Fun Update: Ryan's market maker bot is spitting out prices and backtesting nicely. We're working to hook it up tomorrow / Monday /Tuesday .

Hi,

Please let bitoptionSupport out of jail, I need his help!

Thanks!

Hi Everyone,

I am Okay, I got many nice requests for a personal update in the last day.

Here's my story -- I pulled out all the stops to launch Bitoption and carved as much family and work time out as I possibly could about a month ago. It was up and running, and then Mt. Gox crash happened, necessitating a similar two week death march, roughly, to fix against the new API, plus fix some open issues you all had discovered.

I got overwhelmed (and needed to see my kids and dayjob again for a bit).

During that period, there were four withdrawal requests that took longer than two days to process; two are still outstanding, and should get out today. I'm sorry about that, I'm aiming for 12 hour response time, plus automating everything that can be so there's zero wait time.

As penance, I've hired someone to work on this full-time -- Ryan, codename Bitoption Support on the forums (he's currently waiting to get out of the newbie jail here in the forums).

What Ryan is doing right now is writing a market-making bot; we will be posting it to github and open sourcing it pretty soon now. It's pumping out put/call prices, but it needs to be tested, and it will need a few new API functions written. I'm hopeful that Friday / Saturday it will go out, but one of us will update here in any event.

What I'm doing right now is encapsulating the Mt. Gox exchange API into a testable framework, one that we'll be able to use for other exchanges. We used to be able to do all our bookkeeping with Mt. Gox API calls, this is no longer the case, and that's part of what's taking the extra time; we have to implement a bunch of little tricks to make sure we don't have nasty race conditions in the exchanging portion.

We also needed to implement our own deposit mechanics, since Mt. Gox no longer provides the same deposit support. That's mostly done.

I promised European only as of 6-30, but I've been hesitant to do so when I'm unable to fully test new changes, a lot is in flux all at once, again a sort of sticking point that I'm working to rehab right now with the codebase.

Essentially, I beg your pardon, and I'm working on improvements as fast as I can, plus I'm putting my money where my mouth is to make sure this gets off the ground. Let me know if you have thoughts or suggestions.

Hi Enky,

Actually you asked for a refund on an option you purchased before we swapped over. I offered to buy it from you at the greater of the price you paid or the intrinsic value.

That's a little different.

My quick update is that we're rewriting the Exchange API to deal with numerous changes made at Mt. Gox; Gox had gone dark on us for a while, but I think we're close to having feature parity from before the crash, based on some API additions Mark made last night.

Sorry for being out of touch; my life got crazy. As penance, I've hired a support person and programmer, Bitoption Support on the forums. He'll be in and commenting and helping out M-F at the least.

I wanted to make a few notes / updates here for people as it's been a bit of an unsettling week.

We filed the exchange's Mt. Gox claim today; we should have no problem getting our account reopened; the password was plenty secure, and the account was used frequently and created after the salted passwords were added.

I would like to make something clear; as of right now, I have enough BTC (stored outside of Mt. Gox) to cover all losses the exchange would incur if Mt. Gox died and delivered 0 to everyone. It would take me pretty close to zero, but I could do it.

It's my hope that I won't have to do that, but I appreciate the trust you all have put in me and the exchange, and I definitely sleep well at night knowing that we can cover our obligations.

Long term, I am considering how to best store the BTC and USD for the exchange. As it is, I had considered it a safer and more secure solution to use Mt. Gox directly than to deal with Dwolla, wallet backups and etc. This might have been a bad decision, or it might be that Gox is still better placed to deal with this right now, while I work on features. I think we'll know more in the next week or so.

As might be expected, trading has slowed on bitoption this week; it's been helpful for me as we were moving at a breakneck pace for a bit there.

Upcoming Changes
I am 90% settled (meaning: advocate hard, now, if you disagree) on the following structural changes to the market:

As of June 30 or so, all new options written will be European style. We will keep the weekly options close dates. European and American style options will coexist in the system out through roughly Dec-30, as some have been written / bought out in that timeframe; you'll just see the 'exercise' link next to the ones you can exercise.

We will halt trading 24 hours before a period close, and allow exercising of options during that 24 hour period UNTIL we implement auto-exercise, at which point we will probably turn off exercising altogether.

We will soon allow a very specific netting: bought and sold contracts of the same type and positive strike delta for the same date. This is easy to implement and low risk to the exchange, plus it will free up some funds for you all.

This netting system means you'll be able to buy and sell contracts along the way, creating the sort of value that most option traders are looking for. It also means you can dig out your Black-Scholes calculators, something I think will be a big help for proper pricing.

It is my goal to also implement a more effective margin system, along the lines Damien and I have been discussing. When it rolls out, we will likely first lock any account that goes 'negative' based on some risk scoring, and it will need to be manually reinstated; this will give us the ability to make sure we're getting things right, something everybody wants, no doubt.

Because of this locking, I will probably make margining 'opt-in' meaning you can trade on hard assets only, and avoid the heuristic locking.

Finally, I built the system to be pretty careful about money (for instance, the first thing I wrote was the exchange's balance sheet functionality), but I am convinced that a full, replayable log is the right thing to have given what happened with Mt. Gox. I'm still getting my head around the right way to do this; suggestions are welcome. My current plan would be to dump out a log of each request to something like a co-located MongoDB box. This of course has its security implications, and I'm happy to have more eyes on this than less.

TOTALLY. Let me think about how to implement.

This is a very polite way to say "why the fuck is everything broken right now??" by the way.

Billy Joe is settled; just had to logout and back in.

FreeMoney seems to be settled from my side; just waiting to hear back from him/her.

Thanks Nefario,

Good luck on the audit; I appreciate the approach.

