Hacker News Reader

Comment by sharkweek | Hacker News Reader

Pardon my naivety, I don't follow much Bitcoin news except for what I read here in passing. What happened to Mt Gox? Having trouble finding unbiased news on the subject

View on HN

MtGox wrote their own Bitcoin wallet software.

MtGox had a bug in the wallet software that caused it to lose track of outgoing Bitcoin transactions.

People exploited that bug to take out more Bitcoin than they had in their MtGox account.

MtGox shut down Bitcoin withdrawals to fix the bug.

MtGox has not fixed the bug three weeks later and a lot of their customers are anxious.

And then MtGox blamed their own bug on the open source developers calling the actual protocol a bug. (Although malleable transactions were a pretty stupid idea.)

Although malleable transactions were a pretty stupid idea

I'd say that malleable transactions are a bug in the protocol.

I wouldn't say a bug... more like a flaw in design.

AKA a bug.

Agreed.

For those interested in finding out what transaction malleability is:

http://www.coindesk.com/bitcoin-bug-guide-transaction-mallea...

<quote> What is transaction malleability?

It’s an attack that lets someone change the unique ID of a bitcoin transaction before it is confirmed on the bitcoin network. The change makes it possible for someone to pretend that a transaction didn’t happen, if all the right conditions are in place. </quote>

This is a fatal design flaw in any TPS system. From any sound accounting principles point of view, no journal entry is to be manipulated after insertion - only through compensating transactions (referencing the original).

To be clear here: when broadcasting your transaction to the network, somebody can reissue your transaction with a different ID, but they cannot change the inputs and outputs.

There are other ways to track transactions other than the txid, for example by tracking a unique output address. A normalized hash routine has been added recently: https://github.com/bitcoin/bitcoin/pull/3656#issuecomment-35...

Thanks.

Just a naive suggestion (will this work?):

Why not introduce some sort of a 2-phase commit with the original transaction and the newly inserted one on the block-chain? So, before the block-chain transaction is committed, check the two transaction id hashes, if they are different for the request, fail the transaction.

Edit: Of course, the eavesdropper could just as well pass the expected hash back to the originator anyways. :-( Hmmm

That's not necessary. A transaction with a modified id is not a problem unless you falsely rely on the id for payment verification instead of tracking the inputs and outputs by a custom hash.

The biggest flaw here is probably the name "transaction id", because it suggests that a transaction can only have one valid id. The normalized id fixes this issue for most transaction types.

Not the same thing in common usage. Most people use "bug" to refer to unintended behavior. Wikipedia also includes "incorrect behavior" in its definition, but that's extremely broad, since "incorrect" could be used to describe anything from an underperforming call to action on a landing page to creating software in the wrong market (e.g. "My software had a bug: I created a food delivery app when I should have created a social network app").

In fact, it's hard to even call this a flaw in design, because your intentions and hopes for Bitcoin might be very different than those of the Bitcoin developers.

I've often heard "design bug".

Well, there are many sources of malleability which could be eliminated. Certainly I would consider each of those a bug. However it is not yet known whether malleability can be eliminated entirely (e.g. algebraic manipulations of ECDSA signatures).

Even if transactions were not malleable, or if you use unchangeable signatures, you would still hit a race condition using them like Mt. Gox does.

The proper way to resend a transaction is to re-use an input which was used in the original transaction. It does not need to be all the same inputs, just at least one. This way it is not possible for the two transactions to both succeed. If the original transaction succeeds then the second will be rejected as a double spend.

In general Mt. Gox's software appears to not be paying attention to little details about inputs. For a while now if a miner sends the block find award to their Mt. Gox address then Mt. Gox will use the inputs resulting from that block find before the inputs are valid. This causes any transaction with said input to be ignored. The proper solution is to wait the ~100 confirms before using the new btc.

Note that this is a separate problem from the duplicated transactions. The point is: Mt. Gox is not tracking their bitcoin at the correct granularity. They appear to have written the software like we might use the bitcoin rpc api, without paying close attention to the details.

So people with money frozen by MtGox are w/o recourse while the funds crash? Yikes...

