Begin forwarded message:

> From: Doug Huff <dhuff@jrbobdobbs.org>
> Date: June 27, 2011 11:28:28 PM CDT
> To: Gavin Andresen <gavinandresen@gmail.com>
> Subject: Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
> 
> Already talked to Jeff and agreed to stop posting them here. There is just currently no other forum for such reports. I think he was going to talk to you about starting a bitcoin-vendor-sec or similar list.
> 
> I agree it does not belong there.
> 
> On Jun 27, 2011, at 11:22 PM, Gavin Andresen wrote:
> 
>> The bitcoin-development list is for discussion of core bitcoin
>> development, not about Mt.Gox or other sites or software that uses
>> bitcoin.
>> 
>> -- 
>> --
>> Gavin Andresen
> 
> -- 
> Doug Huff
> 
> 

-- 
Doug Huff

On Jun 28, 2011, at 1:35 AM, Mike Hearn wrote:

> Hi Doug,
> 
> Could we keep the Mt Gox related stuff off bitcoin-development please?
> It's not related to the core software.
> 
> On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff@jrbobdobbs.org> wrote:
>> 
>> 
>> Begin forwarded message:
>> 
>>> From: Doug Huff <mith@jrbobdobbs.org>
>>> Date: June 27, 2011 9:46:13 PM CDT
>>> To: full-disclosure@lists.grok.org.uk, "Mt.Gox" <info@mtgox.com>
>>> Cc: Bitcoin Dev Development <bitcoin-development@lists.sourceforge.net>
>>> Subject: Live mtgox.com trade matching bug.
>>> 
>>> Step 1: Have USD available for spending on mtgox.com.
>>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
>>> Step 3: Withdraw all USD funds.
>>> Step 4: Wait for market to fall enough to meet your order.
>>> Step 5: ...(self explanatory)...
>>> 
>>> There's a bit of luck in being able to take advantage, obviously.
>>> 
>>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>>> 
>>> ==========
>>> Welcome <username removed> 0.00000000 ฿TC 424.44901
>>> Buying  138468.901  0.01  Active  1384.69  06/26 15:27  cancel
>>> ==========
>>> 
>>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>>> 
>>> At the very least this could be used to influence market conditions if it is only a display bug.
>>> 
>>> --
>>> Douglas Huff
>>> 
>>> 
>> 
>> --
>> Doug Huff
>> 
>> 
>> 
>> ------------------------------------------------------------------------------
>> All of the data generated in your IT infrastructure is seriously valuable.
>> Why? It contains a definitive record of application performance, security
>> threats, fraudulent activity, and more. Splunk takes this data and makes
>> sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-d2d-c2
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>> 
>> 

-- 
Doug Huff