Bitcoin Forum
December 03, 2016, 07:57:29 PM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: « 1 2 [3] 4 »  All
  Print  
Author Topic: [Full Disclosure] Live mtgox.com trade matching bug.  (Read 14519 times)
Tasty Champa
Member
**
Offline Offline

Activity: 84


View Profile
June 28, 2011, 08:42:19 AM
 #41


Your reasoning is in conflict with your ability to have a fulfilling conversation.
Lashing out at anyone who does not share your viewpoints, is the key motivator for war.
You are authoritarian.

Another non sequitur.

In reference to your own or do you have comprehension issues?
1480795049
Hero Member
*
Offline Offline

Posts: 1480795049

View Profile Personal Message (Offline)

Ignore
1480795049
Reply with quote  #2

1480795049
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1480795049
Hero Member
*
Offline Offline

Posts: 1480795049

View Profile Personal Message (Offline)

Ignore
1480795049
Reply with quote  #2

1480795049
Report to moderator
1480795049
Hero Member
*
Offline Offline

Posts: 1480795049

View Profile Personal Message (Offline)

Ignore
1480795049
Reply with quote  #2

1480795049
Report to moderator
1480795049
Hero Member
*
Offline Offline

Posts: 1480795049

View Profile Personal Message (Offline)

Ignore
1480795049
Reply with quote  #2

1480795049
Report to moderator
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 28, 2011, 09:15:57 AM
 #42

Please leave possible exploits away from the public.
In other words, keep it private.
Work with them behind closed doors.
Definitely no.

Doesn't mean you shouldn't give the code owner a couple of hours to fix it and advertise the deadline.

CampBX will be open soon. It looks to be the most thoroughly tested of the exchanges.
You can only be sure if the source is open Smiley






Tasty Champa
Member
**
Offline Offline

Activity: 84


View Profile
June 28, 2011, 10:17:43 AM
 #43

Where are the full disclosure and exploits for this forum?

I'm assuming everyone is behind i2p, swarm and/or the onion router, reading this through lynx/links correct?

shouldn't everyone know what you trannys are up to?
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 28, 2011, 10:19:53 AM
 #44

I'm assuming everyone is behind i2p, swarm and/or the onion router, reading this through lynx/links correct?
There is discrepancy between your imagination and reality.

bitbot
Member
**
Offline Offline

Activity: 70



View Profile
June 28, 2011, 11:24:28 AM
 #45

MagicalTux is really taking all problems seriously, and has been working almost 24 hours per day last week to resolve issues while being bombarded with crap from all sides.

I can honestly say that man has not been working anywhere near 24 hours per week but the last part is true.

Anonymous BITCOIN Exchange: https://www.TRADEHILL.COM
jrmithdobbs
Jr. Member
*
Offline Offline

Activity: 59


View Profile
June 28, 2011, 01:06:04 PM
 #46

He programs large blocks of code and does insufficient testing leaving the community of users to suffer the consequences. MtGox nolonger deserves the privilege of keeping bugs and security flaws private.
He also has (by his own admission) written his own in house mysql DAO code instead of using a public, well vetted one. He say it doesn't use bind values. He doesn't understand why this is bad.:

(This is edited to leave irrelevant pieces out, please feel free to verify with anyone else logging #mtgox.)
Quote
[17:57:31] <MagicalTux> dehuman: we had been working on security, I can guarantee there is no SQLi right now
[17:57:45] <go1dfish> MagicalTux: how can you say so with confidence?
[17:57:51] <go1dfish> are you using parameterized queries?
[17:58:01] <go1dfish> everywhere
[17:58:07] <MagicalTux> go1dfish: because I know each and every line of the code, and we mostly use either DAO
[17:59:21] <MagicalTux> just make good code and things are fine
[17:59:49] <dehuman>  @MagicalTu : just make good code and things are fine
[17:59:58] <dehuman> thats kinda a slap in the face dont you think?
[18:00:08] <MagicalTux> dehuman: healthy code is important for a healthy security & business
[18:00:46] <MagicalTux> we've been busy for 2 months rewriting Mt.Gox
[18:00:49] <dehuman> you exposed 60,000 client's information
[18:01:02] <dehuman> i wouldn't talk about healthy code, healthy security, healthy business
[18:01:06] <dehuman> not yet
[18:01:08] <MagicalTux> dehuman: new code is healthy
[18:01:10] <dehuman> quite a bit premature for that
[18:01:30] <go1dfish> MagicalTux: looks like DAO doesn't protect against SQLi by default
[18:01:36] <go1dfish> your using bound parameters everywhere?
[18:02:23] <MagicalTux> go1dfish: DAO makes SQLi impossible, since queries are not built by the dev
[18:02:36] <MagicalTux> go1dfish: now it just depends how you do that
[18:03:18] <go1dfish> good show, you shouldn't be writing sql by hand for mt gox
[18:03:42] <MagicalTux> go1dfish: \DB::DAO('Table')->insert(array('Field' => $value));
[18:04:36] <go1dfish> MagicalTux: cool, yeah that should be pretty resiliant against injection assuming the underling DAO implementation is sane
[18:05:02] <MagicalTux> go1dfish: the DAO implementation was written by us, and makes sure everything is escaped correctly, including table & field names
[18:05:15] <Ox41> you wrote your own DAO?
[18:05:20] <Ox41> why the hell would you want to do that?
[18:05:25] <dehuman> so does this mean previously mtgox didn't use any type of DAO pattern?
[18:05:27] <Ox41> I mean, im no EXPERT...
[18:05:34] <go1dfish> Ox41: I'm hoping thats a misunderstanding
[18:05:39] <dehuman> 'dont reinvent the wheel'
[18:05:41] <Ox41> go1dfish: I doubt it is
[18:05:47] <MagicalTux> Ox41: it's part of our framework

