* [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
[not found] <D024B465-AD6C-4AAD-A07F-956223929B6F@jrbobdobbs.org>
@ 2011-06-28 2:48 ` Doug Huff
2011-06-28 6:35 ` Mike Hearn
0 siblings, 1 reply; 6+ messages in thread
From: Doug Huff @ 2011-06-28 2:48 UTC (permalink / raw)
To: Bitcoin Dev Development
[-- Attachment #1.1: Type: text/plain, Size: 1317 bytes --]
Begin forwarded message:
> From: Doug Huff <mith@jrbobdobbs•org>
> Date: June 27, 2011 9:46:13 PM CDT
> To: full-disclosure@lists•grok.org.uk, "Mt.Gox" <info@mtgox•com>
> Cc: Bitcoin Dev Development <bitcoin-development@lists•sourceforge.net>
> Subject: Live mtgox.com trade matching bug.
>
> Step 1: Have USD available for spending on mtgox.com.
> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
> Step 3: Withdraw all USD funds.
> Step 4: Wait for market to fall enough to meet your order.
> Step 5: ...(self explanatory)...
>
> There's a bit of luck in being able to take advantage, obviously.
>
> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>
> ==========
> Welcome <username removed> 0.00000000 ฿TC 424.44901
> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
> ==========
>
> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>
> At the very least this could be used to influence market conditions if it is only a display bug.
>
> --
> Douglas Huff
>
>
--
Doug Huff
[-- Attachment #1.2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 3737 bytes --]
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 881 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
2011-06-28 2:48 ` [Bitcoin-development] Fwd: Live mtgox.com trade matching bug Doug Huff
@ 2011-06-28 6:35 ` Mike Hearn
2011-06-28 6:57 ` Luke-Jr
2011-06-28 13:24 ` Doug Huff
0 siblings, 2 replies; 6+ messages in thread
From: Mike Hearn @ 2011-06-28 6:35 UTC (permalink / raw)
To: Doug Huff; +Cc: Bitcoin Dev Development
Hi Doug,
Could we keep the Mt Gox related stuff off bitcoin-development please?
It's not related to the core software.
On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff@jrbobdobbs•org> wrote:
>
>
> Begin forwarded message:
>
>> From: Doug Huff <mith@jrbobdobbs•org>
>> Date: June 27, 2011 9:46:13 PM CDT
>> To: full-disclosure@lists•grok.org.uk, "Mt.Gox" <info@mtgox•com>
>> Cc: Bitcoin Dev Development <bitcoin-development@lists•sourceforge.net>
>> Subject: Live mtgox.com trade matching bug.
>>
>> Step 1: Have USD available for spending on mtgox.com.
>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
>> Step 3: Withdraw all USD funds.
>> Step 4: Wait for market to fall enough to meet your order.
>> Step 5: ...(self explanatory)...
>>
>> There's a bit of luck in being able to take advantage, obviously.
>>
>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>>
>> ==========
>> Welcome <username removed> 0.00000000 ฿TC 424.44901
>> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
>> ==========
>>
>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>>
>> At the very least this could be used to influence market conditions if it is only a display bug.
>>
>> --
>> Douglas Huff
>>
>>
>
> --
> Doug Huff
>
>
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists•sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
2011-06-28 6:35 ` Mike Hearn
@ 2011-06-28 6:57 ` Luke-Jr
2011-06-28 9:52 ` Mike Hearn
2011-06-28 13:24 ` Doug Huff
1 sibling, 1 reply; 6+ messages in thread
From: Luke-Jr @ 2011-06-28 6:57 UTC (permalink / raw)
To: bitcoin-development
On Tuesday, June 28, 2011 2:35:59 AM Mike Hearn wrote:
> Could we keep the Mt Gox related stuff off bitcoin-development please?
> It's not related to the core software.
MtGox's code is just as related as BitcoinJ or any other Bitcoin software,
IMO.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
2011-06-28 6:57 ` Luke-Jr
@ 2011-06-28 9:52 ` Mike Hearn
2011-06-28 11:54 ` Matt Corallo
0 siblings, 1 reply; 6+ messages in thread
From: Mike Hearn @ 2011-06-28 9:52 UTC (permalink / raw)
To: Luke-Jr; +Cc: bitcoin-development
>> Could we keep the Mt Gox related stuff off bitcoin-development please?
>> It's not related to the core software.
>
> MtGox's code is just as related as BitcoinJ or any other Bitcoin software,
> IMO.
It's closed source, so nobody here can do anything about it (unlike
other software discussed here).