Kind of reminds me of that online poker company that got in trouble with the law and people were trading "[name of company, I forgot] dollars" for below value in an attempt to recoup some of their funds.

The exact same thing is happening with MtGox: https://www.bitcoinbuilder.com/

Looks like Gox bitcoins are currently available for roughly a 60% discount.

Yes, there are Mt Gox BTC, trading for about half of a real world BTC: https://bitcoinbuilder.com/

There is some fear that funds may have been lost on a large scale, due to this bug, and that Mt Gox simply won't be able to make good on their accounts. Some have suggested that Gox is buying BTC at the current deflated price to try to cover the gap. All of this is hearsay, and I don't know how much of it I would believe. It's difficult to take the Gox folks at their word, however, given their reticence about providing details of what they're up to, and the slowness of a return to normalcy.

I don't understand how that works. I had $1000 in my account, say, and it was worth 1 BTC. Now it's worth 10. Isn't that much more expensive for Gox to return?

You aren't buying directly from Gox, it's an exchange. You can buy 10x more bitcoins with your money, but you're buying from people who have lost confidence in the exchange and believe they are more likely to get their USD out than their bitcoins.

MtGox should be full reserve, that is, they should be holding 100% of all user's bitcoins and fiat deposits, only skimming off the exchange fees.

The issue at hand is that Gox has allegedly lost BTC due to double-payouts as a result of the malleable transaction. So if the price of BTC on Gox is super low, Gox could decide that it's better to change the ledger such that instead of 10 BTC a person has $1000, instead of having to buy 10 BTC at the market price (~$10 000) and use that to reimburse the person.

(Granted, considering how much trouble they were having before with USD being frozen, I can't imagine that this is a feasible move for Gox at the moment.)

Right, but still, they wouldn't gain much from people who had money in the system...

Sure, but for people who had 100BTC in their Gox account that was worth $100000 and is now worth $10000 that's much cheaper for Gox to return. If the balances in Gox accounts in BTC are higher than the balances in $, and/or most of Gox's own assets are in $, then it's in their interests for the BTC price to be lower.

You're trading coins with someone who has coins in MtGox and can't currently withdraw them.

Alex has 10 GoxBTC and trades them to Bob for 1 BTC. If MtGox recovers, they give Bob 10 BTC and Alex 0. Their obligation remains unchanged.

Poker Stars, Full Tilt Poker, and Absolute Poker/Ultimate Bet were the 3 affected by what is known as "black friday" in the poker community. Poker Stars paid back players relatively quickly so I'm not sure anyone sold any of their frozen assets on that site. For Absolute Poker, the exchange rate began at 50 cents on the dollar and plummeted quickly from there all the way down to 1 cent on the dollar. For Full Tilt, the exchange rate started higher but also eventually went as low as 1 cent on the dollar. 14 months after black friday, Poker Stars bought Full Tilt Poker and has since returned all funds owed to Full Tilt players. Ultimate Bet still has not paid any players back and likely never will.

Fun story: I was a professional online poker player when black friday happened. And I just happened to be in Guatemala, on my honeymoon. Prior to going on my honeymoon, I had experienced the worst downswing in my career and all we had left (about 20k) was now frozen in my Poker Stars account. When we returned home, we didn't have enough to make the next month's mortgage payment. What we did have was about 1k in cash from our wedding gifts. The night after we got back, I took that 1k to the local casino and played in the highest cash game I could buy into. It was high risk but I didn't have time to grind it out at lower stakes. Luckily I went on an amazing heater, ran the 1k up to 10k and that was enough to last us until Poker Stars unfroze my account.

What do you do now, if you don't mind my asking?

I was an online pro too. Taught myself to code since Black Friday.

I started coding professionally as well. I had some experience before Black Friday. I had been working on a few side projects (in Python) for a couple of years. I augmented that by attending the App Academy, which at the time was teaching Objective C.

"The night after we got back, I took that 1k to the local casino and played in the highest cash game I could buy into. It was high risk but I didn't have time to grind it out at lower stakes. Luckily I went on an amazing heater, ran the 1k up to 10k and that was enough to last us until Poker Stars unfroze my account."

