[deleted]
Augur REP Token Critical Vulnerability Disclosure
11–20 of 22 posts
Re: Augur REP Token Critical Vulnerability Disclosure
#12Earlier quoted context omitted.
They needed a language to compile to the Ethereum Virtual Machine (EVM). Stack exchange with more info. https://ethereum.stackexchange.com/questions/3112/what-is-th...
The problem here is that you are handling a ton of money and it is irresponsible to manage a project in this way. More thinking that many people, including developers, in the community are millionaires, so it is not a resource problem. When you send a rocket to the space you also test it against ETs.
Valid points. The project is not production ready yet. One of the main devs has a good explaination of his tweet stating:
>"Ethereum isn't safe or scalable. It is immature experimental tech. Don't rely on it for mission critical apps unless absolutely necessary!"
https://medium.com/@Vlad_Zamfir/about-my-tweet-from-yesterda...
Re: Augur REP Token Critical Vulnerability Disclosure
#13> Second, the Serpent language is untyped. It allows any operation to be performed on any data. Every value is a 256-bit sequence which can be used as an address, a contract, an integer, or an array. I normally dislike people who criticize startups for not being perfect from day one and understand it takes iterations and a wide audience to get things right. But this isn't a normal startup and security was an obvious…
To be fair, the Ethereum author sold shares in his quantum computer Bitcoin miner before starting his own coin. Security was likely not the primary design objective.
That the language was like javascript was one of the selling points (in a very real sense, as there was a lot to be sold before the software could be released).
Re: Augur REP Token Critical Vulnerability Disclosure
#14Earlier quoted context omitted.
The problem here is that you are handling a ton of money and it is irresponsible to manage a project in this way. More thinking that many people, including developers, in the community are millionaires, so it is not a resource problem. When you send a rocket to the space you also test it against ETs.
Valid points. The project is not production ready yet. One of the main devs has a good explaination of his tweet stating: >"Ethereum isn't safe or scalable. It is immature experimental tech. Don't rely on it for mission critical apps unless absolutely necessary!" https://medium.com/@Vlad_Zamfir/about-my-tweet-from-yesterda...
He's probably the only one, it's a surprise they haven't ostracised him already. (Btw your response is close to step #3 on https://news.ycombinator.com/item?id=14838148 :P )
At least Vitalik & Gavin Woods in combination with Joe Lubin (Consensys & Ethereum Foundation) keep pushing it without any talks about reality, but just sell unproven future ideas while they train people and manufacture ICOs (less so after the SEC) and sell Ethereum to dumb enterprise that drunk the cool-aid.
Re: Augur REP Token Critical Vulnerability Disclosure
#15I think Ethereum has a lot of potential and really love the platform. With that, the language options that work on top of the EVM are quite awful. There needs to be considerable investment in either building better options or building EVM compilers for well designed languages.
Something functional would be great: OCaml, F#, Haskell with immutability and formally verified abstractions for dealing with the blockchain.
Re: Augur REP Token Critical Vulnerability Disclosure
#16I think Ethereum has a lot of potential and really love the platform. With that, the language options that work on top of the EVM are quite awful. There needs to be considerable investment in either building better options or building EVM compilers for well designed languages. Something functional would be great: OCaml, F#, Haskell with immutability and formally verified abstractions for dealing with the blockchain.
That's what Tezos is doing, using OCaml for their smart contracts.
Re: Augur REP Token Critical Vulnerability Disclosure
#17Earlier quoted context omitted.
Dynamic types make sense for newbie-friendly web languages like Ruby and stuff like bash/zsh or support languages like Lua is to game development... but I really don't see the downside to adding types for anything outside of that. It's really not that much of a learning curve nor does it result in a significant amount of boilerplate. People may believe static types are a drag from using Java or C++ but if you look at…
I agree with you! Yet, looking at Node, JS has sorta taken off. And so has Ethereum, despite the poorly designed languages. Maybe they should have done one proper language, then a toy language to make it easy onboarding? In the end, the Ethereum folks have achieved wild financial success, even if not in the realm of making smart contracts usable. After seeing shitty coding make people independently wealthy many times…
Their wild financial success is based on scamming gullible people into investing in Ponzi schemes. not one ethereum based enterprise has actually produced a product that people are using.
Re: Augur REP Token Critical Vulnerability Disclosure
#18Earlier quoted context omitted.
The problem here is that you are handling a ton of money and it is irresponsible to manage a project in this way. More thinking that many people, including developers, in the community are millionaires, so it is not a resource problem. When you send a rocket to the space you also test it against ETs.
Valid points. The project is not production ready yet. One of the main devs has a good explaination of his tweet stating: >"Ethereum isn't safe or scalable. It is immature experimental tech. Don't rely on it for mission critical apps unless absolutely necessary!" https://medium.com/@Vlad_Zamfir/about-my-tweet-from-yesterda...
There are no rollbacks so it will never be production ready for 99% of businesses.
Re: Augur REP Token Critical Vulnerability Disclosure
#19> Second, the Serpent language is untyped. It allows any operation to be performed on any data. Every value is a 256-bit sequence which can be used as an address, a contract, an integer, or an array. I normally dislike people who criticize startups for not being perfect from day one and understand it takes iterations and a wide audience to get things right. But this isn't a normal startup and security was an obvious…
The introduction of type checking in JS could just as easily be attributed to so many devs coming from other languages who don't want to leave their strong types security blankets behind.
The evidence for types preventing bugs is mixed. A strongly typed language in smart contracts may be entirely reasonable, but the rise of type checking in JS shouldn't be understood as evidence of anything more than many devs like having types.
And giving up types coming from another language feels like flying blind for someone used to having it. (Until you get used to it, imo, and realize that it wasn't helping as much as you thought.)
Also, the error here seemed much, much deeper than the lack of type checking.
Re: Augur REP Token Critical Vulnerability Disclosure
#20Earlier quoted context omitted.
The problem here is that you are handling a ton of money and it is irresponsible to manage a project in this way. More thinking that many people, including developers, in the community are millionaires, so it is not a resource problem. When you send a rocket to the space you also test it against ETs.
Valid points. The project is not production ready yet. One of the main devs has a good explaination of his tweet stating: >"Ethereum isn't safe or scalable. It is immature experimental tech. Don't rely on it for mission critical apps unless absolutely necessary!" https://medium.com/@Vlad_Zamfir/about-my-tweet-from-yesterda...
Vlad isn't a dev fyi, and he pretty much does say his tweet was hyperbolic intentionally to temper the crazy bullishness of the time