Topic: List of Bitcoin Companies with Adequate Backup--Please Submit - page 2. (Read 5549 times)

Bitstamp is now on the list.

Any others?


I went to that thread and upon reading the word certificate I immediately thought of Matthew's UABB. May be time to revisit his ideas.

~Bruno~

+1

Easy way to fix that is a proxy in one dc and the important stuff in another.

I hope this thread is the beginning of this.

I will name some of the features and safety precautions that ensure stability of our system:

* Operating system from prominent North American Enterprise Linux vendor
* Secured by National Security Agency guidance for hardening OS
* Tape storage backup
* Bitcoin cold storage on separate server and location
* Backups of database and wallet every hour 24/7
* Industry standard router and network switches
* Industry standard servers


Best regards,
Nejc Kodrič
Bitstamp.net

The list is growing! I've added Mr. Bitcoin to the list in Post #2 of this thread. (ref. https://bitcointalksearch.org/topic/m.927914)

~Bruno~

Therein lies the value of a company getting an independent SAS 70 / SSAE 16 audit.

This is something I've begged MtGox to do for over a year and is a reasonable request.  It gives third party credence to the claims a company makes about numerous things, including backups.

In the payroll business, I have to do this for my customers... it's about a $10-$20k a year expense.  It is worth every penny.

Good enough to be added to the list, casascius. I'm sure the community thanks you.

Reader: What other company would you like to see on the list? Simply ask on this thread.

~Bruno~

I don't need to see anything to satisfy the purpose of this thread.

As I've said, simply stating that a backup system is in place protecting your clients is good enough for all extent and purposes of this thread. At the moment, I'm taken aback that some of the major players have yet to publically disclose, i.e. Mt Gox. Does anybody know as a fact that they currently have a backup system in place, protecting valuable data? What about the other exchanges? Anybody concerned enough to fire them a PM or email, kindly asking for the information, or do you feel 100% sure that your investment is in good hands, thus having no need to worry?

The list on Post #2 of this thread sure does look mighty thin. Maybe that's all the companies that deal with Bitcoin that have adequate backups. Maybe I'll just go ahead in a couple days and create that second list I mentioned earlier on this thread. I can easily removed a name from the bad list and place the linked company's name on the good list but, of course by then, Google may already have the bad list indexed. This is not a threat! But it is looking more like a promise.

~Bruno~

As part of running Casascius Physical Bitcoins, I am occasionally in the position of holding others' funds, typically for overseas or large orders.

Bitcoins aren't kept online.  Payments to my website actually go to an offline wallet.  The web server knows only a list of pre-generated addresses and dispenses one with each order.  The offline wallet was generated deterministically and therefore could be recovered with just the seed.

In addition to regular database backups, I make sure my e-mail contains everything I would need to recover in the event of data loss, the e-mail being completely independent from the web server and database of course.  I receive e-mails with order details, and whenever I send unfunded coins, I send a complete list of addresses to the recipient at the time I fill the package.  While there's nothing high-tech about using e-mail, it's effective as a secondary measure.

Glad to hear, if you are unsure whom to trust I suggest you contact one of the moderators or admins here, not everyone is technically competent and trustworthy.

Meanwhile, I'll check your site with nmap + w3af + my brain & google

This is critical.  Many businesses are dangerously under-capitalised at start-up and don't have enough financial reserves to cover catastrophic loss (and few are profitable enough in the short term for a business to set aside adequate reserves as the customer base grows - at some stage, an expanding enterprise will reach the point where taking out a HELOC or the owner selling their home would be inadequate to cover the amount owed in the event of catastrophic loss).

It's important to remember that the best technical security in the world isn't going to help if the majority of user funds are held in currency and an exchange's bank accounts get frozen.  In some cases, the loss of Bitcoins would be less catastrophic to a business and it's users than bank or payment processor accounts being frozen.

WBX customers, for example, would have been better off had the exchange's Bitcoins been stolen rather than anything affecting user funds being held in the bank account.  Had the funds been intact but the Bitcoins lost, the return to users would be significantly higher.


Users have no real idea of how the risk is spread with most Bitcoin entities and whether the loss of Bitcoins or funds held in bank accounts would be more catastrophic. 

