Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ethereum “hacker” didn't hack anything

jsfour.com

Post reply on HN
Print view View original

31–40 of 72 posts

Re: The ethereum “hacker” didn't hack anything

#31

Post by Spivak »

honestlyreally wrote: post #26
Spivak wrote: post #23

Earlier quoted context omitted.

It's not really a matter of what you want, it's the legal prededent that will be set when someone exploits a bug in a smart contract that is obviously not part of the authors intent. Or a smart contract that was entered into by manipulation, coercion, or violence. Or a smart contract that violates some financial regulation or requires performing illegal activity. The court will intervene and that will be the end of t…

The court can order the contract's private key to be magically willed into existence? The law often sees itself as onnipotent, but it stands no chance against cryptography and unnamed contract authors.

They don't have to. Just like encryption having the ability to use violent force enables all sorts of side channel attacks. But in the case of an anonymous scammer they would probably hold the Etherium Inc. responsible for the damages.

Re: The ethereum “hacker” didn't hack anything

#32

Post by valuepack »

It was a hack, clear as day. I really don't like this mindset of "code is law" that has arisen by calling the code being executed on the blockchain "contracts". I think people sometimes forget that these "smart contracts" are just code, no different than the code running HN or any other web app. This is a hack in the same sense that dumping a database from web app vulnerable to SQL injection would be considered a hack. Even though the code allowed it, it clearly isn't intended behavior.

It just seems so silly -- no system is perfectly secure; any developer can attest to this. There is always going to be a way skirt around the smart contract owner's intent, especially as the apps being run on the blockchain grow in complexity. To not blatantly call this malicious activity just doesn't sit well with me.

Re: The ethereum “hacker” didn't hack anything

#33

Post by [deleted] »

Spivak wrote: post #31
honestlyreally wrote: post #26

Earlier quoted context omitted.

The court can order the contract's private key to be magically willed into existence? The law often sees itself as onnipotent, but it stands no chance against cryptography and unnamed contract authors.

They don't have to. Just like encryption having the ability to use violent force enables all sorts of side channel attacks. But in the case of an anonymous scammer they would probably hold the Etherium Inc. responsible for the damages.

[deleted]

Re: The ethereum “hacker” didn't hack anything

#34

Post by devrandomguy »

msbarnett wrote: post #22
tylersmith wrote: post #21

Earlier quoted context omitted.

The intent of all smart contracts is to be exactly what the code says. That is why they exist. For any case where you want to consider intent you should not use smart contracts. People using smart contracts when that's not what they really want are going to cause damage to the ecosystem that will take years to undo.

The question becomes, under what circumstances would you EVER want to use a smart contract for a non-trivial amount of money? Since smart contracts are software, and all software has bugs, and to a first approximation nobody is interested in having a significant amount of their money, time, or goods erased by a software bug, of what use are these things other than as a curiosity?

They would be useful for making agreements across a large imbalance of power. For example, if I am a one-person operation selling on Amazon, and they screw me over in a clever way, I could not afford to fight them in court. Even if they would have lost, I might simply be incapable of pursuing the case to the end.

I personally would much rather use smart contracts for making deals with employers, the overlords of the marketplaces, foreign clients, etc. Maybe it's just because I'm a programmer, but I would rather fail because of my own bug, than get screwed over and Nelson-laughed at by a bunch of powerful people. I can improve my contract-coding methodology, but I can't do much about other people's shadiness.

Re: The ethereum “hacker” didn't hack anything

#35

Post by int_19h »

ryanlol wrote: post #20
elnygren wrote: post #15

It seems we have some mismatch between the abstraction layer where we want to talk about cryptocurrencies and how their actual implementation goes. IMHO, we are venturing to the domain of lawyers; most people are not just going to be saying computer code == what-we-agreed-here because most people are just normal people and they couldn't care about computer code. And let's face it, cryptos are already full of normal p…

If computer code == what-we-agreed-here isn't what you want, then you don't want smart contracts.

What makes contracts valid and enforceable in the first place is the backing of the law. And the law can choose to not recognize such contracts as valid, or recognize them only with various caveats.

Re: The ethereum “hacker” didn't hack anything

#36

Post by IIAOPSW »

grey-area wrote: post #16
stale2002 wrote: post #10

Earlier quoted context omitted.

