MtGox source code leaked ...

[Definit]

interesting

[1714156733]

1714156733

[tvbcof]

Oh and it gets worse

From the IRC chat of Nanashi and other hackers, it seems that the hacker also have access to a 20GB data dump of customer data along with passport scans.

This is much worse.  A whole new slew of lawsuits heading their way.

+1.  Much worse.  I can live without the modest wire they owe me else I would not have requested it.  My ID docs, OTOH, spell a lifetime of hassles.  I have only ever sent high quality identity dox to Mt. Gox.  I they are used by any criminal I'll know exactly where they came from.

I'd estimated that after the 2011 Mt. Gox problems and all the money they should have been raking in, they would have had some professional architects and coders on staff and the data would be a little bit safe (though the support contractors would still have some access to it.)  I'll take some responsibility for mis-estimating here, but only so much.  If my dox are lost/sold, I'm coming for that fat cock sucker.  I've had the patience to HODL BTC for years, and I'll have the patience to see that Karpeles suffers for much longer than that.  And the resources to boot, especially if we see at least one more price run-up.

[Definit]

http://forums.graal.in/forums/showthread.php?7661-Is-Stephane-Portha-involved-with-MtGox

who is Stephane Portha (known scammer) and why is he connected with Mt.Gox Mark Karpeles?

http://nekoroy.com/hiddengox.html

[dave111223]

Where is the rest of the code?

This only seems to contain one PHP class which wraps other classes which are not included here?

http://pastebin.com/W8B3CGiN

[mami]

Surely NOT Ruby (way more scary than PHP), and probably not C++/CGI (too esoteric and crashworthy), probably not Python/web (still not ready for the bigtime), and don't even mention Java (the world will be a better place when people finally stop using it).

Nothing wrong with Java running server side.  The security hell that is java applets needs to die.  I personally don't install java client side not because it is any direct risk but out of fear that some browser exploit will enable java applet access.  If java applets were killed off an no longer supported by modern browsers I would have no issue with java client side either.  Most financial institutions and large enterprises use java server side.  

Well there are problems with Java server side - high memory and CPU use, slow execution, occasional required restarting of backend infrastructure, and code bloat (Karpie's Bitcoin PHP class would take 5000+ lines of Java). Also Java server architecture didn't start off HTTP/REST-based - PHP was specifically designed for it (albeit recklessly).  Finally,  Java bugs always take longer to FIND AND FIX than any other language's -  a major cost.
  

The issue isn't so much PHP as the way it was used.  As a side note, you can shoot of your own foot with any programming language, PHP just makes it easier than others.  I would use Python over PHP because dynamic typing and implicit (warningless) conversion between types just makes it to easy to create bugs which only occur run time.  Combine that with no test driven development and you got a recipe for hard to identify bugs.

very true - php5's execution is SCARILY NON-DETERMINISTIC from time to time...

Someone up thread said testing, testing, and testing.  That doesn't mean let me try to manually "test the hell out of this" it means things like unit testing, code coverage, mocking, automated test validation in build process, etc.  That is impossible with the code as written.  The code as written is untestable, unmaintainable, and undocumented.  Everything is a bunch of static methods, magic constants spread throughout, SQL code interspersed with business logic, mixed with formatting.  The few places where a constant should be used they decided to use a literal 100000000 for conversion from satoshi to Bitcoins.  Money values are handled as floats.  Everything is tightly coupled and poorly documented so if Mark ever did bring on additional programmers that would just be a timebomb waiting to go off.  You can get god's gift to programming but if other "lesser" programmers can make fatal mistakes with your code because it is fragile ... it is bad code.

Hard to argue these points - nonetheless the old industry saying of "it's not a bug unless a customer finds it" holds true... With PHP a lot of poop can be swept under the rug or offloaded to the web server...

I forgot to mention node.js as an option for web infrastructure - I am not a fan of anything google and I hate Javascript...

Karpie might be polishing his coding skills up in a cell in the US soon...

[mp420]

Using PHP for ANYTHING is a recipe for a disaster. (Yes, even using it for the thing it was originally meant for - a simple tool for beginners to make dynamic web content. Ever seen a beginner write PHP code without gaping security holes all around?) Even Perl is much more sane language. Perl at least has consistent block scope.

For web development, I'm strangely drawn toward Node.js at the moment. But anything goes if it does not have to be PHP.

[Juneass]

I posted about this before.
There are some doubts about its validity.

https://bitcointalk.org/index.php?topic=498341.0

[nagnagnag2]

this is probably the code which allowed the leak of the 800 000 bitcoins.

[itsunderstood]

This fits weel here:

http://mag.newsweek.com/2014/03/14/bitcoin-satoshi-nakamoto.html

[...]

In addition, the code was not always terribly neat, another sign that Nakamoto was not working with a team that would have cleaned up the code and streamlined it.

"Everyone who looked at his code has pretty much concluded it was a single person," says Andresen. "We have rewritten roughly 70 percent of the code since inception. It wasn't written with nice interfaces. It was like one big hairball. It was incredibly tight and well-written at the lower level but where functions came together it could be pretty messy."

So, this is a very educational thread.  Thanks all.

edit

I'll tell you what, this Satoshi guy they found, is exactly like so many programmers I have supported as a tech in the US.  He comes out and says "where's my free lunch?!"  Hahaha, a genius savant Japanese guy who will never admit to bitcoin and who write "hairball" assembly level code that changes the entire world.

Like a sir.

[gollum]

The MtGox code is worst practice of coding and security... I bet Mark Karpeles never heard about "design patterns".
https://en.wikipedia.org/wiki/Software_design_pattern

Design Patterns: Elements of Reusable Object-Oriented Software
http://www.amazon.com/Design-Patterns-Elements-Reusable-Object-Oriented/dp/0201633612

[DeathAndTaxes]

Well to Marks credit there is more than one anti-pattern in the code.