Hacker News Reader

Comment by amalag | Hacker News Reader

No mention of liability. So they are fixing it, but someone is out of $12k of bitcoins. Linode says, tough luck for trusting us with your valuables.

View on HN

These bitcoin servers trusted their currency exchange to cloud servers--VPSes, really--and they want Linode to compensate them for the money lost? Insane. I don't claim to know anything about the bitcoin infrastructure hosted here but I'm going to go out on a limb here and say that there was no dedicated hardware firewall in front of it, no IDS, no WAF, nothing but some Linux instances running iptables.

The payment card industry wouldn't certify this hardware to process credit cards for a mom-and-pop online business, yet these guys use it like their bank? Come again?

PCI-DSS is actually quite easy to get certified in. I would say the issue is Linode not protecting their customers but as you say it's completely optional and would incur higher costs.

So you are saying that you can not use cloud hosting for anything serious? Even if they don't keep cash around, most web apps might lose a lot of value by being hacked. user data stolen, reputation lost and so on. So according to you, the cloud is only for worthless toy projects.

If you put $12k of value on their service, why do they take on that risk? Why wouldn't the risk fall squarely on your shoulders?

Why would a hosting provider take on the liability of what you host on it? If the underlying filesystem had an error that Linode could avoid and you lost data, would you expect them to replace the value that was lost? Why is it not limited (at most) to the value of the VPS itself? (I can't imagine them compensating for hardware failure either).

Any business that would be running on linode could be worth potentially far more than that. What your saying here is that no one should put anything of value into a VPS, which I imagine is not something linode itself would say.

That's not quite what I'm trying to stay.

OP's expectation was that Linode should have unlimited liability where no guarantee on their part has been made. If you expect Linode to take on the risk then you would want (and probably need) that in writing.

Otherwise, you take on the risk: which would be true wherever you hosted it without any guarantees regardless of whether it's a VPS, dedicated server, or your basement.

One user (slush) lost $12k worth of bitcoins, but another (bitcoinica) lost upwards of [$40k-$50k - wrong].

EDIT: first report from bitcoinica was "over 10k btc". Most recent report is 43,554 BTC, which would be worth almost $200k if liquidated on MtGox at the moment.

If all of those bitcoins were liquidated at once, that would probably depress the market significantly.

Using the current mtgox order book (mtgoxlive.com), such a sell would push the price from $4.60 (where it is now) down to about $4.00.

Not that much, actually. If I'm reading it right, you could sell 50K BTC at $3.90, causing the market to drop "only" 17%. http://bitcoincharts.com/markets/mtgoxUSD_depth.html

And some selling is going on: http://bitcoincharts.com/charts/mtgoxUSD#rg1ztgSzm1g10zm2g25...

As someone who is unfamiliar with how exchanges work, I'm curious what an "ask" for 1.337 trillion dollars in bitcoins means, exactly:

  1337000000000.00 	1 (1) 	272981 	1405085033491

Not entirely sure, but I believe this represents someone willing to sell 1 BTC for $1,337,000,000,000.00, where all sell orders in the order book add up to 272981 BTC and USD$1,405,085,033,491

One of the hacked exchanges said they'd reimburse their clients, so I guess they'll buy roughly the amount that was stolen.

Best thing to do would be for Linode to generously reimburse these people, but they have no obligation to do so.

As a policy, it would neither be good business nor appropriate for Linode to assume all of the risk in a situation like this.

Also, if Linode did put a policy in place to assume some of the risk (some sort of insurance policy) they open themselves up to scams (just get your friend to rob your bitcoins and cash in on Linode's good will insurance policy).

"Best thing to do would be for Linode to generously reimburse these people"

Creates a precedent and greater future liability.

Good point.

The scam you mention would be difficult to pull off as there would have to be evidence that the account was compromised on Linode's end for the customer to make a claim.

Reply on news.ycombinator.com