Hacker News Reader

Comment by sillysaurus | Hacker News Reader

It was a bitcoin trading platform. Many bitcoins had to be accessible by a sever.

It wasn't the platform's fault that they lost the bitcoins. Linode's admin interface was the attack vector. This is roughly equivalent to getting robbed because your landlord left your apartment's master key under a doormat.

View on HN

Hosting bitcoins on any vps is not a good idea. I'd be hesitant to store just a few, but trying to run an exchange on one is like trying to run a bank on a vps.

I agree linode's response was not ideal and they should learn from that and be far more transparent (see recent twilio billing issues for a good example of the way they should have responded), but hosting digital money which can be stolen on a shared vps is not a good example of a failure solely down to linode - those bitcoins wouldn't be safe on any vps long term, and their presence sounds like it caused this targetted hack in the first place.

To continue that analogy, its roughly equivalent to keeping $200k cash in a briefcase the floor of your apartment instead of in a safety deposit box at the bank.

That analogy is completely invalid. It was a trading platform. How do you propose they trade bitcoins without those bitcoins being accessible by the server?

Bitcoin trading platforms do not need bitcoins accessible by remote servers. They should have a huge portion of the coins in cold storage (not available from remote servers). Also, the storage and attribution of coins to accounts should be done by a server under physical possession/control, so that authentication cannot even be forged in the event of a frontend breach.

There are a lot of things you can do to protect your bitcoins. Having them all on linode servers is the worst thing possible.

http://en.wikipedia.org/wiki/Air_gap_%28networking%29

Yeah, that's one of those applications that you really need to colo and secure yourself with outside security verification, or at the very least go with a host that has a reputation for ironclad security. Hosting that kind of thing on a low-cost VPS is ridiculous.

From what I remember, it was a 17 year old kid who built and ran the site, and it was his first time ever handling financial transactions (there was another bitcoin-related hacking around the same time, so I might be confusing them.) It was a recipe for disaster.

It's incredible how much people are willfully ignoring Linode's gross incompetence in this matter.

Their only gross incompetence was not informing customers in a timely manner, which I could forgive them for. Having a security breach is something that happens to, quite literally, every hosting provider.

I say all this as someone who dropped Linode for DO due to not being able to afford them anymore.

Yes, bitcoin is definitely not an appropriate VPS to run a bitcoin trading application from where the bitcoins are stored. Stored bitcoins are one of the most sought after targets since law enforcement generally will not investigate. For most web apps, it's an excellent choice.

Reply on news.ycombinator.com