Hacker News Reader

Eh well, it is Bitcoin's problem in that it's not meant to ever happen. Mt Gox's implementation is based on what is meant to happen in the network (transaction IDs can not change) rather than what does happen (signatures with weird padding are accepted). The network as of late version doesn't relay these either, I seem to remember reading, so it's a problem that's being intentionally reduced.

This is not a recently discovered "problem." This is how bitcoin has always worked. Even before the OpenSSL signature encoding malleability discovery, it was always known that you could add a NOP instruction to a scriptSig, for example, to change the txid without affecting the signature (as the scriptSig is not covered by the signature, for obvious reasons). From the very first day that Bitcoin was released, it was known to anybody who looked at the code that transaction ID's could be changed without affecting signatures.

From the references on the forum, it looks like the issue wasn't really discovered or considered until mid 2011. The developers comment on their active involvement in closing this up, so it's probably reasonable to expect that it's not intended or desirable.

https://bitcointalk.org/index.php?topic=8392.msg122410#msg12...

It's Feb. 2014 the issue has been known since at least May 2011 In other words people have known about this for about 3 years. My vote is still on Mt.Gox incompetence.

That is concerning malleability of the DER encoding only. Note that there are other ways to modify a transaction which change the hash without affecting the signature validity, such as inserting NOP instructions into any of the scriptSig's. That is what I was referring to, and something which was quite obvious from the first release of bitcoind.

Isn't it the case with Bitcoin that the official implementation amounts to its specification? Maybe implementing the protocol themselves was a good idea from a theoretical standpoint but in reality amounts to over-engineering? I certainly don't know enough about this stuff so I could be naive of course.

I suspect this is more FUD than incompetence.

Mt. Gox could solve the issue without a change to the Bitcoin protocol by tracking the entire transaction and not just the hash.

But instead of fixing their own problem they make it sound like Bitcoin itself is broken.

Why would they do this? Cui bono?

If Mt. Gox has been scammed out of a large amount of Bitcoin, they may not own enough to fill withdrawal requests. If this is true, then a steep decline in the price of Bitcoin could allow them to cover the gap.

>Why would they do this? Cui bono?

This is ass covering.

If it's a 'bug in the bitcoin protocol' it isn't their fault.

>This is incompetence on the part of MtGox.

This is surprising.

So a guy who calls himself "Magical Tux" and describes himself as "PHP Developer working on some weird stuff, like a mail server (POP3/IMAP4/SMTP) written in PHP" was not able to build a reliable worldwide exchange?

Yeah, like that guy that they call "The Zuck" who is a PHP developer working on some weird stuff, like a face book written in PHP, was not able to build a reliable worldwide social network?

Get over yourself, MagicalTux is not alone any more, and they're working hard on being a reliable exchange, the most reliable one out there as far as I am aware.

I wouldn't trust The Zuck with my money either

I was confused about this whole thing. I honestly thought that MagicalTux was the only name he gave, and that'd be troubling for someone running a financial institute.

But his name is Mark Karpeles, its plastered all over the website, registration, and even his twitter account.

Well, there are a few points were your counter-example breaks down.

For one, one could use social networking site, even a relatively unknown one, without much to lose. It's not like people wired $1000 dollars to Facebook when it started.

So, yes, I could trust a random guy with some bs social site. With my money? Not so much.

>Get over yourself, MagicalTux is not alone any more, and they're working hard on being a reliable exchange, the most reliable one out there as far as I am aware.

If true, that just speaks very poorly of the state of bitcoin exchanges:

"""Or let's take that historic hack of Mt. Gox, which temporarily dropped the exchange rate to $0.01 per BTC, and involved a large Bitcoin heist. What they didn't tell you, was that several vulnerabilities in the Mt. Gox website and API were reported a while before the hack, and that the Mt. Gox staff more or less waved them away, completely ignoring their severity. This included MySQL injection vulnerabilities, just to put things into perspective a little. One of these vulnerabilities was almost certainly the attack vector that was used for the heist."""

http://cryto.net/~joepie91/blog/2014/02/10/why-mtgox-is-full...

(And of course now we have this new fiasco).

Nice ad hominem there.

