Hacker News Reader

Comment by gtCameron | Hacker News Reader

To continue that analogy, its roughly equivalent to keeping $200k cash in a briefcase the floor of your apartment instead of in a safety deposit box at the bank.

View on HN

That analogy is completely invalid. It was a trading platform. How do you propose they trade bitcoins without those bitcoins being accessible by the server?

Bitcoin trading platforms do not need bitcoins accessible by remote servers. They should have a huge portion of the coins in cold storage (not available from remote servers). Also, the storage and attribution of coins to accounts should be done by a server under physical possession/control, so that authentication cannot even be forged in the event of a frontend breach.

There are a lot of things you can do to protect your bitcoins. Having them all on linode servers is the worst thing possible.

http://en.wikipedia.org/wiki/Air_gap_%28networking%29

Yeah, that's one of those applications that you really need to colo and secure yourself with outside security verification, or at the very least go with a host that has a reputation for ironclad security. Hosting that kind of thing on a low-cost VPS is ridiculous.

From what I remember, it was a 17 year old kid who built and ran the site, and it was his first time ever handling financial transactions (there was another bitcoin-related hacking around the same time, so I might be confusing them.) It was a recipe for disaster.

It's incredible how much people are willfully ignoring Linode's gross incompetence in this matter.

Their only gross incompetence was not informing customers in a timely manner, which I could forgive them for. Having a security breach is something that happens to, quite literally, every hosting provider.

I say all this as someone who dropped Linode for DO due to not being able to afford them anymore.

Yes, bitcoin is definitely not an appropriate VPS to run a bitcoin trading application from where the bitcoins are stored. Stored bitcoins are one of the most sought after targets since law enforcement generally will not investigate. For most web apps, it's an excellent choice.

Reply on news.ycombinator.com