Hacker News Reader

Comment by Scoundreller | Hacker News Reader

> ZHONG did not list any item or service for sale on Silk Road, nor did he buy any item or service on Silk Road

> ZHONG funded the Fraud Accounts with an initial deposit of between 200 and 2,000 Bitcoin. After the initial deposit, ZHONG then quickly executed a series of withdrawals. Through his scheme to defraud, ZHONG was able to withdraw many times more Bitcoin out of Silk Road than he had deposited in the first instance. As an example, on September 19, 2012, ZHONG deposited 500 Bitcoin into a Silk Road wallet. Less than five seconds after making the initial deposit, ZHONG executed five withdrawals of 500 Bitcoin in rapid succession — i.e., within the same second — resulting in a net gain of 2,000 Bitcoin. As another example, a different Fraud Account made a single deposit and over 50 Bitcoin withdrawals before the account ceased its activity.

So Silk Road wasn’t waiting for any transaction confirmations??? And didn’t append a nonce to each withdrawal to avoid duplicates?

Is this the guy that Ross wanted to kill?

View on HN

> Is this the guy that Ross wanted to kill?

No. The guy he "wanted to kill" was a moderator who didn't even steal from him. A FBI agent (huray, my taxes) pretended to be a drug lord for over 2yrs convincing Ross he should kill some moderator with lies about he wanting to take over silkroad or something, and then staged a mock assassination. All that for no tangible investigative benefit other then strengthen their 2yr old bro-bond.

That agent didn't even contribute to the actual arrest. Go read wired write up of the whole thing. It's better than most fiction books. Pure comedy.

Also, the current silk road is a honeypot set up by the Feds. That's why 1) they screwed up on validating transactions (it's not their money) and 2) they want after the stolen funds.

Has the concept of "Entrapment" not made its way across the pond yet? This seem highly unethical on the part of the FBI.

FBI gets a wide berth from the courts. A couple of years ago, they seized some TOR child porn website, and then started making upgrades to it causing the userbase to increase by 30%. Then they tried to pin that user count on the person they arrested.

FBI is federal, unlike the police, so they can do whatever, at least that’s how it’s playing out. The FBI is supposed to be effective, not ethical. It’s what’s “on the tin” and has always been. A good example is their treatment of MLK.

The FBI is supposed to be ethical, that's what's on the USA tin containing the FBI tin.

You can provide a billion examples of how the US hasn't lived up to that notion, but 'liberty and justice for all' is, "what's on the tin."

I think we agree, probably that what is and what should be are not the same. The tension is that voters will often reward politicians that are effective, rather than those whom are ethical. When it comes to the safety of your child, most humans go for effective over ethical.

We disagree insofar as your statement, "The FBI is supposed to be effective, not ethical." They are supposed to be ethical, and then effective.

> When it comes to the safety of your child, most humans go for effective over ethical.

Wouldn't the balance of the child's needs change the ethical judgement (now considered ethical as well as effective)? I don't see how they would be mutually exclusive.

Entrapment is an invention of 20th century American courts. See William E. Mikell, "The Doctrine of Entrapment in the Federal Courts," U. Pa. L. Rev. 90 (1942), calling entrapment as a defense a "purely American doctrine" not considered by earlier English writers on criminal law.

Trivia aside, no. Entrapment is a specific concept narrower than "a fed lied to me."

Given the mention of "across the pond", it seems the parent commenter was talking about the English law meaning of entrapment. That is where you are enticed to commit a crime by a law agency. Technically it's still a crime and there's no legal defence based on entrapment, but courts will tend not to prosecute if "the police did more than present the defendant with an unexceptional opportunity to commit a crime".

I'm assuming you pulled that from Wikipedia, which is what Google points to for that phrase. You've radically oversimplified Wikipedia's coverage of UK entrapment, and Wikipedia oversimplifies UK law. "More than an unexceptional opportunity to commit a crime" is just one factor in a complex analysis. The "exceptional" opportunity starts the consideration of entrapment; it doesn't end it.

