<p>First of all, don't even consider using VPSes for these things. As long as there's a layer above the OS that can be hacked, the data cannot be safe.</p>

<p>Also, if things are going to be safe, you're going to need at least several machines. The machine that stores the bitcoin wallet information shouldn't be connected directly to the internet, and should not run on the machine that also handles the website.</p>

<p>As long as your server is an actual <strong>physical server</strong> at a company you can trust, you should be fine hardware-wise, as long as you don't run out of resources.</p>

<p>Of course, software is a far more important factor here. VPSes should be considered untrusted, as there's software running on the machine that you cannot control. As I already mentioned, don't run the webserver on the same machine where the wallets are stored, because a programming error can probably allow attackers to access those wallets.</p>

<p>Don't assume that network traffic between your servers is safe: a routing error or packet interception can cause a lot of trouble for you. Always encrypt traffic between the machines.</p>

<p>Don't trust closed-source software, and don't use beta quality software. They tend to contain more bug than open source software used by lots of people.</p>

<p>Always assume that your own code sucks. This is a very important part. Even if you're an extremely good software developer who has ten years of experience with security, you're going to make mistakes in your code. These things can be code injections that allow attackers to steal password, exploits that allow attackers to view the source code, etc.</p>

<p>But the most important part is that if you read this answer and learn new things about security, you shouldn't be starting a bitcoin exchange. You are dealing with people's money here, and if this answer taught you anything new, you definitely don't know enough about security to start a bitcoin exchange.</p>

CC BY-SA 3.0
2013-05-17T21:31:37.927Z
Thanks for the answer! I plan to store most of the coins in cold storage is that what you mean by not having the webserver on the same machine as the wallets are stored. If bitcoind isn't on the same server as Apache, isn't that going to cause overhead and latency having bitcoind on a separate machine?
user1796995
CC BY-SA 3.0
2013-05-17T21:32:24.743Z
Also, if you could recommend a trustworthy company to supply a dedicated server I could hire that would help me. What do you make of dedipower/pulsant in the UK? :)
user1796995
CC BY-SA 3.0
2013-05-17T21:38:55.323Z
Websites like Facebook and Twitter aren't served from a single machine either, do they seem slow? ;-) About cold storage: I mean storing them on different servers. And of course as little in RAM as possible, even when stored on another machine.
Tom van der Woerdt
CC BY-SA 3.0
2013-05-17T21:26:05.523Z
2013-05-17T21:26:05.523Z
Tom van der Woerdt
<p>I was looking at Amazon Web Services recently but they are based in the US - maybe not a good idea following what happened with mtgox.</p>

<p>I then looked at Linode as they have a pretty solid reputation, but I am concerned with the security issues they have had (bitcoinica lost all their funds because someone hacked the actual Linode admin panel, and I am still seeing security issues on their news in 2013).</p>

<p>I have what I think is a novel idea for an exchange and want to try and get a toy hobby project up and running... but how do you choose a server with good ram so it handle a surge in traffic? The ones I listed above are examples of what I don't want.</p>

CC BY-SA 3.0
2013-05-17T21:09:58.493Z
If you don't know what you're doing (which you obviously don't), don't start an exchange.
Tom van der Woerdt
CC BY-SA 3.0
2014-05-04T19:34:11.610Z
@Jacob Torba: I re-focused the question to deal with how to choose a good service, relegating "individual" services to the role of examples, and wonder if the question can be reopened it is current form.
Tom Au
<exchanges>
How do you make a good choice of server host to run an exchange on?
user1796995
# How do you make a good choice of server host to run an exchange on?

(Asked by: username_0 on 2013-05-17)

I was looking at Amazon Web Services recently but they are based in the US - maybe not a good idea following what happened with mtgox.

I then looked at Linode as they have a pretty solid reputation, but I am concerned with the security issues they have had (bitcoinica lost all their funds because someone hacked the actual Linode admin panel, and I am still seeing security issues on their news in 2013).

I have what I think is a novel idea for an exchange and want to try and get a toy hobby project up and running... but how do you choose a server with good ram so it handle a surge in traffic? The ones I listed above are examples of what I don't want.

**Tags:** exchanges

> **Comments:**
> **username_1**: If you don't know what you're doing (which you obviously don't), don't start an exchange.  
> **username_2**: @Jacob Torba: I re-focused the question to deal with how to choose a good service, relegating "individual" services to the role of examples, and wonder if the question can be reopened it is current form.  

---

## 1 answers

### Answer by username_1 on 2013-05-17. Score: 4

First of all, don't even consider using VPSes for these things. As long as there's a layer above the OS that can be hacked, the data cannot be safe.

Also, if things are going to be safe, you're going to need at least several machines. The machine that stores the bitcoin wallet information shouldn't be connected directly to the internet, and should not run on the machine that also handles the website.

As long as your server is an actual **physical server** at a company you can trust, you should be fine hardware-wise, as long as you don't run out of resources.

Of course, software is a far more important factor here. VPSes should be considered untrusted, as there's software running on the machine that you cannot control. As I already mentioned, don't run the webserver on the same machine where the wallets are stored, because a programming error can probably allow attackers to access those wallets.

Don't assume that network traffic between your servers is safe: a routing error or packet interception can cause a lot of trouble for you. Always encrypt traffic between the machines.

Don't trust closed-source software, and don't use beta quality software. They tend to contain more bug than open source software used by lots of people.

Always assume that your own code sucks. This is a very important part. Even if you're an extremely good software developer who has ten years of experience with security, you're going to make mistakes in your code. These things can be code injections that allow attackers to steal password, exploits that allow attackers to view the source code, etc.

But the most important part is that if you read this answer and learn new things about security, you shouldn't be starting a bitcoin exchange. You are dealing with people's money here, and if this answer taught you anything new, you definitely don't know enough about security to start a bitcoin exchange.

> **Comments:**
> **username_0**: Thanks for the answer! I plan to store most of the coins in cold storage is that what you mean by not having the webserver on the same machine as the wallets are stored. If bitcoind isn't on the same server as Apache, isn't that going to cause overhead and latency having bitcoind on a separate machine?  
> **username_0**: Also, if you could recommend a trustworthy company to supply a dedicated server I could hire that would help me. What do you make of dedipower/pulsant in the UK? :)  
> **username_1**: Websites like Facebook and Twitter aren't served from a single machine either, do they seem slow? ;-) About cold storage: I mean storing them on different servers. And of course as little in RAM as possible, even when stored on another machine.  

---

