I don't really feel sorry for them, their access control and accounting are a completely mess. It only takes one mistake to lose tons of money, like in this case.
PeopleDAO “exploited” by Google Docs edit
11–20 of 87 posts
Re: PeopleDAO “exploited” by Google Docs edit
#12What's a DAO?
Re: PeopleDAO “exploited” by Google Docs edit
#13Hilarious.
DAO stands for "decentralized autonomous organization." This thing appears to collect transactions via a centralized google form and then complete those transactions if 5 of 9 people vote to perform them. Neither decentralized nor autonomous.
You go through all this effort to establish something fancy using whatever hot defi thing exists but situate it on top of a google form and a spreadsheet just owned by some guy.
Also, I can't believe that the form uses scientific notation for amounts. How unbelievably error prone to miss that one row has a "+" instead of a "-".
The lessons learned should be "holy fuck don't run everything on a google sheet" not "be more careful with how you share links and make sure the signers are uber careful to review 80 rows of boring transactions for single-character swaps."
Unreal: https://twitter.com/The_PeopleDAO/status/1634524761744367616...
"Most DAOs do use spread sheet for collecting information and accounting. What tools do you suggest to use instead?"
Re: PeopleDAO “exploited” by Google Docs edit
#14So people want to be progressive and use cryptocurrency that is not tied to a government.
But when things go wrong they run to the FBI and FTC both run by the government.
Re: PeopleDAO “exploited” by Google Docs edit
#15Re: PeopleDAO “exploited” by Google Docs edit
#16What's a DAO?
[deleted]
Re: PeopleDAO “exploited” by Google Docs edit
#17Hilarious. DAO stands for "decentralized autonomous organization." This thing appears to collect transactions via a centralized google form and then complete those transactions if 5 of 9 people vote to perform them. Neither decentralized nor autonomous. You go through all this effort to establish something fancy using whatever hot defi thing exists but situate it on top of a google form and a spreadsheet just owned b…
I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number.
I did not realize that was actually how this operated.
Re: PeopleDAO “exploited” by Google Docs edit
#18I don't see an exploit. I see a negotiation and a successful agreement of 6 of 9 parties. The analog to this in the real world is 2 pages stuck together, and the signer(s) didn't do their due diligence.
After all, wasn't the saying with shitcoin was that "The code is the contract, and the contract is the code"?
You make your bed, and lie in it.
Re: PeopleDAO “exploited” by Google Docs edit
#19Hilarious. DAO stands for "decentralized autonomous organization." This thing appears to collect transactions via a centralized google form and then complete those transactions if 5 of 9 people vote to perform them. Neither decentralized nor autonomous. You go through all this effort to establish something fancy using whatever hot defi thing exists but situate it on top of a google form and a spreadsheet just owned b…
I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number. I did not realize that was actually how this operated.
Let people buy multiple cells and arbitrarily set the formatting and you basically have reinvented the million dollar homepage.
https://en.wikipedia.org/wiki/The_Million_Dollar_Homepage
Actually that would be a pretty neat NFT project. With each pixel having its RGB value and a link stored on chain, the entire image could be reconstructed without having to be hosted anywhere in specific.
Re: PeopleDAO “exploited” by Google Docs edit
#20Is clicking on a link really “hacking”? > The accounting lead mistakenly shared a link with edit access in a public channel in discord. The hacker gained edit role via the link.
Imagine the number of people who have ownership of business-critical documents in the cloud. Now imagine a venn diagram with the number of people who don't realize that granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity.
> granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity.
That's like saying passwords are "security through obscurity" because they're also "obscure" random strings, just like URLs.
To try and make my point more clear:
Basic auth password url: https://username:randomSecurePassword@webpage.com
Google docs edit url: https://docs.google.com/randomLongString/edit
How are those two things different, other than one is a password which might be short and insecure, and the other has plenty of entropy? Will you also argue that all shared secrets are security by obscurity?