Mt. Gox Resigns Bitcoin Foundation Board Seat
bitcoinfoundation.org
bitcoinfoundation.org
MtGox had a bug in the wallet software that caused it to lose track of outgoing Bitcoin transactions.
People exploited that bug to take out more Bitcoin than they had in their MtGox account.
MtGox shut down Bitcoin withdrawals to fix the bug.
MtGox has not fixed the bug three weeks later and a lot of their customers are anxious.
I'd say that malleable transactions are a bug in the protocol.
AKA a bug.
For those interested in finding out what transaction malleability is:
http://www.coindesk.com/bitcoin-bug-guide-transaction-mallea...
<quote> What is transaction malleability?
It’s an attack that lets someone change the unique ID of a bitcoin transaction before it is confirmed on the bitcoin network. The change makes it possible for someone to pretend that a transaction didn’t happen, if all the right conditions are in place. </quote>
This is a fatal design flaw in any TPS system. From any sound accounting principles point of view, no journal entry is to be manipulated after insertion - only through compensating transactions (referencing the original).
There are other ways to track transactions other than the txid, for example by tracking a unique output address. A normalized hash routine has been added recently: https://github.com/bitcoin/bitcoin/pull/3656#issuecomment-35...
Just a naive suggestion (will this work?):
Why not introduce some sort of a 2-phase commit with the original transaction and the newly inserted one on the block-chain? So, before the block-chain transaction is committed, check the two transaction id hashes, if they are different for the request, fail the transaction.
Edit: Of course, the eavesdropper could just as well pass the expected hash back to the originator anyways. :-( Hmmm
The biggest flaw here is probably the name "transaction id", because it suggests that a transaction can only have one valid id. The normalized id fixes this issue for most transaction types.
In fact, it's hard to even call this a flaw in design, because your intentions and hopes for Bitcoin might be very different than those of the Bitcoin developers.
The proper way to resend a transaction is to re-use an input which was used in the original transaction. It does not need to be all the same inputs, just at least one. This way it is not possible for the two transactions to both succeed. If the original transaction succeeds then the second will be rejected as a double spend.
In general Mt. Gox's software appears to not be paying attention to little details about inputs. For a while now if a miner sends the block find award to their Mt. Gox address then Mt. Gox will use the inputs resulting from that block find before the inputs are valid. This causes any transaction with said input to be ignored. The proper solution is to wait the ~100 confirms before using the new btc.
Note that this is a separate problem from the duplicated transactions. The point is: Mt. Gox is not tracking their bitcoin at the correct granularity. They appear to have written the software like we might use the bitcoin rpc api, without paying close attention to the details.
Kind of reminds me of that online poker company that got in trouble with the law and people were trading "[name of company, I forgot] dollars" for below value in an attempt to recoup some of their funds.
Looks like Gox bitcoins are currently available for roughly a 60% discount.
There is some fear that funds may have been lost on a large scale, due to this bug, and that Mt Gox simply won't be able to make good on their accounts. Some have suggested that Gox is buying BTC at the current deflated price to try to cover the gap. All of this is hearsay, and I don't know how much of it I would believe. It's difficult to take the Gox folks at their word, however, given their reticence about providing details of what they're up to, and the slowness of a return to normalcy.
MtGox should be full reserve, that is, they should be holding 100% of all user's bitcoins and fiat deposits, only skimming off the exchange fees.
(Granted, considering how much trouble they were having before with USD being frozen, I can't imagine that this is a feasible move for Gox at the moment.)
Alex has 10 GoxBTC and trades them to Bob for 1 BTC. If MtGox recovers, they give Bob 10 BTC and Alex 0. Their obligation remains unchanged.
Fun story: I was a professional online poker player when black friday happened. And I just happened to be in Guatemala, on my honeymoon. Prior to going on my honeymoon, I had experienced the worst downswing in my career and all we had left (about 20k) was now frozen in my Poker Stars account. When we returned home, we didn't have enough to make the next month's mortgage payment. What we did have was about 1k in cash from our wedding gifts. The night after we got back, I took that 1k to the local casino and played in the highest cash game I could buy into. It was high risk but I didn't have time to grind it out at lower stakes. Luckily I went on an amazing heater, ran the 1k up to 10k and that was enough to last us until Poker Stars unfroze my account.
I was an online pro too. Taught myself to code since Black Friday.
That's a fantastic story my friend. It took some luck but also a lot of guts and self confidence to do that. Glad you managed it.
Story is fantastic, but I'm not glad he did it. I would like it much more if he understood that gambling is a zero sum game except for gambling companies, and stopped playing it after learning a lesson.
All that being said, the entire reason I was devoting time and effort to my side projects was the belief that I could derive more meaning from life doing something other than poker. I was already trying to transition to something new. Black Friday just gave me a giant kick in the ass.
