Zcoin implementation bug enabled attacker to create over 500K Zcoins • Hacker News Board

Re: Zcoin implementation bug enabled attacker to create over 500K Zcoins

#221

Post by Shorel » Wed, Mar 08, 2017, 9:08 PM UTC

aij wrote: post #201

CyberDildonics wrote: post #194

Earlier quoted context omitted.

Hello world in Rust is still 2.5MB if you statically compile all the libraries in since it doesn't strip unused functions. The tools and ecosystem are nowhere near what they are for C++

> Hello world in Rust is still 2.5MB if you statically compile all the libraries in Still? Since when? Last I checked it was 661kB for Rust vs 829kB for C, and that was quite a while ago. http://stackoverflow.com/a/29461455/2343847

What? I have done hello world in C at about 4kB. You may be confusing C with C++.

Re: Zcoin implementation bug enabled attacker to create over 500K Zcoins

#222

Post by easytiger » Thu, Mar 09, 2017, 8:11 AM UTC

lmm wrote: post #102

easytiger wrote: post #101

Earlier quoted context omitted.

This bug had nothing to do with c++ and its ergonomics, let alone it's safety. > Unfortunately when populating the denomination member variable, an equality operator was used instead of assignment, resulting in the denomination always being zero, as set in the class constructor. So = Vs ==

That is absolutely a bug in C++'s ergonomics. Languages that use pascal-style := for assignment would not have this problem. Languages that don't have the surprising value behaviour of = would not have this problem. Hell, even as crude a language as Java would not have this problem because it doesn't allow an integer to implicitly decay to a boolean. Building with warnings on would also have caught it, but the fact t…

> Languages that use pascal-style :=

So, just as in c++ there is a different operator of assignment and equality that requirs you to type a different thing. User error and testing failure.

Re: Zcoin implementation bug enabled attacker to create over 500K Zcoins

#223

Post by lmm » Tue, Mar 14, 2017, 3:07 PM UTC

easytiger wrote: post #222

lmm wrote: post #102

Earlier quoted context omitted.

That is absolutely a bug in C++'s ergonomics. Languages that use pascal-style := for assignment would not have this problem. Languages that don't have the surprising value behaviour of = would not have this problem. Hell, even as crude a language as Java would not have this problem because it doesn't allow an integer to implicitly decay to a boolean. Building with warnings on would also have caught it, but the fact t…

> Languages that use pascal-style := So, just as in c++ there is a different operator of assignment and equality that requirs you to type a different thing. User error and testing failure.

The difference is that it's a visually different operator and much harder to type accidentally.