Damien,

In answer to your question about writing the 6th call; we would allow you to do that; you'd then have: 0 BTC and $115. The question is then "what next?" What I'm proposing is that any action that would take you negative would force the suggested flowchart to execute.

So, In our case, you want to go buy a $20 Put.

Now you have -1 BTC, since you don't have the money to pay for that call. At that point, we walk through the process.  In the situation I'm describing, you could get out of for less than $100 by just buying 1 BTC, and the flowchart would get there first automatically since you don't own any in the money calls (presumably).

Then you'd have (if BTC were at $10), 0 BTC net, $85 cash and some puts and calls.

It is head-spinning on the numbers. I agree a flow chart would make a lot of sense. We have a sort of state machine going here in describing it.

I think I want to build up from the bottom; the first thing that needs to be done is an auto-exercise, then a 'multi-stage' execute, that is, execute, exchange, execute again.

Then I can add closing out positions and the 'net requirements' calculation.

Once those are done, we can open the leverage up a little, say to asks on a certain strike/date.

We have a little time since Gox is down, but I'm eager to get the next level going for you guys.

FreeMoney, email me at admin@bitoption.com, and I'll make sure we're properly sorted on your account. You shouldn't be seeing this behavior. Like always, I'll post any updates and resolution here. I'm all about transparency!

Inre: Frank Dodd, we're not domiciled in the USA, but see below.

Inre: Dwolla -- The answer is that I'm still figuring out the entire business plan. Doing this business fully registered almost anywhere in the world means you need to comply with US regs when you're dealing with US citizens on US soil. It was easy to piggy back onto Mt. Gox, and I knew generally that we'd be covered by their setup, so I did it. Right now, I regret that!

My hypothesis is that there is going to be strong demand for a fully registered, functioning exchange which can work in and outside the US in high dollar volumes. Bitoption is my first foray in that direction; there are whole bunch of moving pieces there, though, including US regulatory regime.

While the accountant may be an accountant; he is definitely not a securities lawyer.

Here is a very, very brief summary of the laws in this area if you're in the US:

You made a public offer to sell shares in a corporation and took something very like legal tender in exchange.

You or the company you represent are officially a publicly traded corporation.

In the US, to get an exemption from this, you would typically do one of two things:

A) Issue a convertible note (e.g. debt, that can be converted to stock at a certain rate). This is fairly inexpensive to lawyer up properly.

B) Apply for an exemption under Reg. D; Reg. D makes a number of stipulations about how you conduct the business of fundraising and buying / selling shares, if you fit them all, you can be exempted.

You certainly would not qualify under Reg. D, since, for instance, there is  public market for your shares. Additionally, you haven't verified that all your investors are sophisticated investors per the SEC's perspective.

Functionally, in this case, (I'm not a lawyer), I believe you would likely need to pay everyone back whatever they'd lost investing if things went south; if you didn't, you would be looking at the wrong end of US securities law.

My own research here indicates that the best thing to do is probably incorporate somewhere that has flexible laws regarding public stock offerings; that company could then form a US subsidiary and do business in the states as a sub of a foreign (public) corporation.

Note that all this is going to take $10k at least. Again, I'm not a lawyer.

If you think you're unlikely to come under SEC investigation, (and really, generally, you should do this as a US citizen), do make sure you report and pay your income / taxes. The IRS has promised, vigorously, over the years that they DO NOT CARE where the money came from so long as you report and pay taxes on it. Read about Al Capone if you're curious what the US takes most seriously as far as crimes.

You can and should always ask about security! No worries. Keep the questions coming.

Damien,

As far as available BTC/USD, we will roll back in accordance with Gox, as we use their history. This is likely to be a big mess. I'm going to turn off Mt. Gox facilities on bitoption until things settle down; you will still be able to trade, but you won't be able to send / withdraw until I'm sure we're settled properly.

Personally I had a bunch of buys down at $7 or $8 on Gox; looks like I wasn't aggressive enough!

Hunter, we're back up now; Our register function wasn't smart enough to get past the anti-CSRF stuff we put in.

Sorry about that! Try again.

I have some low buy offers in; I'm curious how they'll deal with those. Sounds like we will have a 'go back in time' moment.

Here's how password security on bitoption works:

1) We take your password via an SSL-only POST request.  (This used to be a GET request before we turned on the anti-CSRF functionality. POST is marginally more secure; some logs will log the entire URL, so there was a chance of leakage that way, but it would only be at the endpoints of the request.) As it is, this is now encrypted end to end.

2) We have a sitewide secret salt that is used in all hashes

3) We have a per-account 'nonce' that is used to salt the password.

4) We store only the sha-256 hash of the password,secret,and nonce.

As far as I know, the combination of 3 and 4 is industry best practices for one factor authentication; it means that a rainbow attack is computationally difficult, in that each rainbow table is only effective for one account.

Happy to take further suggestions.

Stephen, we had two places that the register form might call the backend; in one of them, we weren't using the new anti-CSRF system. It's fixed now, sorry!

FreeMoney, I just tried posting bids on puts and calls, it works for me. Did you double check that subtracted your obligations from your total USD? I will put in a better reporting interface shortly.

I'm on a boat with limited internet right now, trying to get these assessed. Likely it's fallout from our new session system, installed under urgent time pressure. Sorry!

Second update, we got DDOS'ed today, but seem to have weathered it ok. Services are at normal.

Exercising puts is verified working.

Thanks for bearing with us!!

We're back up; our provider seems to have things under control; no notification though. I'm probably on the hunt for better hosting. We'll see.

Makes it hard to trade, all this security / DDOS-ing type stuff! Bad for business..

Update: there's a DDOS attack against our provider and node. Could be due to us, could be something else. More as I get it.