Topic: MtGox source code leaked ... - page 2. (Read 19047 times)

Nothing wrong with Java running server side.  The security hell that is java applets needs to die.  I personally don't install java client side not because it is any direct risk but out of fear that some browser exploit will enable java applet access.  If java applets were killed off an no longer supported by modern browsers I would have no issue with java client side either.  Most financial institutions and large enterprises use java server side. 

The issue isn't so much PHP as the way it was used.  As a side note, you can shoot of your own foot with any programming language, PHP just makes it easier than others.  I would use Python over PHP because dynamic typing and implicit (warningless) conversion between types just makes it to easy to create bugs which only occur run time.  Combine that with no test driven development and you got a recipe for hard to identify bugs.

Someone up thread said testing, testing, and testing.  That doesn't mean let me try to manually "test the hell out of this" it means things like unit testing, code coverage, mocking, automated test validation in build process, etc.  That is impossible with the code as written.  The code as written is untestable, unmaintainable, and undocumented.  Everything is a bunch of static methods, magic constants spread throughout, SQL code interspersed with business logic, mixed with formatting.  The few places where a constant should be used they decided to use a literal 100000000 for conversion from satoshi to Bitcoins.  Money values are handled as floats.  Everything is tightly coupled and poorly documented so if Mark ever did bring on additional programmers that would just be a timebomb waiting to go off.  You can get god's gift to programming but if other "lesser" programmers can make fatal mistakes with your code because it is fragile ... it is bad code.

The code is not particularly readable, therefore it probably has some subtle bugs. OO PHP is some of the worst looking code out there, but it mostly works... Honestly, what else is anyone suggesting people USE to make this type of site?

Surely NOT Ruby (way more scary than PHP), and probably not C++/CGI (too esoteric and crashworthy), probably not Python/web (still not ready for the bigtime), and don't even mention Java (the world will be a better place when people finally stop using it).

It's all those "rockstar programmers" who spend more time reading blogs than working. Only the object oriented design pattern de jour is the way to go, everything else sucks beyond belief, apparently.

Meanwhile, COBOL code sprinkled with GO TOs run their banks and steer their satellites. The only thing that matters is if the code 1) works and 2) is readable (and most hipster frameworks fail on both accounts).

The difference between serious and amateurish outfits like MtGox is testing, testing, testing and testing. Did I mention testing? And a bunch of people who do not consider themselves rockstars or other silly things who work these systems daily.

I wonder why the SQL dump to create the database was not leaked, the actual sources using the class were not leaked either. It is not like "hey, i leaked it so you can just run it or fully analyze", 'cause you can't.

It is like Karpeles himself leaked that for some malicious reason

Not a good point... Bitstamp is using php. The difference is that it seems bitstamp is built with a proper framework, and Gox was built with a crappy/old CMS... that's why I never trusted them.

I agree. I've worked as a software developer for 15+ years and this really is not that bad compared to some of the code out there. I was honestly expecting worse..

Has someone had the time to study the code more carefully? At first glance it seems to me like they are encrypting all the private keys using the same encryption keys and storing them in a database. So if someone would get access to the database and the master key (likely to be hardcoded in a php file somewhere...) they could steal all the money from all the addresses. I haven't spent much time looking at the code so I might be interpreting it wrong.

Thanks friend.

And I do not intend to defraud, because, if my exchange goes south, I will turn the damn thing off.

But, since you are all very smart, I would also suggest this:  There is no way to make Android safe.  And there is no way to stop the tablet-tsunami, with crapware standard.  So?

If you got all the programmers in a room, I don't think the public could stand to be in that room.

edit

Also the person who said that A: The Gox customer list, and now B: This code being dupe'd all around Earth, could open severe vectors for crime that smack cryptocoin in the face for years even (tho we know it will always rebound and/or have value).

So, in terms of any cred on the programmer-class of persons on Earth, I am not sure they can agree amongst themselves, as the good/shitty ones are good/bad enough to make a ton of cash either way, and then they bail and retire at 40, good for them!  Awesome.  But you can't build a world on that kind of code, can you?

There is a lot of wisdom here. Worse is better. Programming is not (always) art.

