Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OptiFi Program Incident Report

medium.com

Post reply on HN
Print view View original

71–80 of 158 posts

Re: OptiFi Program Incident Report

#71

Post by yaddaor »

pbhjpbhj wrote: post #29
RedShift1 wrote: post #14

Commands like that really need a confirmation prompt and a command line switch to override like --do-as-i-say (long form only). Good example of developers being put in an end user's shoes, I hope they learn from that mistake and update their programs.

An example of such a command came up on Linus Tech Tips (LTT), from apt (IIRC) on Pop_OS!. Basically (paraphrasing) "this will destroy your system and render it useless; type 'I'm an idiot and wish to proceed'". Our eponymous youtuber went right on, typed the phrase and blitzed the system, and then moaned about how the system shouldn't have let him break it ... I suspect such prompts only work for cautious people, wh…

It's a person who gets paid by views. They did this for the attention.

Re: OptiFi Program Incident Report

#72

Post by simiones »

rvz wrote: post #65
spaceman_2020 wrote: post #39

This is one of the biggest flaws in crypto. Small errors can erode hundreds of millions of value. That's when most crypto companies right now are very small. Can you imagine the chaos if crypto were to actually become big and dev count were to grow to 1k+ people spread across multiple offices? There's definite efficiency gains with crypto (a dex like Uniswap can do massive volume with very few developers for instance…

> This is one of the biggest flaws in crypto. Small errors can erode hundreds of millions of value. This is hardly exclusive to crypto. > Can you imagine the chaos if crypto were to actually become big and dev count were to grow to 1k+ people spread across multiple offices? Yeah I can already imagine in other places, just ask Santander Bank. [0] [0] https://www.theguardian.com/business/2021/dec/30/santander-b...

> Yeah I can already imagine in other places, just ask Santander Bank. [0]

Per the article, they were very likely to recover most of that money (and were legally entitled to recover all of it, but were unwilling to do so for image reasons). So exactly the opposite of what happens with DeFi.

Re: OptiFi Program Incident Report

#73

Post by blibble »

mpeg wrote: post #56
spaceman_2020 wrote: post #39

This is one of the biggest flaws in crypto. Small errors can erode hundreds of millions of value. That's when most crypto companies right now are very small. Can you imagine the chaos if crypto were to actually become big and dev count were to grow to 1k+ people spread across multiple offices? There's definite efficiency gains with crypto (a dex like Uniswap can do massive volume with very few developers for instance…

It's not exactly unique to crypto... in adtech, a configuration mistake on a web server can cost 6-7 figures as ads are being paid for, but take people nowhere.

and in a live trading system a small mistake can cost you 6-7 figures per second

see: Knight Capital

Re: OptiFi Program Incident Report

#75

Post by benreesman »

tinco wrote: post #66
benreesman wrote: post #34

I once deleted like, maybe a few petabytes of data valuable enough to store on FusionIO cards with a bad config change. I think it destroyed $50-100MM once the dust settled in all the various ways that it cost money were added up. I’m quite sure the hacker who pressed the button feels plenty bad enough already, and I hope the people around them were as kind as the people around me were.

Was it Cambridge Analytica that was going to pay 50MM for that data? ;)

No, it was features for a P(click|impression) model, which are surprisingly mundane: it is basically impossible to care much either way, let alone be outraged, if you look at the actual features used in these kinds of things and it’s not explicitly your field. It’s not a microphone listening on your smartphone!

You can even read about it in this paper which publicly described the system contemporary to that event: http://www.quinonero.net/Publications/predicting-clicks-face...

If you read it and are still steamed up, well, then you hold that opinion honestly, but I suspect most would be like, “cool story bro”.

Re: OptiFi Program Incident Report

#76

Post by FabHK »

bhaak wrote: post #48
pjc50 wrote: post #26

Earlier quoted context omitted.

You (and everyone really) should probably read some more comp.risks http://catless.ncl.ac.uk/Risks/ Certain fields have always had a high cost of programming error, including a cost in human life. It's just that cryptocurrency combines this with a first-to-market rush that's somehow still going on, encouraging a rush to error.

I don't disagree with that there have always been niche areas where there is a high cost to programming errors (like space or medical). But with crypto, the effect is much more direct. The programmer is handling money much more directly and if something goes wrong, they are much more directly affected and not being insulated from the effects.

Yes. In space, aviation, and medical, it is usually someone else that is affected, not the programmer.

Re: OptiFi Program Incident Report

#77

Post by raverbashing »

selfhoster11 wrote: post #58
darrenf wrote: post #38

Earlier quoted context omitted.

Command line switches like that won't, IMO and IME, make developers think "wow, I'm so glad this exists to guard against footguns". Rather they'll just set an alias to get around it. Likewise confirmation prompts albeit with a little more resitance. Once a repeat user is frustrated enough they'll bust out `expect` or similar, angry at the original command for mollycoddling them because they know what they're doing an…

If you alias a —do-as-i-say switch to a command without wrapping into a script to make sanity checks of your own, IMO that’s negligence. The name of the flag should make you think thrice about invoking it without safety checks.

It was the same with safety overrides on hydraulic presses

People would tape one button on, then wonder why it would chop a finger sometimes

Yes it is annoying. Yes, there may be better choices. But it is there for a reason

Re: OptiFi Program Incident Report

#78

Post by jdasdf »

spaceman_2020 wrote: post #39

This is one of the biggest flaws in crypto. Small errors can erode hundreds of millions of value. That's when most crypto companies right now are very small. Can you imagine the chaos if crypto were to actually become big and dev count were to grow to 1k+ people spread across multiple offices? There's definite efficiency gains with crypto (a dex like Uniswap can do massive volume with very few developers for instance…

> This is one of the biggest flaws in crypto. Small errors can erode hundreds of millions of value.

That's reality.

Same thing would have happened if they had put all that cash on a boat, and accidentally sunk it.

Re: OptiFi Program Incident Report

#79

Post by glandium »

rcxdude wrote: post #53
pbhjpbhj wrote: post #29

Earlier quoted context omitted.

An example of such a command came up on Linus Tech Tips (LTT), from apt (IIRC) on Pop_OS!. Basically (paraphrasing) "this will destroy your system and render it useless; type 'I'm an idiot and wish to proceed'". Our eponymous youtuber went right on, typed the phrase and blitzed the system, and then moaned about how the system shouldn't have let him break it ... I suspect such prompts only work for cautious people, wh…

In his defense, it was literally the first package he tried to install, which was in the official repositories but horribly broken, so he had no real way to tell whether this was the normal flow and linux just made it really irritating to install packages.

And the more relevant error message was buried in the scrollback, IIRC.

Re: OptiFi Program Incident Report

#80

Post by LetMeInNowMate »

mpeg wrote: post #56
spaceman_2020 wrote: post #39

This is one of the biggest flaws in crypto. Small errors can erode hundreds of millions of value. That's when most crypto companies right now are very small. Can you imagine the chaos if crypto were to actually become big and dev count were to grow to 1k+ people spread across multiple offices? There's definite efficiency gains with crypto (a dex like Uniswap can do massive volume with very few developers for instance…

It's not exactly unique to crypto... in adtech, a configuration mistake on a web server can cost 6-7 figures as ads are being paid for, but take people nowhere.

No post body was provided.
Post reply on HN