Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

121–130 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#121

Post by baddox »

twblalock wrote: post #38
grandalf wrote: post #21

Earlier quoted context omitted.

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

> Ethereum offers immutability, and blockchains can foster new kinds of trust, but trust still has to grow organically in the ecosystem. If you need a source of trust outside of the blockchain, why would you need the blockchain after such trust has been obtained?

I'm not sure if I understand your question. It's still nice to be able to choose who the trusted party is.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#122

Post by finnh »

grandalf wrote: post #21
finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

Awesome idea, until an evil-or-just-buggy insurance contract robs its counterparties blind.

We're basically in no true Scotsman territory here.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#123

Post by sillysaurus3 »

doener wrote: post #83

"my favorite part of this latest ICO hack is that it appears to have gone to same wallet as the dao hack ....." https://mobile.twitter.com/IamNomad/status/88777698177709261... "incredible plot twist: whitehat hacker supposedly saved most tokens from being stolen using the same vuln." https://mobile.twitter.com/bcrypt/status/887775417406431232?... "Multisig wallets affected by this hack: - Edgeless Casino (@edgelesspr…

my favorite part of this latest ICO hack is that it appears to have gone to same wallet as the dao hack .....

Any proof of this?

EDIT: This appears to be false. From https://blog.ethereum.org/2016/06/17/critical-update-re-dao-...

The leaked ether is in a child DAO at https://etherchain.org/account/0x304a554a310c7e546dfe434669c...

But that site shows the account hasn't received anything since July 8.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#124

Post by grandalf »

AlexandrB wrote: post #40
grandalf wrote: post #21

Earlier quoted context omitted.

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

> Not really true. Nothing has to be perfect if there is insurance infrastructure. Why not just use a traditional financial institution then? What's the benefit of the complexity of a blockchain if it's still unreliable without the added meatspace complexity of a bank?

> Why not just use a traditional financial institution then?

Insurance via smart contracts is still far simpler and more efficient to implement than in meatspace.

Consider things like insurer solvency risk and the way that meatspace regulations make that hard to understand. With cryptocurrencies an insurer can easily offer proof of solvency based on all outstanding risks.

Insurance emerges as a fundamental economic behavior when you have investment and you have an uncertain future. There is benefit to risk pooling. Since most of us live in the first world where the traditional financial system has evolved ample insurance infrastructure, we don't always realize how remarkable it is, or how vulnerable we are to bad regulation of it.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#125

Post by cookiecaper »

dna_polymerase wrote: post #46
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Won't happen. People need to believe that the justice system will hear their pleas and consider factors on-balance, and then proceed in fairness. In real law, there are several potential overrides available to stop egregiously unfair outcomes that would otherwise be legally valid (estoppel, unconscionability, etc.). People will not accept a system that does not have the appearance of fairness (regardless of its actual fairness).

One of the things that cyberpunks fail to grasp is that people don't want a perfectly immutable, fixed system. They want to feel that their sense of justice and moral righteousness can be satisfied. Stuff that drops people off right at "sucks to be you" doesn't really work; there must be some type of recourse available even if it doesn't have a 100% success rate.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#126

Post by swsieber »

codewiz wrote: post #106
matt_wulfeck wrote: post #100

I'm sure they'll just hard fork again. And nobody cares because ethereum isn't actually being used for anything real, just a bunch of enthusiasts trying to get rich.

How is rolling back transactions that are clearly part of a robbery a bad thing?

Because it's rolling back transactions that were done under "the law" (e.g. the ether contract stuff) by human intervention when the entire draw of the ether contract stuff was the promise of no human intervention

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#127

Post by pg_is_a_butt »

codewiz wrote: post #106
matt_wulfeck wrote: post #100

I'm sure they'll just hard fork again. And nobody cares because ethereum isn't actually being used for anything real, just a bunch of enthusiasts trying to get rich.

How is rolling back transactions that are clearly part of a robbery a bad thing?

how is a contract mechanism with arbitrarily mutable contracts a good thing?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#128

Post by csomar »

pyrale wrote: post #95
csomar wrote: post #71

Earlier quoted context omitted.

The problem is, how do you reassign the funds after the hardfork? The funds are attached to addresses and not persons.

You can revert the funds to the address that paid into the contract in the first place, since transactions are public.

That wouldn't move the money to their rightful owner but to the previous owner.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#129

Post by hirsin »

justinjlynn wrote: post #59
Analemma_ wrote: post #43

Earlier quoted context omitted.

> Unmarked functions default to public in Solidity What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

Design... before Solidarity I had never seen such an abuse of the word.

I think the capitalization of a method making the difference between two very different outcomes might be my favorite example. It's that kind of stuff that makes me happy I have to go through api reviews at work - although seriously how does anyone sign off on these designs?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#130

Post by bnbn66788 »

dna_polymerase wrote: post #46
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Which is the minority opinion of the more "neckbeard" crowd that disproportionate control of the platform.

If it scales to be a relied upon social tool, their foot-down rhetoric would likely come under heavy scrutiny.

Post reply on HN