Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

bleepingcomputer.com

Post reply on HN
Print view View original

21–30 of 41 posts

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#21

Post by darawk »

wglb wrote: post #17
darawk wrote: post #14

Earlier quoted context omitted.

> The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. You mean, except for the cases where we do exactly that? Like mars rovers, space shuttles, medical devices, IOT, etc...

Do you see blockchain developers doing the diligence that any random part of the space program does as a reflex?

Absolutely not. The state of blockchain development is shit. My point isn't that it's being done well. My point is that, in theory, it can be done well, and I believe that it can get there, and I think the end goal is worthwhile.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#22

Post by darawk »

pavel_lishin wrote: post #18
darawk wrote: post #15

Earlier quoted context omitted.

Changed arbitrarily by the author and immutable are pretty clearly not the only two options. Ethereum lets you design whatever governance scheme you want. You can build a system in which people vote on upgrades, for instance. You can structure that scheme however you want. It's just plain lazy thinking to say "welp code imperfect, therefore we can never use it for important stuff".

Sure hope that system is bug-free.

Yep, it'll take time to converge on high assurance implementations of these schemes. But we will. It is possible to write bug free code, particularly for relatively well defined, small areas.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#24

Post by eric_h »

darawk wrote: post #14
this_user wrote: post #12

Earlier quoted context omitted.

The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. This means this ultimately require some form of human arbiter to decide in cases like that, but this ultimately defeats the entire purpose o…

> The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. You mean, except for the cases where we do exactly that? Like mars rovers, space shuttles, medical devices, IOT, etc...

a counterpoint: https://en.wikipedia.org/wiki/Mars_Climate_Orbiter

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#25

Post by vec »

hardlianotion wrote: post #13
this_user wrote: post #12

Earlier quoted context omitted.

The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. This means this ultimately require some form of human arbiter to decide in cases like that, but this ultimately defeats the entire purpose o…

Quite. This is a live topic for me. Wiser heads pointed me toward https://medium.com/@jimmysong/the-truth-about-smart-contract... when I had my own blockchain moment. I think that immutability and lack of human judgement limit the usefulness of these things. And of course, not everything needs decentralised.

It's worse than that because immutability and lack of human judgement is also the killer feature that smart contracts offer over good old fashioned paper contracts and binding arbitration agreements. Any attempt to make maintaining smart contracts manageable is almost by definition going to undercut one of the main rationales for wanting to use them in the first place.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#26

Post by WalterBright »

darawk wrote: post #14
this_user wrote: post #12

Earlier quoted context omitted.

The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. This means this ultimately require some form of human arbiter to decide in cases like that, but this ultimately defeats the entire purpose o…

> The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. You mean, except for the cases where we do exactly that? Like mars rovers, space shuttles, medical devices, IOT, etc...

The rovers and shuttles have backup systems with different code in them specifically to deal with coding bugs. These fallback systems have also been repeated needed because of bugs in the shipped system.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#27

Post by vec »

darawk wrote: post #20
daylightsavings wrote: post #19

Earlier quoted context omitted.

To assume those code bases don't contain bugs or go through multiple revisions and iterations is just naive. Just because bugs have not been exposed does not mean they are not present. Smart contracts have people actively snooping and trying to exploit bugs for gain. Oh, and they are publicly accessible. Also, IOT...pwned many times over ;)

> To assume those code bases don't contain bugs or go through multiple revisions and iterations is just naive. To assume smart contracts don't go through multiple revisions is equally naive. Now we're arguing about implementation, anyway, which is not the point. Implementation and best practices can be iterated on. The fact that the ecosystem isn't mature yet isn't an argument against getting it there.

I think there's a difference between what you're saying (doing it right is possible) and what the critics are saying (doing it wrong needs to be impossible). There's nothing that best practices can do to prevent a motivated novice from throwing together a minimum effort contract that "works" by whatever test criteria they thought up over the past five minutes.

Imagine surfing the web, but instead of showing a 500 error a broken page would withdraw a random sum from your checking account. It doesn't matter how good the best pages are, no one in their right mind would ever open a browser.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#28

Post by technion » 

    and also failed to register all versions of an ICO domain
Surely that's just not feasible these days with the massive amount of TLD's available.

I've been in businesses that wanted to own domain.com, domain.net, domain.org, domain.co.uk, domain.com.au, et al and it was a "vulnerability" if you missed one. But with hundreds of TLDs and some costing hundreds of dollars a registration, this has to be seen as a lost battle.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#29

Post by abritinthebay »

technion wrote: post #28

and also failed to register all versions of an ICO domain Surely that's just not feasible these days with the massive amount of TLD's available. I've been in businesses that wanted to own domain.com, domain.net, domain.org, domain.co.uk, domain.com.au, et al and it was a "vulnerability" if you missed one. But with hundreds of TLDs and some costing hundreds of dollars a registration, this has to be seen as a lost batt…

Doing the top 3-5 should be trivial though. Some just have those oddball tlds (ie, bloc.kcha.in or whatever) and nothing else

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#30

Post by darawk »

vec wrote: post #27
darawk wrote: post #20

Earlier quoted context omitted.

> To assume those code bases don't contain bugs or go through multiple revisions and iterations is just naive. To assume smart contracts don't go through multiple revisions is equally naive. Now we're arguing about implementation, anyway, which is not the point. Implementation and best practices can be iterated on. The fact that the ecosystem isn't mature yet isn't an argument against getting it there.

I think there's a difference between what you're saying (doing it right is possible) and what the critics are saying (doing it wrong needs to be impossible). There's nothing that best practices can do to prevent a motivated novice from throwing together a minimum effort contract that "works" by whatever test criteria they thought up over the past five minutes. Imagine surfing the web, but instead of showing a 500 err…

> I think there's a difference between what you're saying (doing it right is possible) and what the critics are saying (doing it wrong needs to be impossible). There's nothing that best practices can do to prevent a motivated novice from throwing together a minimum effort contract that "works" by whatever test criteria they thought up over the past five minutes.

You're absolutely right. There's also nothing to prevent a motivated novice from writing software to control a mars rover. Just, nobody's going to send his rover to Mars. Nothing stops anyone from writing a smart contract, but common sense will (eventually, once the dust settles) stop people from throwing money at them.

Post reply on HN