Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deconstructing the DAO Attack: A Brief Code Tour

vessenes.com

Post reply on HN
Print view View original

111–120 of 167 posts

Re: Deconstructing the DAO Attack: A Brief Code Tour

#111

Post by wyager »

RobertoG wrote: post #66

I'm going to be a little polemic here. It's this an attack? It's not the problem that those technologies try to solve, to get rid of subjectivity?. In a way, this could be interpreted as trying to be free of politics. If my understanding of what they are trying to accomplish here is correct, if the system allow it, then, by definition, it's legal. If you require a framework where something allowed by the code but wit…

You're being thoroughly downvoted, but I don't see anything wrong with your argument. The person who pulled off this "hack" was following all the rules. In fact, I could even see the argument that by undoing this transaction, the people who started the DAO are in fact going back on their word. They promised that they would build a system which would obey certain rules. By undoing this transaction, they are no longer following those rules. Now, obviously there's a strong argument for rolling back the transactions, but at this point ethereum has lost any claim to objectivity or decentralization.

Re: Deconstructing the DAO Attack: A Brief Code Tour

#112

Post by jacquesm »

whazor wrote: post #108
jacquesm wrote: post #77

Earlier quoted context omitted.

> Buterin is now more busy with sharding and scaling issues. Those are currently not the issues that require attention. You can make it as fast and as large as you want, if it is broken at the root that's all pointless. First walk, then run. I'd be more impressed with a much smaller system without sharding and massive scaling properties if it was bullet proof.

Ethereum is a turing machine that runs code, programming languages are more high level. Creating an ADA-like language is trivial compared to making a scalable blockchain that supports computation. Ethereum itself is more bullet proof, as there are multiple implementations and the description of the protocol better defined and has proofs inside.

> Ethereum is a turing machine that runs code

That's the whole problem in a nutshell. I highly doubt that is the road to a viable solution but I'm patient enough to be proven wrong in the longer term. But anything that is Turing complete automatically implies that anything layered on top of it will incorporate such niceties as being impossible to formally verify due to the halting problem.

In other words: the only way to establish whether or not the code will try anything funny is to run it.

Re: Deconstructing the DAO Attack: A Brief Code Tour

#113

Post by fabled_giraffe »

dang wrote: post #96
fabled_giraffe wrote: post #49

Earlier quoted context omitted.

> it is a community that gathers and discusses news that is relevant to people who are starting or funding new companies, mostly in the information technology sector. Been here since 2007 off and on. Usually don't use same user because I quit HN periodically due to philosophical differences, and I don't care about HN user karma or the ability to downvote. It's been my experience that people here have many interests,…

One "philosophical difference" that you need to know about is that comments like these aren't allowed here: > I know I'll get napalmed for saying this > And if you downvote this, tell me why, otherwise I'll just assume you are with those that want to exploit me and others. Please reread the HN guidelines, particularly the last two: https://news.ycombinator.com/newsguidelines.html . If you're going to comment here, pl…

I'm sorry, I was unaware of that guideline.

Here are some you might be unfamiliar with:

'When disagreeing, please reply to the argument instead of calling names. E.g. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."'

'Please don't submit comments complaining that a submission is inappropriate for the site. If you think a story is spam or off-topic, flag it by clicking on its 'flag' link. If you think a comment is egregious, click on its timestamp to go to its page, then click 'flag' at the top. (Not all users see flag links; there's a small karma threshold.)'

Thanks.

Re: Deconstructing the DAO Attack: A Brief Code Tour

#114

Post by fabled_giraffe »

fabled_giraffe wrote: post #6

I know I'll get napalmed for saying this, but why is this all over HN? Why are people obsessed with cryptocurrencies? It's bad enough that those with sufficient computing speed/power can already rip off the stock market; why does the world need another way for people to rip each other off? Since we've determined over history that some people will take advantage of weakness for their own gain, no matter what system yo…

I'm sorry for violating an HN guideline by saying "I know I'll get napalmed for saying this". I was not aware of that guideline, and have been in the HN community for about nine years now.

Re: Deconstructing the DAO Attack: A Brief Code Tour

#115

Post by fabled_giraffe »

dang wrote: post #98
draw_down wrote: post #36

Earlier quoted context omitted.