Also, poker is not gambling, at least not the way I play.
What you did that night was definitely gambling (buying in with 100% of your bankroll). Glad it worked out for you though
And about poker being not gambling, well I don't agree. However smart you play, as much as you count on the statistics, in the end of the day, there's still luck involved. Even if it were only pure skill game, you can't always know skill level of your opponents :)
I guess absolutely everything we do in life is gambling, then :)
You're not wrong to be critical of the OP for gambling with his lunch money, but at the same time, it's wrong to conflate statistics with luck. If "the way he plays" is "by the numbers", then luck really isn't a factor. Sure, it may bear on any given hand, but in a long enough game, luck is all but eliminated as being relevant.
I didn't say 'lunch money' as to imply something necessary. Rather, it was intended as something trivial.
Either way, kudos on the hot streak.
As for whether poker is a game of chance, I would argue that the level of skill involved trumps the level of chance and thus doesn't qualify. A good poker player is much like a casino. On any given bet they could lose but in the long term they never do because they always have an edge on their opponents.
But more importantly, there's luck involved in almost everything you do, and you can almost never predict with certainty the outcome of your actions. Should we seek to avoid all luck in life, or perhaps only when money is involved? That would mean we could no longer make investments in anything. Even putting your money in a savings account has, perhaps not luck, but at least a degree of risk involved. There are some things I would never risk in life but money isn't one of those things. Money is just a means to an end.
Yes, it is. No matter how you play.
I question how "professional" you are if you don't even understand this basic concept of advantage gambling.
people who insist on saying 'zero-sum' is really just passive-aggressively saying that the person indulging on said activity should've spent their time on other non-zero sum activity.
It's still a hell of a lot of fun though.
There's something "romantic" about the whole thing. Sometimes we have to do things that are irrational to experience life. It's sort of like climbing Everest. It makes no sense and still quite dangerous but people do it to satisfy some irrational yearning.
The irrationality and the circumstances of his story are what makes it all so beautiful.
Not totally correct. As part of the deal, Pokerstars paid out balances for all non-U.S. Full Tilt players. Players from the U.S. are still waiting for their money, which will be in the form of remittance through the DOJ. The latest news is that those payments will begin soon (nearly 3 years after "Black Friday").
0: http://www.huffingtonpost.com/2012/10/15/fred-smith-blackjac...
banks take your money, and can then trade on a 1000:1 leverage, and when they lose all your money it's pretty much tough luck.
sure, mtgox sucks, but this is in no way something new.
And of course all that downtime for denial of service attacks which was their own fault. MagicalTux slammed BlackLotus, Prolexic and Cloudflare as garbage before somebody pointed out they left a bunch of open ports which is why they were still getting DDoS'd. That whole exchange is a joke from day 1.
This all happened in the past few weeks.
BitCoin just got very serious and much less fun. I guess that's what happens when it suddenly accounts for real, actual money and real actual livelihoods. I sincerely hope everyone gets through safely.
I use CoinBase which (seems like it) is slightly more reputable.
Edit: Madoff was much more. Still, this would be significant.
12,437,700 bitcoins have been mined, with a market cap today of around $7.4B [1]. Madoff scammed investors to the tune of around $50B [2], so even if MtGox owned every bitcoin ever mined, they would have a bit of catching up to do.
[2] http://www.forbes.com/2008/12/12/madoff-ponzi-hedge-pf-ii-in...
Apparently about $36 billion was paid in, and $18 billion paid out, and about $10 billion recovered, leaving about $8 billion(!) "missing". All the numbers are still bigger than both BTC and Gox, though.
Although, didn't the US literally lose something like $10 billion in cash in Iraq/Afghanistan?
There are worse pseudo wallets, like dice sites and mining pools, but it is still a bad idea.
"Coinbase is an international digital wallet that allows you to securely buy, use, and accept bitcoin currency"
It really comes down to whether you trust Coinbase (equivalent of a bank, albeit a startup bank) or yourself (equivalent of putting cash in your mattress) to securely store your money.
You can even trust a regular bank, by putting the key in their safe. And if it's encrypted, you don't even need to trust them to not abuse it.
And using something like ssss[1], you could also store it in a lot of places at once, without any single one having enough info to use your coins.
The point is it's your responsibility to secure it, and if you think you can do that properly then great. I can do it, but I don't think it's easy enough that most "normal" people can do it properly yet.
Bitcoin offers a lot of security mechanism that are not available with traditional asserts, like m-of-n-keys etc. Insured online wallets will become available as well.
I've had friends lose Bitcoins both stored themselves and in exchanges/online wallets.
In any case you should think carefully about your choice.