That's a fantastic story my friend. It took some luck but also a lot of guts and self confidence to do that. Glad you managed it.

> That's a fantastic story my friend. It took some luck but also a lot of guts and self confidence to do that. Glad you managed it.

Story is fantastic, but I'm not glad he did it. I would like it much more if he understood that gambling is a zero sum game except for gambling companies, and stopped playing it after learning a lesson.

When the payoff for not hitting a certain monetary threshold is extremely negative and out of proportion to the amount of money in question (lose your wife/house/family/life) that can actually change that calculus, and taking a losing bet is your best move in the absence of other options.

I'm well aware that poker is a zero sum game, at least as far as the exchange of money is concerned. That being said, that doesn't mean that playing professionally provides no value to society. As with any game or sport, there's a certain entertainment value provided to those that play as well as those that watch. Even those players that never make it on tv help to provide the foundation for the ecosystem needed to provide the entertainment on a global level, in the same manner that minor league sporting athletes help support the majors.

All that being said, the entire reason I was devoting time and effort to my side projects was the belief that I could derive more meaning from life doing something other than poker. I was already trying to transition to something new. Black Friday just gave me a giant kick in the ass.

Also, poker is not gambling, at least not the way I play.

> Also, poker is not gambling, at least not the way I play.

What you did that night was definitely gambling (buying in with 100% of your bankroll). Glad it worked out for you though

I understand the spirit of what you're saying. Typically risking your entire bankroll is a bad move because you're risking more than you can afford to lose. I'd argue that, in this instance, that wasn't the case. If anything, I was on a "free roll" of sorts. Winning that night would significantly improve my situation (allow me to pay my bills) where losing would not significantly worsen my situation - I'd still be screwed. There just wasn't much difference between having 1k and having 0 and I didn't have enough time to build slowly.

Well, in that case I can only congratulate you for getting rid of the poker. I'm glad that you had a rational approach and kept kalm that allowed you way out.

And about poker being not gambling, well I don't agree. However smart you play, as much as you count on the statistics, in the end of the day, there's still luck involved. Even if it were only pure skill game, you can't always know skill level of your opponents :)

"However smart you play, as much as you count on the statistics, in the end of the day, there's still luck involved."

I guess absolutely everything we do in life is gambling, then :)

Not everything I do involves competing with someone else for both my own and their money.

At the end of each day, yes, luck is a big factor. At the end of a career, statistical probabilities remain supreme, and you'll find that the hand you're supposed to play 60% of the time will win about 60% of the time.

You're not wrong to be critical of the OP for gambling with his lunch money, but at the same time, it's wrong to conflate statistics with luck. If "the way he plays" is "by the numbers", then luck really isn't a factor. Sure, it may bear on any given hand, but in a long enough game, luck is all but eliminated as being relevant.

I agree entirely with everything other than the lunch money comment. Having 1k was no better to me than having 0 - in either case, I wouldn't have enough to pay my bills - so I wasn't really risking anything significant. Really, I only stood to benefit by taking the risk. If I had enough time I would have rebuilt my bankroll slowly but I simply didn't have enough time.

Just for the record, that's exactly what I assumed.

I didn't say 'lunch money' as to imply something necessary. Rather, it was intended as something trivial.

Either way, kudos on the hot streak.

It sounds like you have a very loose definition of what gambling is, going so far as to suggest that placing wagers on chess would be gambling because you might not be certain of your opponent's skill level, and thus cannot predict the outcome. Most definitions of gambling would reject that as an identifying characteristic is that the game be a game of chance. That being said, you might find it interesting to know that professional online poker players usually have a LOT of information about their opponents - usually more than enough to gauge their skill level. There are sites that mine every hand ever played online and then programs that compile that data into useful information that is then displayed beside each player's icon while you play. We know each player's win/lose percentage, how aggressive or passive they are, how likely they are to bluff, fold to a bluff, ect... In addition there are programs that help professionals find the best tables to play at - not only where the opponents are the weakest, but where they are the weakest against your particular style of play. Luck is minimized as much as possible. The true minimizer of luck, however, is volume. I've literally played million of hands of poker. Out of 7 years of play, I've had plenty of losing days, but only a handful of losing months, and never any losing years.

