Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OptiFi Program Incident Report

medium.com

Post reply on HN
Print view View original

31–40 of 158 posts

Re: OptiFi Program Incident Report

#31

Post by imtringued »

soco wrote: post #25
RedShift1 wrote: post #14

Commands like that really need a confirmation prompt and a command line switch to override like --do-as-i-say (long form only). Good example of developers being put in an end user's shoes, I hope they learn from that mistake and update their programs.

I don't know about you folks but I can do stupid stuff also with confirmation. Maybe splitting the damaging actions in some substeps, so instead of a big bang you have a slow death?

You are right, something like closing a program shouldn't be valid immediately, the program should be frozen for a day with the ability to cancel the closing at any time until the day is over.

Re: OptiFi Program Incident Report

#32

Post by jiggawatts »

ibz wrote: post #23
jjwtieke wrote: post #11

Just another example of how useless crypto is.

rm -rf / Whoops, I lost everything! Computers are useless.

You can recover from that by restoring from backups.

In the crypto world all changes are permanent and immutable.

There is no recourse.

That’s the difference.

Re: OptiFi Program Incident Report

#34

Post by benreesman »

I once deleted like, maybe a few petabytes of data valuable enough to store on FusionIO cards with a bad config change. I think it destroyed $50-100MM once the dust settled in all the various ways that it cost money were added up.

I’m quite sure the hacker who pressed the button feels plenty bad enough already, and I hope the people around them were as kind as the people around me were.

Re: OptiFi Program Incident Report

#35

Post by SkyMarshal »

dan-robertson wrote: post #3

Can you change the title of this submission to match the title of the post please? Normally people change titles when the original is sensationalised however the opposite is true in this case.

Sounds like they only lost $661k worth, which is peanuts by comparison to most other crypto hacks/losses, probably didn't destroy the entire company since they're compensating their users, and not really worthy of the sensational title.

Re: OptiFi Program Incident Report

#36

Post by hypertele-Xii »

ReptileMan wrote: post #22
vicnicius wrote: post #15

Earlier quoted context omitted.

A simple confirmation step with a relevant warning could possibly make developers think twice before proceeding.

From personal experience - no it won't. I have made mistakes with overriding warnings - when under pressure, hyper focused and already in the mental mode of - of course I am sure I want to do it - your slow brain is just shut down so you are moving a bit like on muscle memory.

Simply add a 1 hour unskippable countdown timer to the warning. Now you have to think about it.

Re: OptiFi Program Incident Report

#37

Post by imtringued »

whywhywhywhy wrote: post #21
Me163GermanSoup wrote: post #6

Man, if only there was a central authority to appeal those mistakes.

It’s Solana, so there kinda is. It’s pretty much centralized.

I need an explanation for this because the only arguments I have seen are Reddit memes that disregard the centralisation of mining pools.

Re: OptiFi Program Incident Report

#38

Post by darrenf »

RedShift1 wrote: post #14

Commands like that really need a confirmation prompt and a command line switch to override like --do-as-i-say (long form only). Good example of developers being put in an end user's shoes, I hope they learn from that mistake and update their programs.

Command line switches like that won't, IMO and IME, make developers think "wow, I'm so glad this exists to guard against footguns". Rather they'll just set an alias to get around it. Likewise confirmation prompts albeit with a little more resitance. Once a repeat user is frustrated enough they'll bust out `expect` or similar, angry at the original command for mollycoddling them because they know what they're doing and don't make daft mistakes, damn it.

Re: OptiFi Program Incident Report

#39

Post by spaceman_2020 »

This is one of the biggest flaws in crypto. Small errors can erode hundreds of millions of value.

That's when most crypto companies right now are very small. Can you imagine the chaos if crypto were to actually become big and dev count were to grow to 1k+ people spread across multiple offices?

There's definite efficiency gains with crypto (a dex like Uniswap can do massive volume with very few developers for instance), but there needs to be a way to limit the cost of human errors.

Re: OptiFi Program Incident Report

#40

Post by rjh29 »

ibz wrote: post #23
jjwtieke wrote: post #11

Just another example of how useless crypto is.

rm -rf / Whoops, I lost everything! Computers are useless.

I mean that won't work, because --preserve-root is on by default. In the same way, eventually crypto may acquire the same checks and balances that other industries have, but it'll take a lot of costly mistakes to get to that point.
Post reply on HN