Live data from Hacker News

A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

medium.freecodecamp.org

231–240 of 440 posts

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#231
I'm sort of confused[1] that formal proofs are not mandatory tools in this space. There's some Herculean effort underway[2] to create verified HTTPS stack. The failure mode in that case is maybe, sort of data leakage or server control that might be worth something to someone. In the Etherium case, they just walk away with cash. It takes a sort of hubris (or is it foolishness?) to think you can just be very very careful and it will all work out okay.

[1] Actually, its more schadenfreude, partly with the audacity of the speculator and system market makers, and partly at the mindless waste these proof of work/stake systems require.

[2] https://project-everest.github.io/

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#232
post #46
post #11

Earlier quoted context omitted.

> Isn't "unbreakable" a bit of a dirty word in the security community "Dirty" is one way to put it, yes. I'd personally use something like "false god" or "blasphemy" :). "Unbreakable" is a naive way of describing cryptographic algorithms, because it preempts conversations about intractability assertions or complexity analysis...modern cryptography accepts as a premise that "unbreakable" is not a reasonable goal, whic…

Those are not sufficient conditions for a one-time pad. The entire pad, not just some "seed" has to be random. The pad cannot ever be reused even with a different plaintext. Breaking a one-time pad that's been used twice is not very hard. It's equivalent to recovering two texts which have been XORed together, which is not hard for English. One time pad systems are used regularly for high-security embassy-to-State Dep…

> Those are not sufficient conditions for a one-time pad. The entire pad, not just some "seed" has to be random.

Well that seems a bit pedantic, but yes, you're right. The difficulty I was focusing on however is the randomness itself, not how far it has to be extended. Ostensibly once you've incorporated a non-deterministic seed (which is necessarily external) into your process, you can extend it to the pad itself. The pad itself will just be a stream of that data, like a non-deterministic stream cipher. I get the impression you're aware of this already though, so I won't belabor it.

> One time pad systems are used regularly for high-security embassy-to-State Department communications. Since there are also secure couriers between those locations, there's a way to distribute key material. With today's storage densities, carrying key material around is easy.

Fair enough, I'll concede they have practical uses in situations where there are couriers and extremely high security requirements. That's about all they're practical for, though :)

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#233

Earlier quoted context omitted.

Your Whig history of an ever progressing political system is not accurate in my opinion. I've written this comment before, and I'll repeat it as it's relevant to your comment: Societies have gradually grown more unfair as the political system has strained under their growing complexity. According to political scientists, the average voter has an extremely limited understanding of what their government is doing. The t…

> Your Whig history As this point you've already lost everyone who doesn't already ready the same pamphlets you read and agree. Either because they have read those pamphlets and eye-roll, or because they haven't and figure you're a rambling extremist. It's literally equivalent to communists beginning propaganda pieces with "Attention all Comrades!" That said, I disagree with you, so feel free to keep talking this way…

>As this point you've already lost everyone who doesn't already ready the same pamphlets you read and agree.

Usage of the term "Whig history" is not confined adherents of a particular ideology, and does not require one to have/not-have any particular set of beliefs to use it (other than believing that the history of some institution is not a story of progress)..

In other words, it's not comparable to "comrade".

>Appealing to this fact in a thread about cryptocurrency is beyond ironic.

There's a subtext that you're missing here, which is that the political system doesn't work when voters don't understand the system, which is unlike most domains, which manage complexity effectively.

For example, most people don't understand how microprocessors work. But this is addressed through an effective and spontaneous process of delegating responsibility.

The political process differs in this respect. The delegation process is baked in, as a result of built-in mechanisms that actively resist change. This prevents the kind of readjustment that occurs in other institutions. Meanwhile, those affected by policy are a captive audience, which eliminates a major feedback mechanism that exists in market-based systems.

These two factors result in the system as a whole not evolving toward greater efficacy. On the contrary, it has the potential to evolve toward greater exploitation.

>Political power will flow from the arrangement of bits only when the arrangement of bits determines who controls overwhelming military force. And not a moment before.

