I really doubt a company like Linode would even consider risking anything for this amount of Bitcoin. If it was internal then it would most likely be a single employee. That is a possibility and if it was internal the chance of the individual being caught goes up considerably.

Jered

Yeah I agree with you here.

I edited this; of course Linode doesn't steal *as a company*, I didn't mean it that way.



The hell? Yes, I expect them to say exactly that. So the "grownups" are to not speak the truth these days? Hide it between dodgy wording? I prefer not to be classified with them in this case, thank you.

Yes, I expect people to tell the outright truth, or else I expect they have facts to hide or twist. And even though profit seems to be the measure of everything these days, I don't see how going with that flow is grown up at all. Keh. Court games, involving simply not saying the most important fact. Makes me sick.

Oh alright then. ^^

I was more speaking as devil's advocate for their side. Obviously it's better for us if they said that, I am just asking you-- did you really expect them to? I mean, as a business with lawyers, a stake in the financial future of their employers and assets, etc? You've never held a management position have you? Did you know merely trying to help someone in a car crash and having them die can get you sued for causing their death for holding them wrong or making a mistake? Did you know that if someone breaks into your house and gets wounded by your careless arrangement of knives or something they can sue you for that in some cases? We're not talking about sanity here, we're talking about law. They did the right thing legally to protect themselves by saying that. You want to argue morals, start a thread about morals and dishonest business. We're talking about getting Zhou's money back here. Morals will not be a factor.

How about they have investors to protect, so that even if they have details that they know for a fact will not help anyone find the crooks, they're rather not go bankrupt for their errors? What if you're in a country where sex is punishable by death and you have sex with your girlfriend in private. Are you going to publicly announce it the next day? What if someone asks? Morality. Ho hum.

No offense, but I question if you're even over the age of 18 yet. You don't sound like someone who's ever held a job either. I certainly am not impressed by Linode's security or their actions, nor am I particularly impressed by their response. I was the first one to respond to slush and Zhou tong (who are in our DCAO group) and recommend a multiple party lawsuit against them for damages. The thing anyone who has ever run a company would know though, is that it's not losing in itself, it's how you lose. If they gave Zhou back $500k just to keep quiet and not push issues publicly so that they could fix their problems and keep their business going, do you think that's bad when the alternative is bankrupting them in court fees, and Zhou gets nothing? What about insurance? What if Linode can only claim the insurance to pay Zhou back if they never publicly admit it was their fault or how much was stolen? Can you wrap your head around the idea that maybe, just possibly, less is more?

No one has said they won't pay. And yes, court games can be very trying and bothersome, but part of the game is knowing how to play. People who say "Herp Derp just tell the truth and everything will be okay!" don't know how to play. Are you American? Linode is in America. In US law, "What you say can and will be used against you in a court of law". That includes the honest things you say. The less the judges know, the better for everyone.

If the court knows that Zhou was running Bitcoinica, what if they found a law that says because it was not registered in the US as a trading site by US rules, they will not process the case, wouldn't it have been better for them not to know that little bit of information about bitcoinica, and just mention it as a 'Linode customer'?

Welcome to the Dark Side.

DCAO?

marked

I do not think it was Linode itself. As they control the systems that run the VMs they could have trivially copied the wallets without leaving any trace, leaving everyone to wonder how the private keys leaked.

However, the hackers had to change the root password to get in... If it was an insider it was a very dumb one, or someone with limited permissions working alone.

It certainly sounds fishy. I have a linode box, it doesn't use bitcoin in any way, and it wasn't restarted, for example. Based on this information, what Linode published and what others reported, it looks like only those that were running bitcoind were restarted. So the attacker must have figured out how to request a password reset only for particular machines. How do they figure out which? They can do that, for example, based on the IP. To find out the IP is not difficult, since it shows up on the Bitcoin network. But knowing the IP does not automatically allow one to find out which server it corresponds to in a control panel. So either the mysterious "customer service portal" was compromised thoroughly (= security fiasco) or the attacker had inside knowledge (= also fiasco, but a different sort).

@Matthew:
So now, it's about... hiding facts to stay within an insurance policy? That's fraud! Yes, I understand, it's not about morals, just about getting the most money for one's own position/company/whatever. But if this is the only purpose, where is the difference to the thief? (At the girl example, I don't see why one can have an obligation to tell anyone about a private relationship. Unless you like slavery, and someone "entrusted" someone else with the girl... otherwise, I don't see the analogy.)

I'm not actually a kid. But maybe my ideology is stuck with that of an 18 year old, I dunno. I have never been so desperate for money that I'd trade it in.

@lonelyminer:
That's interesting... so, if I got this right, the password reset requires information an outside attacker should not have? I don't know how Linode handles administration, but that sounds quite important.

From their terms of service:

"Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscriber for services during the period damages occurred. In no event shall Linode.com be liable for any special or consequential damages, loss or injury. Linode.com is not responsible for any damages your business may suffer. Linode.com does not make implied or written warranties for any of our services. Linode.com denies any warranty or merchantability for a specific purpose. This includes loss of data resulting from delays, non-deliveries, wrong delivery, and any and all service interruptions caused by Linode.com."

I'm not a lawyer but this more or less says they aren't responsible for almost anything ?