Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

medium.freecodecamp.org

Post reply on HN
Print view View original

351–360 of 440 posts

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#351

Post by JumpCrisscross »

andrepd wrote: post #332
ckastner wrote: post #130

> Having sounded the alarm bells, a group of benevolent white-hat hackers from the Ethereum community rapidly organized. They analyzed the attack and realized that there was no way to reverse the thefts, yet many more wallets were vulnerable. Time was of the essence, so they saw only one available option: hack the remaining wallets before the attacker did. > By exploiting the same vulnerability, the white-hats hacked…

Cash is not for the general public. Someone can mug you and take your banknotes, and the solution to that problem is an authority mugging those people and taking the money and giving it back. Not a sound argument.

> the solution to that problem is an authority mugging those people

The authority and the process by which they do this is agreed upon, or at least known, ex ante. That was not the case here. Trust isn't fungible.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#352

Post by DennisP »

richardknop wrote: post #285
bmon wrote: post #152

Earlier quoted context omitted.

It's a hot topic right now just like when Bitcoin was first booming. Although today and yesterday especially so because of this hack.

But Ethereum is not booming. Isn't it a consensus that it is mostly speculative and most of these ICOs are money grabs and no working products ever get released other than prototypes to raise money? Yes the price has increased by 4000% in couple of months this year but most reasonable people agree it is a pure speculation / gambling.

I'd say that's a matter of opinion, not consensus. Plenty of us have a different opinion, including people from some large corporations in the Enterprise Ethereum Alliance, who say they hope to put applications on the public Ethereum chain after scalability improves.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#353

Post by pipermerriam »

int_19h wrote: post #76
pipermerriam wrote: post #53

Earlier quoted context omitted.

Your parallel is not an accurate one. One of the key and powerful features of the Ethereum Virtual Machine or, EVM, is the ability to delegate execution to external libraries. You can think of this much the same way you think of installing 3rd party libraries in your favorite programming language of choice. In the EVM you can write a "library" which performs some common functionality such as manipulation of date-time…

A serious question: are the benefits really worth it? How much overhead would it be to just include the library code directly into the contracts instead (so that the whole thing can be verified as a single black box)?

I think the answer to that question is extremely contextual and going to be very different for different applications. I also think that

I'd like to point out that the idea of including the library code within the contract is untennable at a certain level as contracts currently have an upper limit on size which is determined by the block gas limit. It also doesn't make it any safer because it's still functionally the same as executing external code because it's the same code being executed.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#354

Post by tetrep »

neaden wrote: post #343
andrepd wrote: post #332

Earlier quoted context omitted.

Cash is not for the general public. Someone can mug you and take your banknotes, and the solution to that problem is an authority mugging those people and taking the money and giving it back. Not a sound argument.

There is a key difference here in that as you say the authorities are doing something. If we had random vigilantes going around mugging muggers that would indeed be a sign that we had a problem.

Not quite that, but rather vigilantes mugging you when you're most vulnerable, and then returning the money later when they're confident you can safely hold onto it.

I wonder if the vigilantes will return the money with interest...

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#355

Post by [deleted] »

mannykannot wrote: post #227
sillysaurus3 wrote: post #224

Earlier quoted context omitted.

The thing is, everyone knows it's difficult. It's not new information. The people who proceed anyway stand to benefit handsomely if they don't screw it up. So the game is simply: don't screw up. It's hard, to be sure. But to say it's impossible is to overstate the issue. And even if it is impossible, it doesn't mean it will end in disaster 100% of the time.

> The thing is, everyone knows it's difficult. It's not new information. Actually, a lot of people seem to be in denial over just how difficult it is, and what those difficulties are. > So the game is simply: don't screw up. If only the people who lost a combined $31M had followed this simple advice! Then everything would have been fine. > And even if it is impossible, it doesn't mean it will end in disaster 100% of…

[deleted]

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#356

Post by bloominglotus »

thinkmassive wrote: post #305
canoebuilder wrote: post #150

Earlier quoted context omitted.

Just in case lordnacho's meaning here isn't clear to anyone. testing a bit with short keys. He's put some bitcoin into wallets with keys/passwords that don't meet very high security standards. I've already lost a tiny amount of BTC He's then lost that bitcoin because there are programs running running around the clock to programatically empty any wallets with passwords that don't meet very high standards of security.…

A more accurate analogy would be that your money vanished from a public locker with combination 0-0-0. Nobody complains about the shortage of address space provided by 256 bits. This guy was experimenting, and being lazy during his experiments, so at the very least he should have known what to expect after the first loss.

It still violates the optimistic premise of blockchain advocates that it helps us move to a world where trust is baked into the systems.

If you live under the assumption that you're perpetually under attack unless you rigorously protect yourself, it's not really the example of trust we're promising to non-technically adept folks.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#358

Post by gspetr »

"There is no avoiding war; it can only be postponed to the advantage of others." -- Niccolo Machiavelli

If he was alive today, perhaps he would have said:

"There is no avoiding professional security audit; it can only be postponed to the advantage of cybercriminals."

Their statement is the biggest joke[0]:

"This body of code continues to have no known security issues."

This reminds me of:

"Beware of bugs in the above code; I have only proved it correct, not tried it." - Donald Knuth

[0] https://blog.ethcore.io/the-multi-sig-hack-a-postmortem/

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#359

Post by fapjacks »

tetrep wrote: post #354
neaden wrote: post #343

Earlier quoted context omitted.

There is a key difference here in that as you say the authorities are doing something. If we had random vigilantes going around mugging muggers that would indeed be a sign that we had a problem.

Not quite that, but rather vigilantes mugging you when you're most vulnerable, and then returning the money later when they're confident you can safely hold onto it. I wonder if the vigilantes will return the money with interest...

"With interest" at least to me is a very greedy proposition. Those people just kept you from having zero ethereum. If anything, I'd personally give them reward money.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#360

Post by seanwilson »

electronvolt wrote: post #319
seanwilson wrote: post #129

Earlier quoted context omitted.

I think the problem is that the language for smart contracts that backs Ether hasn't been written with formal verification in mind. You could apply formal methods to anything after the fact but it doesn't look like they've made this easy here. You could claim that a C program could be made bug free eventually by applying formal methods for example but it would require a huge amount of work. Is there a good reason the…

I'd agree, and the article basically says the same thing--the language is too expressive, and therefore hard to analyze. I don't know that much about the Ether devs, but I'd expect it just didn't occur to them--even among PL folks, knowledge & experience with something like coq is somewhat rare unless you went to the right undergrad or grad school. Especially if you weren't keeping up with the latest research in the…

> I don't know that much about the Ether devs, but I'd expect it just didn't occur to them--even among PL folks, knowledge & experience with something like coq is somewhat rare unless you went to the right undergrad or grad school. Especially if you weren't keeping up with the latest research in the last ~5-10 years or so.

Hmm, you'd think they'd know about languages like Haskell though.

I don't think it would be practical to expect developers to write verified code anyway; it's still far too challenging in general. Having a language where you could optionally formally verify the code would have been useful though.

> Something like Coq with a few primitives to represent interacting with the Ether network, and an optimizing, verified cross compiler would have been a perfect fit for this sort of thing, in my opinion

You wouldn't think something like Coq with a few primitives would make some contracts difficult to write?

Post reply on HN