We'll see.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#234
post #197

Earlier quoted context omitted.

> the law should not be able to influence the outcome of a smart contract You don't seem to understand how the law works. The problem isn't a judge trying to interfere with any of the technical features of the contract. A judge would rule on the legality of the contract as the law sees it[1]. You will be able to argue that the code is the final authority. You will probably also have to show why the other party knew a…

This all assumes that you know your counterparty, which isn't necessarily the case. You could simply reduce your argument to 'in situations where you use a smart contract where a normal contract would suffice a judge has their usual powers'. But that wasn't the point I was making. Smart contracts will most likely be used in all kinds of situations where a judge does not have their normal powers, hence the reliance on…

Even if you can rely on the courts, smart contracts could still make themselves useful, since the costs for enforcement are lower. Until your interpretation of the contract and its implementation disagree, which is when you start your costly litigation spree, assuming you have an idea of who to sue.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#235
post #89

Earlier quoted context omitted.

quicksort? cat? ls? I mean some of these things have bugs still, but generally when you have something of fixed scope then there are less bugs over time. Especially if you're restricting your scope to something simple

Very many implementations of quicksort are vulnerable to inputs that trigger quadratic runtime because of improper selection of the pivot element.

Less well-known, not only is the selection of the pivot element important, but also the selection of which side you use recursion:

"[...] it always recurses on the first sub-partition, and iterates on the second sub-partition; but instead, it should always recurse on the smaller sub-partition, and iterate on the larger sub-partition [...] our attack constructs an input array of N elements that causes qsort() to recurse N/4 times." https://www.qualys.com/2017/06/19/stack-clash/stack-clash.tx...

That's from last month.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#236
I am a programmer and I don't understand Ethereum. Sure I haven't really read up on it but if I don't understand it, how will the common man?

I have little faith in this kind of system. Could anyone here explain to a noob how Eth would be any better than Bitcoin?

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#237

Earlier quoted context omitted.

It's like EVE Online but for real.

Because it is unfettered completely innovative ruthlessly competitive free market. Boom and bust cycles from the era of industrial revolution tied to a capped deflationary currency (gold) that saw some of the fastest and most astounding speed of technological advancement in recorded human history. It's creative chaos is, personally, liberating.

Which also resulted in that jolly good time called "The Great Depression".

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#238

Earlier quoted context omitted.

I don't understand how this is practical. If you have a highly secure mechanism for distributing the ultimate secret - one-time-pads - why not just distribute the messages in this way? Is it just the fact that it would take two trips for the courier? Or that someone would need to intercept both communications (pad, ciphertext)?

A big benefit is that you can time-shift the distribution of the secret - you can distribute the one-time pad when it's convenient (e.g. when your submarine is at a home port) and be able to send secure messages over insecure channels at any future time.

Yes, this is essentially half the basis for cryptography, of which the one-time pad is one particularly rigid form. If Alice and Bob wish to communicate, they can do so by first verifying each other in person, or with a trusted courier, and from then on can communicate remotely. Alternatively, they can use public-key cryptography to communicate remotely and securely over an insecure channel without requiring face to face contact or a trusted courier.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#239

Earlier quoted context omitted.

> Your Whig history As this point you've already lost everyone who doesn't already ready the same pamphlets you read and agree. Either because they have read those pamphlets and eye-roll, or because they haven't and figure you're a rambling extremist. It's literally equivalent to communists beginning propaganda pieces with "Attention all Comrades!" That said, I disagree with you, so feel free to keep talking this way…

>As this point you've already lost everyone who doesn't already ready the same pamphlets you read and agree. Usage of the term "Whig history" is not confined adherents of a particular ideology, and does not require one to have/not-have any particular set of beliefs to use it (other than believing that the history of some institution is not a story of progress).. In other words, it's not comparable to "comrade". >Appe…

Like I said, feel free to keep talking like this. In fact, I encourage you to do so.

> The political process differs in this respect.

On this we agree. I don't see how layering software engineering on top of politics will ever simplify politics.

Post reply on HN