I wasn't planning on naming anyone or even mentioning Russia, however given how things are now it makes little difference~

Email requests about?

Looks like some Russian dudes are not fond of mtgox, and based on what has been posted on this forum so far, it is difficult to exclude btcex from having something to do with it.

The decision I'm taking now is a "temporary shutdown of mtgox" until the appropriate protections against this kind of DDoS are setup here. I wasn't expecting any major DDoS so early, however I guess anarchy got back at me (maybe I should say "us" here).
For info the DDoS has started yesterday, with something really soft. It has hardened today with over 6000 connections/second at some point (I nullrouted the ip since then).

Things should be back within less than 24 hours, right for the monday trading. If anyone who understands Russian can report/translate what's being told in the Russian forums, I guess this could be interesting too.

I'll update this post as things evolve.

UPDATE May 1st 12:00 JST: I've requested a new server from a specific provider which is used to handle DDoS attacks and provide guarantees. I confirmed on phone that servers are usually up within less than 24 hours, and negociated for it to go even faster.

UPDATE May 1st 14:00 JST: DDoS strenght have subsided a bit, system is back with current protections running. Had to increase conntrack buffer and a few things, but for now it holds together. Move to a system capable to mitigate such DDoS attacks is still planned.

UPDATE May 1st 17:00 JST: DDoS suddently stopped for no visible reason. Graphs are back to normal (even lower than that since we moved a lot of things to mitigate load). Will still get ready for more anyway.

No, don't worry, this is fine. Your balance will show up correctly once things are back to normal.

Well, as long as someone somewhere wants to buy bitcoins, the price will increase, would it be on mtgox or anywhere else. People who mine bitcoin want to sell at the best price, and if there is enough demand, would it be on mtgox or anywhere else, the price will increase anyway.

On the contrary, unavailability of mtgox may make bitcoins harder to obtain, and cause an extra increase of the bitcoin value...

Reporting here! What I got so far:

Getting ~6000 SYN/sec (standing at ~1.7MB/s) from various sources, mainly vietnam. Those are attempts to connect on port 443 to "poke" various urls, including / and /users/login.

There are different patterns, suggesting either there are various version of the "drones" out there trying to attack mtgox, or that different people are attacking.

The attacks seems specifically targetted at mtgox (use of the login url, for example), and contain a vast majority of russian bits (use of random russian referers, use of russian user agents, etc).


The strategy:

I'm trying to get some patterns out there I can block out from the server. Traffic load is still lower than server uplink, which should allow to block that without too much troubles. The first thing I'll be doing is to block the ips I've recorded so far, and write a little C program with libpcap to analyze the network traffic and block ips that seem obviously doing something bad. I'll also reduce the max open tcp connections per ip to limit the load caused by a single IP.

I like how this DDoS comes right in time to prove your point~

For info I got the ssl for the wiki (bitcoin.it) from startssl

I would recommend startssl for bitcoin.org too.

Nah, mtgox is not having problems. You may be unable to access mtgox however if you flooded a bit too much, if so, send your ip to info@mtgox.com so we can check if you were blocked.

Nah, getting DDoS'd.

The attack is mostly blocked now, however I cannot tell for sure for how long it'll continue. Just hope whoever's doing this will get bored.

Fixed notices for orders without enough funds.

As for the trade price, it'll be fixed in a few days when we switch to a new backend~

Hi,

Broadcasting of depth changes fixed, I think (mostly).

As for the extra fields, they are there mainly to avoid mistaking the messages for something else, however you can safely ignore them

We are working on a new version of MTGox, that will (for now) look exactly like the old one, with some minor differences such as:

• Supprort for Euro and Yen on top of USD
• Can be displayed in multiple languages

We will hire professional translators to get the various translations done, however each translation will take time, so let's see which language you want to see there first. If you want something not on the list, just let me know.

Sorry if I got you worried, I was just referring to the easter weekend and banks not moving, thru the inability for anyone not using LR or another trading method to add funds to mtgox for (up to) 4 days.

So here are some replies for MtGox. I guess we need a more elaborate FAQ on the site (or at least have someone put those on the MtGox wiki page on en.bitcoin.it).

• Is there a minimum size for bid/ask offers to the market?  If there is, is the minimum size determined by the number of BTC or the other currency involved in the offer?

Yes, minimum size is currently 1 BTC (it was 10BTC a while ago, but with the increased value it has been recently put at 1 BTC)

• Is there a maximum size for bid/ask offers, and if so what currencies form the basis for the limit?

None other than the amount you have deposited.

• Is there a maximum outstanding position limit? For example, regardless of whether there are limits on the size of an individual offers, is there a maximum number of bitcoins that can be put up for sale (or for bid) by a single trader at one time?