Just sayin'.

Did you fail to read the part about responsible disclosure?
http://en.wikipedia.org/wiki/Responsible_disclosure
They are two separate but related concepts. I subscribe to the former and deem the latter unnecessary in cases such as these where the company in question has a track record like mtgox.

1B8TSDzXdyTRX5eF77gWQoXujBaDtKFE6H
psyborgue
Newbie
*
Offline Offline

Activity: 28


View Profile
June 28, 2011, 04:08:27 PM
 #47

Well.  I hope OP is happy he got what he wanted:

http://www.thinq.co.uk/2011/6/28/mt-gox-flaw-opens-door-free-bitcoins/

They're calling it a way to get "free bitcoins".  Good job OP.  I don't suppose you'd "fully disclose" that the "exploit" as you call it, is not, in fact, a way to get "free bitcoins".  I don't suppose you'd bother to correct the misinformation you've fostered.

Donate to Thank Me:
1DTwRpHQPsmBfxG4EWEq3NYH8e9rAq5io7
ius
Jr. Member
*
Offline Offline

Activity: 56


View Profile
June 28, 2011, 04:20:13 PM
 #48

They're calling it a way to get "free bitcoins".  Good job OP.  I don't suppose you'd "fully disclose" that the "exploit" as you call it, is not, in fact, a way to get "free bitcoins".  I don't suppose you'd bother to correct the misinformation you've fostered.

You can't blame him for 'journalists' writing about matter they have little to no knowledge about.

PGP: 0xCC06E446 Bitcoin: 19kdfgW1KXQgV7SCLEPAojtHxN9xotGkGH
Dirt Rider
Member
**
Offline Offline

Activity: 111


View Profile
June 28, 2011, 04:22:34 PM
 #49

CampBX will be open soon. It looks to be the most thoroughly tested of the exchanges.

I was there the other day - allows logins via http!

p.s.  This OP was very much a dick move.  Either a fool or someone intent on causing as much trouble for the Bitcoin community would create such a post without at least giving the site operator a little time to address the issue.
psyborgue
Newbie
*
Offline Offline

Activity: 28


View Profile
June 28, 2011, 04:24:16 PM
 #50

They're calling it a way to get "free bitcoins".  Good job OP.  I don't suppose you'd "fully disclose" that the "exploit" as you call it, is not, in fact, a way to get "free bitcoins".  I don't suppose you'd bother to correct the misinformation you've fostered.

You can't blame him for 'journalists' writing about matter they have little to no knowledge about.

Oh I very much CAN blame him, as he started the false implication.  The journalist was merely repeating (accurately) what he read in the OP.

Donate to Thank Me:
1DTwRpHQPsmBfxG4EWEq3NYH8e9rAq5io7
julz
Legendary
*
Offline Offline

Activity: 1092



View Profile
June 28, 2011, 04:27:27 PM
 #51

I don't even understand why it's a bug. (unless it affects the current price calculations)

I've put in buy orders without the USD to cover it - based on the assumption that the buy would only occur if my sell orders had executed to provide the funds.
It's a feature!

@electricwings   BM-GtyD5exuDJ2kvEbr41XchkC8x9hPxdFd
Shinobi
Full Member
***
Offline Offline

Activity: 196


View Profile
June 28, 2011, 04:53:12 PM
 #52

How are you blaming the OP? The OP is trying to make trading safer and more accurate. MT has shown that he doesn't do anything unless his hand is forced.

_______
Thinking of using a cheap, yet reliable VPN? Go with PrivateInternetAccess. Not a referral link. Just a satisfied customer!
jrmithdobbs
Jr. Member
*
Offline Offline

Activity: 59


View Profile
June 28, 2011, 04:58:35 PM
 #53

They're calling it a way to get "free bitcoins".  Good job OP.  I don't suppose you'd "fully disclose" that the "exploit" as you call it, is not, in fact, a way to get "free bitcoins".  I don't suppose you'd bother to correct the misinformation you've fostered.

