Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White hat hacker awarded $2M for fixing ETH-creation bug

cryptoadventure.com

Post reply on HN
Print view View original

111–120 of 354 posts

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#111

Post by MarcoZavala »

saurik wrote: post #13
saagarjha wrote: post #6

Earlier quoted context omitted.

I’m glad you seem to be happy with your payout, but can we talk for a moment about how much you got? For an exploit like this, especially given how much effort was put into it and how much the market rate of a security engineer like this would be, plus given how much this could be worth on the exploit market, $2 million is literally pennies. This could’ve easily been a bug worth hundreds of millions of dollars. I gue…

If we choose to value everything we touch by way of "the next highest bidder might have paid $X for this" while fully ignoring their intentions (and so allowing black market sales to be in scope for the implied auction), I think you won't actually enjoy the society you end up with :(. Like, as a security researcher yourself, it might feel interesting to posit the exact addition of value we protect per incident, but I…

No post body was provided.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#112

Post by kingcharles »

heliodor wrote: post #54
saurik wrote: post #42

Earlier quoted context omitted.

I do not expect to make any major expensive lifestyle changes as a result of having more money (and to the extent to which I have already been being paid better recently due to working on Orchid, I have only barely done so and usually only quite temporarily), which I realize disappoints some people who had wanted me to post a concrete picture of something expensive I purchase to help motivate others to reach for bug…

Please read this thread to see the pitfalls that might potentially lie ahead: https://www.reddit.com/r/AskReddit/comments/24vo34/comment/c... It's about winning the lottery but still applicable to some extent, and shows how people's lives go horribly wrong.

Wow, that's depressing.

I was in jail with a guy who was a total mess. Nice, but seemed pretty mentally-disabled.

One day a new guy came on the block. "Wow, what is George doing in here?" "You know him?" "Yeah, I know him. He is one of the greatest musicians I ever met. He can play any instrument like a savant. I knew him a few years ago, just after he inherited $4m when his father passed. He ended up getting in drugs and everyone would hang out at his house." "Wow, who was his dealer?" "Who was his dealer?! EVERYONE was his dealer!"

I'd been keeping George in coffee, because he didn't have a single cent on his commissary account (which is rare in jail, even the worst criminals usually have someone out there). Poor George had snorted or injected $4m of drugs and everyone had sold them to him and partied with him until all the money was gone and George's brain was cooked and he went around shaking his fist at the sky until he was arrested. And not one of his hundreds of "friends" would put a cent on his account.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#113

Post by __MatrixMan__ »

colesantiago wrote: post #103
__MatrixMan__ wrote: post #92

Earlier quoted context omitted.

Not yet, but I don't think that we're too far away from using USD, GBP or any fiat currency as a unit of account at the POS and letting software handle ensuring that the buyer loses whatever assets they want to pay in and the seller receives whatever assets they want to be paid in. But that's orthogonal to how quickly the maintainers of these tokens can make changes in response to threats.

So no then? Over a decade later and I still cannot use any of them at the restaurant or without waiting in the queue for the transaction to settle and paying more for the fees than the goods itself.

It took 100 years for steam engines to start outperforming horses, why is it so damning that crypto isn't yet outperforming fiat after a decade and change?

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#114

Post by tenuousemphasis »

colesantiago wrote: post #73
__MatrixMan__ wrote: post #64

Earlier quoted context omitted.

Do you think that a bank or a government would've handled fixing such a flaw as well has optimism did? All tokenization schemes are ponzi scams including USD, it's just that some use violence to stay relevant, and other use bug bounties.

I have no problem with white hat hackers, I'm saying more power to them in the broken web3 space, which that is a complete scam. However, I can use USD, GBP or any fiat currency in my local grocery store. Can I use Bitcoin, Shib, Doge, or even Orchid at my grocery store without waiting hours in the queue for the transaction to complete and no huge fees?

Bitcoin has a system built on top of it called Lightning, which allows for millions of cheap transactions per second inside of payment channels. Only the opening and closing of channels requires a transaction on the blockchain.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#115

Post by tenuousemphasis »

colesantiago wrote: post #98
birracerveza wrote: post #88

Earlier quoted context omitted.

>But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid. Seems like just an opinion to me, and a poorly opinionated one at that.

Can you name any examples of cryptocurrencies being used that are not scams, ponzi schemes or for speculative purposes? All I see are people holding coins and not using them at all for anything else other than 'I want coin to go up'.

Speculative investment is not the same as a Ponzi scheme. Not so subtle goalpost moving there.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#116

Post by phphphphp »

toolz wrote: post #102
eli wrote: post #93

Earlier quoted context omitted.

Poor people aren’t stupid

If you're poor and gambling, then you're making a stupid financial decision. So the odds of you being financially stupid seem likely to be high.

For most people, gambling isn't a financial decision, it's an entertainment decision. The value of thinking about winning (regardless of how unlikely it is) is worth the $1 cost of a lottery ticket, so labelling gambling a "stupid financial decision" is like labelling owning a TV while poor a "stupid financial decision"... but poor people deserve entertainment as much as rich people.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#117

Post by jacquesm »

sillysaurusx wrote: post #86
jacquesm wrote: post #72

Earlier quoted context omitted.

Yes, but that's not what we're discussing, because then I can counter with: "Would you sell your mother or your children at any price?" And I hope - admittedly, that's speculation - I know what the answer to that would be. So this is now an absurd discussion, whereas it started off from a rational point of view: there exist such people whose ethics can not be corrupted. The fact that you believe this is not the case…

People did in fact sell their children when faced with hard times, by the way. The 1920’s era was rough. https://www.ranker.com/list/story-behind-photo-of-children-f... You are asking what I would personally do. But it’s better to think of limit cases that everyone would do — such as lie to their wife for a billion dollars. Since it’s guaranteed you fall into the bucket of “everybody”, that means you can locate your…

You are still moving the goalposts.

My statement is pretty simple: ethical people exist.

You countered with "Everyone’s ethics have a price tag. It’s better not to pretend otherwise, since it clarifies a lot of human behavior."

And have been moving the goalposts ever since. The fact that unethical people exist was never up for debate.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#118

Post by saurik »

notanote wrote: post #99
saurik wrote: post #21

Earlier quoted context omitted.

Hah! When I added SSL to my site a few days ago, I really cranked those settings hard trying to optimize for "security" on the Qualy's SSL Server Test. Do you know what the most secure cipher suite you actually support is (and are you sure the issue isn't that you aren't merely using a particularly-out-of-date copy of Firefox)?

I can confirm this issue. It’s related to Fedora’s crypto-policies which are more restrictive than Firefox. In this case it seems to be caused by the SHA1 DigiCert root in your cert chain, not by your nginx settings. Edit to add: It’s possible to run update-crypto-policies --set=DEFAULT:SHA1 and avoid enabling the whole LEGACY policy

Ah... OK, well, I'm not going to mess with that in the near future (sorry) :(. If it makes you feel any better (or worse!! ;P) my personal website didn't support SSL at all until this past week. I might reconsider the certificate chain I use in another month or so when I have to update my certificates anyway.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#120

Post by memonkey »

toolz wrote: post #102
eli wrote: post #93

Earlier quoted context omitted.

Poor people aren’t stupid

If you're poor and gambling, then you're making a stupid financial decision. So the odds of you being financially stupid seem likely to be high.

This applies to people who are gamblers.

Most people who are the poorest are usually the ones who know exactly where their dollars are going. They can tell you exactly how much a carton of eggs and milk are.

Post reply on HN