None.

• Are there daily per trader volume limits?  For example, can a single trader sell 1 million BTC in one trading day, or are they limited to some maximum volume per day?  Is this volume a separate limit on buying/selling or is it a limit on the sum total of the trading activity?

None.

• Is there a minimum price tick?  By this I mean, what is the finest precision that is allowed for the rate of bitcoins to other currency; i.e. if there are standing orders at $1/BTC can a new offer be placed at $1.000000001/BTC?

There is a rounding at 5 decimals, however it seems to not be present in some parts. On the new system (in one~two weeks) it will be properly enforced.

• Are all currently outstanding bid/ask offers shown?  If some are not made public, what criteria is used to determine which offers are public and which are hidden?  For example, do the publicly available data feeds include very very low/high offers, or are only the first so many in each direction shown?

The depth of market contains trades around the price of the last trade. It is about 1/3rd asks, 2/3rd bids (not exactly, I'll let you compute the exact numbers to see what you come up with). Other orders are made private on request of the requestor (dark orders).

• If some offers are not shown on the public boards, who (if anybody) has access to the full list of offers?

Only the staff intern to MTGox, who is forbidden to provide any information to anyone outside.

• Are there any fees for entering bid/ask offers, or are there trading fees assessed on successful trades?

Trading fees are only collected on successful trades.

• Are there fees on deposits/withdrawal of bitcoins or other currencies?

It depends on the deposit/withdrawal method. There is no fee for bitcoins, and usually we try to make deposits free.

• Is there a daily limit on deposit/withdrawal of funds to trading accounts?

No limit on deposits, however we limit withdrawal to $1000/day (or equivalent). You can request more, and we might require extra informations to make sure you are indeed you (and not some hacker who gained access to your account) and/or fill customs declarations if funds are going overseas.

• How long do deposits/withdrawals take before they post to the account?

Bitcoins require 6 confirmations. Other type of deposits/withdrawals depend on the method (LR is usually instant, except when their API has problems. Euro deposits are handled when banks are not on holidays, twice a day. US ACH/wire and JPY deposits are handled during business hours).

• How are differences in matching bid ask offer prices resolved?  For example if Alice puts up 50 bitcoins for sale at $1.00/BTC and Bob puts in a buy offer of $1.10/BTC, at what price will the deal close?  Does the deal always get closed on the lower, or the higher amount, halfway in between, at the price of the first person to post their offer?

The deal closes on the earlier order. If Bob's offer is put when Alice's offer is already posted, it'll be resolved at Alice's price.

• Is trading by bots allowed on the market?

There is an API that can be used by bots. There is currently no specific rules for bots (except "avoid killing the server"), however depending on the situation additionnal rules may be added.

• Whether you allow bot trading or not, is there a mechanism by which machine readable market data is made available and is there a way for bid/ask offers to be posted or canceled other than through the standard web interface?

Yes, you may want to consult the API pages and look at how the mtgox.com webpage generate their graphs (data is pulled out in json format).

• Is historical data on the closing trades available, and to whom is it available?  Is the full historical data of all bid/ask offers made available even if the offers did not fill, is this data even stored at all?

It is not currently available from mtgox, however some users are known to have collected those for some time and made them available. Bid/asks data is not kept if the owner cancelled it (if not, the bid/ask will continue existing until someone fills it).

• Are there minimum or maximum times that bid/ask offers are valid for?  For example, can an offer be made and then canceled immediately, or must it remain on the market for at least some length of time?  Is there a maximum lifetime for offers or will old offers be removed from the market by the operator?

There is no minimum (ie. you can cancel a bid/ask immediatly). There is no maximum either at this time (we might have to set one if this makes the database too big).

• What are the opening/closing hours of trading on the market (and what timezone is used for this)?

The market is open 24/24, however we stop the day at 0:00 GMT for statistical purposes (ie the - currently broken - all time graph)[/list]

I would like to avoid "guessing" the user input, especially when it's about sending funds there.

In the meantime I'll just drop any non-alphanumeric char, but I would expect users who want to withdraw funds to double check their input (well, here the bitcoin client is adding invisible chars, not much you can do about it I guess...)

I'd say for the last 9 hours, which matches exactly night here in Japan.

http://www.magicaltux.net/date.php

I'll add a trim() at the input time to see if it helps. Please let me know if this solves the use of clipboard-copied addresses.

Thanks

Hi,

I saw the errors here and fixed this bug (the automatic refund system didn't handle the new wallet system I coded, now fixed). I'll re-add your missing funds.


Mark

Hi,

I have located the source of the null and fixed it


Mark