Yes I got that quote via Wikipedia. It, in turn, is a direct quote from a judgement from the Law Lords, which set a precedent – the main precedent on the subject if that Wikipedia article is to be believed. So it's not just a random Wikipedia editor's view on the subject.

Yes, no kidding it's a more complicated subject than that one short sentence. But my point was just that it's different from any notion of entrapment, or lack of, in the US.

The point is that it's simply not the case that the state tends not to prosecute in cases where "the police did more than present the defendant with an unexceptional opportunity to commit a crime".

> Also, the current silk road is a honeypot set up by the Feds. That's why 1) they screwed up on validating transactions (it's not their money) and 2) they want after the stolen funds.

The DOJ release says these transactions were from 2012

this bitcoin theft happened in September 2012, before Ross Ulbricht got arrested (in 2013) so when Silk Road was active and not a Feds' honeypot like you describe.

> No. The guy he "wanted to kill" was a moderator who didn't even steal from him.

Ross Ulbricht commissioned 5 murders fully expecting each of them to be carried out.

> All that for no tangible investigative benefit other then strengthen their 2yr old bro-bond.

The murder-for-hire evidence denied him bail. But the prosecutor already had Ulbricht nailed and decided to avoid complicating the case by formally filing the murder-for-hire charges. Would your tax dollars have been better used if Mr. Ulbricht had additional life sentences and decades of prison? No, he is going to die in a prison cell either way.

Ross Ulbricht built his empire, in large part, by profiting off people's suffering. And he exhibited time and time again that he would murder people to protect it. He is nothing short of evil.

A reminder that the murder-for-hire schemes were a predicate of the conspiracy charge in his indictment; he was in part charged for them.

But conspiracy charge depends on overt act(s), so being convicted of conspiracy doesn't necessarily mean he was convicted on the basis that particular overt act occurred. The prosecution never had to prove all the overt acts, including murder-for-hire, were true to convict for the more generalized non-murder conspiracy. Just that some subset of overt acts were true.

> prove

There are different levels of proof. For example, civil court only requires a preponderance of evidence.

It might have been worth them formally filing the murder-for-hire charges just to save us from having to read his supporters repeatedly say they weren't real.

Don't worry, even though he wasn't convicted of them, his sentencing included the alleged activity and punished him for it anyway!

In my opinion the Sackler family has cause a lot more suffering and they see no day in prison. And they're not the only lords who get away with murder. Yet a guy like Ulbricht gets to spend a lifetime in jail... This is a miscarriage of justice unless all monsters are locked up and all would be fair. It could be argued that Ulbricht caused no suffering but alleviated it by providing a service for people to buy their "drugs" by skipping meeting a shady dealer...

That alleged right of criminals to be persecuted in strictly descending order of severity simply does not exist. Finding some bigger wrong does not make a right.

> That alleged right of criminals to be persecuted in strictly descending order of severity simply does not exist.

Exactly. Justice does not exist at that level of wealth, and this is a core problem in western society.

Well pointed out.

> this is a core problem in western society

Are there any societies, historical or current, where the extremely rich and powerful face justice in the way you would like, other than by pissing off other extremely rich and powerful people?

In China they say you can get away with anything as long as nobody dies.

For example, in the 2008 Chinese milk scandal, two people were sentenced to death and three received life sentences.

I did wonder whether I should include 'western' or not. I probably shouldn't have, since, I agree with your point, it's not a area that distinguishes western from non-western.

The arbitrary nature of what's become of "justice" is only magnified as the wealth gap increases.

> In my opinion the Sackler family has cause a lot more suffering and they see no day in prison.

So what? Which is it, are you in favor of a lighter sentence for Ulbricht, or a heavier sentence for the Sackler family?

