Hacker News Reader

Comment by JoachimSchipper | Hacker News Reader

Note: there was a lot of discussion about security etc last time Bitcoinica came up (http://news.ycombinator.com/item?id=2973301).

patio11: "My semi-amateurish opinion is that as a non-registered securities dealer with all accounts having margin capabilities the (near 100%) likelihood of your Rails app exploitably broken is not the key source of risk to your business." (http://news.ycombinator.com/item?id=2974695)

On the other hand, Bitcoinica may not be less secure than Mt. Gox...

View on HN

I'm actually quite serious about security. But I still feel that the security-related discussions are too overwhelming. Of course I know that nothing is 100% secure, but I can make my bottom-line high.

This is not my first project. I have been coding in Rails for almost 3 years, with some failed projects. I also know some security basics because I have hacked websites before (non-destructive).

There is always relative security. Ruby on Rails itself is a relatively secure framework. Rails sites have been much less frequently hacked than PHP sites. (Because everything is well wrapped.) I'm also very conservative about using Rails (rarely override methods myself, not even toughing find_by_sql even when it's the easy way).

Passwords are stored hashed and salted using BCrypt. Although no explicit security auditing has been done, all the Rails app logs (including requests and IP addresses) are extracted and backed up nightly. Soft-deleting is enabled for all operations, etc.

I'm not distracting myself from the real problem, but I have to say that I'm not that kind of random kids who write crappy apps for fun.

My use of Heroku is also partly because of security. I use Mac and know a bit of Linux, but I know I can't really set up a Linux box and be sure about the security. Instead I have chosen Heroku's integrated, read-only and cloud-based platform.

Sorry for not replying most of the security-related comments. Not because I can't face opposing arguments, but instead, I think they are valuable.

However, I hope everyone can be a little bit more reasonable and realistic. Since nothing is secure, security is everyone's problem. Although I don't have anything to prove my security experience, at least this is not the first time I deal with money. I once developed a mini payment gateway (PayPal and credit card) for my friend who used it to process transactions totaling more than $50,000. There're a lot of fraudulent orders, which means that people have an incentive to steal, but the payment system itself has been safe.

I can understand that people are skeptical considering my age (or even my Chinese name). But will the Bitcoin community be better off if I shut down the project now? I have chosen Bitcoin because its low barrier to entry and open community, not because I have no bottom-line or security concerns.

What I really want to disagree is the view that I must end this project now. There are basically too many people emailing me just to thank me for delivering the features that the big guys (Mt. Gox and TradeHill) can't finish in months.

I have taken the extreme minimalistic approach in development of Bitcoinica - no Bitcoin wallets and no unusable features. I make it a pure trading platform - you can't even do money laundering on Bitcoinica. System wise, I don't have to SSH the server to configure anything, and I don't have to even see the database credentials myself.

Anyway, I completely accept all the negative viewpoints about Bitcoinica, but I just want to explain clearly that I may not be the person everyone's thinking about.

The term of art for responses like this is "jazz hands".

Sorry. Security isn't "everybody's job". You've chosen to advertise a financial application. Security is your job. In a very real sense: sucks to be you.

I'm not sure whether you're referring to a part of my comment or the whole comment.

What I mean is, security is every financial platform owner's big challenge. This includes banks, escrow service providers, payment processors and e-commerce solution providers. Sometimes it's hard to know how secure a system is before anything happens. But I have already explained my experience, ability, current situation, my strategy, how my product works, my objectives and what I have done to the public to help everyone make informed choices.

Not everyone will like every single product. I have been careful about everything I can.

I think you think these multi-paragraph responses you're writing are convincing.

I think the best thing I can do for you is to be blunt about how unconvincing they are.

Very few people with Rails or appsec experience will read them and think that you know what you're doing with regards to security.

You should not be taking "thousands and thousands of dollars" from people. Full stop.

Thank you for your guidance!

