Quote from: wolftaur on June 22, 2011, 04:58:28 PM

I actually find the poll to be kinda premature.

For Mt.Gox, I have more questions than answers. And this could be a bad thing -- apparently many people think that Mark's just stalling for time while he prepares to escape with our money. (And I'll guess half of those people just want to drive the market down so they can buy more coins cheap...) It could also mean that right now they're trying to worry more about fixing things and moving forward than about what is said in the forums.

TradeHill is just too new and hasn't made much disclosure. Sure, they did an interview which I watched, where they talked about how they will have better security than Mt.Gox did. That's not actually saying much. And it isn't a third-party security audit either. So all we really actually have to judge them on the grounds of code stability and security ... is them saying it's so. And while a self serving statement like that can actually easily BE the truth, it's harder to accept as such.

And, yeah, I'm sorta kicking the puck down the road in not coming to a conclusion. Why? Because I wasn't in a rush to sell my coins. I do want to sell a handful of them because my roommate needs a new computer and I'm tired of fixing the piece of crap he has now... but I don't actually have to go sell mine right away, and even if I did sell some I wouldn't be selling them all. I have time to sit back and wait for more info before I decide who I should distrust less.

Yeah, distrust less. Because there is a lot of validity to the point that a lot of the people who are upset with Mt.Gox were as vulnerable as they were because of foolish practices on their own end. People who had their coins stolen from other sites because they used trivial passwords, and the same password everywhere, come to mind. This DOESN'T give Mt.Gox a pass -- far from it. Everyone who's upset that Mt.Gox was part of the attack vector has every right to be, even when they were the vector too.

No business deserves your absolute, complete, 100%, undisputed trust. Ever. Even if they're ethical and technically competent. Why? Because shit happens, sooner or later. Mt.Gox and TradeHill could both go get security audits, and both could pass, and that doesn't mean they're truly secure. Sooner or later a bug shows up in Apache. Or in SSL. Or in the Linux/BSD/Solaris/whatever kernel. Or someone hires a corrupt employee. Or an honest employee gets stupid. Or your best friend steals your password...

It's fair to expect businesses to be competent, and to take your dollars and bitcoins elsewhere when they screw up. It's prudent to expect them to screw up and limit what harm could befall you as a result.

poll has to do with NOW not later