Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PeopleDAO “exploited” by Google Docs edit

twitter.com

Post reply on HN
Print view View original

21–30 of 87 posts

Re: PeopleDAO “exploited” by Google Docs edit

#21

Post by ceejayoz »

NoZebra120vClip wrote: post #9
sokoloff wrote: post #2

Is clicking on a link really “hacking”? > The accounting lead mistakenly shared a link with edit access in a public channel in discord. The hacker gained edit role via the link.

Imagine the number of people who have ownership of business-critical documents in the cloud. Now imagine a venn diagram with the number of people who don't realize that granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity.

If the super long string on a Google doc is “security through obscurity”, so are passwords, 2FA codes, and ssh keys.

Re: PeopleDAO “exploited” by Google Docs edit

#22

Post by mstipetic »

weego wrote: post #4

I know this is a low value way of saying this, so, apologies up front but: Fucking lol at their bookkeeping and payout system just being a spreadsheet with no other comparison of truth before submission. We're on course for DAOs to rediscover the basic principles of our existing financial system within the decade.

And if you take the process to its conclusion people will say we’re tired of doing all this accounting all the time, let’s hire a specialized person to do that - and you’ll end up with a company accountant. After that they’ll say he we should standardize the accounting process over different organizations and end up where we are now

Re: PeopleDAO “exploited” by Google Docs edit

#24

Post by camillomiller »

michaelbuckbee wrote: post #17
UncleMeat wrote: post #13

Hilarious. DAO stands for "decentralized autonomous organization." This thing appears to collect transactions via a centralized google form and then complete those transactions if 5 of 9 people vote to perform them. Neither decentralized nor autonomous. You go through all this effort to establish something fancy using whatever hot defi thing exists but situate it on top of a google form and a spreadsheet just owned b…

I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number. I did not realize that was actually how this operated.

I hope you thought about calling it SheetCoin. Please make it. I want row A.

Re: PeopleDAO “exploited” by Google Docs edit

#25

Post by BobbyJo »

TheDong wrote: post #20
NoZebra120vClip wrote: post #9

Earlier quoted context omitted.

Imagine the number of people who have ownership of business-critical documents in the cloud. Now imagine a venn diagram with the number of people who don't realize that granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity.

> granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity. That's like saying passwords are "security through obscurity" because they're also "obscure" random strings, just like URLs. To try and make my point more clear: Basic auth password url: https://username:randomSecurePassword@webpage.com Google docs edit url: https://docs.google.com/randomLongString/edit How are…

> How are those two things different

How they're used? I mean, we can argue that pizzas are wheels because they're circles, but, until you throw one on a car and get where you're going, no one will take it seriously.

URLs get shared, passed around, posted in chats, etc. Passwords don't, or at least everyone knows they're doing something wrong if they do.

In the case of the this doc, if it was privately shared, I don't think anyone would have mistakenly posted their Google password the same way.

Re: PeopleDAO “exploited” by Google Docs edit

#26

Post by im3w1l »

karulont wrote: post #14

So people want to be progressive and use cryptocurrency that is not tied to a government. But when things go wrong they run to the FBI and FTC both run by the government.

If you use google sheets and discord to run your org then it's pretty clear you are not in it for the decentralization. Is it money? Or is it the cool mystique of these emerging technologies? I don't know.

Re: PeopleDAO “exploited” by Google Docs edit

#27

Post by Waterluvian »

camillomiller wrote: post #24
michaelbuckbee wrote: post #17

Earlier quoted context omitted.

I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number. I did not realize that was actually how this operated.

I hope you thought about calling it SheetCoin. Please make it. I want row A.

Oh wow yes. I’ll pay a dollar for row AA.

Re: PeopleDAO “exploited” by Google Docs edit

#28

Post by jerpint »

camillomiller wrote: post #24
michaelbuckbee wrote: post #17

Earlier quoted context omitted.

I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number. I did not realize that was actually how this operated.

I hope you thought about calling it SheetCoin. Please make it. I want row A.

Run it using doc-ker

Re: PeopleDAO “exploited” by Google Docs edit

#29

Post by 5350-uiop-1130 »

UncleMeat wrote: post #13

Hilarious. DAO stands for "decentralized autonomous organization." This thing appears to collect transactions via a centralized google form and then complete those transactions if 5 of 9 people vote to perform them. Neither decentralized nor autonomous. You go through all this effort to establish something fancy using whatever hot defi thing exists but situate it on top of a google form and a spreadsheet just owned b…

this is way too contrived not to be an inside job.

the only people dumber than those who believe this excuse are those that invested in it. 10/10.

Post reply on HN