Bitcoin isn't a store of value (its too volatile), it isn't a currency (too slow and expensive for small transactions), and it isn't even a product in its own right.
One definite use of bitcoin is to transfer moneys all over the place.
If you don’t like it or think it’s too slow doesn’t change these facts.
I agree that it’s not a product though. It is a distributed system that nobody owns.
And yes you can functionally make transactions, but based on current transaction fees it looks like I'd pay $0.22 in fees so I could wait 10-20 minutes for a transaction to likely clear. I'm not doing that at a gas pump, grocery store, etc.
Its almost a given that the value you pull out won't be what you put in, likely not close, its either much higher or much lower and that changes frequently over time.
Otherwise I just use the dollar bill as the store of value
Watching crypto rediscover 100yr of financial regulation and system/process design has never not been amusing to me, esp as someone who works in an asset that has solved the custodianship problem (not that people in the industry aren’t actively attempting to light those safety rails on fire to make a few extra bucks).
Nope, using money for everyday purchases is not kewl enough for the bored apes.
now: "big business and central finance are the reason digital money sucks"
He got tried and jailed for a long time for fraud.
Mt. Gox was just incompetence, like Binance here. But then on the other hand Binance is making so much money that to them $3.5 billion to cover the losses is just a slap on the wrist.
But a lot (generalizing here) don't like giving up access "in case they need it". I haven't worked backend in ages, but years ago there was one developer that went to the ops guys and said "can I just ssh to production I need to check some env vars to debug my software" (or something to that degree). Ops team was good and it was a hard no - "just add some logging, you can deploy a new release quickly enough".
For example at most good crypto companies that hold wallets it's not possible to ssh at all, even if someone asked and go permission. It just simply isn't possible short of having a AWS root key or physical access to a computer in a DC.
There is no login, no accounts, no ssh keys or similar, they are immutable containers running from images with a signed SHA. The SHA can only be built by a build system that has it's own set of strict security controls.
Without details, I don't know why a comproised laptop would make any difference unless it submitted code through a PR and had it approved by multiple people.
I cannot look at how these companies are run with anything but derision. It’s institutional laziness, and it’s sloppy.
A good solution to this is to have a "break glass" system. Ie. access permissions get granted to the developer directly in an emergency by going through a set of steps available beforehand. All requests by that developer are then allowed, limited to 10 kilobytes of results per minute and logged.
For example, imagine you run a bank, and a rare code bug means that at exactly midnight on new years eve all bank balances have $1B added to them.
Your oncall takes down the production servers to to reduce losses and uses the break glass system, by getting approval from n other developers, allowing them direct database access. They use that access to count(accounts) with a balance around $1B or more, see it is everyone, and subtract $1B from them all, before bringing production back up with an older software release. Downtime = 2 hours.
In the morning, all the developers actions are reviewed.
If the developer turned evil and trying to dump the database, the n approvers and 10 kilobytes per minute would reduce data loss. But the break glass system still lets the developer make fairly major emergency fixes to reduce losses or downtime.
The problems can be overcome, but management types may balk at the cost of a complete break glass system.
I agree it's a grave fuckup but its a common one. You should just assume that when you deposit coins somewhere there are dozens of people who could just walk off with everything on their own. It's remarkable that it doesn't happen more often.
This is a one-sentence horror story. I almost can't believe someone would let this happen, unless the 1Password account is not important (highly unlikely).
Blaming this on the user is a bit like blaming someone for doing their banking on their regular day to day computer instead of an air gapped machine.
The nice thing is that using the private key requires physical touch. That means that AI itself (or a remote attacker, for that matter) can't do things unless I confirm.
Yeah (not talking about crypto): yubikeys (or similar) are really sweet for that. I've use them for ssh / pushing / fetching from Git etc. I use them for 2FA to various services etc.
There are also similar devices where you enter a PIN and the PIN to register to a service the first time and then the PIN to auth are different. So you can't be tricked by mistake to register to a new service when you just want to auth (you could still be tricked to register to a service which ain't the one you think while registering, but never while auth'ing).
And yup I use that with AI all the time: my agents go inside a container or inside a VM (or both), and the damage it can do is very limited.
It's also possible to do passthrough of devices (GPU, USB, ...) to VMs: good stuff.
In my thinking, this is more secure than plaintext in filesystem
you know most tools like gcloud, bitwarden, etc store auth keys just in dotfiles too?
Local compromise is KO now, and we can't do shit on platforms like MacOs didn't research Linux recently