I agree with everything that has been said so far, with the exception of the conclusion. I don't have a problem with zhoutong taking money. People putting their money in Bitcoin are investing in a currency that is two years old. Said another way, a currency that is younger than a $15 bottle of wine. All players in such a market by definition lack reputation, lack experience in handling currency, and lack experience in running a financial institution. Yes, zhoutong doesn't understand security and yes he is hand-waving. Yes, he needs to do his best to secure his app. Yes, he should invest money in an audit when it can afford it (if only because a security audit maps directly to better business for a financial institution). But do I feel bad for users who are putting their money into Bitcoinica? Not really. Trading in a currency that is only two years old is the NFL. Dealing with young and inexperienced financial institutions is part of the game if you chose to enter such a risky market.

tptacek is a security expert with almost as many years of experience in that area as you've been alive. Arguing with him about the merits of your security system would be like you arguing with an NBA veteran about the best way to slam dunk.

To continue the basketball analogy, you're using a trampoline (Heroku) to reach the basket (a secure system) when you really should be learning how to jump (encryption, anti-intrusion, etc.).

I have never argued with him about the merits of my security system. What I have done is to explain to everyone what I have done and why I think Bitcoinica still deserves some trust as a Bitcoin trading platform.

He think it's unconvincing, I accepted. The security standard is very different. What I can say now is, compared to other Bitcoin exchanges which handle millions of dollars of transactions, it's likely that Bitcoinica has almost the same level of security.

BitCoin trading platforms have an abysmal record fuor security. MtGox was hacked hard. You have just told the world that you view yourself as as (in)secure as them. "we're just as good as the others" is not encouraging.

Sometimes it's hard to know how secure a system is before anything happens

However there are many ways to look at a system and see weak points, before you get hacked. Are you vulnerible to SQL Injection attacks? (You have already been shown that RoR sites can be vulnerible to SQL Injections attacks and your ignorance of that fact http://news.ycombinator.com/item?id=2973796 ). You cannot just say "Nothing in 100% secure" as a way to shut down conversation. Yes, there are unknown problems that could happen, but there are known security weaknesses. Are you covering for them?

I strongly recommend that you take a few minutes to dig into who tptacek is and where he is coming from, then consider VERY CAREFULLY what your next step really ought to be.

Remember where you are. This is a website where people are encouraged to pour significant fractions of their life savings, and ideally the money of others, into high-risk, high-reward endeavors. If this crowd has this many people yelling at you to stop, in the level of detail and with the level of experience at and openness to this sort of high-risk high-reward activity on tap here, maybe, just maybe, you should listen.

(And I'd class this "high-risk, low reward" personally.)

I respect all these views, really.

But now I have a big question, if your users love your product and they keep investing, but there are many people out there who may never have tried to understand how the product works are yelling at you to stop, what will you do?

I have to admit that many Bitcoin investors are not rational at all, and they don't know what they are doing. But there are also a lot of Bitcoin miners who want to short sell to protect their investment along with some speculators who want to long positions with margin. The market is already here.

I have never claimed that I'm not responsible for the security measures, I just said that many people were over-sentitive in these matters. Bitcoinica is probably the first Bitcoin-related website that doesn't have Bitcoin wallet. And vast majority (I'd say nearly all) of security incidents happen with stolen or lost Bitcoin wallets. I know my bottom-line clearly - I know I may be good at writing secure apps, but not good at keeping a wallet secure.

I don't know what's your attitude towards Mt. Gox or TradeHill. I may have over-used these two examples but in fact, the system works the same way. It's just that I have only 3 years of experience of Ruby development and have done this project more quickly than others.

I'll be working with TradeHill together to expand the service further, because TradeHill requested so. And many users want to see Bitcoinica continue.

Bitcoinca was launched a bit more than 2 days ago. I know how high the stake is, but I'm not going to close it. Our finances are running very smoothly and trading volume is higher and higher.

I will consider hiring a security expert after a month or so. Currently there are two adults working with me in terms of financial systems (they are professional forex brokers). I think everything has just started.

