Unfortunately it is not that easy to secure a hot wallet.

The game plan should be:

1. Minimise amount of bitcoins to be held in hot wallet.
2. Have complete control over physical and management access to hardware and OS. It sucks but this requires extending trust to a few trusted people. This is the weakest link.
3. Definitely do not have ANY 3rd parties anywhere in the loop with any kind of access to the hot wallet server in either management or physical access capacity.
4. Obviously, having secure web interfacing code, with all user supplied data sanitised and hardened server helps a lot. But this is relatively trivial matter.
5. Using multisig functionality could help a lot. For example, say, a "offline" second sig server, which also has some monitoring code and freeze withdrawals based on some set of rules, until manual intervention resolves the flagged issues."

- Hosting your own email could help too in some cases.
- Securing cold wallets is another topic.

This basically means, decent colo setup with a few nuts and bolts on top of it. Hello! Big news! It was pretty much brought to Bitconica's attention in August/September 2011. I hope others will be able to learn from this.

This also means no hosting any wallets with nontrivial amounts of bitcoins on any:
- VPS's (generally, the bigger the company operating those VPS's, the more random dudes have root access, the more risk you take)
- dedicated servers are effectively the same VPS with all kinds of management access hosters have, however encrypted partitions could help a lil bit in this scenario, i.e. attacker would need to access it without rebooting.

(The above assumes VPS's and dedi's hosted by 3rd parties)

In other words, if you do not know who EXACTLY has or can have root access, say bye bye to your hot wallet.

Tough titty, "google search based sysadmins" and "flying in the clouds" generation! You simply cannot google up 10-20 years of professional experience and once you start relying blindly on all those cloud services you are screwed again.

Bitcoinica's "Zero sysadmin" policy in action. Enjoy!

LOL, my sense of humour is failing me today.

Who ha! If you read some dogmatic 30 year old BS addressed to noobs a-la "do not use root accounts" 1000 times, this does not mean that using a root account for pings (or whatever) on a machine(physical or virtual and of unknown to you configuration, location and purpose) is necessarily insecure. Security, my friend, is not a state it is a process.

root@boris:~>ping bitcoinica.com
PING bitcoinica.com (50.56.4.62): 56 data bytes
64 bytes from 50.56.4.62: icmp_seq=0 ttl=48 time=102.786 ms
64 bytes from 50.56.4.62: icmp_seq=1 ttl=48 time=101.933 ms
64 bytes from 50.56.4.62: icmp_seq=2 ttl=48 time=102.374 ms
^C

Ever tried to google "asymptotically approaching" ?

Or maybe this is NSA guys, who have access to all those emails, are messing with you.

Relax. It is geek currency, hackers are geeks. So they get their share one way or another. In long run it is utterly immaterial for Bitcoin how initial distribution/emission of money is done and who are "early adopters". Actually, the quicker "early adopter" lion share of Bitcoin is diluted, the better.

What is it with all the anonymous/pseudonymous guys on this forum repeatedly attacking every NAMED (and easily verified) individual and company and labelling every project run by those most legitimate operators as a scam?

Insane! Grow a brain or something.

Sorry to hear about this again.

It seems Bitcoinica got swindled for another 100k$, this time they got "smarter",  instead of cheapest possible VPS, they went for most expensive possible Dedicated (or is it still vps's?).

FFS! it does not change anything! Insiders still have physicall access to their computers, or management access for instance via KVMs, they still can arrange to get themselves untracked access, leak passwords etc, they still can take your wallets.

Linode lesson was not "go to dedi", it was to go to a well locked colo and control physical and management access to servers. Owning the DC would be even better. Banks do not host their critical infrastructure on cheapest VPS's nor do they use the most expencive dedis either.  Take a hint.

Better yet hire someone who can do information security professionally and this time listen to what they tell you.

IANAL, but it seems that anyone who lost any money on GLBSE has a valid claim against someone, probably GLBSE (they potentially could be considered as UK agents of all the offshore issuers of "securities"). I take it if you are located in UK and lost anything on GLBSE you can ask FSA to make you whole (at expense of GLBSE, most likely). I would guess it is pretty much the same in most jurisdictions.

here is some fun reading:

https://www.google.co.uk/search?q=financial+promotion+act
http://www.legislation.gov.uk/uksi/2001/1335/contents/made
http://www.salans.com/en-GB/Locations/~/media/Assets/Salans/Publications/2006/20060407-Making-financial-promotions-in-the-UK.ashx (just random comment on the relevant legislation, no affiliation)

P.S. Argument that Bitcoin is not money or that it has no value and therefore you can promote unlawfully or illegally assets denominated in BTC is just silly.


