a Pinto. But you'll be competing in that unregulated market with Pintos with a consumer base full of people willing to take the risk of driving in a Pinto instead of a Bentley they can't afford anyways.

And this has nothing to do with the government yet, either sanctions or regulations.

In fact this type of "tragedy of the commons" is exactly why there is government regulation. They help ameliorate the inevitable "race to the bottom" by artificially limiting where the bottom may be.

But government regulation probably won't help too much here since you can always run your exchange out of a country that doesn't care and people can make their transactions with whatever identity they wish.

Who knows, maybe the industry will self-create and self-adopt appropriate regulation as a market differentiator. But that still would open the question of who does the enforcement; if competitors discover their competition isn't actually following the regs then they'd be forced to "streamline" themselves and then the whole thing goes to pot again.

Re:BTC Stolen from Poloniex by jnbiche on Wednesday March 05, 2014 @09:38AM (#7347124)
But here's where I disagree with you: it costs literally millions of dollars to get the needed state money licenses to legally operate a Bitcoin exchange[1]. FinCEN has been very explicit that they consider Bitcoin exchanges to be money transmitters.

So those millions are money that could go toward building the infrastructure you describe. Bitcoin companies like Coinbase who have finished their Series A have to spend their runway on licenses instead of developers or infrastructure.

It's a huge problem, whether or not people are willing to admit it.

But thank you for arguing in a rational and non-bullying/non-contemptuous manner.

1. http://payment-systems.quora.com/The-Money-Transmitter-Licen...

Re:BTC Stolen from Poloniex by mpyne on Wednesday March 05, 2014 @09:07PM (#7351406)
Well as long as the cost is fairly applied to new entrants then I don't see that as being problematic per se (as after all, any new entrant will have to deal with the same selectivity). In fact that's practically the point, to ensure that the "fly by night" Bitcoin exchange shops that couldn't survive a theft of 50 Bitcoins without going under don't actually make it into legit business.

Yes, this is unfortunate for those devs out there who could solve the problem of making a good Bitcoin exchange if only the cost-of-entry were cheaper, but that happens in tons of other industries too (and not always due to the government), and it already has an answer.

Re:BTC Stolen from Poloniex by yuhong on Monday March 10, 2014 @04:30AM (#7371834)
I think deposit insurance is a better solution to the problem. Part of underwriting Bitcoin deposit insurance would be a code and design review and proof of reserves etc, and it would also allow reimbursement if it does get hacked.
Re:BTC Stolen from Poloniex by danielweber on Tuesday March 04, 2014 @01:58PM (#7342270)
it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions

Where's 'rayiner? He'll love this.

Writing bitcoin software is like writing crypto. You need to get it exactly right.

But instead of starting with a spec written down that the crypto community tears to pieces, instead the developers eat their own dogfood. No, change that: they build critical infrastructure out of their own dogfood. All before it's ever been vetted by the really smart people.

I'd say competent people don't write Bitcoin marketplaces that handle real money for the same reason competent people don't write their own home-grown crypto and then make it a single-point-of-failure for their entire business.

Re:BTC Stolen from Poloniex by jnbiche on Wednesday March 05, 2014 @09:29AM (#7347070)
The arrogance here is unfortunate. First, you start out with a remark reminiscent of a high school bully. Do you really need a co-conspirator to share in your attempt to ridicule someone?

Also, you're pretty uninformed about the history of Bitcoin. Satoshi did start with a spec, or at least a white paper (yes, the lack of a proper spec for Bitcoin has been a major problem). Satoshi presented the white paper to the cryptography e-mail list several months before releasing the software. He got some feedback at that time, and then he got significant feedback when upon his initial release, which he integrated into the protocol.

This list included many of the top cryptographers in the cryptocurrency space, including Hal Finney and Adam Back.

You can find all these discussions, and the original release at: http://nakamotoinstitute.org/

Finally, with the exception of the transaction malleability issue, the failures in exchanges have had nothing to do with cryptography, but rather with basic secure software development practices and architectures.

Re:BTC Stolen from Poloniex by danielweber on Wednesday March 05, 2014 @10:38AM (#7347523)
I'm talking about exchanges, not the protocol itself.

Every exchange seems to be a bespoke system and that is just begging for trouble.

They should publish their architecture, then publish their source code, and then make sure that smart people have tried as hard as they can to find all the weaknesses in their stuff, and then turn it into a business.

Of course, there are business reasons not to do that: someone else can use your verified source, someone else can get a first-mover advantage, you might not get the smart people to pay attention, you might not know when it's ever good enough, and (the more pernicious idea) is the worry that seeing the source will give the attackers ways of attacking your stuff.

They fail for the same reasons that secret crypto systems fail. I fully understand why they are doing it, but it's still doomed to failure.

Re:BTC Stolen from Poloniex by bunderbunder on Tuesday March 04, 2014 @02:22PM (#7342414)
Is it really just government sanctions? Or do regulatory cost and exposure to liability have something to do with it, too?

I think that in the USA at least, government sanctions are far from guaranteed - the courts have confirmed that BTC is a currency. What that means is that there is no longer a question of if you can legally start a Bitcoin exchange in the USA - it's a question of what hoops you have to jump through to do it. (And liability. . . I'm curious if the Flexcoin situation means we'll soon be finding whether a clickthrough EULA that says, "Not responsible for lost or stolen bank accounts" is enforceable.)

Now, perhaps the hurdles are prohibitively high. I'm more than willing to believe that's true. But if so, then you're being rather melodramatic to frame this in terms of "government sanctions". That makes it sound like people aren't doing it because they don't want to knowingly engage in illegal activity. It'd be more realistic to just say that competent people are staying out because the regulatory environment results in an excessive cost of doing business for anyone who wants to make sure they're operating on the up-and-up.

Re:BTC Stolen from Poloniex by abruzzi on Tuesday March 04, 2014 @02:48PM (#7342573)
The hurdles may be high for a couple of guys in a garage, but since the US courts have agreed BTC is a currency, the hurdles are well known and well understood by existing players in the finance world. I suspect their reticence to get into BTC is a combination of limited customer interest, underworld associations (SilkRoad), and volatility. If those three things would go away (i.e. Lots of people want it to use for mundane things, and the price remains relatively stable) I'd bet Bank of America would be happy to get into BTC.
Re:BTC Stolen from Poloniex by jnbiche on Wednesday March 05, 2014 @09:31AM (#7347081)
>It'd be more realistic to just say that competent people are staying out because the regulatory environment results in an excessive cost of doing business for anyone who wants to make sure they're operating on the up-and-up

That's exactly what I meant. Apologies if I made it sound like anything else. It costs millions to start up a money transmission business in all 50 states (like an online exchange would need to), and the federal government has been explicit that they consider a Bitcoin exchange a money transmitter.