<story><title>500k Bitcoins traded in 1h, Mt.Gox market hacked + crash</title><url>http://bitcoincharts.com/charts/chart.png?width=976&amp;m=mtgoxUSD&amp;k=&amp;r=1&amp;i=&amp;c=0&amp;s=&amp;e=&amp;Prev=&amp;Next=&amp;v=1&amp;cv=0&amp;ps=0&amp;l=0&amp;p=0&amp;t=S&amp;b=&amp;a1=&amp;m1=10&amp;a2=&amp;m2=25&amp;x=0&amp;i1=&amp;i2=&amp;i3=&amp;i4=&amp;SubmitButton=Draw&amp;</url></story><parent_chain><item><author>Hawramani</author><text>Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?</text></item><item><author>bradleyland</author><text>I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a &lt;i&gt;financial exchange&lt;/i&gt; and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I&apos;d trust you with any significant sum of money.</text></item><item><author>soult</author><text>I can confirm that the alleged dump is the real deal.&lt;p&gt;Some passwords are md5 hashes, some are salted md5 hashes (utilizing the crypt[0] function). I did not log in for a long time and my password was still unsalted, so I assume that converting to salted passwords was done either automatically on login or on password changes.&lt;p&gt;0: &lt;a href=&quot;http://www.kernel.org/doc/man-pages/online/pages/man3/crypt.3.html&quot; rel=&quot;nofollow&quot;&gt;http://www.kernel.org/doc/man-pages/online/pages/man3/crypt....&lt;/a&gt;</text></item><item><author>tlrobinson</author><text>There&apos;s an alleged database dump of Mt Gox floating around... &lt;a href=&quot;https://twitter.com/#!/954/status/82531189705019392&quot; rel=&quot;nofollow&quot;&gt;https://twitter.com/#!/954/status/82531189705019392&lt;/a&gt;&lt;p&gt;UPDATE: looks legit.&lt;p&gt;&lt;a href=&quot;http://forum.bitcoin.org/index.php?topic=19543.0&quot; rel=&quot;nofollow&quot;&gt;http://forum.bitcoin.org/index.php?topic=19543.0&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback&quot; rel=&quot;nofollow&quot;&gt;https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...&lt;/a&gt;</text></item></parent_chain><comment><author>nokcha</author><text>For web security, I&apos;d recommend checking out this question on Stack Overflow: 
&lt;a href=&quot;http://stackoverflow.com/questions/72394/what-should-a-developer-know-before-building-a-public-web-site&quot; rel=&quot;nofollow&quot;&gt;http://stackoverflow.com/questions/72394/what-should-a-devel...&lt;/a&gt;&lt;p&gt;Also the OWASP top ten vulnerabilities: &lt;a href=&quot;https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project&quot; rel=&quot;nofollow&quot;&gt;https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...&lt;/a&gt;</text></comment>
<story><title>500k Bitcoins traded in 1h, Mt.Gox market hacked + crash</title><url>http://bitcoincharts.com/charts/chart.png?width=976&amp;m=mtgoxUSD&amp;k=&amp;r=1&amp;i=&amp;c=0&amp;s=&amp;e=&amp;Prev=&amp;Next=&amp;v=1&amp;cv=0&amp;ps=0&amp;l=0&amp;p=0&amp;t=S&amp;b=&amp;a1=&amp;m1=10&amp;a2=&amp;m2=25&amp;x=0&amp;i1=&amp;i2=&amp;i3=&amp;i4=&amp;SubmitButton=Draw&amp;</url></story><parent_chain><item><author>Hawramani</author><text>Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?</text></item><item><author>bradleyland</author><text>I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a &lt;i&gt;financial exchange&lt;/i&gt; and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I&apos;d trust you with any significant sum of money.</text></item><item><author>soult</author><text>I can confirm that the alleged dump is the real deal.&lt;p&gt;Some passwords are md5 hashes, some are salted md5 hashes (utilizing the crypt[0] function). I did not log in for a long time and my password was still unsalted, so I assume that converting to salted passwords was done either automatically on login or on password changes.&lt;p&gt;0: &lt;a href=&quot;http://www.kernel.org/doc/man-pages/online/pages/man3/crypt.3.html&quot; rel=&quot;nofollow&quot;&gt;http://www.kernel.org/doc/man-pages/online/pages/man3/crypt....&lt;/a&gt;</text></item><item><author>tlrobinson</author><text>There&apos;s an alleged database dump of Mt Gox floating around... &lt;a href=&quot;https://twitter.com/#!/954/status/82531189705019392&quot; rel=&quot;nofollow&quot;&gt;https://twitter.com/#!/954/status/82531189705019392&lt;/a&gt;&lt;p&gt;UPDATE: looks legit.&lt;p&gt;&lt;a href=&quot;http://forum.bitcoin.org/index.php?topic=19543.0&quot; rel=&quot;nofollow&quot;&gt;http://forum.bitcoin.org/index.php?topic=19543.0&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback&quot; rel=&quot;nofollow&quot;&gt;https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...&lt;/a&gt;</text></item></parent_chain><comment><author>michaelf</author><text>A great place to start is &quot;Applied Cryptography&quot; by Bruce Schneier.&lt;p&gt;&lt;a href=&quot;http://www.schneier.com/book-applied.html&quot; rel=&quot;nofollow&quot;&gt;http://www.schneier.com/book-applied.html&lt;/a&gt;&lt;p&gt;Edit:  Note, this really barely scratches the surface for building secure software. AC says how to apply cryptographic primitives correctly.  It won&apos;t teach you how to avoid vulnerabilities specific to particular application domains (like CSS, SQL injection, etc...).</text></comment>