Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chasing the DAO Attacker’s Wake – A second exploit

pdaian.com

Post reply on HN
Print view View original

141–150 of 180 posts

Re: Chasing the DAO Attacker’s Wake – A second exploit

#141

Post by homogeneous »

jsprogrammer wrote: post #129
homogeneous wrote: post #122

Earlier quoted context omitted.

If that's the case then I'm confused as to where the cryptocurrency comes in. A security deposit works just as well with fiat cash as it does with cryptocurrency and in your example there is no money exchanged at all.

Money is only a token of value. What if you were unable to accept cash (for example, you are on vacation)? Wouldn't it be useful to make a deposit on a car, right before you use it? What hasn't been explained here, are what guarantees the depositor receives.

I just don't see how ethereum (or even bitcoin) is useful here. If you make a deposit on a rental vehicle then the deposit will be returned when you return the vehicle as it was given to you. Why is a smart contract needed?

Re: Chasing the DAO Attacker’s Wake – A second exploit

#142

Post by mbrock »

jerf wrote: post #95
mbrock wrote: post #76

Earlier quoted context omitted.

I'm not sure that it is super humanly difficult. It seems likely that programming patterns, such as not using I trusted external sends at all, will emerge that any contract will need to abide by to be trusted. If what you say is true then Ethereum is DOA, which seems unlikely to me. (I don't own any ETH.) I totally agree that it would be great to have more language based security and I've started dabbling with some s…

And there are still people running around who think that writing code based on threads and semaphores isn't superhumanly difficult and people just need to Try Harder (TM). At least when they're wrong, they usually don't lose millions of dollars. (But only... usually .) I think some people are mentally modeling Ethereum as a sort of hobby thing in their head when they say things like that. I mean, who cares if my hobb…

I think humans are capable of writing correct programs even in machine code, it's just tricky and requires some expertise.

I also think the EVM itself allows for other paradigms than Solidity that might make it easy to create certain kinds of contracts.

And I think worse is better is very powerful, so it wouldn't surprise me if Ethereum sticks along for a long time, like Bitcoin seems to be doing despite its flaws.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#143

Post by etherial »

099812891 wrote: post #82
drcode wrote: post #69

Earlier quoted context omitted.

Yeah, all this shadenfreude from people who (wrongly) predicted ethereum would never work, and who want to feel vindicated, is predictable but frustrating.

Sure, ephemerum works in the same manner as Windows 98, Adobe Flash and sendmail.

So hugely popular beyond anything you or anyone you know has ever made?

Re: Chasing the DAO Attacker’s Wake – A second exploit

#144

Post by homogeneous »

gomox wrote: post #127
homogeneous wrote: post #100

Earlier quoted context omitted.

> a multisignature wallet, that requires more than one person to sign off on a transaction before it can happen. This is possible with bitcoin isn't it? What does the added complexity of ethereum bring to the table? > payment schedules or any kind of transaction that does not function exactly like a one time, full size payment This also seems possible with bitcoin, but it's also a problem that has already been solved…

For example, a smart contract might withhold $100 from an account, and grant whoever owns the private key to that account access to open a lock. When the user is done using the resource (say, a shared car or apartment or locker), he can request his money back (minus a fee for using the resource) which would render him unable to use the resource anymore (i.e. open the lock). Basically the equivalent of a credit card c…

> Basically the equivalent of a credit card collateral on a rental, minus the credit card company.

I just don't see how a smart contract is helpful here since you're still relying on the owner of the resource to relinquish your funds when they are satisfied that you have returned their property in the condition they rented it to you. Whether you use cash, credit card, bitcoins or eth the power dynamics remain the same because it's ultimately up to the owner to say "ok, everything looks good, you can have your deposit back now".

Re: Chasing the DAO Attacker’s Wake – A second exploit

#145

Post by homogeneous »

gomox wrote: post #128
homogeneous wrote: post #121

Earlier quoted context omitted.

I suppose it depends on the product, the merchant, and the cost of the subscription. Certainly, it'd be foolish to give out a credit card to a merchant I do not entirely trust, however, it seems more risky to move cryptocurrency into a contract with a merchant I do not entirely trust (and a contract I probably don't fully understand, even if I take the time to read the code) since a credit card can protect me from fr…

This might sound funny in light of recent events, but the idea is that a smart contract requires no trust in a 3rd party as the rules are specified within the contract and the Ethereum platform guarantees proper execution of the contract.