But I'll say this. it isn't clear that Mark made 500 million with this code. If we go by the leaked (maybe authentic, maybe not) financials, MtGox really didn't make that much money. It may be that the code made 500 million USD (or perhaps some much smaller amount if the coins were stolen earlier and valued at lower prices) for someone else. If Mark stole 500 million USD and got away with it using this code, then I would agree you are on to something. That's hardly proven.

IIRC MtGox had a deal where Eligus would include their transactions.

Why does the MtGox code send e-mails to Luke-Jr? He has a rather "colorful" past around here, he was tampering with blocks passing through his pool.

I am going to take this code and learn from it.  I haven't ever really had much interest in programming because most all software is shit.  So, I guess if one is to learn, may as well start with the SHIT THAT MADE 500 MILLION USD?

PHP all the way + Python, you kiddin me?  This is a no brainer.  

Okay, so, we probably can agree that what is the real problem is: dickhead intentioned persons who break code, i.e. SQL inject, etc.  And Also I bet you would agree with me that these ones will always succeed UNLESS you got VC $$$ with which to test and parse and manage your code.

No way will anything grassroots be done, unless it is one dude typing furiously at his keyboard.  WITNESS the code which made functionality happen.  Haha, it is so cute to me that programmers think they can obfuscate their trade and call for centralized code and wag their finger at Tron-style creativitiy.  Okay, sure, when you look at it, it's dogshit.  But when I look at it, I want to learn it.

Everybody interested in making a better PHP world, go ahead and PM line by line as to where th vuln's are in this code, because, I didn't see anyone of you do an exploit that got his wallets, or did you??

I mean, in some ways, if you build cars so that they can withstand rocket-launchers-type-attacks, you are going to have to build tanks rather than cars.  So, then that again means that Ike was right about science-money taking over the world.  If you do not build better software designers, then there will simply be a whole new generation of them. And eventually they will decide to de-obfuscate all code everywhere.  So anyway, I am learning PHP and Python, because I don't see that programming C++ and making shithot web apps, is really doable in a practical sense.  Just my .02 as a desktop tech who writes .bat files but supports low IQ money-based programmers imported from other countries.  I agree with those who say the world runs on lousy code --it does, and yet, that it won't be fixed is a frightening truth.

There is nothing wrong with PHP or any other language, they all do absolutely the same thing. Banking systems are mostly ancient writen in obsolete languages, and they do work fine. It is up to the programmer, not the language.

I have one word to say:

French

And assloads more capital due to fractionalized fiat debtmonies, yes.

No way can an average human compete with the corporate model, especially in finance.

+ Agreed

Hmmmm.... not really ...not in the golden circle of large blue chip banks

A bank will have a core apps platform maybe 30-100 apps and I gurantee there wont be mysql & php kicking around

No wonder they are all collapsing, needing a bail out every 5 minutes...

*closes account*

MtGox was created in 2010, it was a greenfield project.  Most developers relish the idea of working on a greenfield projects because it doesn't require them to drag forward decades of legacy cludge and instead allows them to do it right (at least initially).  Kinda hard to compare that to a banking system which may have its roots going back forty years and be the net results of multiple acquired and merged systems.  For long runnning enterprise applications, developers are rarely given the option to make a clean break.  MtGox didn't have that problem.  It started with an empty text file and ended up resembling systems which get that way after decades of hacks, workarounds, and patches. 

Sometimes a spade is a spade and you can just call it that.  MtGox's transaction engine was so bad it would choke at 5 tps despite running on server hardware capable of 1000x that (two very high end dedicated servers).  Yes facebook's early roots were in php (it has long since been converted to C++) but facebook would never have scaled to even a million users if its codebase was this bad.  Today we would be saying "facebook who?" instead of it being a household name if the code wasn't scalable.   

There is no excuse or justification for code this bad.  None.  Period.  Anyone offering it just looks silly.

If people are shocked by the quality of code seen from MtGox, you should stop using your bank, abandon your car and ditch your mobile phone.  There are mountains of legacy spaghetti code out there that are completely written against proper academic rules.  You use the code every day for critical applications.

I can assure you that there are many MySQL instances inside any bank you could point your finger at. Several of them business critical for their respective environments.

It is guaranteed to be a lot of PHP too, just not customer facing. Banks are big things with lots of IT.