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
2011-06-28 9:52 ` Mike Hearn
@ 2011-06-28 11:54 ` Matt Corallo
0 siblings, 0 replies; 6+ messages in thread
From: Matt Corallo @ 2011-06-28 11:54 UTC (permalink / raw)
To: bitcoin-development
[-- Attachment #1: Type: text/plain, Size: 626 bytes --]
On Tue, 2011-06-28 at 11:52 +0200, Mike Hearn wrote:
> >> Could we keep the Mt Gox related stuff off bitcoin-development please?
> >> It's not related to the core software.
> >
> > MtGox's code is just as related as BitcoinJ or any other Bitcoin software,
> > IMO.
>
> It's closed source, so nobody here can do anything about it (unlike
> other software discussed here).
And this is also no where near the right place to be disclosing security
vulnerabilities. Whether you like the guy/site or not, keep those prive
for a reasonable amount of time for them to be fixed (that means more
than an hour).
Matt
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
2011-06-28 6:35 ` Mike Hearn
2011-06-28 6:57 ` Luke-Jr
@ 2011-06-28 13:24 ` Doug Huff
1 sibling, 0 replies; 6+ messages in thread
From: Doug Huff @ 2011-06-28 13:24 UTC (permalink / raw)
To: Mike Hearn; +Cc: Bitcoin Dev Development
[-- Attachment #1: Type: text/plain, Size: 3098 bytes --]
Begin forwarded message:
> From: Doug Huff <dhuff@jrbobdobbs•org>
> Date: June 27, 2011 11:28:28 PM CDT
> To: Gavin Andresen <gavinandresen@gmail•com>
> Subject: Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
>
> Already talked to Jeff and agreed to stop posting them here. There is just currently no other forum for such reports. I think he was going to talk to you about starting a bitcoin-vendor-sec or similar list.
>
> I agree it does not belong there.
>
> On Jun 27, 2011, at 11:22 PM, Gavin Andresen wrote:
>
>> The bitcoin-development list is for discussion of core bitcoin
>> development, not about Mt.Gox or other sites or software that uses
>> bitcoin.
>>
>> --
>> --
>> Gavin Andresen
>
> --
> Doug Huff
>
>
--
Doug Huff
On Jun 28, 2011, at 1:35 AM, Mike Hearn wrote:
> Hi Doug,
>
> Could we keep the Mt Gox related stuff off bitcoin-development please?
> It's not related to the core software.
>
> On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff@jrbobdobbs•org> wrote:
>>
>>
>> Begin forwarded message:
>>
>>> From: Doug Huff <mith@jrbobdobbs•org>
>>> Date: June 27, 2011 9:46:13 PM CDT
>>> To: full-disclosure@lists•grok.org.uk, "Mt.Gox" <info@mtgox•com>
>>> Cc: Bitcoin Dev Development <bitcoin-development@lists•sourceforge.net>
>>> Subject: Live mtgox.com trade matching bug.
>>>
>>> Step 1: Have USD available for spending on mtgox.com.
>>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
>>> Step 3: Withdraw all USD funds.
>>> Step 4: Wait for market to fall enough to meet your order.
>>> Step 5: ...(self explanatory)...
>>>
>>> There's a bit of luck in being able to take advantage, obviously.
>>>
>>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>>>
>>> ==========
>>> Welcome <username removed> 0.00000000 ฿TC 424.44901
>>> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
>>> ==========
>>>
>>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>>>
>>> At the very least this could be used to influence market conditions if it is only a display bug.
>>>
>>> --
>>> Douglas Huff
>>>
>>>
>>
>> --
>> Doug Huff
>>
>>
>>
>> ------------------------------------------------------------------------------
>> All of the data generated in your IT infrastructure is seriously valuable.
>> Why? It contains a definitive record of application performance, security
>> threats, fraudulent activity, and more. Splunk takes this data and makes
>> sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-d2d-c2
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development@lists•sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>>
--
Doug Huff
[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 3737 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-06-28 13:24 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <D024B465-AD6C-4AAD-A07F-956223929B6F@jrbobdobbs.org>
2011-06-28 2:48 ` [Bitcoin-development] Fwd: Live mtgox.com trade matching bug Doug Huff
2011-06-28 6:35 ` Mike Hearn
2011-06-28 6:57 ` Luke-Jr
2011-06-28 9:52 ` Mike Hearn
2011-06-28 11:54 ` Matt Corallo
2011-06-28 13:24 ` Doug Huff
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox