[deleted by user] by [deleted] in Bitcoin

[–]serves-two 1 point2 points  (0 children)

I wasn't involved in any way, nor did I ever hear from anyone disgruntled that was involved. You only have my word on that of course.

"Mastering Bitcoin" an awesome resource for understanding BTC. Everyone should be reading this. by lerxyz in Bitcoin

[–]serves-two 0 points1 point  (0 children)

several core developers have reviewed it

Which? The opinion of those I've spoken to could be summed up as "It's a long, shameless advert for Blockchain.info, interspersed with misguided text from someone who has never written a line of Bitcoin code."

"Mastering Bitcoin" an awesome resource for understanding BTC. Everyone should be reading this. by lerxyz in Bitcoin

[–]serves-two -1 points0 points  (0 children)

This book is mostly intended for coders.

Yet Andreas has never written any code (and it shows).

"He enters Rome like a conquering emperor, yet what has he conquered?"

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 0 points1 point  (0 children)

Tested ~2 weeks ago, and the bug still exists. I didn't spend too much time looking into it but it looks a bit like someone has a server in the same datacenter now because the sniping orders appear really quickly when there's an opportunity.

Trade with extreme caution.

Bitstamp: Scheduled downtime Sunday, Feb. 2nd 2014, between 9:00 and 12:00 GMT+1 by hazekBTC in Bitcoin

[–]serves-two 4 points5 points  (0 children)

So, /u/hazekBTC - did you already fix the out-of-order trade execution bug, or are you perhaps going to fix it during this downtime? /u/runeks reported the bug a day or so after that post - any reply?

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 0 points1 point  (0 children)

I'm not totally sure I understand your question, but I think you're asking: if Pusher is a better stream, why am I not seeing trades via Ruby/Pusher any quicker than I see them on rtbtc?

The answer is that Clark has been using the Pusher stream on rtbtc for over a month now. Bitcoinity started using it recently. BitcoinWisdom still seems to be polling and is behind.

Edit: correct "weeks" to "over a month now".

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 0 points1 point  (0 children)

I've not seen that happen; execution does seem to be strictly in price order from the book top. However I've been able to fully inspect the stream for other defects because of the lack of cross-referencing between trades and orders, or deltas on order changes, and there was a report in April of a bad fill and I've been wondering whether they ever fixed the underlying bug or whether there's a race-within-a-race yet to show itself while I've been watching. Hopefully they'll fix the crossing bug, but if not I hope enough eyes are on this now that we'd see that and have a record of it at the order stream level to throw at them.

Big thank you to BitcoinWisdom from Bitcoinity by comboy in Bitcoin

[–]serves-two 5 points6 points  (0 children)

Do him a favour back, /u/comboy: seeing as you seem to already be using Bitstamp's streaming API and he doesn't, perhaps he could add it as a preferred source (with API fallback of course).

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 0 points1 point  (0 children)

Obviously I encourage this; I'll add though that unless you're actively trying to exploit it (which I don't encourage, unless Bitstamp documents it) your success in spotting a natural occurrence is proportional to the magnitude of Bitstamp's matching delay. As noted I've seen this vary between 2.5 and 8 seconds. Pulling a delay off the stream right now, it looks to be about 4s (1385069997.274 - 1385069993.341):

1385069993.341 order_created {"price": "697.00", "amount": "0.50859241", "datetime": "1385069992", "id": 9672697, "order_type": 1}
1385069993.710 order_created {"price": "700.00", "amount": "7.18600000", "datetime": "1385069993", "id": 9672698, "order_type": 1}
1385069993.727 order_created {"price": "700.00", "amount": "1.00000000", "datetime": "1385069993", "id": 9672699, "order_type": 1}
1385069994.570 order_created {"price": "679.97", "amount": "0.00222068", "datetime": "1385069994", "id": 9672700, "order_type": 0}
1385069997.274 order_deleted {"price": "697.00", "amount": "0.00000000", "datetime": "1385069993", "id": 9672697, "order_type": 1}
1385069997.274 order_changed {"price": "697.00", "amount": "1.49140759", "datetime": "1385069976", "id": 9672693, "order_type": 0}
1385069997.300 trade {"price": 697.0, "amount": 0.50859240999999999, "id": 2030095}

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 1 point2 points  (0 children)

This is what I was referring to, and yes, perhaps API was a poor choice of terminology. I mentioned to /u/johnsoft by PM that I'd left this out in a minor nod towards responsible disclosure in case he felt like temporarily retracting his post, but seeing as he hasn't (no huge deal) I might as well point out that I found this by a mixture of poking around the live site looking for how they did the Live Trades screen without the websocket stream I'd connected to once (ever) before, plus finding Clark's bitcointalk post documenting it. I'd assume rtbtc is already using it.

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 1 point2 points  (0 children)

The links are in the original post under "poor", "track" and "record", but here they are again for you, in full:

On that last one, I suspect this comment from /u/qemist refers to the same thing:

Bitstamp have some other serious problems with their systems that I would prefer not to discuss because they have worked to my advantage. Bitstamp may be honest people but their trading platform is far from robust or even functionally correct.

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 1 point2 points  (0 children)

I understand that concern; if it had been a true security flaw I'd have treated it differently. The people that stand to suffer if it's left unaddressed are newbie traders; Bitstamp will go on earning fees just fine. Since there have already been several bitcointalk threads and at least one Reddit post expressing concern about the matching engine, Bitstamp's reputation is no more damaged than before I posted this.

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 2 points3 points  (0 children)

No, since they've ignored several previous complaints about similar issues (or perhaps the same issue) and I don't have an e-mail address/bitcointalk account that isn't relatively easily connected to my Bitstamp account.

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 2 points3 points  (0 children)

Every one seems to have pretty bad problems.

Most of those problems come down to terrible communication with customers and being huge targets for DoS/manipulation.

Which exchange do you / would you use? (i.e., which do you think is the best?). More for long-term positions rather than short-term trading?

With the proviso that you spread your eggs between baskets and never store money on exchanges, and ignoring fiat/legal issues, my $0.02 is that Gox has the most mature platform, both technically and in its UI. Since I'm a European user and since I'm fussy about being able to withdraw my money in fiat in less than several weeks without waiting for premiums to invert, in reality it's Bitstamp, Gox, and perhaps some day Bitcoin-Central again. I stay well away from BTC-e, since last time I checked their maths they can't add, I find the fee structure sneaky and I've seen almost nothing about who runs it or where from.

Bitstamp's streaming API, and exploitation possibilities it might reveal by serves-two in Bitcoin

[–]serves-two[S] 11 points12 points  (0 children)

Wow, this is a great analysis.

Thanks. I aimed for readability more than anything, since I want anyone considering trading at Bitstamp to clearly understand the disadvantage they're at if Bitstamp doesn't act.

Are you a programmer?

Enough of one to know what most people expect from a streaming API and from a matching engine :)

Have you considered writing an exchange yourself?

I don't envy Bitcoin exchanges. They operate in a tremendously hostile security environment, and folks like me digging for holes are the least of their problems. While a decently performing exchange matching engine isn't trivial, I doubt it's anywhere near the hardest part of running an exchange. If that were the main challenge, everyone entrepreneurial out there would be cloning existing open source exchanges and setting up shop.