Standards are much higher when money is involved, especially when the sole purpose of the product/app is to manage money.

You don't get to put off adding security; for a financial application like yours, security needs to be a foundational element from the beginning. You can't just add it on later.

Have you ever built a trading platform before?

What if somebody gains access to your database and changes the financial transactions records? Do you store them in a way they can't be modified? Do you have a cron that constantly checks the historical consistency of your transactions, and if there's a problem, shuts the system down? Do you have a mirror DB or a transaction log running on an independent server, so you have a chance to compare if your DB got hacked?

No, never. This is the first time, that's why I built BTCUSD not EURUSD.

Changes in transaction records do not directly result in financial losses because all the money is stored in more reputable exchanges and banks. Yes, integrity check of transactions is a must and we have it along with the generation of candlesticks (which also checks the integrity of quotes).

Databases are automatically replicated and backed up. Application (transaction and request) logs have log drain set up and will be pushed to a syslog server for archiving.

The databases are only accessible by the instances running this application. The filesystem of the application is read-only.

I like the way the API allows us to see how much business your site is doing.

Guys, if you are seriously thinking of using this platform, and even forget security from a technical aspect for a moment, there are a lot of very basic trading and social-engineering questions that need to be answer by zhoutong and bitcoinica before you deposit money into this account:

1) Who are zhoutong and bitoinica? Where is this based out of? I went through the web site and it doesn't seem to mention this. Is he really who he says he is? A 17-year old who built a sophisticated web site in 1 week by himself? Why did he say that he built the web site himself, but in the blog of bitcoinica, it's written as "we"?

2) Why do they deposit everyone's money into a single account? Who owns this account? How do they keep track of everyone's money? REAL brokerages have people's money in segregated accounts, meaning that the brokerage firm CAN'T TOUCH THE MONEY even if they collapse. How do we know they won't one day turn around, transfer the money to China or Singapore and disappear? How do we know this isn't another Madoff case?

3) How the heck does he afford to give everyone 5:1 margin? The simple story of using the money that no one else is using doesn't fly, it's not that easy. You need to have excess capital in order to do this. What is bitcoinica's excess capital?

4) They do NOTHING to ensure counter-party risk!! What if Bitcoinica implodes and goes under? Again, what is their excess capital to ensure that customers don't share in any losses? If they suffer a catastrophic loss from bad trades, is that loss divided amongst all the customers?

I'm not saying they are crooks. I'm very interested in their platform, because I do a lot of algorithmic trading, so I'm familiar with this. I just want answers to these very basic questions before I deposit any money into this thing.

I understand your concerns. Many people coming from Forex trading have such concerns. But the Bitcoin market is very different. Many people choose to be anonymous.

There're currently no explicit laws regulating Bitcoin transactions and Bitcoin trading.

All these points apply to Mt. Gox or TradeHill as well. There are no law restrictions on this kind of trading.

I use "we" because I represent my company xWaylab Inc. (registered in US). I'm the sole developer and project manager but I'm not the only shareholder.

For margin part, since we offer short selling, generally the combined portfolio is quite balanced. Currently our finances are quite healthy. We will never bet against our clients.

I don't really hope anyone will set a double standard in the Bitcoin market. I think everyone is a fair player. You can choose not to trust Bitcoinica if you're skeptical. But a few dozens of people have chosen to give us a try and they have deposited thousands and thousands of dollars.

Believe it or not, Bitcoinica is currently the third largest Bitcoin Trading Platform, following Mt. Gox and TradeHill. (8000+ BTC traded within merely 48 hours of establishment.)

I still believe in time. If Bitcoinica is still around after a few months, maybe there will be more people joining in.

You didn't answer the vast majority of my questions, even though they were pretty straightforward. If you want people to deposit money into your account, then they should have faith that you actually exist and that you will hold up your end of the transaction. This, in financial parlance, is known as counter-party risk. Will the counter-party to my transaction actually be able to guarantee their side of the deal? Who are you? So far, you are a 17 year old Singaporean, who registered a business in Delaware, when you were 16? How is that possible? Right now, to me there is a severe degree of counter party risk.