P.P.S.


P.P.P.S.

Should qualify as "abandoned property" perhaps?
Or like a planted gun... or self planted gun maybe?

What is it with some people? Control freaks all around us just don't give up. You have a "simple" and elegant system that is Bitcoin, why would anyone want to add all the kinds of stupid rules to it? What is it with this endless desire to turn a simple and elegant system into a bloated monster?

Feel free to fork Bitcoin and add any kind of BS rules to it, then let the fittest survive. It is good that such proposals have no chance to be implemented in Bitcoin itself.

On the second thought, float this idea to Solid Coin N.0 crowd, they may just go for it.


BTW. Today is "Star Wars Day", May the 4th be with you.

Selling Bitcoin via SMS is a losing proposition. Carriers/processors will charge you exorbitant fees while not carrying any risk themselves and offloading it all onto you. Think about it as selling bitcoins for paypal and/or credit cards by proxy and paying 10 times larger fees.

SMS are only good for selling useless tat, like Facebook credits, virtual sheep and ringtones. Those supposedly irreversible Canadian mintchips sound as a much better proposition for medium of conversion of fiat into bitcoins. It is until the mint discontinues it due to all the fraudsters rushing to convert all the stolen credit card numbers into bitcoins via mintchips.

Yep just like that. But note this is non-commercial, i.e. make and ad for Bitcoin itself or something that is in Bitcoin community interests. For example, "do not mine in pools that have more than 50% of all mining power" as opposed to "come mine in my pool".

I know.

You are going to have to get yourself some low cost SSD drives. This is a quick and easy solution. The alternative is RMA's, messing with BIOS updates etc...

I would like to thank everyone who responded in this thread and elsewhere, be it compliments, suggestions, criticism (constructive or otherwise).

At the moment I am having a series of meetings with investors, accountants, lawyers and other "professionals" trying to figure out subtle details of "the plan". As soon as there is some better clarity on our exact plans it will be announced. Until then I will be mostly quiet.

Thank You all, again. Your feedback both positive and negative is very much appreciated.

This matter of existence of technical solution and specific details will be discussed privately and covered by NDA's where required.

How auditors would account for BTC? I suppose exactly the same as they would account for potatoes. Imagine a company which pays dividend in potatoes that it grows. These are open questions how BTC's will be accounted for, whether there will be dividends payable in Bitcoins or not, and it is for accountants to figure out.


"Accepting fiat and extracting fiat" for me sounds as neutral. I am discussing with advisers our options of having both fiat and Bitcoin dividends. This is not a trivial matter considering dividend taxation and VAT. It was also suggested that it would be bad idea to commit to a fixed dividend schedule as this would put the company and shareholders at disadvantage and it would be difficult to react to changing market conditions. We do not know yet how exactly the company will be structured, there are no investment prospectus prepared yet. It is complicated. We are working on it.


REIT is a pipe dream for now. Not going to happen before the company is listed on main market of LSE, and this in turn would not make any sense unless the company is wildly successful and Bitcoin's market cap is measured in billions. Even if it would be accepted that racks of ASIC mining gear is a new sort of "real estate".

However, it is rather rare than companies that are less than 3 years old are listed on public exchanges. Considering how quickly Bitcoin is developing, the future is uncertain. Should it happen that in 3 years time Bitcoin will be in mass adoption stage already, the best time to start thinking about being the first Bitcoin company that goes public is now.


I do not think that this is a fund. This is a company that operates Bitcoin mining hardware on large scale. There is no requirement for minimum turnover for a PLC in UK, to the best of my knowledge. You perhaps mean a listed PLC when you refer to turnover requirements. If so, then we talk about different things.


No, I do not mix private and public, plc and ltd, (they are both limited) , I founded quite a few of ltd's and do know the difference. However, plv vs ltd matter is being discussed behind the closed doors and there are good arguments for both routes.

EDIT:

Catfish, I have one question for you.

Do you think that Bitcoin mining will be confined to the "garage" stage forever?

We are talking with legal bods about this. This is our goal to allow "small time investors" in. At this stage it is not possible. We are in talks with a number of "funds" some of which are considering using GLBSE. We will do what we can to allow small investors to participate, but it is neither simple nor quick process.