And funny!

A number of internet forums have branched off from HN to fill niches that HN doesn't fill. I'm beginning to think that somebody needs to fork a forum for Schadenfreude. We don't want comments like this here.

Looking at your comments- it seems like for all of your karma, you generate a lot of content on HN that is strictly policing: https://news.ycombinator.com/threads?id=dang

Just imagine if you will if all members of the site created similar comments constantly. That would hide all of the discussion relevant to the topics being discussed.

But, I agree with what you said- I don't like it when people enjoy suffering either. I just think that possibly the best way to handle it would be to just ignore those posts, as you might elicit more response from them.

Re: Deconstructing the DAO Attack: A Brief Code Tour

#116

Post by jhildings »

fabled_giraffe wrote: post #6

I know I'll get napalmed for saying this, but why is this all over HN? Why are people obsessed with cryptocurrencies? It's bad enough that those with sufficient computing speed/power can already rip off the stock market; why does the world need another way for people to rip each other off? Since we've determined over history that some people will take advantage of weakness for their own gain, no matter what system yo…

It's a very interesting combination of a lot of HN related subjects. Like networking, cryptoanarchism, decentralisation , computer science and scaling problems, cryptographic solutions and finance platforms.

What not to like about reading about news and opinions about this ? I find the current obsession with deep learning/AI here much more uninteresting

And also, just read the first word of the name. HACKER news, which is very self explanatory

Re: Deconstructing the DAO Attack: A Brief Code Tour

#117

Post by rbobby »

jacquesm wrote: post #2

Whoever thought it was a good idea to have case sensitive function names where the names are allowed to be identical but not identical in function? Major fuck-up there. That should have never passed the concept stage, nor the review stage. Function names should describe what a function does.

Case sensitivity in any programming language is crazy. I can't for the life of me see a valid engineering principal that accepts IsTheOne() and istheone() being different bits of code. Oh sure at a technical level the computer has no problem with... the problem is restricted to those oh so error prone humans.

Can anyone here honestly say that if they were doing a code review they'd agree that solely a difference in case would get their approval?

And don't even get me started on filenames that only differ by case. If that's a good idea then I think trailing whitespace should be significant too!!!

Re: Deconstructing the DAO Attack: A Brief Code Tour

#118

Post by pvg »

fabled_giraffe wrote: post #115
dang wrote: post #98

Earlier quoted context omitted.

A number of internet forums have branched off from HN to fill niches that HN doesn't fill. I'm beginning to think that somebody needs to fork a forum for Schadenfreude. We don't want comments like this here.

Looking at your comments- it seems like for all of your karma, you generate a lot of content on HN that is strictly policing: https://news.ycombinator.com/threads?id=dang Just imagine if you will if all members of the site created similar comments constantly. That would hide all of the discussion relevant to the topics being discussed. But, I agree with what you said- I don't like it when people enjoy suffering eithe…

dang is a moderator of HN.

Re: Deconstructing the DAO Attack: A Brief Code Tour

#119

Post by jsprogrammer »

rbobby wrote: post #117
jacquesm wrote: post #2

Whoever thought it was a good idea to have case sensitive function names where the names are allowed to be identical but not identical in function? Major fuck-up there. That should have never passed the concept stage, nor the review stage. Function names should describe what a function does.

Case sensitivity in any programming language is crazy. I can't for the life of me see a valid engineering principal that accepts IsTheOne() and istheone() being different bits of code. Oh sure at a technical level the computer has no problem with... the problem is restricted to those oh so error prone humans. Can anyone here honestly say that if they were doing a code review they'd agree that solely a difference in c…

IsTheOne() and istheone() are different bits of code.

Re: Deconstructing the DAO Attack: A Brief Code Tour

#120

Post by graup »

amaks wrote: post #95

The biggest problem I see with the code at https://github.com/slockit/DAO/ is absense of the unit tests. The code looks complex, how the hell can you make sure that it's right? The Solidity wiki doesn't have a single entry on testing either: https://github.com/ethereum/wiki/wiki/The-Solidity-Programmi...

The repo you linked does have a "tests" directory. It contains "scenarios", so not really unit tests.

You can't really unit-test contracts at the moment.

Post reply on HN