Ethereum Contracts Are Going to Be Candy for Hackers • Hacker News Board

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#71

Post by easytiger » Thu, May 19, 2016, 10:52 AM UTC

fragsworth wrote: post #21

kneel wrote: post #3

Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin) The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a conc…

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fear seems to stem from misunderstanding how Ethereum works or what it even is. Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or comple…

> effectively error-free - probably as good as the Linux kernel

I encounter major glaring issues as well as continual regressions in the linux kernel on weekly basis. I don't even know what you mean by as correct as the linux kernel

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#72

Post by pjc50 » Thu, May 19, 2016, 11:55 AM UTC

dmix wrote: post #12

Don't these contracts existing in a market? If one contract is flawed won't customers flock to another competing one? This would create an incentive for quality control. Or is the proposed problem that these flaws are unavoidable or too costly to prevent? I could see the high-investment cost being a deterrent for developers to adopt the platform. In general the contract code should be as simple as possible and memory…

If one contract is flawed won't customers flock to another competing one?

Market is small so competition won't be strong; customers aren't professional security reviewers, so have no idea about flaws. What's most likely to happen is people putting money in and then losing it when an attacker discovers the flaw. That will put people off the whole smart contracts concept.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#73

Post by eggy » Thu, May 19, 2016, 12:46 PM UTC

c2340596 wrote: post #69

eggy wrote: post #59

Earlier quoted context omitted.

Handful is a bit extreme ;) But seriously, it is easy to troubleshoot due to the interative nature of development in the REPL, the similiarity with mathematical formula and their layout. A PhD student wrote his thesis in 2008 about parallelization, FPGAs, ASICS and arrays, and was fully intending to write it in J, but his advisor suggested something more known, so he wrote it in Haskell. I'll put in the reference whe…

"it is easy to troubleshoot due to the interactive nature" isn't going to cut it. You cannot change the code of an etherum contract after the fact. Once it's used there is no second chance.

Thanks for bringing it back to the OP's topic, but I was specifically addressing the quote the OP made about number of errors per LOC tally. I was pointing out how it could be weak metric, since the languages used in the examples might contain many LOC of template boilerplate that would make for a low bug:LOC off the bat.

An ADA hello world is 5 LOC vs. 1 for a lot of other languages.

Java is not too different.

J and Python are 1 LOC, and typically not template text, but originally coded.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#74

Post by ChemicalWarfare » Thu, May 19, 2016, 1:53 PM UTC

kneel wrote: post #3

Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin) The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a conc…

To top that off - a relatively simpler Bitcoin software is maintained by a team of well known developers with all the typical artifacts and cycles associated with enterprise software development - release notes, testing etc etc.

I'm sure the Ethereum team does the same but then when it comes to DAPPs and Contracts running on their VMs and potentially trying to compromise the underlying system things are way too fuzzy for now.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#75

Post by cjbprime » Thu, May 19, 2016, 4:06 PM UTC

kneel wrote: post #3

Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin) The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a conc…

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening.

Are you aware of the $155M USD people have sent to https://daohub.org using (depending on) Ethereum?

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#76

Post by descript » Thu, May 19, 2016, 7:15 PM UTC

fragsworth wrote: post #21

kneel wrote: post #3

Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin) The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a conc…

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fear seems to stem from misunderstanding how Ethereum works or what it even is. Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or comple…

Ethereum faces a similar situation as counter-terrorism: There only needs to be one sizeable incident that slips through the cracks for confidence to be shot.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#77

Post by kneel » Thu, May 19, 2016, 8:18 PM UTC

cjbprime wrote: post #75

kneel wrote: post #3

Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin) The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a conc…

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Are you aware of the $155M USD people have sent to https://daohub.org using (depending on) Ethereum?

Are you aware that the Dao was created by employees from slock.it and the Dao's first project is to fund a project from slock.it?

Anyone who did 20 minutes of due diligence would be scratching their head at this.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#78

Post by dang » Thu, May 19, 2016, 8:34 PM UTC

c2340596 wrote: post #69

eggy wrote: post #59

Earlier quoted context omitted.

Handful is a bit extreme ;) But seriously, it is easy to troubleshoot due to the interative nature of development in the REPL, the similiarity with mathematical formula and their layout. A PhD student wrote his thesis in 2008 about parallelization, FPGAs, ASICS and arrays, and was fully intending to write it in J, but his advisor suggested something more known, so he wrote it in Haskell. I'll put in the reference whe…

"it is easy to troubleshoot due to the interactive nature" isn't going to cut it. You cannot change the code of an etherum contract after the fact. Once it's used there is no second chance.

Please don't create many obscure throwaway accounts on HN.

This forum is a community. Anonymity is fine here, but users should have some kind of consistent identity that other users can relate to. Otherwise we might as well have no usernames and no community at all, and that would be an entirely different forum.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#79

Post by cjbprime » Thu, May 19, 2016, 10:10 PM UTC

kneel wrote: post #77

cjbprime wrote: post #75

Earlier quoted context omitted.

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Are you aware of the $155M USD people have sent to https://daohub.org using (depending on) Ethereum?

Are you aware that the Dao was created by employees from slock.it and the Dao's first project is to fund a project from slock.it? Anyone who did 20 minutes of due diligence would be scratching their head at this.

Yes. I don't think they put in $155M, though. Which means they can't force such a project through unilaterally.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#80

Post by anonbanker » Sat, May 21, 2016, 2:47 AM UTC

dmix wrote: post #35

geographomics wrote: post #30

Earlier quoted context omitted.

Hopefully a lot better than the Linux kernel: http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html...

Linus doesn't view security bugs as a special category of bugs. So he doesn't prioritize them they way most infosec people would like them to. The lack of a strong security advocate in their leadership is largely the reason why Linux isn't the best example. The other big reason being that it's a giant blob of C and a large attack surface. All of these factors could be easily avoided or simply don't exist for an Ether…

don't forget the fact that he was approached by the NSA to insert backdoors into linux, a fact his father testified to on the record before EU parliament[0].

0. http://falkvinge.net/2013/11/17/nsa-asked-linus-torvalds-to-...