I certainly understand the level of suspicion, after what's happened lately where we took people's word for something and got shafted ourselves. It's the same in the online casino industry, maybe more so. There's a whole bunch of ways people have tried to solve that trust problem, none of them completely successful:

1) crowd-sourced reputation monitoring, regulation-by-complaint, let-the-market-decide, etc. which doesn't always work (this is where most Bitcoin commerce is presently)
2) a few trustworthy independent sources emerging to act as magnets for the better operations, writing their own standards and stepping in personally to mediate casino/player disputes (like http://casinomeister.com with their pitch-a-bitch complaint resolution procedure, where they contact casinos on the player's behalf; and their dreaded "rogue casino" list). The danger here is that power corrupts.
3) relatively weak government licensing jurisdictions which do a few audits and sign off, in some rare cases making good on defaults of companies in their orbit,
4) large governments like the US where the solution has been to nuke the industry completely, using the history of unaccountability as an excuse to curtail freedom.

There are a few outlying examples, like Galewind Software Co. paying out a player and shutting down an operator's casino when the operator running their software refused to pay; as great as it was, this was barnyard justice and no way for an industry to run.

So take your pick. It ain't pretty. IMHO, option #2 works best. Before we launched I spent almost a year on casinomeister talking to players, reading complaints against other casinos and trying to figure out how to build a site that would be safe, responsive to players, and would make sure that even under catastrophic circumstances we would always have enough backups and funds to cover it and never land on the rogue list. To me, this site isn't just a one-off little league Bitcoin casino, it's a platform I'm constantly improving that isn't limited to this market. So our site was built to casinomeister's standard, which is actually a lot higher than what most licensing jurisdictions ask for; and far higher than anyone in the Bitcoin community has ever asked for out loud. This is probably the first step in that direction, and I support it.

So. While we won't post details of our security procedures in a public forum, we would be willing to share some information with the OP, in confidence, based on which he can make a well-informed recommendation as to whether what I've said here is true. This obviously sets a precedent that gives Phineas a fair amount of power, potentially. But I do think his intentions are honest. I've been approached by certain scammers on this board out of the blue, saying they wanted access to our systems to "audit" us. Good luck. But if we can prove to Phineas that we are what we say we are, then hopefully that will set people at ease, and it would set my mind at ease if more Bitcoin companies were willing to be forthcoming with those kinds of details.

Specifically I'm proposing to show the following:
* List of servers we control
* Hourly cron backup scripts (redacted for usernames)
* Screenshots of daily offline backups in progress/completed (only 71 Mb!)
* A more thorough explanation than I'm willing to give here.

In the short-term, the risk is more that Bitcoin will be brought under existing regulations related to currency, e-currency, commodities, payment transmission etc.  Many players in the Bitcoin game would be unable to afford the cost of licensing, insurance, and other compliance requirements if that happens, and no-one wants to be forced to close down before their initial investment has become profitable (the majority of small businesses aren't profitable in their early years).

It is beautiful, yes, but we're not even getting the best part.

Many of the people who would be this market's honest players are frightened off by the fear that Bitcoin might be (or might be declared) illegal. Dishonest players, of course, don't care about this. So the distribution of market participants is inevitably skewed somewhat.

And this ladies and gentlemen is how a market regulated by strictly market consumers (i.e. a free market) regulates itself. Isn't it beautiful? 

I can't think of any instance so far where social pressure has led to enterprise users recovering funds.  In a couple of instances user balances have been repaid because another company has rescued a business (Mt Gox with Bitomat and the Coinlab guys with Bitcoinica).  TradeHill made the decision to close its doors when it could no longer afford to absorb losses and while it still had the capacity to honour user deposits.  Most other businesses have either simply failed with no return to users or have made a payment to users based on what they claim to have available and made no promises to repay any remaining balances in the future. 

Social pressure isn't the answer to everything, but it can solve a lot of problems that "externally supervised enforcement" will never solve. And even the act of making a public statement will cause all but the most sociopathic to be more aware of the consequences of their actions, and perhaps to take more care.

It might make people feel good to have businesses make such a statement, but ultimately such reassurances are pretty meaningless.  The community has shown itself to have significant aversion to any kind of externally supervised recovery process when Bitcoin enterprises fail and it's also been unwilling to use legal processes to recover funds.  All the promises in the world are meaningless when there is neither a means nor an inclination to enforce them.

If Bitcoin businesses were to be brutally honest about what would happen in the event of a catastrophic event, it's likely that few of them would have the capacity to fully cover any losses and that some would lack the capacity to even partially cover them.

Possibly reasonable, but looking forward to what the community has to say on your proposal, ribuck.

---

I'm adding Yankee of BitInstant to the list.

~Bruno~