If you stole everyone's money (not saying you will), and then I complained to the FBI, they would look at me and say "Are you stupid? You deposited money into someone's bank account 10,000 miles away, and you actually expected the money back?"

"A few dozen people have deposited thousands and thousands of dollars." And yet you have enough money to offer 5:1 margin? If there are 50 people, if all accounts are of roughly equal size, then it takes just 10 people to max out their margin and the entire Bitcoinica has run out of money!!! But assuming a normal distribution of account sizes, and assuming that the ones who deposited the most are the most aggressive, then you would need much less than 10 to max out before you ran out of money.

There are better ways to set up this company so that you can protect yourself and your customers. Even more surprisingly, you offer no protections to YOURSELF. This is a huge red flag. Why would you not be afraid of suffering consequences if bitcoinica melts down or if there is a huge fraud?

From what I gather, you are asking people to deposit money directly into your account (another huge red flag). You are supposed to be held accountable, if there is fraud or if there is a catastrophic loss to bitcoinica, but you're not protecting yourself, at all. The only way is by remaining highly anonymous, and by living in a foreign country that could be outside the reaches of US law.

If you cared about protecting your customers, you would set up a system of segregated accounts, so that one customer can't destroy people's accounts.

I think bitcoinica is a fantastic piece of coding, it's slick and seems to work nicely. But in order to protect yourself, I would return everyone's money and just allow simulated trading. Even as a simulated trading account, bitcoinica is still a fantastic accomplishment.

Then, once you have created a way to protect yourself and protect customers financially, by using things like segregated accounts, and by going through proper channels, etc, then it might be okay to start accepting real money.

If I place a short-sell order, who am I actually selling to? Do you have a huge reserve of bitcoins which you use to make the corresponding trade in the bitcoin market? If not, you are effectively on the other side of my short sell order. That the current set of trades you've brokered balances out is fortuitous, but likely ephemeral. Do you have automation which will stop trading if the set of trades goes out of balance?

Having my broker also be my trading partner is a bit of an uncomfortable position to be in. If I score a huge upside, you would have a strong incentive to just disappear.

"We never bet against our clients." - The most repeated sentence regarding Bitcoinica.

There are people who long and people short. If these positions were opened at the same time and price, they can be canceled out directly. Otherwise, we will trade at other exchanges to hedge.

We are partly responsible for the crash yesterday because we dumped more than 800 BTC into the market when the order book was quite thin due to large amount of short sell orders. The spreads were large due to lack of liquidity.

We have roughly the same financial status regardless of our clients' profitability. We may lose some on guaranteed liquidity, but the loss will be compensated by the subsequent (small) increase in spread.

Do you have automation in place to do such dumping, and shut trading down if you don't have the bitcoins/funds?

Everything is automated, of course.

We can control the risk level any time. Running out of either currency has never happened since launch at least, because our reserves are huge now.

Actually, in the US and Europe, there are laws governing Bitcoin transactions as securities or future. It's simply that the enforcing agencies haven't yet decided which of them has jurisdiction over Bitcoin.

By the way, did you know that by registering your company in the US, you became subject to all of these laws, plus US tax laws, US accounting laws, etc.?

To answer these questions for the US futures market:

The options clearing corporation [OCC] is the organization that performs clearing and alleviates most of the counterparty risk. They demand deposits from various member companies to ensure that, if a member defaults, at least the other parties get their payments.

Organizations such as SIPC offer protection for investors in the case that brokerage firms belly up. They are government-backed. It's hard for a private company to do that.

Leverage involves a contractual agrement which generally involves some sort of clause that allows the broker to go after your company assets, and sometimes even your personal assets, if you blow up. And the brokers generally have enough cash to provide necessary float (in case of a failure to meet requirements).

zhoutong, it's useful to study how existing futures markets work, and try to see how you can replicate some of those key facets (like counterparty risk)

Reply on news.ycombinator.com