211–220 of 629 posts
I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition. Isn't…
[1] https://blog.ethereum.org/2016/06/10/smart-contract-security...
Earlier quoted context omitted.
Majority is consensus?
It has been proven impossible to reach full consensus at scale in a fully decentralized, asynchronous system (the FLP theorem). So, in computer science terms, consensus algorithms are about approximating distributed consensus in the face of benign and malicious threats or communication failures, which devolves to "quorum / majority" pretty quickly in a crisis. After the crisis, some kind of compensation, reconciliati…
ETH is advising, "Contract authors should ... be very careful about recursive call bugs, and listen to advice from the Ethereum contract programming community," which indicates there's some subtle behaviors to be aware of and secure contracts are apparently not easy to write.
Lest you think, "we'll just be careful, review and QA it", consider the bug[1] in the "Programming Pearls" binary search. Bentley was clearly an expert who had proven the algorithm correct and the algorithm had 20 years of careful study by thousands of professionals. Yet it had a simple overflow.
How do _you_ know your contract is secure?
1. https://research.googleblog.com/2006/06/extra-extra-read-all...
Can someone eli5 what DAO and ethereum are?
For example, you could upload a contract that lets some specific set of accounts withdraw money unless the balance goes under 500 ETH (which is the basic Ethereum currency).
"The DAO" is such a contract but with more complex logic that amounts to a kind of venture fund. If you send money into it, you get to vote in proportion on proposals for "The DAO" to fund projects.
That contract was hyped enormously as the future of financing etc and indeed received an enormous amount of ETH from people who hoped it would benefit the Ethereum ecosystem.
In the first weeks after its recent launch, the contract logic was shown to have economic flaws that would most likely lead to bad fund performance, and it seemed as if the incentives for voting on proposals didn't work: no proposal ever made it past the threshold.
And now it turns out that despite the assurance of security audits, the logic (written in Ethereum's contract language Solidity) had a serious bug that allowed an attacker to start draining all of the fund's assets.
I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition. Isn't…
Earlier quoted context omitted.
Actually, I'd say the fact that he has to publicly ask for exchanges to stop the trades, and can't simply press a button or send out an order, shows the decentralization. Decentralization doesn't prevent coordination.
I think you're missing the point. The fact that one man can bring the whole of Ethereum trading to a halt with an announcement really demonstrates just how much power he has. So it doesn't matter that he doesn't have a physical kill switch if the end result is the same.
I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition. Isn't…
This argument can be made for most/all software vulnerabilities.
I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition. Isn't…
This argument can be made for most/all software vulnerabilities.
I the DAO case I am not aware of any regulations or laws that the "attacker" has broken.