To be honest I don't know, I just expect justice to do it's bidding and make the world a better place for all of us. What bothers me is that the rich get away with murder while the rest of us are held at a different standard. It also seems to me that the Sacklers' caused a lot more harm while this guy is not as evil as purported to be and doesn't disserve to be locked up for life. Should the justice be harsh for everyone I'd swallow that pill but it's not. I'm just comparing the amount of suffering caused and the received sentence. And there's no what, it's just an ordinary person's opinion, an opinion that does not change anything.

I respect where you're coming from, but here's an opinion, that if adopted, may influence where you choose to stop or continue your thought process.

I see this "comparison" form of objection quite a bit, where someone points out relative injustice without taking a stand on which way to go. Once you notice it, you start seeing it everywhere.

In terms of conversation, it almost always seems to have a muting effect, of freezing the momentum towards figuring out what should be done. Desiring consistency is honorable, but these sorts of scenarios further ask us which way we want to apply that consistency. While each individual case probably wouldn't make a difference, I think when we refuse to answer those questions as a society, it makes it more likely for these imbalances to occur. So I think it's worthwhile to try and think it through, take a stand, and voice a stand.

The Sackler's had their name stripped from museum exhibits, campuses, etc, which I'm sure hurts at the end of the day.

The US government really should have went the extra mile and stripped the Sackler family of every penny they had.. to the point that they were forced to beg for spare change on the side of the road e.g. Mortimer & Randolph Duke style.

> The bankruptcy judge acknowledged that the Sacklers had moved money to offshore accounts to protect it from claims, and he said he wished the settlement had been higher

https://www.nytimes.com/2021/09/01/health/purdue-sacklers-op...

> Ross Ulbricht built his empire, in large part, by profiting off people's suffering.

He built Silk Road, which allowed people to sell drugs to one another.

If the 'people's suffering' you are referencing is the use of drugs, I hope you have this same ire for the pharmaceutical companies and physicians prescribing opioids linked to over 500k deaths in the US over the past two decades[1]. I hope you feel the same ire for the CIA who facilitated and supported the Nicaraguan Contra groups' smuggling of crack into the US to finance their coup attempt[2].

I would hope the "nothing short of evil" rhetoric isn't exclusively saved for the kid who built an onion site and then was entrapped by FBI agents into a murder-for-hire scheme of their creation.

[1]https://www.npr.org/2022/11/02/1133523740/cvs-health-agrees-... [2]https://nsarchive2.gwu.edu/NSAEBB/NSAEBB113/north06.pdf

>> Ross Ulbricht built his empire, in large part, by profiting off people's suffering.

> He built Silk Road, which allowed people to sell drugs to one another.

Actually, that's the tiniest part. [1]

  The Silk Road was an online black market where buyers and sellers of illegal or
  unethical items could transact anonymously. Utilizing privacy techniques such
  as the Tor network and cryptocurrency transactions, people were able to
  transact in drugs, hacked passwords, illegal data, and other contraband.

Or, you could look at how he used Silk Road, to contract killers. [2]

  MANY OF THE ideological supporters of the Silk Road have described its
  sprawling online black market for drugs as an experiment in victimless crime
  and a nonviolent alternative to the bloody turf wars of the streets. But
  prosecutors in the trial of Ross Ulbricht, the 30-year-old accused of running
  that anonymous bazaar, have pointed to one conversation they say shows the
  contrary: That the Silk Road's boss was willing to resort to the drug trade's
  most violent measures when it suited his needs.

[1] https://www.investopedia.com/terms/s/silk-road.asp

[2] https://www.wired.com/2015/02/read-transcript-silk-roads-bos...

Literally fake news. Don't believe everything you read, especially if the source is a prosecutor.

> built his empire, in large part, by profiting off people's suffering.

LOL. Wow. You clearly have no sense for nuance whatsoever.

https://www.wired.com/2014/06/silk-road-study/

https://www.theatlantic.com/technology/archive/2013/10/did-s...

