Pages:
Author

Topic: Zhoutong - page 2. (Read 3022 times)

legendary
Activity: 826
Merit: 1001
rippleFanatic
May 25, 2012, 10:24:01 PM
#4
really?  why make this thread? 

Because i'm pissed that he didn't make any backups of the database.

And I see a pattern in his behavior where he blames everything and everyone else for his (and now collectively our) problems. Most people don't have time to go through everything and might miss this pattern. But I believe its important to have an accurate, summarized record of history.

hero member
Activity: 868
Merit: 1000
May 25, 2012, 10:17:56 PM
#3
Regardless of any short-comings in the way Zhoutang originally set things up, Bitcoin Consultancy was engaged to a "comprehensive security audit" prior to becoming the owners and operators of Bitcoinica in late April.

Either their security audit failed to detect the vulnerability or they failed to address it - neither option is really excusable from an entity which promotes itself as being "expert" in security, and it's precisely the kind of vulnerability they should have been looking for in the wake of the Linode debacle.  They cannot blame Zhoutang for their own failure to detect and address vulnerabilities or the fact that those vulnerabilities remained undetected and/or unaddressed after they assumed ownership and control of operations - a second intrusion is precisely what they were brought in to prevent.
hero member
Activity: 662
Merit: 545
May 25, 2012, 09:41:39 PM
#2
really?  why make this thread? 
legendary
Activity: 826
Merit: 1001
rippleFanatic
May 25, 2012, 09:29:50 PM
#1
1. I play no part in Bitcoinica. If you get your money late, it's Bitcoinica Consultancy's fault.

 Nope, it's your fault too.

Both major incidents happen due to bitcoind problems (while we are trying to find alternate solutions), and there are tons of small incidents happening during development stage, majority are due to bitcoind problems as well.

Blaming bitcoind? No, the majority of the problems are due to you.


If anything of the following happened this would be prevented:

- Patrick's email was not added to the mailing list, and he used Bitcoinica email instead.
- Rackspace should just terminate the sessions then at least the database would be safe.
- We should not use the official Bitcoin client because it's very hard to secure it without large investments and affecting instant withdrawals in large amounts.

Blame email. Blame Rackspace. Blame the bitcoin client.

I made a mistake not to advise the previous owner to stop the negotiation. I only asked him to check their actual technical abilities.

Your continual mistake is a lack of honest self-reflection.

They did an intensive code review and dig out a Nginx vulnerability that someone notified me earlier but I forgot to address. (This was really my fault! Luckily no one exploited it.)

Luckily.

The hacker almost gained access to our Mt. Gox API keys, before I revoke them!

He could get 30,000+ BTC easily if I was asleep, or busy.

So all bitcoinica's MtGox funds were on one account and unsecured by yubikey? Good thing you were on top of things.

Well, shit just happens and it's not anyone's fault or incompetence here.

I disagree. It is your fault for not thinking ahead, having contingency plans, and back-ups.

I know you've made statements accepting responsibility elsewhere, but these conflicting statements reveal your actual attitude. You got yourself into this mess entirely on your own, zhou.

Nope. I wouldn't handle things like this.

But you did.


I'm taking all the responsibility here.
...[snip]...
I might be immature (I have no age privilege to disprove this). I might just suck at PR. I might be the 17-year-old kid causing endless troubles for you. I'm truly sorry.

You are? are you truly?

I actually LOL'd when I see the mess I'm creating.
...[snip]...
Just that the whole thing is quite funny if I look back. :-D
Pages:
Jump to: