Critical Update on DAO Vulnerability • Hacker News Board

Re: Critical Update on DAO Vulnerability

#141

Post by joosters » Fri, Jun 17, 2016, 10:34 AM UTC

ottodev wrote: post #107

joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

If there is network consensus to do the rollback, then the blockchain stays decentralised.

What is 'network consensus'? It certainly isn't giving everyone a vote as to whether they think the rollback is a good idea or not. Instead, it's connected people wielding influence.

Re: Critical Update on DAO Vulnerability

#142

Post by mpeg » Fri, Jun 17, 2016, 10:35 AM UTC

curiousgal wrote: post #113

mpeg wrote: post #101

Earlier quoted context omitted.

Apparently all that talk of decentralisation goes out the window when you're losing money. Ha

Huh? What does halting trading has to do with compromising decentralization? You do know what "decentralization" mean right?

They're now talking about essentially blacklisting the hacker's ETH address, how is that decentralised?

Halting trading is a show of force too, if they believed a single thing of what they preach they'd let the free market continue its course with the hacker walking away with the money.

Looking at your comment history it seems clear you have an agenda here, so I'll ignore the ad hominem.

Re: Critical Update on DAO Vulnerability

#143

Post by makomk » Fri, Jun 17, 2016, 10:36 AM UTC

nneonneo wrote: post #104

ThomasRooney wrote: post #60

Earlier quoted context omitted.

- I don't think there's any definitive details yet, but it could be an instance of this attack [1]. The code behind the DAO is available here [2]. Apparently [3], there's a bug where one can recursively call `splitDAO` multiple times to extract ether from the contract if one has a split open. - Ether can go missing when it is sent to a public address which has no known corresponding private key. It's a "we can't inve…

Ah, I see: the money isn't missing, it's just gone to an unknown party (the hacker) - so we're practically watching a bank heist in progress, where the "good guys" are trying to slow down the robber's getaway vehicle (by flooding the transaction network). I looked into this a bit more, and it seems very likely that the attackers are exploiting a recursive call - from https://live.ether.camp/account/304a554a310c7e546d…

I'm not sure someone else could start exploiting the bug - I suspect that they need to have DAO tokens and successfully vote to split their share off into a new sub-DAO they control first, and if I recall correctly there's a minimum voting period that has to elapse for that to happen.

Re: Critical Update on DAO Vulnerability

#144

Post by lordnacho » Fri, Jun 17, 2016, 10:36 AM UTC

I recall reading in the Bitcoin docs that the Forth-like scripting language was non-Turing complete. In addition, nothing particularly complex was using the scripting at the time.

I guess this sort of thing would be the reason. One thing is finding bugs in ordinary software, where the bugs are accidents. It's hard.

Another thing entirely is where you are looking for adversarial bugs. Just look at security articles that appear on HN now and again. They're incredibly complex, and it's not like you can turn off the firehose. When you fix one gap, someone will find another.

I haven't done a lot of reading on ETH, but I would imagine the smart thing to do would be to have some small number of contract types that a lot of people can stare at and try to break. The more attention is distributed among various bespoke contracts, the harder it gets to secure them.

It's like everyone building their own awesome cars, with special bells and whistles, and then asking these non-security engineers to design a lock. Everyone will end up re-learning some painful lessons.

Re: Critical Update on DAO Vulnerability

#145

Post by nikolay » Fri, Jun 17, 2016, 10:42 AM UTC

return0 wrote: post #119

Is this a weakness of ethereum or the DAO ? How much analog money was invested in total in the DAO ?

Of both, I guess. Or of cryptocurrencies in general.

Re: Critical Update on DAO Vulnerability

#146

Post by mpeg » Fri, Jun 17, 2016, 10:42 AM UTC

buttershakes wrote: post #24

This pretty directly contradicts a lot of the hype around Ethereum. Yes, bad contract code is bad, but a lot of money is about to evaporate. If it isn't easy to write secure contracts then there is a serious deployment problem.

This is what really annoys me about the Ethereum VM, there was no need for turing completeness. Bitcoin has a perfectly good scripting system that they keep adding opcodes to, and is not vulnerable to some of these kind of attacks.

Re: Critical Update on DAO Vulnerability

#147

Post by benbou09 » Fri, Jun 17, 2016, 10:43 AM UTC

tingol wrote: post #116

benbou09 wrote: post #106

Earlier quoted context omitted.

Can't they just take control of TheDAO, and then steal all its Ether?

And drop its value to nothing, why do that?

TheDAO only owns 15% of Ether supply, so it would not destroy its value

Re: Critical Update on DAO Vulnerability

#148

Post by pron » Fri, Jun 17, 2016, 10:44 AM UTC

infodroid wrote: post #127

icebraining wrote: post #114

Earlier quoted context omitted.

Actually, I'd say the fact that he has to publicly ask for exchanges to stop the trades, and can't simply press a button or send out an order, shows the decentralization. Decentralization doesn't prevent coordination.

I think you're missing the point. The fact that one man can bring the whole of Ethereum trading to a halt with an announcement really demonstrates just how much power he has. So it doesn't matter that he doesn't have a physical kill switch if the end result is the same.

Why, has anyone thought that decentralization means no one has a lot of power? I figured that people who prefer decentralizations prefer feudal power over centralized power.

Re: Critical Update on DAO Vulnerability

#149

Post by mbrock » Fri, Jun 17, 2016, 10:44 AM UTC

mpeg wrote: post #111

walrus01 wrote: post #29

It's almost as if a cryptocurrency system used by the grey market and black market sections of the internet contained actual blackhats. What a surprise. Much as I hate to link to reddit, for effective and biting criticism of cryptocurrencies: http://reddit.com/r/buttcoin

This might serve as a future warning to NOT write your own VM. Sure, it's probably a contract issue, but we'd have some much better contract code if the VM didn't require you to code defensively all the time.

Do you mean there are some existing VM designs that could have been used instead of EVM?

Re: Critical Update on DAO Vulnerability

#150

Post by 1019301911 » Fri, Jun 17, 2016, 10:47 AM UTC

verroq wrote: post #138

746F7475 wrote: post #132

Earlier quoted context omitted.

So can random people who agree with each other completely control everything that happens with the currency? So if there is a company who they dislike can they just decide that they have no money?

Majority of ethereum holders would want to rollback. That is consensus. If they don't hard fork they can keep running an old node. What is the problem?

How do you know? Of course, it could be established using "safe" blockchain voting technology...