Courts will absolutely use intent to judge contracts. The interesting thing with the DAO though, was the explicit INTENT of the contract, was for it to be entirely governed by the code. As in, the announcement website, and all the marketing for the DAO included a whole lot of lines like "None of the information here is binding. The only thing that it binding is the code. The contract is the code". So, it is arguable,…

While this isn't about DAO, its true that recourse to courts undermines a central tenet of smart contracts, hence as you say DAO people would probably insist the code is the contract, until a problem occurs. In fact the DAO fork brings up another problem which applies to Bitcoin too - the developers (and miners if a POW coin) are de facto arbiters of the fate of millions, and if this sort of system were to gain wides…

this is the original sin of bitcoin. Either the protocol can't be updated even for legitimate technical reasons or there exists a group of people who can change bitcoin arbitrarily thus defeating the purpose. Right now the answer seems to be that a bitcoin politic exists but it is an extremely conservative politics. The miners know that if they are seen to be a centralized body in control then the value of bitcoin (and thus their own wealth) vanishes. Thus the miner cabal must pretend it doesn't exist. As more "normie" users join the miners might get more embolden and Satoshi's vision lost. What is to stop miners from creating a fork where the block reward never goes down?

Re: The ethereum “hacker” didn't hack anything

#37

Post by msbarnett »

devrandomguy wrote: post #34
msbarnett wrote: post #22

Earlier quoted context omitted.

The question becomes, under what circumstances would you EVER want to use a smart contract for a non-trivial amount of money? Since smart contracts are software, and all software has bugs, and to a first approximation nobody is interested in having a significant amount of their money, time, or goods erased by a software bug, of what use are these things other than as a curiosity?

They would be useful for making agreements across a large imbalance of power. For example, if I am a one-person operation selling on Amazon, and they screw me over in a clever way, I could not afford to fight them in court. Even if they would have lost, I might simply be incapable of pursuing the case to the end. I personally would much rather use smart contracts for making deals with employers, the overlords of the…

Employers, "overlords", etc with considerably more power than you are practically by definition going to be able to spend more money finding exploitable bugs in your code than you would be able to put into bug-proofing it.

The odds that you can improve your contract-coding methodology to such a degree that you write no bugs is most likely nil. You haven't been able to do that in your non-contract code, and the stakes there are much lower.

Besides, how many mistakes will you be able to afford to learn from while avoiding complete financial ruin?

Edit: you've also got the threat model wrong. With a traditional contract, your only concern is the other party (your employer, say). With a "smart" contract, you also have to worry about any 3rd party who can wander by, notice a bug in your contract, and use it to avail themselves to your income.

You've got all the same second-party worries (my employer will use their resources to find a way to screw me) plus a whole new 3rd party attack surface.

Re: The ethereum “hacker” didn't hack anything

#38

Post by agotterer »

This logic is the same as saying that an ATM has a software bug and if it spits out too much money it's okay to keep it. The reason being that the "intent" of the machine was programmed to dispense that amount of money. That still feels like stealing to me.

I also think the author misrepresents that the only purpose of the blockchain is to eliminate the central governing body. There are many other value propositions and uses for the technology. Here's just a few:

- Eliminates financial overhead and operational complexity for banking.

- Personal information control. Like profiles or identity data.

- Distributed network to sell things with trust

- Access to public records

- The author shoots down the value of ICO's. But the blockchain can offer a significantly cheaper alternative to clearing costs for equites.

And there so much other potential...

Re: The ethereum “hacker” didn't hack anything

#39

Post by IIAOPSW »

will_brown wrote: post #24

What is with the smart contract propaganda. Let's put everything in a legal perspective using the DAO as the example...was what occurred there a "hack" or just a proper function of the contract which all parties agreed? let's assume, all things being equal, the DAO smart contract wasn't a smart contract on the block chain but a regular contract, which included a provision allowing any single party to unilaterally tak…

>was what occurred there a "hack" or just a proper function of the contract which all parties agreed?

both. Lawyers are just hackers of the legal system. the runtime environment is the courtroom. The contract is the code. loopholes and technicalities are another name for bugs.

Re: The ethereum “hacker” didn't hack anything

#40

Post by killbrad »

agotterer wrote: post #38

This logic is the same as saying that an ATM has a software bug and if it spits out too much money it's okay to keep it. The reason being that the "intent" of the machine was programmed to dispense that amount of money. That still feels like stealing to me. I also think the author misrepresents that the only purpose of the blockchain is to eliminate the central governing body. There are many other value propositions…

Computers don't lie, code doesn't lie. The idea of smart contacts is literally that code is law. If the code is flawed, that flaw is law. As soon as you try to wrap intent, disposition, and other legalities into the equation, how is a "smart contract" anything unique?
Post reply on HN