Comment by narush | Hacker News Reader

Comment by narush | Hacker News Reader

Congrats on the launch! Woop woop.

Two questions for y'all:

1. I'm wonder what your thinking is as a new, custodial crypto exchange. It's not that I don't think a custodial exchange can be successful (see: CB), but it seems like if the whole smart contract thesis is right, then decentralized exchanges are gonna eat the world (at least: your world). If you're all-in on crypto, why not build something decentralized/non-custodial? Long-term, how do you see competition against decentralized exchanges?

2. I read your security page, but what's the real deal w/ your security? 2FA and all is great, but giving a service my API keys is, uh, terrifying / something I will pretty much never do. Does anyone have a background in security / have you done an audit? Not to be a total narc, but crypto exchanges are like, big pots of beautiful honey. More details on your security page would be nice, and for many potential users (such as myself), seem quite necessary - hopefully this is helpful feedback and not just a dunk! I might also promote security stuff to the top of the page / more visible, it's at least the first thing I look for on any crypto service.

I've posted on HN about blockchain stuff before (I'm generally aligned on the "very interesting space, fuck scams" mentality) - and I can say is good luck :) Wish you all the best + looking forward to hearing your thoughts

Thanks @narush for the support and the great questions!

1. We completely believe in the DEX thesis, and we plan for our custodial solution to integrate with hardware wallets so that we can immediately return your funds to your own cold storage, and take advantage of DEX aggregators that already exist like 1Inch, Totle, or Slingshot.

However, no one is aggregating the much larger (for now) pools of liquidity on centralized exchanges, and additionally, the usability story for DEXs is really tough for mainstream users. We want to address both of these problems by providing a simplified interface for interacting with smart contracts, and providing the best execution requirement that already exists in traditional finance for the world of cryptocurrency.

2. We completely understand your security concerns, and we take our duties here with utmost seriousness. Thanks for the feedback!

We just brought on a dedicated security hire who contributed to the EMV chip standard for credit cards as well as the Global Platform standard for secure enclave, and he is helping us to ensure we have processes and procedures in place using the Mitre Att&ck framework. We intend to release audit details once they are complete.

For now, we do rely on Heroku to do a lot of the heavy lifting on the secure server management, but we also have internal processes and procedures for encrypting sensitive information using AES-256 and reducing attack surface.

Hope that answers your questions, and please tell us any additional concerns!

> "rely on Heroku to do a lot of the heavy lifting on the secure server management"

You trust all the employees and contractors of the hosting firm who have the VM hypervisor login of the machines where your code runs.

Agreed, this was a necessary step when we were a team of 3 at the beginning of the year, and we are transitioning as quickly as we can to self-managed infrastructure now that we have additional help.

If you have more concerns or recommendations, we'd love to hear them!

Reply on news.ycombinator.com