Read the comments on that article. I posted a gpg signed comment (that got mangled by their crappy site) calling the author out for irresponsible journalism. Before you even posted this. He made no attempt to contact me and only a cursory attempt to contact tux so that he could add a derisive comment in his "article."

Crappy journalist is crappy. Surprise, surprise.

1B8TSDzXdyTRX5eF77gWQoXujBaDtKFE6H
Dirt Rider
Member
**
Offline Offline

Activity: 111


View Profile
June 28, 2011, 05:19:52 PM
 #54

If the original poster can't adjust the original post such that it stops implying there is some exploit, an admin should remove the post all together. 

Are we really sure this isn't a feature?
andes
Jr. Member
*
Offline Offline

Activity: 42


View Profile
June 28, 2011, 05:41:58 PM
 #55

Although I dont share the timing of the OP disclosure, I would rather encourage total (and sometimes brutal) honesty in our comunity, rather than half truths and compromises.

Our world is mess right now because of too much double standards, compromises, and falsehood (environmentaly, socially, politically), not because of too much honesty.

Once you start to compromise on truth and openness, you will never know exactly where to draw the line between what is a right compromise, and what is a wrong one. The OP may not know how to compromise on honesty, but I would rather prefer to have people like him in our comunity, than not having them. They are the fresh air on opennes our society needs.

bitsnbytes
Newbie
*
Offline Offline

Activity: 7



View Profile
June 28, 2011, 05:58:17 PM
 #56

I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.

It will not execute, and I told you it'll be fixed in a couple of hours. Thanks for disclosing this before.

Yes, it is all our fault:

Quote
Today 16:51 GMT on #mtgox
<molecular> anyone know what that weird spike around 18:00 is? looks erroneous to me, no? it went up to 17.52 apparently, but my order at 17.25 did not get filled.
<MagicalTux> molecular: it's the closing of a bug, some orders were blocked and are now freed

It is because we let such people have our money!

you like my comment? send some bitcoin (fraction)!

1FpRFcoE3ww3ErKvQDH2tEcMNk4ivFEQTL
Dirt Rider
Member
**
Offline Offline

Activity: 111


View Profile
June 28, 2011, 06:02:16 PM
 #57

I don't think anyone is suggesting anything but truth and honesty and disclosure, but when someone doesn't even give the site admin a chance to correct a potential problem (good thing this wasn't actually a serious exploit), they are just being irresponsible towards the users of the site in question and the community as a whole.  I for one hope that when/if someone does discover some potentially damaging exploit that they won't put us all at risk by instantly sharing it with everyone, including those who will jump at an opportunity to take advantage, at least until site admin has had an opportunity to take action.
jrmithdobbs
Jr. Member
*
Offline Offline

Activity: 59


View Profile
June 28, 2011, 06:16:13 PM
 #58

I for one hope that when/if someone does discover some potentially damaging exploit that they won't put us all at risk by instantly sharing it with everyone, including those who will jump at an opportunity to take advantage, at least until site admin has had an opportunity to take action.
If you're so worried feel free to stop using the services provided by companies with horrible security records or, as previously stated, petition said service providers to open their code and/or make public the results of 3rd party code/security audits.

To everyone sending me hate-filled PMs:

I don't care. See the above.

Additionally:

It is not my responsibility to enforce responsible journalism. If the blog d'jour is posting ill-informed "articles" about your pet bitcoin project, petition them to hold themselves to a higher standard of journalism.

I thought this forum was full of lolbertarians who believe in "absolutely free market capitalism?" Vote with your feet and your wallet.

Oh wait, I get it, your idealistic "free market" concepts only apply when they work in your favor. Brilliant!

1B8TSDzXdyTRX5eF77gWQoXujBaDtKFE6H
BTC Economist
Member
**
Offline Offline

Activity: 112


View Profile
June 28, 2011, 06:22:43 PM
 #59

I applaud the OP.  The idiots who still trust in Mt Gox deserve to get defrauded in every way possible.  I'd recommend informing hacker forums every time you find an exploit in that shithole of a business.

When BTC soars, you need to be READY!  PM me to learn more about my new e-book, How to Create and Profit from the Second Bitcoin Bubble available exclusively to BTC forum members!

17JzkreEBYNHQM9tMTiUKCHANofwzHRLhP
Dirt Rider
Member
**
Offline Offline

Activity: 111


View Profile
June 28, 2011, 06:25:02 PM
 #60

If you're so worried feel free to stop using the services provided by companies with horrible security records or, as previously stated, petition said service providers to open their code and/or make public the results of 3rd party code/security audits.

So what alternative services would you recommend, that are guarenteed to be perfect?
Pages: « 1 2 [3] 4 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!