I understand how it works, I just don't see how it is useful in this instance. How is a smart contract helpful in the case of an online subscription service like netflix? A credit card is less work because I don't have to "refill" the contract every month and it's safer because of the added protection from fraud and erroneous charges that a credit card company guarantees.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#146

Post by dragonwriter »

homogeneous wrote: post #144
gomox wrote: post #127

Earlier quoted context omitted.

For example, a smart contract might withhold $100 from an account, and grant whoever owns the private key to that account access to open a lock. When the user is done using the resource (say, a shared car or apartment or locker), he can request his money back (minus a fee for using the resource) which would render him unable to use the resource anymore (i.e. open the lock). Basically the equivalent of a credit card c…

> Basically the equivalent of a credit card collateral on a rental, minus the credit card company. I just don't see how a smart contract is helpful here since you're still relying on the owner of the resource to relinquish your funds when they are satisfied that you have returned their property in the condition they rented it to you. Whether you use cash, credit card, bitcoins or eth the power dynamics remain the sam…

Yeah, basically any time a smart contract involves anything that isn't a digital commodity (currency or otherwise) on the same platform, you run into that kind of problem, AFAICT.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#147

Post by chc »

happyslobro wrote: post #136
wyager wrote: post #111

Earlier quoted context omitted.

Patchwork solutions won't cut it. "Solidity" is inherently unsuited for the task of safe and correct contract design.

This looks like an ideal use case for a Haskel based DSL. We need good static analysis capabilities, and we have to carefully manage side effects.

I'm not sure Haskell's type system is sophisticated enough to be relied on to prevent the kinds of problems The DAO ran into. As I understand it, one of the bugs boils down to recursive calls between two side-effecting functions, which seems like it would probably be just as possible in a parallel-universe Ethereum based on Haskell.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#148

Post by 989182911 »

etherial wrote: post #143
099812891 wrote: post #82

Earlier quoted context omitted.

Sure, ephemerum works in the same manner as Windows 98, Adobe Flash and sendmail.

So hugely popular beyond anything you or anyone you know has ever made?

Sure, Herbalife is also more popular than most things that diligent and intelligent persons have made.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#149

Post by IncRnd »

homakov wrote: post #41
AJ007 wrote: post #20

Nearly a year ago I made the comment -- "Who are these people[1] and what credentials do they have to build and run a cryptocurrency platform?" [1] https://angel.co/ethereum-1 Today, not a single cryptographer, mathematician, or anyone with software security experience is listed on the Ethereum Foundation member list[2]. I am not attacking any individuals by themselves, but as a group this says a lot. For the record,…

This is unfair to banish a company for not having enough "security experience". It could happen to anyone (i mean making such a design mistake), plus they afaik had some external audits. "Aha, no security background!" is wrong.

Actually, "Aha, no security background!" is the exact right attitude to have.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#150

Post by homogeneous »

dragonwriter wrote: post #146
homogeneous wrote: post #144

Earlier quoted context omitted.

> Basically the equivalent of a credit card collateral on a rental, minus the credit card company. I just don't see how a smart contract is helpful here since you're still relying on the owner of the resource to relinquish your funds when they are satisfied that you have returned their property in the condition they rented it to you. Whether you use cash, credit card, bitcoins or eth the power dynamics remain the sam…

Yeah, basically any time a smart contract involves anything that isn't a digital commodity (currency or otherwise) on the same platform, you run into that kind of problem, AFAICT.

So it seems to me as well, and even when you're dealing with most kinds of digital commodities, I don't see how a smart contract is helpful. Say I bought some software from valve or microsoft or whoever; I pay (with fiat or crypto) download, install and run, if it does not function or is totally different from what is advertised, I can ask for a refund and either the merchant will honor my request or they won't, but a smart contract cannot codify this type of arrangement.

I don't want to sound like a hater, and I think as a developer it seems pretty cool that you can start receiving funds on the web without relying on a 3rd party gatekeeper, but it seems like smart contracts have pretty limited uses (not that they are useless, just very specialized)

Post reply on HN