A great summary of recent events and recommendations for the future.
A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
391–400 of 440 posts
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#392Earlier quoted context omitted.
I think you're vastly underestimating the number of deadly mistakes doctors and lawyers and other such licensed professionals make every day. Just look at Enron! Maybe such a system would keep out the very worst programmers but I doubt someone hacking on Ethereum smart contracts falls into that bucket anyways.
Are you arguing for self-taught doctors to practice their quackery, then? Shall we accept freelance surgeons having out gall bladder and appendixes with whatever whiskey, x-acto knife, needle and thread they have at-hand? What exactly are you arguing for here? Obviously, humans are imperfect and corrupt - but you can impose some order and ethics and error correction into any community when you get organized. OP said…
My point is that your suggestion is unlikely to have helped prevent this specific incident or others like it.
A guild or professional association keeps quacks and idiots out, it doesn't solve the problem of experienced competent people occasionally making subtle mistakes.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#393Earlier quoted context omitted.
So if a majority of participants (50% + 1 of the network) wanted to say, "rob" the wealthy top 1% of wallets and redistribute wealth by rewriting the history of the blockchain, nothing could stop them?
You can't just transfer money however you like, even if you had complete control of the blockchain. Transactions still need to be signed by the private key of the wallet involved. You could put a transaction with an invalid signature into the blockchain, but then the chain would be rejected by clients because of the invalid transaction.
The clients could be rewritten to accept the "invalid" block. That would cause a fork between the modified and unmodified clients. Like fiat currency, the only thing maintaining the definition of a legal block is the software the majority of the network choose to run.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#394Earlier quoted context omitted.
Aside from in the rest of the developed world, where it has...?
I've seen no evidence of that. Pretty much the entire advanced world has seen its rate of progress slow since the late 1960s, in concurrence with growing public sectors.
I'd argue that you'd have to come up with a VERY suspect definition of "progress" to make that stick. Especially as almost all the major innovation in that time started with tech developed from public funding.
NASA, DARPA, and CERN would like a word with you.
Also most of the private sector innovation was due to public funding and tax code incentives (Bell Labs, Xerox PARC, etc).
So basically technology, science, medicine, and social programs must either not count as progress for your hypothesis to hold... or it's bunk.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#395This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: > The problem is that his programming toolchain allowed him to make these mistakes. Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wal…
But the function people were exploiting needed to be public, I don't see how internal by default would have made any difference. The real issue here is that the class constructor called a function instead of containing all code within itself. It's a fundamental misunderstanding of how the EVM works and how Solidity compiles to it. I've read the code and it's hard to convey the level of incompetence that went into hav…
It's below the level of incompetence required to design and deploy a language for this specific purpose that makes such misuse so simple, and apparently also below the level of incompetence of the Ethereum community who allowed $100M to be protected by it.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#396This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: > The problem is that his programming toolchain allowed him to make these mistakes. Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wal…
But the function people were exploiting needed to be public, I don't see how internal by default would have made any difference. The real issue here is that the class constructor called a function instead of containing all code within itself. It's a fundamental misunderstanding of how the EVM works and how Solidity compiles to it. I've read the code and it's hard to convey the level of incompetence that went into hav…
[deleted]
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#397Earlier quoted context omitted.
No, ability to issue a controlled lot of physical currency is the meaningful differentiator, which is why the relation to banks is irrelevant. I can buy $1 worth of Bitcoin, declare it ErikCoin, acceptable only in my stores at a 1/1,000,000 denomination, and I instantly "minted" $1,000,000 in cryptocurrency, using only the Bitcoin blockchain. Bitcoin doesn't let people be banks, it let's people be the mint.
How is that different from virtual currency in video games?
- Blizzard can't wipe your balance
- You can't destroy anyone's balance after you've issued them currency
- Balances are publicly verifiable
- Balances can be stored in one's mind
... lots of things. Tons of affordances differ from a game currency.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#398Earlier quoted context omitted.
A big benefit is that you can time-shift the distribution of the secret - you can distribute the one-time pad when it's convenient (e.g. when your submarine is at a home port) and be able to send secure messages over insecure channels at any future time.
Yes, this is essentially half the basis for cryptography, of which the one-time pad is one particularly rigid form. If Alice and Bob wish to communicate, they can do so by first verifying each other in person, or with a trusted courier, and from then on can communicate remotely. Alternatively, they can use public-key cryptography to communicate remotely and securely over an insecure channel without requiring face to…
An important note: public key cryptography allows secure communication over insecure channels, where an adversary only has the ability to listen in, but not over untrusted channels, where an adversary can actively intercept messages and edit them.
The internet is an untrusted medium, since packet switching requires packets to travel through routers that can edit them at will. (The fabled man in the middle attack) This is the whole point of the certificate issuer public-key infrastructure, where issuer public keys are included in your OS's installation files, a secure communication channel. (If you can't trust your OS, you of course can't trust any communication made with it to be secure anyway)
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#399Earlier quoted context omitted.
Yes, this is essentially half the basis for cryptography, of which the one-time pad is one particularly rigid form. If Alice and Bob wish to communicate, they can do so by first verifying each other in person, or with a trusted courier, and from then on can communicate remotely. Alternatively, they can use public-key cryptography to communicate remotely and securely over an insecure channel without requiring face to…
An important note: public key cryptography allows secure communication over insecure channels, where an adversary only has the ability to listen in, but not over untrusted channels, where an adversary can actively intercept messages and edit them. The internet is an untrusted medium, since packet switching requires packets to travel through routers that can edit them at will. (The fabled man in the middle attack) Thi…
That's a good note - more succinctly, the key exchange can provide confidentiality, but not authentication.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#400Earlier quoted context omitted.
Yes, this is essentially half the basis for cryptography, of which the one-time pad is one particularly rigid form. If Alice and Bob wish to communicate, they can do so by first verifying each other in person, or with a trusted courier, and from then on can communicate remotely. Alternatively, they can use public-key cryptography to communicate remotely and securely over an insecure channel without requiring face to…
An important note: public key cryptography allows secure communication over insecure channels, where an adversary only has the ability to listen in, but not over untrusted channels, where an adversary can actively intercept messages and edit them. The internet is an untrusted medium, since packet switching requires packets to travel through routers that can edit them at will. (The fabled man in the middle attack) Thi…
[deleted]