"Ethereum is a descendant of the Bitcoin protocol, and improves on Bitcoin’s design"
Misleading statement
A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
31–40 of 440 posts
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#32Earlier quoted context omitted.
One thing I've never understood about the one-time pad: How do you guarantee the third condition? Wouldn't you eventually run into the birthday problem if you sent enough messages?
Yes, so the rule is slightly misstated. Assuming that your messages are all under n bits and you always use an n-length pad, you will reuse the same pad approximately once every 2^n messages. Not coincidentally, 2^n is also the number of possible one-time pads there are, so your adversary gains no information from this fact.
> Not coincidentally, 2^n is also the number of possible one-time pads there are, so your adversary gains no information from this fact.
Yes! And this is what's critical to the success of the one-time pad: you've not just encrypted data, you've encrypted data in such a fashion that (from the attacker's perspective), all plaintexts they recover are equally likely. Cryptanalysis is fundamentally impossible.
The information theory is absolutely groovy, but the application of it is unfortunately impractical.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#33Earlier quoted context omitted.
I know I'm this situation the dev made a simple mistake, but I wonder if Ethereum is safe as a system assuming developers will make many mistakes, and those mistakes will happen more often as more complicated contracts are written. At some point I wonder if the idea of smart contracts is better than a traditional system, since they seem prone to developer error due to complexity.
> I know I'm this situation the dev made a simple mistake, but I wonder if Ethereum is safe as a system assuming developers will make many mistakes, and those mistakes will happen more often as more complicated contracts are written. This will probably come off as being assholish, but I honestly don't mean it to be: you should read the rest of the article. It actually covers this topic in depth and has good thoughts…
The rest of the article amounts to a few points:
- Humans make mistakes, the tools should have been better
- The technology to make Ethereum safe doesn't really exist
- We should work to make that technology exist
- We should be happy this happened since it raises awareness about the problem
> In the end, attacks like this are good for the community. They call you to your senses and force you to keep your eyes open.
What?!
Listen, just because Valgrind exists doesn't mean you can't accidentally write a C program with memory errors. Just because Rust protects against race conditions doesn't mean you can't have bugs in your threading code. We're not even close to a world where tools can offer amazing protection.
> The developer here was Gavin Wood, one of the co-creators of Ethereum, and the inventor of Solidity, the smart contract programming language. The code was also reviewed by other Parity contributors. This is basically the highest standard of programming that exists in the Ethereum ecosystem.
This was an error made by the best of the best, reviewed by the best of the best. The tools that will save us from this madness don't exist. What does this mean for Joe Developer? It means he's not going to build something that he keeps anything of value on. The author's cheery "we'll be stronger for this!" attitude completely neglects the obvious chilling effect that this is having. If the guy that invented the damn thing can't protect his $31 million dollars, why would I even try to build something that could manage even hundreds of dollars?
And to that end, is it really better than a traditional system?
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#34Nothing was stolen. All I see is a programmer abiding by the contracts.
.. and this wasn't even the first time. And this is all by design.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#35previous discussion: https://news.ycombinator.com/item?id=14807779
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#36"smart contracts can also do things that normal contracts can’t, such as enforce a set of rules entirely through unbreakable cryptography." Isn't "unbreakable" a bit of a dirty word in the security community? Is there really such a thing as "unbreakable cryptography"?
"Is there really such a thing as "unbreakable cryptography"?"
Yes. One time pads are unbreakable.
"Even after the aliens from Andromeda land with their massive spaceships and undreamed-of computing power, they will not be able to read the Soviet spy messages encrypted with one-time pads (unless they can also go back in time and get the one-time pads)." (Bruce Schneier, Applied Cryptography)
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#37> In the end, attacks like this are good for the community.
I'm sorry, but what a bunch of baloney.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#38Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established. Our community cannot continue operating in the hacker mode wherever money is involved.
I think you're vastly underestimating the number of deadly mistakes doctors and lawyers and other such licensed professionals make every day. Just look at Enron!
Maybe such a system would keep out the very worst programmers but I doubt someone hacking on Ethereum smart contracts falls into that bucket anyways.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#39Earlier quoted context omitted.
> I know I'm this situation the dev made a simple mistake, but I wonder if Ethereum is safe as a system assuming developers will make many mistakes, and those mistakes will happen more often as more complicated contracts are written. This will probably come off as being assholish, but I honestly don't mean it to be: you should read the rest of the article. It actually covers this topic in depth and has good thoughts…
The rest of the article amounts to a few points: - Humans make mistakes, the tools should have been better - The technology to make Ethereum safe doesn't really exist - We should work to make that technology exist - We should be happy this happened since it raises awareness about the problem > In the end, attacks like this are good for the community. They call you to your senses and force you to keep your eyes open.…
[deleted]
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#40Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established. Our community cannot continue operating in the hacker mode wherever money is involved.
That just makes the price of a "programmer" go up. And the normal people responsible for putting together said requirements know that in the end it would just make their IT costs go up, so therefore they don't (which is fine with me)
Or work move to countries without red tape around the job. Unlike masonry, software is easily shipped.