Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

bleepingcomputer.com

Post reply on HN
Print view View original

31–40 of 41 posts

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#31

Post by darawk »

WalterBright wrote: post #26
darawk wrote: post #14

Earlier quoted context omitted.

> The whole idea behind smart contracts that code can be law is fatally flawed, because it is a bet on our ability to write bug-free code. We know from experience that this is virtually impossible, especially at large scale, even for the best people and organisations in the world. You mean, except for the cases where we do exactly that? Like mars rovers, space shuttles, medical devices, IOT, etc...

The rovers and shuttles have backup systems with different code in them specifically to deal with coding bugs. These fallback systems have also been repeated needed because of bugs in the shipped system.

You mean like how many smart contracts have reference implementations in other languages?

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#32

Post by WalterBright »

darawk wrote: post #31
WalterBright wrote: post #26

Earlier quoted context omitted.

The rovers and shuttles have backup systems with different code in them specifically to deal with coding bugs. These fallback systems have also been repeated needed because of bugs in the shipped system.

You mean like how many smart contracts have reference implementations in other languages?

Being written in other languages is not sufficient. A different algorithm is needed.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#34

Post by bkor »

darawk wrote: post #21
wglb wrote: post #17

Earlier quoted context omitted.

Do you see blockchain developers doing the diligence that any random part of the space program does as a reflex?

Absolutely not. The state of blockchain development is shit. My point isn't that it's being done well. My point is that, in theory, it can be done well, and I believe that it can get there, and I think the end goal is worthwhile.

> My point is that, in theory, it can be done well, and I believe that it can get there,

You really mean that eventually smart contracts can be reliable, no bugs, etc? I've seen procurement sign contracts with various unclear wordings in them. I've seen vendors wrongly apply contracts in their rates. It's quite common to have errors in real world contracts. I fail to see how a smart contract would work especially as it's even more complicated.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#35

Post by darawk »

WalterBright wrote: post #32
darawk wrote: post #31

Earlier quoted context omitted.

You mean like how many smart contracts have reference implementations in other languages?

Being written in other languages is not sufficient. A different algorithm is needed.

I believe the idea is that you write the alternative reference implementation in a language that's easy to computationally reason about (e.g. Haskell) and then try to prove equivalence between your Solidity implementation and that one.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#36

Post by WalterBright »

darawk wrote: post #35
WalterBright wrote: post #32

Earlier quoted context omitted.

Being written in other languages is not sufficient. A different algorithm is needed.

I believe the idea is that you write the alternative reference implementation in a language that's easy to computationally reason about (e.g. Haskell) and then try to prove equivalence between your Solidity implementation and that one.

If the algorithm has bugs (and they often do) using the same algorithm in different languages doesn't help.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#37

Post by darawk »

WalterBright wrote: post #36
darawk wrote: post #35

Earlier quoted context omitted.

I believe the idea is that you write the alternative reference implementation in a language that's easy to computationally reason about (e.g. Haskell) and then try to prove equivalence between your Solidity implementation and that one.

If the algorithm has bugs (and they often do) using the same algorithm in different languages doesn't help.

Sure, but in certain languages you can reason formally about them, and prove properties of them. It's not completely perfect, but particularly for relatively simple models you can get pretty high confidence in correctness, at least, up to certain invariance assumptions.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#38

Post by aussieguy1234 »

technion wrote: post #28

and also failed to register all versions of an ICO domain Surely that's just not feasible these days with the massive amount of TLD's available. I've been in businesses that wanted to own domain.com, domain.net, domain.org, domain.co.uk, domain.com.au, et al and it was a "vulnerability" if you missed one. But with hundreds of TLDs and some costing hundreds of dollars a registration, this has to be seen as a lost batt…

Correct. Heres a full list https://en.wikipedia.org/wiki/List_of_Internet_top-level_dom...

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#39

Post by WalterBright »

darawk wrote: post #37
WalterBright wrote: post #36

Earlier quoted context omitted.

If the algorithm has bugs (and they often do) using the same algorithm in different languages doesn't help.

Sure, but in certain languages you can reason formally about them, and prove properties of them. It's not completely perfect, but particularly for relatively simple models you can get pretty high confidence in correctness, at least, up to certain invariance assumptions.

Proofs have bugs in them, too. Would you bet your life on them? Algorithms are also based on a model of reality. The models are usually wrong, too.

Re: Researchers: Last Year’s ICOs Had Five Security Vulnerabilities on Average

#40

Post by darawk »

WalterBright wrote: post #39
darawk wrote: post #37

Earlier quoted context omitted.

Sure, but in certain languages you can reason formally about them, and prove properties of them. It's not completely perfect, but particularly for relatively simple models you can get pretty high confidence in correctness, at least, up to certain invariance assumptions.

Proofs have bugs in them, too. Would you bet your life on them? Algorithms are also based on a model of reality. The models are usually wrong, too.

You bet your life on them all the time. Every time you cross a bridge. Medical devices rely on algorithms. The standard of evidence you're requesting here is unreasonable, and not applied in any other domain.
Post reply on HN