Silk Road reduced deaths in a black market that was always there and would always continue to be there regardless of the presence of Silk Road. Period. Given that black markets are going to continue to exist, since anti-drug laws are dumb (just like Prohibition was; regulation of an irrepressible market is always superior to "illegalization" in a vain attempt to suppress it), it is at least less bad if there are fewer killings.

Entrapment is unethical precisely because you can use it to enforce a law regardless of the ethical justification of the law. If it was a capital offense to have sex before marriage in 2040 in the United Christian Dictatorship of America, and another Ross Ulbricht type came along and made it possible for teens to seek and meet in secret online, and a christo-fascist cop pretended to be a hot girl on said system while pretending to threaten to take the whole thing down unless a ransom was paid, and ANOTHER christo-fascist cop (or the same one pretending to be someone else) offered a "solution" to this by "getting rid of" the "problem"... Do you see where I'm going with this? Future Ross Ulbricht just wanted people to be able to find physical love before committing to wed!! Certainly not guilty enough to do life in prison, because no actual murders ever actually occurred.

Part I of an account of the wild story can be found here; it’s really quite interesting, at the least!

https://web.archive.org/web/20220112152207/https://www.wired...

> As another example, a different Fraud Account made a single deposit and over 50 Bitcoin withdrawals before the account ceased its activity.

> So Silk Road wasn’t waiting for any transaction confirmations??? And didn’t append a nonce to each withdrawal to avoid duplicates?

See the ACID properties of databases. [1] These are often put to the wayside in order to have greater transaction speed. We can see the results.

  In computer science, ACID (atomicity, consistency, isolation, durability) is a
  set of properties of database transactions intended to guarantee data validity
  despite errors, power failures, and other mishaps.[1] In the context of
  databases, a sequence of database operations that satisfies the ACID properties
  (which can be perceived as a single logical operation on the data) is called a
  transaction. For example, a transfer of funds from one bank account to another,
  even involving multiple changes such as debiting one account and crediting
  another, is a single transaction.

[1] https://en.wikipedia.org/wiki/ACID

> See the ACID properties of databases. [1]

But since this is "blockchain", is it more like... they weren't polling for the right confirmation/status/update from the blockchain network API thingie?

> But since this is "blockchain", is it more like... they weren't polling for the right confirmation/status/update from the blockchain network API thingie?

That's the exact same mistake I referenced. The consuming website should not be in charge of the atomicity of transactions.

It doesn't matter whether the API was used incorrectly, blockchain was used, or finanglesperunk was the technology. The vagaries of the implementation don't matter. Sending money should be atomic with the request instead of whatever this was, otherwise the result might be $3.36 Billion in theft.

PS Blockchain is a database. The developer can choose to enforce SALT instead of ACID, but something wasn't done right.

No, it's not blockchain. It's a SQL usage error.

Which of the ACID property is broken here? Transaction is by definition atomic, internal consistency was not broken, and isolation and durability are fine.

ACID makes sense in internal transfer, like the example you gave:

> debiting one account and crediting another, is a single transaction.

Blockchain is ACID compliant, their internal database could be ACID compliant hard part is linking it together.

The solution here is exactly going opposite of ACID. Do a transaction in database first, and hope the transaction goes through Bitcoin, if not have another job reverse the transaction. If the reverse job fails, have a support agent manually revert the transaction. A common mistake someone could do is to put transaction in processing state in the database, and have another job update it to success.

> Blockchain is ACID compliant, their internal database could be ACID compliant hard part is linking it together.

That's the issue, ACID is not ACID for a tiny bit but for the transaction. See the definition you quoted, "debiting one account and crediting another, is a single transaction." Blockchain is absolutely not ACID compliant. There must be a deterministic methodology not miner consensus for ACID. Miners can even change the blockchain.

However, why are you even mentioning blockchain instead of MYSQL without SERIALIZABLE, which enforces atomicity?

> The solution here is exactly going opposite of ACID.

What solution are you talking about? There was no solution put in place, which was the cause of the thefts.

