Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OptiFi Program Incident Report

medium.com

Post reply on HN
Print view View original

101–110 of 158 posts

Re: OptiFi Program Incident Report

#101

Post by birracerveza »

klabb3 wrote: post #100
whywhywhywhy wrote: post #21

Earlier quoted context omitted.

It’s Solana, so there kinda is. It’s pretty much centralized.

Why is this called DeFi? If a dev can nuke an entire app (intentionally or accidentally) it's not decentralized. Contrary to the HN zeitgeist, I have a lot of excitment for decentralization medium- to long term. But it seems almost everything that's happening in the DeFi space today is about as decentralized as a traditional client server app with mysql.

Multiple DeFi platforms exist. Some are mostly decentralized, others only use DeFi as a marketing buzzword. Some of these are actually centralized, but it doesn't mean all of them are.

Re: OptiFi Program Incident Report

#102

Post by ReptileMan »

hypertele-Xii wrote: post #36
ReptileMan wrote: post #22

Earlier quoted context omitted.

From personal experience - no it won't. I have made mistakes with overriding warnings - when under pressure, hyper focused and already in the mental mode of - of course I am sure I want to do it - your slow brain is just shut down so you are moving a bit like on muscle memory.

Simply add a 1 hour unskippable countdown timer to the warning. Now you have to think about it.

If you have one hour you shouldn't be editing live anyway.

Re: OptiFi Program Incident Report

#103

Post by ClassyJacket »

rvz wrote: post #74
thro388 wrote: post #61

Quoted post unavailable.

Or what happens when the tech bros get their hands on radiography hardware [0]. They probably would write it in Javascript. [0] https://en.wikipedia.org/wiki/Therac-25

This is kind of a nitpick but it actually wasn't even radiography, it wasn't for imaging, it was for radiation therapy - blasting cancer with radiation to kill it. So it was even more dangerous than it might sound :( definitely something that should not have safety controlled by software.

There was also a horrible disaster with someone taking the radioactive material from a machine like that in an abandoned hospital and messing around with it at home. People died in both incidents.

Re: OptiFi Program Incident Report

#104

Post by ItsTooMuch »

adastra22 wrote: post #99
Hinrik wrote: post #95

Earlier quoted context omitted.

In finance, MM is a shorthand for millions: https://www.orsurety.com/blog/is-it-m-for-thousand-and-mm-fo...

Weird to call it a shorthand when M means the same thing ;)

English wasn't always the lingua franca

Re: OptiFi Program Incident Report

#105

Post by AmericanChopper »

bhaak wrote: post #48
pjc50 wrote: post #26

Earlier quoted context omitted.

You (and everyone really) should probably read some more comp.risks http://catless.ncl.ac.uk/Risks/ Certain fields have always had a high cost of programming error, including a cost in human life. It's just that cryptocurrency combines this with a first-to-market rush that's somehow still going on, encouraging a rush to error.

I don't disagree with that there have always been niche areas where there is a high cost to programming errors (like space or medical). But with crypto, the effect is much more direct. The programmer is handling money much more directly and if something goes wrong, they are much more directly affected and not being insulated from the effects.

At the first proper job I had we would measure our service outages in dollars per second. It was always in the thousands, and we were just a rather ordinary financial OLTP service.

Re: OptiFi Program Incident Report

#106

Post by Yizahi »

pjc50 wrote: post #26
bhaak wrote: post #5

For all its flaws (and there are countless) the one thing about the show cryptocurrency space that stands out to me as a programmer is that programming errors can be suddenly very costly (granted, in this case it was more of a DevOps blunder). Being able to very easily put a price tag on sloppy programming is intriguing to me.

You (and everyone really) should probably read some more comp.risks http://catless.ncl.ac.uk/Risks/ Certain fields have always had a high cost of programming error, including a cost in human life. It's just that cryptocurrency combines this with a first-to-market rush that's somehow still going on, encouraging a rush to error.

First to market is only part of the problem. Another self inflicted problem is that execution of those "smart" "contracts" cost tokens (so essentially money). This incentivizes developers to write the shortest possible code, without any "fluff" like tests or additional checks or more verbose style. And the immutability problem also increases severity of the problem - you either deploy immutable "contract" signifying that it should be respected because it can't be changed later for malicious purpose, or you deploy modifiable "contract" and that is not good for the reputation of the company.

Re: OptiFi Program Incident Report

#107

Post by adamhp »

renewiltord wrote: post #64
pbhjpbhj wrote: post #29

Earlier quoted context omitted.

An example of such a command came up on Linus Tech Tips (LTT), from apt (IIRC) on Pop_OS!. Basically (paraphrasing) "this will destroy your system and render it useless; type 'I'm an idiot and wish to proceed'". Our eponymous youtuber went right on, typed the phrase and blitzed the system, and then moaned about how the system shouldn't have let him break it ... I suspect such prompts only work for cautious people, wh…

That guy is a savvy YouTuber, man. He did that because the resulting content has high memetic replication properties. I find the prompt for dangerous ops useful. GitHub will ask you to repeat the name of the repo before you destructive actions, Terraform will ask you to say yes to the prompt. These are all good things.

Yet there was some popular HN post a few months ago about someone complaining that GitHub didn't do enough to stop them...

Re: OptiFi Program Incident Report

#108

Post by bhaak »

automatic6131 wrote: post #54
bhaak wrote: post #47

Earlier quoted context omitted.

CitiBank can't get the money back they accidentally transferred to another company. https://www.bloomberg.com/news/articles/2022-08-15/citi-sues... You can say that's an edge case today but I and OP are saying, the future will look more like crypto looks today. Not a bright future.

>CitiBank can't get the money back they accidentally transferred to another company. Given it was an accidental early repayment of a loan, this isn't quite the slam dunk you think it is. If they had paid a company they didn't owe money to, they could get the money back through the courts. Crypto is meant to evade those courts.

The reason was not because of a repayment but because you wouldn't expect a respectable bank like CitiBank to do such a mistake.

> “To believe that Citibank, one of the most sophisticated financial institutions in the world, had made a mistake that had never happened before, to the tune of nearly $1 billion, would have been borderline irrational,” he wrote.

https://www.nytimes.com/2021/02/16/business/citibank-revlon-...

That's as close to "code is law" and other nonsense of the crypto libertarians as you can get.

Re: OptiFi Program Incident Report

#110

Post by throw101010 »

birracerveza wrote: post #101
klabb3 wrote: post #100

Earlier quoted context omitted.

Why is this called DeFi? If a dev can nuke an entire app (intentionally or accidentally) it's not decentralized. Contrary to the HN zeitgeist, I have a lot of excitment for decentralization medium- to long term. But it seems almost everything that's happening in the DeFi space today is about as decentralized as a traditional client server app with mysql.

Multiple DeFi platforms exist. Some are mostly decentralized, others only use DeFi as a marketing buzzword. Some of these are actually centralized, but it doesn't mean all of them are.

In agreement with GP, Solana and other very centralized networks should have to earn their way into the term DeFi. It's hard to quantify but a network that can be "paused" by few devs and relying on the existence of a registered company clearly don't fit this term.
Post reply on HN