As for whether poker is a game of chance, I would argue that the level of skill involved trumps the level of chance and thus doesn't qualify. A good poker player is much like a casino. On any given bet they could lose but in the long term they never do because they always have an edge on their opponents.

But more importantly, there's luck involved in almost everything you do, and you can almost never predict with certainty the outcome of your actions. Should we seek to avoid all luck in life, or perhaps only when money is involved? That would mean we could no longer make investments in anything. Even putting your money in a savings account has, perhaps not luck, but at least a degree of risk involved. There are some things I would never risk in life but money isn't one of those things. Money is just a means to an end.

>Also, poker is not gambling, at least not the way I play.

Yes, it is. No matter how you play.

I question how "professional" you are if you don't even understand this basic concept of advantage gambling.

Why do people insist on telling us that gambling is a zero-sum game, in an attempt to sound wise and knowledgeable? Do you really believe the are people who think that a poker game magically creates new money for everyone?

There are people who act like they believe that.

> people insist on telling us that gambling is a zero-sum game

people who insist on saying 'zero-sum' is really just passive-aggressively saying that the person indulging on said activity should've spent their time on other non-zero sum activity.

Like SEO :)

I complain because I SUCK at poker and it makes me mad when smart asses take all my money :-)

It's still a hell of a lot of fun though.

I don't know...

There's something "romantic" about the whole thing. Sometimes we have to do things that are irrational to experience life. It's sort of like climbing Everest. It makes no sense and still quite dangerous but people do it to satisfy some irrational yearning.

The irrationality and the circumstances of his story are what makes it all so beautiful.

> 14 months after black friday, Poker Stars bought Full Tilt Poker and has since returned all funds owed to Full Tilt players.

Not totally correct. As part of the deal, Pokerstars paid out balances for all non-U.S. Full Tilt players. Players from the U.S. are still waiting for their money, which will be in the form of remittance through the DOJ. The latest news is that those payments will begin soon (nearly 3 years after "Black Friday").

Ah. I knew the date to file your claim with the DOJ had already passed so I assumed (incorrectly it seems) that the refunds had already been processed. Thanks for the correction!

Reminds me of the story of how FedEx almost went under [0].

0: http://www.huffingtonpost.com/2012/10/15/fred-smith-blackjac...

no offense really, but it's stupid to always bring up these things. it's not like people got their money back from lehman brothers demise.

banks take your money, and can then trade on a 1000:1 leverage, and when they lose all your money it's pretty much tough luck.

sure, mtgox sucks, but this is in no way something new.

It also reminds me of when governments freeze the bank accounts of certain people for various reasons.

Except for the last bit, also Bitstamp (a slightly more reputable site) had the same story. They fixed it in a few days, though.

Didn't other BitCoin excahnges suffer the same problem with "losing transactions"?

Other exchanges were DDoSed but never lost any coins or got hit with double spends.

http://www.wired.com/wiredenterprise/2014/02/bitcoin-ddos/

Is there any evidence in the blockchain of this being exploited? Can you see if there are occurences of MtGox paying out twice?

MtGox had plenty of problems before their php hot wallet was emptied like multiple civil suits, their US accounts being frozen with millions seized, and their Dwolla account was also seized full of funds.

And of course all that downtime for denial of service attacks which was their own fault. MagicalTux slammed BlackLotus, Prolexic and Cloudflare as garbage before somebody pointed out they left a bunch of open ports which is why they were still getting DDoS'd. That whole exchange is a joke from day 1.

long story short, they halted customers from withdrawing fund until they 'sort out their technical and security problems'. The longer the problem go unfixed, less likely customers would be able to withdraw at all, so price crashed 85%.

This all happened in the past few weeks.

Note that only the MtGox price crashed that hard, other exchanges offer much more bucks for the coins. But, since you can't withdraw in btc, it's no use buying them cheap at MtGox because you can't sell them elsewhere. At least for now, if we should believe them.

Reply on news.ycombinator.com