I knew a guy about 10 years ago that upgraded his iphone through the apple website and AT&T website at the same time, received two phones, and never heard from either company about a double transaction. I love these kinds of hacks -- I guess it's one way to profit from hard-learned database lessons :)

Reminds of my older brothers friend who in second grade got back in line to get his yearbook picture taken and showed up twice in the yearbook with slightly different pics.

When I was a kid we had vending machines for drinks in school.

One morning I put 20p in and it immediately came back out. It wasn’t accepting the coin so I tried two in quick succession. Both were spat back out… but the machine registered one of them.

I of course would never exploit that repeatedly for a couple free drinks and some extra change too.

The soda machine in my dorm at college had separate mechanisms for “I released a soda” and “you actually got a soda” and if you knew this, you could trigger the “I released a soda” mechanism and delay the “you actually got a soda” event until after you got your money back. You just had to stick your arm up the machine and not let the released soda fall while you hit the cancel button. Then you got your money back and then a soda. Atomicity fail.

They were not around for very long but there was a soda machine that had a conveyor belt that drinks would drop down onto and then be pushed out of a flap door into the bucket. The machine could detect when a drink was actually vended but didn't seem to be able to detect when someone was holding the door shut. You'd pay for a drink and hold the door shut while the machine tried to push your drink out the door. Since the door wasn't opening, the machine would think that no drink ever dropped down onto the conveyor belt so it would mark that specific drink number as out of stock and return your money. Except your drink selection was still sitting on the belt. You'd pick a new drink and pay for it but this time not holding the door shut, two drinks would come out for the price of one. You could do this quite a few times over to either get a couple free drinks or just jam the machine. Out of all the vending machine "hacks" I learned about in middle school, this was the only thing that ever worked and only for a short time before they got quickly replaced.

The new machines use either a basket to hold the drink instead of a conveyor belt or some sort of shield to prevent you from messing with the flap door until it knows a drink has been vended.

Seems like it was working as intended, that if there was some blockage in the machine that resulted in the soda getting released but then getting stuck, you'd want a refund.

Somehow I doubt giving out unlimited free sodas is "as intended." This is why it's an atomicity fail, leading to an inconsistent transaction. It should never be blocked according to the payment mechanism and unblocked according to the delivery mechanism.

No it's literally just a good faith effort to err on the side of customer satisfaction being exploited to steal a soda.

The tumble dryers in my halls of residence were meant to take 20p (oh, those were the days, it's probably a quid now), but if you put in a 1p slowly and kept turning the handle it would trick it.

I didn't get into the UC of my choice. So I appealed. This was in 2006, and the appeal process was not through an online application. You had to mail in a packet with your appeal letter, transcripts, etc. I sent one in by the postmark deadline (Friday), but it wasn't very good. So, come Monday morning, I overnighted a much better one. After a week or whatever, I got a message notifying me that my application status had changed, but I did not get in. Then a day or two later, I got another one, to which I _did_ get in.

Now, I don't know for sure, but I like to think two different reviewers got my packets in parallel and never knew it, and upon changing my status the second reviewer probably wouldn't have seen any evidence of the last status change having been from an appeal.

> I got a message notifying me that my application status had changed, but I did not get in. Then a day or two later, I got another one, to which I _did_ get in.

Back in the days before email was common, I applied for a postdoc position at <famous prof's lab @ MIT>.

I mailed my letter to <famous prof>, expressing interest in working in his lab.

A few days later, I asked 3 profs in my graduate program to write letters of recommendation on my behalf to be mailed to <famous prof>.

After ~10 days, I received a response letter from <famous prof>, to the effect of: "Sorry, my lab is full. Won't have any openings for several years. etc. etc. Thanks, but no thanks."

I figured "Oh well.... No big deal."

But I was too lazy to inform the profs who were writing my recommendations to stop.

About a week after my "rejection" letter, <famous prof> phones me and says, "I always send a standard rejection letter because I'm only interested in people who are _aggressive_. Thanks for sending your recommendation letters. I _definitely_ have openings in my lab."

