The term of art for responses like this is "jazz hands".
Sorry. Security isn't "everybody's job". You've chosen to advertise a financial application. Security is your job. In a very real sense: sucks to be you.
Sorry. Security isn't "everybody's job". You've chosen to advertise a financial application. Security is your job. In a very real sense: sucks to be you.
What I mean is, security is every financial platform owner's big challenge. This includes banks, escrow service providers, payment processors and e-commerce solution providers. Sometimes it's hard to know how secure a system is before anything happens. But I have already explained my experience, ability, current situation, my strategy, how my product works, my objectives and what I have done to the public to help everyone make informed choices.
Not everyone will like every single product. I have been careful about everything I can.
I think the best thing I can do for you is to be blunt about how unconvincing they are.
Very few people with Rails or appsec experience will read them and think that you know what you're doing with regards to security.
You should not be taking "thousands and thousands of dollars" from people. Full stop.
However there are many ways to look at a system and see weak points, before you get hacked. Are you vulnerible to SQL Injection attacks? (You have already been shown that RoR sites can be vulnerible to SQL Injections attacks and your ignorance of that fact http://news.ycombinator.com/item?id=2973796 ). You cannot just say "Nothing in 100% secure" as a way to shut down conversation. Yes, there are unknown problems that could happen, but there are known security weaknesses. Are you covering for them?
To continue the basketball analogy, you're using a trampoline (Heroku) to reach the basket (a secure system) when you really should be learning how to jump (encryption, anti-intrusion, etc.).
He think it's unconvincing, I accepted. The security standard is very different. What I can say now is, compared to other Bitcoin exchanges which handle millions of dollars of transactions, it's likely that Bitcoinica has almost the same level of security.