BitPay Integrates Bitcoin with Fulfillment by Amazon
marketwatch.com
marketwatch.com
this is not a market for weak hands.
Global GDP futures perhaps? It would be interesting to have a currency worth a particular percent of global output.
It appeals to libertarians for this reason. Doesn't appeal to me because I like stability in my currency and am happy to have central authorities that try to ensure that, but it appeals to libertarians.
However, if you want something with a RESTful interface that you don't have to maintain yourself, ycombinator-funded Coinbase appears to have a nice API. But unlike bitcoind (which I've used for several small and one largish project), I've never used coinbase or any of the other third-party APIs.
[0] https://en.bitcoin.it/wiki/Bitcoind [1] http://json-rpc.org/wiki/implementations [2] https://coinbase.com/
EDIT: Clarity, grammar.
It's not that hard to understand why. Having a computer connected to the net to run bitcoind means that if you get it rooted by any chance, you just lost the entirety of your hot wallet.
Please, please stop doing that.
How do you accept bitcoin? Please enlighten us.
I didn't say you shouldn't use wallets, just don't use the naive approach of having a plain wallet in a computer that's exposed via bitcoind. That's asking for it.
Cryptography is hard, but you can use this for instance:
http://bitcoinarmory.com/using-offline-wallets-in-armory/
It's already prepackaged for you. Give it a good read if you don't know it. Free, Open Source, etc. And the author is a nice chap.
It's not the only way. But whatever you do, just don't keep a massive hot wallet in a server that's online. They will find it and if you move enough money they will put massive amounts of effort into hacking it.
EDIT: BTW, you do realize that Armory is a front-end to bitcoind, right? You still have to run bitcoind for Armory to work.
From their Github page:
"Armory has no independent networking components built in. Instead, it relies on on the Satoshi client to securely connect * to peers, validate blockchain data, and broadcast transactions * for us. Although it was initially planned to cut the umbilical * cord to the Satoshi client and implement independent networking, * it has turned out to be an inconvenience worth having. * Reimplementing all the networking code would be fraught with bugs, * security holes, and possible blockchain forking. The reliance * on Bitcoin-Qt right now is actually making Armory more secure!"
You can have a computer with a firewall and a custom protocol connected to another system, and still get hacked, if you don't put in place the sort of measures Armory uses.
Read carefully what you quoted: "it relies on on the Satoshi client to securely connect * to peers, validate blockchain data, and broadcast transactions * for us" - that is not the actual problem when you have your server rooted. The problem is KEYS. Key generation, and key storage/management. Which no other common solutions that I know do in a way that won't get your arse robbed if the computer storing the wallet is compromised. Which I think is a big deal.
And if you send the balance to an off-site wallet every hour, or less, then you aren't exposing much of your balance anyway. If you're an exchange, it gets a lot harder since you have to figure out how much to keep on a hot wallet. But if you're just accepting Bitcoins, there's little to no risk, as long as you regularly send your balance off-site to a cold wallet.
And if your web server is rooted, then they've got any balance you've exposed to your web app, regardless of whether you are running it on bitcoind or some third-party web service.
I recommend cold wallets instead. You can have your server rooted and not lose a satoshi.
At the time, Roman Shtylman, the founder of Bitfloor, described it: “last night, a few of our servers were compromised. As a result, the attacker gained accesses to an unencrypted backup of the wallet keys (the actual keys live in an encrypted area). Using these keys they were able to transfer the coins. This attack took the vast majority of the coins BitFloor was holding on hand.”
So it was a storage issue and had nothing to do with what we're discussing, which is how to process Bitcoin transactions. Which brings me to the question: how would you process transactions on this cold wallet you speak of? Somewhere, you have to have either bitcoind or libbitcoin running (and most business will avoid the latter because it's AGPL, unlike bitcoind which is under MIT license).
To be clear, I strongly agree with the suggestion to keep as much money as possible on cold wallets. If you are just accepting Bitcoins for payment, this can be virtually 100% of your coins. As long as you are regularly moving your coins off of the bitcoind daemon connected to your web app, you are risking very little. Hell, you can transfer the balance off-server every minute if it makes you sleep better.
Otherwise, in real life, most people take the easy way out which means a standard client without no special measures. Note that encrypting the wallets still is not good enough if your webapp needs to be able to operate it (it will typically have the means to transfer funds just there, either keys or source code capable of replicating it).
Crypto is too hard to do right to leave all that as an exercise for the reader.
Also, I get the distinct feeling you're lecturing us about something you've never done. "to operate [a wallet]"?? "to transfer fund just there, either keys or source code capable of replicating it"?? How would you connect a web app, say a Ruby on Rails app, or a Django app if you're more comfortable with Python, to Armory to process Bitcoin payments? There's a new feature that's just been merged that I see would allow Armory to be used on the web, but as far as I can tell, no one is using it in production. But assuming this feature is production ready, how would you use Armory to process payments on the web? Have you actually done this? You're just mentioning a product and nothing about implementing payment processing. The extra measures needed to set up payment processing are most decidedly non-trivial and should be detailed.
Finally, I should mention that Bitcoin Armory is under AGPL (even stricter than the GPL), which means that no serious business is going to use it for payment processing since they would have to open source whatever app they are connecting it to (it's just fine to use it to store a business's Bitcoins, however, since in this case, it's not connected to your application). From the BitcoinArmory site: "Armory is licensed under the AGPL version 3, which guarantees that any derivative programs based on Armory source-code must also be open-source." bitcoind, on the other hand, is under the MIT license and can be freely used in commercial software without the obligation to share your source code.
The option of just having a small hot wallet and a cron script (risking just the amount in the hot wallet at any given time) is probably good enough for most people, and it's a lot simpler than the kind of crypto needed to set up a wallet that can be safely operated in untrusted media. That much is fine.
Still, hotwallets combined with limited human resources (can't have someone constantly checking the balance, cannot automate the loading of the wallet and keep that in the server for obvious reasons) usually end up in cutting corners, getting robbed and essentially financing crooks.
Cannot go around saying safe, home-made BTC wallet support is trivial for a newbie. If you think so you live in la-la land.
It's just unrealistic and conveys a dangerous message, that's all. 99% of HN's readers would be much better off using any of the already put in place payment processing systems and pay them for their years of expertise.
Source: I bought BTC on coinbase right before I replied to your comment.
also, you can mine them yourself ;-)
http://howdoyoubuybitcoins.com/
I recommend the following services right now: http://howdoyoubuybitcoins.com/from/bitme/ http://howdoyoubuybitcoins.com/from/localbitcoins/ http://howdoyoubuybitcoins.com/from/ziggap/
Yes, they've been hacked before and lost bitcoins. I figure 1. being hacked once probably makes them a lot more cautious now, and 2. what was stolen was bitcoins that were sitting in user accounts there. You're at very low risk if you don't leave bitcoins sitting in your account - transfer them to a private wallet or convert them to USD immediately.