I didn't have the heart to tell him that he only got those letters because of my laziness.

Couldnt it be the case that one packet was reviewed and they updated your status, then they just chucked the duplicate?

Yes I suppose. I just vaguely remember two different notifications about it

I have to fess up, too.

Back in the early 1990s, I withdrew $10 from an ATM.

But the machine gave me two $10s (they were stuck to each other).

I then went back for a second transaction (secretly hoping there were multiple "stuck $10s" waiting to be released).

The machine only dispensed a single $10 the second time, so I stopped.

Let it be known that I owe Chemical Bank (or whoever bought them) $10 + interest.

First time Im hearing of an ATM dispensing $10 bills. Granted, first time I started using ATMs was in the early 2000s...

I think they even dispensed $5s at the time, but my memory is a bit hazy about that.

At the time, my girlfriend (now wife) used to tell me I wasted so much $$ on ATM fees by only withdrawing $10 at a shot.

I told her I was not good at budgeting my money and I had a tendency to spend whatever was in my pocket, irrespective of the amount.

So, $10 was my way of putting brakes on my spending. Fees were just part of the cost of my budgeting method.

She married me anyway.

First time Im hearing of an ATM dispensing $10 bills.

Back when ATMs were new, you could get any amount, including change.

The ATMs at the Chase bank next door currently dispense any bills you want, but not change. After you tell it how much you want, it asks you how you would like it and you can tap different denominations.

Last month I took out $17, just to see it work.

Back before all of the banks were wired together, I had a friend with what we called a "bottomless ATM card."

He could withdraw whatever amount he wanted from the ATMs at college, but since that region's ATM network wasn't hooked up to his home bank's ATM network, it took months for everything to reconcile.

He could keep withdrawing, even if he had taken out far more cash than he had in his home bank account.

On breaks, he would go back home and pick up enough hours at his part-time job to cover the difference (it wasn't unusual for people to be paid weekly or in cash back then), make a deposit, and everything was fine. He just had to keep one step ahead of the computer batch processes.

Also, I think Chemical is Citibank now. I had a Chemical account, and a Dime account. I still think of Citi as "Chemical," though.

Opposite experience here! Requested $100, got back $60 with two of them folded over on the corners. $100 debited from bank account, filed a complaint with the bank. The temporary refunded the money, did an investigation, then said that the ATM actually settled at the correct number, and took the money back from me. Not cool

"the code is the contract"

"oh wait we fucked something up? shit no, give me my money back"

Isn't that the silly thing they say about etherium, not Bitcoin?

No, the bug was in the withdrawal code. Concurrency bug, numerous simultaneous withdrawals have a high change of succeeding and you are able to withdraw more than your actual balance. Very common in amateur coded websites.

Sure, but if silk road waited for X confirmations, it would have made it at least a bit more complex to pull off.

(Maybe you could have just hammered it continuously, but hopefully would have to predict when the blocks would be confirmed. They’re not exactly every 10 minutes).

It’s not exactly related to this hack, but poor blockchain practice on the part of silk road if it permitted withdraws this quick after deposits.

From what they said it sounds like the issue was executing the same withdrawal request more than once, unrelated to the bitcoin confirmation window. The fraudulent withdrawals had to happen on the same second, not merely on the same hour.

That’s correct. I read the indictment and the first one was done within 5 seconds of deposit, while the next successful one was after 24 minutes.

If the bug is a read-modify-write sequence without a transaction, then regardless of whether you wait for more confirmations, the withdrawal action will always be racy and vulnerable to this exploit.

Not waiting for confirmations would leave you vulnerable to random chain forks and make 51% attacks cheaper.

> Very common in amateur coded websites.

Also common in professionally coded websites.

« Do not click PAY more than once »

In 2012 bitcoin was worth ~ $7.00. So 2,000 bitcoin is only $14,000 but the feds too $3 billion back. Does not seem fair.

Reply on news.ycombinator.com