Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZeppelinOS: tools for smart contract applications

blog.zeppelin.solutions

Post reply on HN
Print view View original

11–20 of 39 posts

Re: ZeppelinOS: tools for smart contract applications

#11

Post by currymj »

dvcc wrote: post #5

So if I read this right, I am supposed to trust a contract that sits on top of a mutable 'OS' that is managed by the community? I feel like all of these contract-as-code groups really need to have a lawyer on their team as well; for some reason, it seems like developers believe they understand the purpose of financial/other contracts and how they're actually used. Would you sign a contract that references a contract…

yeah, people do this all the time, to a greater or lesser extent! referencing past or future agreements, agreements between other parties, the prime interest rate published in the WSJ, etc.

the difference is, if someone does something really abusive with one of these clauses, a judge will throw it out.

Re: ZeppelinOS: tools for smart contract applications

#12

Post by heliumcraft »

currymj wrote: post #10
sauravt wrote: post #4

I'm a big fan of Zepplin devs and the open source work they have been putting out there since the early days. Their medium posts are a goldmine for any beginner developer looking to develop DAPPs.

it's pretty hard to write even a simple smart contract that doesn't have horrible vulnerabilities. far harder, I would say, than writing C code that can't be buffer-overflowed on an old system with no protections in place. and solidity the language does NOT make this any easier. read all the resources you can. there are really counterintuitive best practices. the reason for all these hacks is not stupidity or lazines…

Quite the exaggeration, this silly meme has to stop. You make it sound like writing even a hello world would have horrible vulnerabilities or something. There are thousands of perfectly safe contracts deployed, one can't take some isolated incidents and make such conclusions from such a small sample.

Re: ZeppelinOS: tools for smart contract applications

#13

Post by sillysaurus3 »

heliumcraft wrote: post #12
currymj wrote: post #10

Earlier quoted context omitted.

it's pretty hard to write even a simple smart contract that doesn't have horrible vulnerabilities. far harder, I would say, than writing C code that can't be buffer-overflowed on an old system with no protections in place. and solidity the language does NOT make this any easier. read all the resources you can. there are really counterintuitive best practices. the reason for all these hacks is not stupidity or lazines…

Quite the exaggeration, this silly meme has to stop. You make it sound like writing even a hello world would have horrible vulnerabilities or something. There are thousands of perfectly safe contracts deployed, one can't take some isolated incidents and make such conclusions from such a small sample.

There are thousands of contracts where no vulnerabilities have been discovered yet. Mostly because there are larger targets to go after.

It's not true to say that something is secure just because it hasn't been broken yet.

I agree with your call for balance, but it's unnecessary to jump to the opposite extreme.

Re: ZeppelinOS: tools for smart contract applications

#15

Post by nosuchthing »

heliumcraft wrote: post #12
currymj wrote: post #10

Earlier quoted context omitted.

it's pretty hard to write even a simple smart contract that doesn't have horrible vulnerabilities. far harder, I would say, than writing C code that can't be buffer-overflowed on an old system with no protections in place. and solidity the language does NOT make this any easier. read all the resources you can. there are really counterintuitive best practices. the reason for all these hacks is not stupidity or lazines…

Quite the exaggeration, this silly meme has to stop. You make it sound like writing even a hello world would have horrible vulnerabilities or something. There are thousands of perfectly safe contracts deployed, one can't take some isolated incidents and make such conclusions from such a small sample.

  If the creator of Solidity, Gavin Wood, cannot write a 
  secure multisig wallet in Solidity, pretty much confirms 
  Ethereum is hacker paradise.
[1] https://t.co/WAR3eltfWl

[2] https://www.cryptocoinsnews.com/hackers-seize-32-million-in-...

Re: ZeppelinOS: tools for smart contract applications

#16

Post by edjere »

themanual wrote: post #8

how does this compare to Tezos?

Tezos and zeppelinOS are very different things. zeppelinOS is building an operating system on top of the Ethereum Virtual Machine to provide secure infrastructure for the development of smart contract applications. A technology that is still being developed but used by thousands of developers, and maturing into it's next phase. Tezos is building a new blockchain with a different infrastructure altogether.

Re: ZeppelinOS: tools for smart contract applications

#17

Post by heliumcraft »

nosuchthing wrote: post #15
heliumcraft wrote: post #12

Earlier quoted context omitted.

Quite the exaggeration, this silly meme has to stop. You make it sound like writing even a hello world would have horrible vulnerabilities or something. There are thousands of perfectly safe contracts deployed, one can't take some isolated incidents and make such conclusions from such a small sample.

If the creator of Solidity, Gavin Wood, cannot write a secure multisig wallet in Solidity, pretty much confirms Ethereum is hacker paradise. [1] https://t.co/WAR3eltfWl [2] https://www.cryptocoinsnews.com/hackers-seize-32-million-in-...

That's tweet is factually incorrect.

Gavin Wood DID NOT write the change that caused that bug, he was not the assigned reviewer either. https://github.com/paritytech/parity/pull/3773

Re: ZeppelinOS: tools for smart contract applications

#18

Post by Rmilb »

hrpnk wrote: post #9
Rmilb wrote: post #2

Standard peer reviewed libraries for the new world of smart contracts is sorely needed. Hopefully the increased complexity does not increase the gas costs of the contracts too much. I think most devs would trade higher gas costs for a more secure platform to develop on. Anyone who lost funds in the parity wallet hack would probably agree. https://www.coindesk.com/30-million-ether-reported-stolen-pa...

> Hopefully the increased complexity does not increase the gas costs of the contracts too much It's possible to save gas by pulling in libraries' code into the contracts via the "internal" keyword [0]. This way JUMP will be used instead of DELEGATECALL. Peer reviewed libraries will definitely help to make the platform more secure. However, the engineers decide whether to use libraries or not. What's needed is more di…

Thanks for linking docs

Re: ZeppelinOS: tools for smart contract applications

#20

Post by mattl »

edjere wrote: post #19
mattl wrote: post #14

What about this is an operating system?

It's an operating system insofar as it's a layer of services on top of the "bare metal" that is the EVM. Through those services it allows the development of complex applications in the same way a normal OS does.

How does that differ from installing a web framework, or an application? That doesn't seem like an operating system to me.
Post reply on HN