I suggest you read this very carefully: http://plover.net/~bonds/adhominem.html

I suggest that the gp's post is very much an ad hominem attack. It suggests, but does not offer proof that Magical Tux is an inferior programmer not capable of building quality software by playing on the fact that some people consider PHP a toy, broken and inferior programming language. It asserts that PHP programmers are always inferior programmers - an assertion that does not hold true. So it uses an unrelated info-bit (PHP-Programmer) to attack Magical Tux qualities as programmer of a bitcoin exchange.

Please note that I'm not asserting anything about the qualities of the programmers of MtGox or the code quality running the exchange. It might quite well be shitty and bug-ridden, but that quality is totally unrelated to PHP.

>It suggests, but does not offer proof that Magical Tux is an inferior programmer not capable of building quality software by playing on the fact that some people consider PHP a toy, broken and inferior programming language.

No, I suggest that some random web developer, with no experience in finances, and without a big financial player behind him, should not really be trusted with people's hard earned money.

Counter to what you say, I could not care less if he did this in Scala or Racket instead of PHP -- I merely quoted the one-liner he gives about himself. He could have written Haskell in there and I would still have the same objections:

Who is he? What has he done before in the financial world? Why should people trust his skills at setting up a money exchange?

Note that, in my argument, I don't even care if he's a good programmer or not. He might outdo Rick Hickey and Simon Peyton Jones put together. What I'm asking is: why should we trust him? Ability to set up a good and safe money exchange AND not be a crook != ability to program.

You should have probably said this in the first place instead of drawing the attention to his choice of nickname and self-description. This here was a much more reasonable argument.

The argument you're making now is a very different one from the one you were making in your original post. In your original post you call attention to his nickname (which is totally unrelated to competence, a lot of competent people have weird nicknames and a lot of incompetent people don't have any) and his one-line self-description which only tells us that he working on some weird stuff written in PHP. This is all of the argument that you made - you attacked his person and character, not anything he said or any of his qualities related to the incident. To sum up your post in a quip "Oh, look, PHP programmer at work, LOL, what did you expect?"

Now you're making a different and more nuanced argument which boils down to "why should we trust him, even if he's competent." That's a reasonable question to ask - but the question of trust is a fundamentally different question from the question of competence. I might trust someone incompetent to be well-meaning and someone competent and capable might be completely untrustworthy. It might even be true that he's incapable and untrustworthy, but still - that's not the argument you made.

The fundamental problem with the older bitcoin exchanges is that they all started out when nobody in the financial world even cared about bitcoin: No technical knowledge, no investors, ... so basically trust had to be earned from 0 on. One point speaking for Mt.Gox is that they are still in business while other exchanges folded. Somebody seems to trust them.

>To sum up your post in a quip "Oh, look, PHP programmer at work, LOL, what did you expect?"

Ever noticed how those are entirely your words?

I merely pointed out at his experience -- not picked on the particular language he uses. In fact I've supported PHP in other HN threads.

The language was only mentioned because HE used it in his bio blurb.

What I wanted to point in that blurb was: random web developer (ie. not a person with known expertise in financial software and money exchanges) and a silly nickname (ie. not really the short of mature behavior that inspires confidence in a major venture such as a financial service).

Contrary to the purely theoritical notion that such a nickname is "totally unrelated to competence" (which might be perfectly reasonable in theory), I'd say that in the real world it speaks volumes about maturity and self-perception. If my banker was calling himself "Crazy-Ass Joe" or "Mr Fancypants" I'd be similarly worried.

>One point speaking for Mt.Gox is that they are still in business while other exchanges folded. Somebody seems to trust them.

Well, to paraphrase P. T. Barnum, there is one person trusting them born every minute.

> Transactions are malleable. Deal with it.

Clearly MtGox overlooked this and thought it was the obvious way to track a transaction.

Given that they're malleable, what use-case do they have now?

Is it possible someone has been running a 'malleability bot' deliberately targeting transactions to cause this issue as much as possible?

Or, since MtGox was known to create transactions with encodings that became non-standard in 0.8, maybe someone was charitably rewriting these transactions so they could be relayed by the network. I don't think there's public knowledge yet as to what happened, including whether it was deliberate or malicious.