Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

medium.freecodecamp.org

Post reply on HN
Print view View original

91–100 of 440 posts

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#91

Post by mbrock »

owenversteeg wrote: post #52

I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…

I'm not sure premise 1 is true. The most useful smart contracts so far are tokens and multisigs, and those are definitely simple enough to do right (if you don't make a major blunder like the Parity team did).

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#92

Post by mdekkers »

As an aside, every time I see a headline with "Hacker" and an image of a hoodie with binary and mostly dark colour tones, my expectation of the quality of content to follow drops significantly.

Having said that, the actual article is pretty good...

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#94

Post by [deleted] »

tlrobinson wrote: post #59
owenversteeg wrote: post #52

I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…

Is formal verification of contracts feasible? Is anyone working on it? Also, here's a possibly crazy idea: could one create bug bounties for algorithms (or even arbitrary software) on the Ethereum blockchain by writing the algorithm into a contract such that if you somehow break it you receive the bounty? An example of this would be the massive implicit bounty currently placed on the crypto algorithms (SHA256, ECDSA/…

[deleted]

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#95

Post by EdSharkey »

danblick wrote: post #27
EdSharkey wrote: post #12

Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established. Our community cannot continue operating in the hacker mode wherever money is involved.

What you are proposing: (1) Is bad economics. In most cases, getting rid of occupational licensing would create wealth. To take law/lawyers as an example, see http://www.econtalk.org/archives/2011/09/winston_on_lawy.htm... (2) Would have the practical effect of taking away my livelihood and ability to work. Would have radically altered my life, personally, for the worse.

Status quo sounds like it's your thing, which is cool.

I just want to posit that the world doesn't care about what we, the developer community, thinks. All they care about is what we DO. And, if we're going to keep acting like unethical mercenaries, and then something truly tragic happens (like mass deaths) as a result of our mistakes or malice, then your livelihood will be affected anyways.

So, do you want to get ahead of this thing and define the parameters of our reordering? Or, would you like some clueless politicians and bureaucracies to decide our fate?

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#96

Post by mbrock »

noobermin wrote: post #66
xfer wrote: post #49

Earlier quoted context omitted.

> We're not even close to a world where tools can offer amazing protection. I wonder how do you ride your plane then? > The tools that will save us from this madness don't exist. These tools do exist(not with ethereum ofc). They are harder to work with, which should be a non-issue for writing contracts.

>I wonder how do you ride your plane then? When I was in physics undergrad, I remember talking to engineering students taking statics. In general physics, we were allowed to make simple numerical errors, the emphasis then was on figuring out the solution and understanding the physics. My friends on the other hand complained how they, after acing gen. physics, would get mercilessly docked off points for minor arithmet…

That means there is an entrepreneurial prospect for you to enter the space with a team that has a more serious background, right? Eventually people will generally understand that contracts require serious correct engineering, and you'll be able to capitalize on expertise.

Smart contracts have only been generally available for like a couple of years. Most people are clueless about how to do them properly. That means it's an interesting thing to work on! And hopefully we'll steer the ship towards safety, correctness, and simplicity.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#97

Post by jacquesm »

buzzybee wrote: post #73
owenversteeg wrote: post #52

I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…

Regarding smart contracts and other inventions of cryptocurrency: I think, most of all, the crypto market is absolutely vicious, in a way that both capital markets and technology companies haven't seen(in the public eye) for many, many years. As of right now there's still some faith left that Ethereum is going to go places because firms keep trying to use the technology on the basis of hype. Unlike with most overhype…

> This is like if Apple and Google had daily columns on the front page showing every bug or support issue that they experienced in the past 24 hours.

It will never happen, but that's actually a great idea.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#98

Post by JohnJamesRambo »

As an Ethereum investor, this hack has shaken my belief in Ethereum ever making sense as an ecosystem. Smart contracts which will always be fallible plus irreversible blockchain transactions seems like a peanut butter and tuna fish sandwich.

I moved my money out of Ethereum for now.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#99

Post by jacquesm »

wildmusings wrote: post #69
eridius wrote: post #58

Earlier quoted context omitted.

> This isn't a normal loss by the way, where you can prosecute someone or sue somebody. No, this is the instant, digital theft of the entire value of the contract, to an anonymous digital address where it will be quickly blended in with hundreds of millions of dollars of similar thefts a month. Also worth pointing out that a non-trivial number of people would say that no theft at all has occurred, as the smart contra…

That's a fascinating point. Can any lawyers comment on how the law might see this?

The whole point of smart contracts is that lawyers' (and judges) opinions are not relevant. As soon as you need them and they have some power to make the thing go one way or the other the whole smart contract concept has failed.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#100

Post by wildmusings »

jacquesm wrote: post #99
wildmusings wrote: post #69

Earlier quoted context omitted.

That's a fascinating point. Can any lawyers comment on how the law might see this?

The whole point of smart contracts is that lawyers' (and judges) opinions are not relevant. As soon as you need them and they have some power to make the thing go one way or the other the whole smart contract concept has failed.

As long as real people can be hauled before a real court, judges and lawyers--but more importantly, the law--will be highly relevant.
Post reply on HN