... The natural corollary to the Kim Stanley Robinson-ian "That's libertarians for you -- anarchists who call the police to get their Bitcoins back."
I hope they get through safely, if they had the foresight to hire a private security firm to protect them?
Playing Devil's advocate, if the Mafia took control of your city, and forced you to pay 20% of everything you made (or be taken from your home and family), but offered to "take care" of any other criminals that might bother you, would it be hypocritical of you to not want to get robbed twice, and therefore use the services that you already had been forced to pay for?
When you live in a system that is forced upon you, it's not hypocritical to use the benefits of that system, since you're forced to withstand its drawbacks.
Why? There is basically no discernible benefit to keeping your money in an exchange, but there are huge risks associated.
Theoretically a 'good' Bitcoin exchange would have insurance and multi-factor auth, and some complicated internal crypto scheme to minimize the scope of breaches. I can't imagine any of the current exchanges are that advanced yet.
Any half-decent online wallet or exchange keeps the vast majority (typically ~95%) of their funds in "cold storage", usually with an n-of-m encryption scheme, which will minimize the scope of breaches, with an occasional inconvenience when withdrawals exceed projections before they can pull funds from cold storage.
Even given the malleability bug (which actually isn't the real problem: http://blog.tlrobinson.net/bitcoin-transaction-malleability-...) if Mt Gox managed to lose more than say 10% of customer funds they were doing something seriously wrong.
Cold storage is an interesting concept for an exchange, but it still seems fundamentally inferior to normal banking's procedures for undoing fraudulent transactions. N-of-m encryption schemes are nice, but they only really make sense if you have each of the keys in a different hardware crypto device. Even then, in practice I suspect all of the exchanges are set up such that 95% of their cold storage is accessible via machines that are connected to the public Internet. (I'd be interested in independent audits that show otherwise.)
1) Does CoinBase have an interest in keeping my BitCoin's safe? They do.
2) Is it competent to keep my BitCoins safe? They seem about 100% more competent than Mt. Gox, which isn't saying much, but unlike Gox I actually believe CoinBase has had its cold storage audited, especially by its rather well-known backers who almost certainly do not want to lose prestige to a massive BitCoin heist/loss...
3) If I keep my BitCoins on my home machine will they will be a) harder to access from anywhere I wish to access them and b) equally susceptible to being lost?
Yes, and yes.
I've seen too many nightmares of people losing their private keys to believe that I'm fundmentally more capable at keeping my BitCoins safe than CoinBase is.
The worst thing about this is that you are probably recommending this scheme to everyone else.
The promise of BitCoin is that it functions like cash, with all the advantages of electronic payments. If I can't bring my cash with me everywhere, then yes, it does fundamentally limit its utility to me.
BitCoin is just like any other money: the base system is based on distrust but for it to be mainstream an ecosystem of trust must be built around it. If we can't sort out the difference between competent BitCoin institutions and incompetent ones then we are in a world of trouble.
Speaking of ecosystem, I noticed that FDIC insurance suspiciously missing.
Wasn't there a Reddit thread about how Coinbase is using Mongo as a transaction backend?
With many Bitcoin users claiming Bitcoin is not money, I don't see the fraud here.
http://www.theverge.com/2014/1/28/5354328/charlie-shrem-resi...
As far as anybody can tell they haven't fixed their software bugs, Gregory Maxwell wrote about that yesterday[0]. The gist is that they haven't fixed incredibly easy bugs, and are still spending unconfirmed transactions that they were warned about months ago (in this case not withdrawals, just automated housekeeping transactions).
I'm on the fence weather they will reopen their own withdrawls or not, they don't seem to be in too much of a hurry. From them moving to a virtual office[1][2] it sounds like they were threatened or some other physical incident arose that made it necessary for them to mask their location. We probably won't ever know about that, but it's not a long stretch to imagine somebody with a lot of money there could do something stupid.
[0]: https://pay.reddit.com/r/Bitcoin/comments/1ymwzj/mtgox_still...
[1]: https://support.mtgox.com/entries/27131120-MtGox-Co-Ltd-Loca...
There have to be some colourful people with very large deposits at Mt. Gox.
Past that, we can't assume much about the situation until they tell us what the status is. Hopefully it'll resolve this week and we can all move on from it. Lessons learned.
I don't have funds in MtGox, but I really wish they could at least make everyone whole using profits(that hopefully were eventually moved into fiat) before shutting down. I'm mildly impacted in that my day-trading has been stalled since MtGox drama has prevented the monthly'ish high swings of coin prices. But I know that's nothing compared to funds mtgox account holders stand to lose in this. However, I'm not sure I have the same sympathy for these folks[1].
1. http://money.cnn.com/2014/02/20/technology/innovation/bitcoi...
Anyways... Good luck folks, http://i.imgur.com/nTFj3zs.png