Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

bleepingcomputer.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#11

Post by vec »

nemild wrote: post #5

So far, we have a long way to go to build higher quality code. There's a few reasons: 1. Blockchain smart contracts are often unchangeable, so you can't fix bugs 2. The language is being built as people write code, with some bad design choices that encourage mistakes (slowly being fixed) 3. Libraries are still being developed 4. Tooling is still limited (even basic linting) 5. People are not taking the time to have a…

> Blockchain smart contracts are often unchangeable, so you can't fix bugs

This is the fatal flaw with smart contracts as a concept.

If they can be changed by the author then they don't provide the security guarantees that make the system worth using, but if they aren't changeable by the author then a huge fraction of smart contracts will ultimately end up doing something unintended because of any of the million reasons we don't normally expect first releases of alpha software to work perfectly in all circumstances.

In a perfect world Etherium would work great, but we don't live in a perfect world. People make mistakes. Any system which expects human input but isn't designed to gracefully handle human error (including the humans who programmed the system) is probably not going to end well.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#12

Post by this_user »

nemild wrote: post #5

So far, we have a long way to go to build higher quality code. There's a few reasons: 1. Blockchain smart contracts are often unchangeable, so you can't fix bugs 2. The language is being built as people write code, with some bad design choices that encourage mistakes (slowly being fixed) 3. Libraries are still being developed 4. Tooling is still limited (even basic linting) 5. People are not taking the time to have a…

The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world.

This means this ultimately require some form of human arbiter to decide in cases like that, but this ultimately defeats the entire purpose of smart contracts.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#13

Post by hardlianotion »

this_user wrote: post #12
nemild wrote: post #5

So far, we have a long way to go to build higher quality code. There's a few reasons: 1. Blockchain smart contracts are often unchangeable, so you can't fix bugs 2. The language is being built as people write code, with some bad design choices that encourage mistakes (slowly being fixed) 3. Libraries are still being developed 4. Tooling is still limited (even basic linting) 5. People are not taking the time to have a…

The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. This means this ultimately require some form of human arbiter to decide in cases like that, but this ultimately defeats the entire purpose o…

Quite. This is a live topic for me. Wiser heads pointed me toward

https://medium.com/@jimmysong/the-truth-about-smart-contract...

when I had my own blockchain moment. I think that immutability and lack of human judgement limit the usefulness of these things. And of course, not everything needs decentralised.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#14

Post by darawk »

this_user wrote: post #12
nemild wrote: post #5

So far, we have a long way to go to build higher quality code. There's a few reasons: 1. Blockchain smart contracts are often unchangeable, so you can't fix bugs 2. The language is being built as people write code, with some bad design choices that encourage mistakes (slowly being fixed) 3. Libraries are still being developed 4. Tooling is still limited (even basic linting) 5. People are not taking the time to have a…

The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. This means this ultimately require some form of human arbiter to decide in cases like that, but this ultimately defeats the entire purpose o…

> The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world.

You mean, except for the cases where we do exactly that? Like mars rovers, space shuttles, medical devices, IOT, etc...

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#15

Post by darawk »

vec wrote: post #11
nemild wrote: post #5

So far, we have a long way to go to build higher quality code. There's a few reasons: 1. Blockchain smart contracts are often unchangeable, so you can't fix bugs 2. The language is being built as people write code, with some bad design choices that encourage mistakes (slowly being fixed) 3. Libraries are still being developed 4. Tooling is still limited (even basic linting) 5. People are not taking the time to have a…

> Blockchain smart contracts are often unchangeable, so you can't fix bugs This is the fatal flaw with smart contracts as a concept. If they can be changed by the author then they don't provide the security guarantees that make the system worth using, but if they aren't changeable by the author then a huge fraction of smart contracts will ultimately end up doing something unintended because of any of the million reas…

Changed arbitrarily by the author and immutable are pretty clearly not the only two options. Ethereum lets you design whatever governance scheme you want. You can build a system in which people vote on upgrades, for instance. You can structure that scheme however you want. It's just plain lazy thinking to say "welp code imperfect, therefore we can never use it for important stuff".

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#17

Post by wglb »

darawk wrote: post #14
this_user wrote: post #12

Earlier quoted context omitted.

The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. This means this ultimately require some form of human arbiter to decide in cases like that, but this ultimately defeats the entire purpose o…

> The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. You mean, except for the cases where we do exactly that? Like mars rovers, space shuttles, medical devices, IOT, etc...

Do you see blockchain developers doing the diligence that any random part of the space program does as a reflex?

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#18

Post by pavel_lishin »

darawk wrote: post #15
vec wrote: post #11

Earlier quoted context omitted.

> Blockchain smart contracts are often unchangeable, so you can't fix bugs This is the fatal flaw with smart contracts as a concept. If they can be changed by the author then they don't provide the security guarantees that make the system worth using, but if they aren't changeable by the author then a huge fraction of smart contracts will ultimately end up doing something unintended because of any of the million reas…

Changed arbitrarily by the author and immutable are pretty clearly not the only two options. Ethereum lets you design whatever governance scheme you want. You can build a system in which people vote on upgrades, for instance. You can structure that scheme however you want. It's just plain lazy thinking to say "welp code imperfect, therefore we can never use it for important stuff".

Sure hope that system is bug-free.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#19

Post by daylightsavings »

darawk wrote: post #14
this_user wrote: post #12

Earlier quoted context omitted.

The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. This means this ultimately require some form of human arbiter to decide in cases like that, but this ultimately defeats the entire purpose o…

> The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. You mean, except for the cases where we do exactly that? Like mars rovers, space shuttles, medical devices, IOT, etc...

To assume those code bases don't contain bugs or go through multiple revisions and iterations is just naive. Just because bugs have not been exposed does not mean they are not present.

Smart contracts have people actively snooping and trying to exploit bugs for gain. Oh, and they are publicly accessible.

Also, IOT...pwned many times over ;)

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#20

Post by darawk »

daylightsavings wrote: post #19
darawk wrote: post #14

Earlier quoted context omitted.

> The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. You mean, except for the cases where we do exactly that? Like mars rovers, space shuttles, medical devices, IOT, etc...

To assume those code bases don't contain bugs or go through multiple revisions and iterations is just naive. Just because bugs have not been exposed does not mean they are not present. Smart contracts have people actively snooping and trying to exploit bugs for gain. Oh, and they are publicly accessible. Also, IOT...pwned many times over ;)

> To assume those code bases don't contain bugs or go through multiple revisions and iterations is just naive.

To assume smart contracts don't go through multiple revisions is equally naive. Now we're arguing about implementation, anyway, which is not the point. Implementation and best practices can be iterated on. The fact that the ecosystem isn't mature yet isn't an argument against getting it there.

Post reply on HN