Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

171–180 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#171

Post by true_religion »

sillysaurus3 wrote: post #154
vkou wrote: post #80

Earlier quoted context omitted.

> If you were the attacker and you now have the ETH in your wallet, how do you cash out without anyone identifying you and maximising your profits? Exchange to BTC, mix it, exchange to USD. > Also has the attacker broken a law by exploiting a bug in the contract? There are no laws. Only contracts.

This won't work in the US. It's very hard to get USD out of Bitcoin. And then the IRS will want to know where you are suddenly getting a huge amount of money from. You could use localbitcoins to offload one coin at a time on an as-needed basis. That'd be pretty sweet, and the IRS won't be able to know anything strange is happening if you avoid depositing your USD into a bank. But paying rent in all-cash is rather ske…

Why is it very hard? Can't one simply use Coinbase?

> And then the IRS will want to know where you are suddenly getting a huge amount of money from.

In my experience, the IRS is largely unconcerned with where you are getting money from. They just want you to declare it, and pay taxes on it.

If you treat Bitcoin as ordinary income and pay taxes on it at the highest available rate, the IRS will largely be satisfied. If you treat Bitcoin as a long term investment and attempt to only pay capital gains tax.... well then the IRS will become curious enough to ask for 'proof of origin'.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#172

Post by ryandvm »

cookiecaper wrote: post #125
dna_polymerase wrote: post #46

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Won't happen. People need to believe that the justice system will hear their pleas and consider factors on-balance, and then proceed in fairness. In real law, there are several potential overrides available to stop egregiously unfair outcomes that would otherwise be legally valid (estoppel, unconscionability, etc.). People will not accept a system that does not have the appearance of fairness (regardless of its actua…

Not sure why you're being downvoted because you're exactly right. The crypto-anarchists love to say "the code is the law", but the reality is that losing your retirement savings because somebody forgot to mark a method private is a pretty shitty outcome.

For all its warts, a legal system backed by a jury of your peers is still the best way of sorting out the actual intent of a contract when the shit hits the fan.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#173

Post by oh_sigh »

resf wrote: post #156
swsieber wrote: post #126

Earlier quoted context omitted.

Because it's rolling back transactions that were done under "the law" (e.g. the ether contract stuff) by human intervention when the entire draw of the ether contract stuff was the promise of no human intervention

In a blockchain, the participants in the network have unlimited authority to modify the "law" of the blockchain, even retroactively. If there is sufficient consensus among Ethereum users for a hard fork, then it can happen.

Yes, and that 'feature' of block chains is never really touted by blockchain supporters. Basically, if 51% of the network think you have too much money, they can just take it from you with no recourse available.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#174

Post by ep103 »

taspeotis wrote: post #111
dna_polymerase wrote: post #46

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Matt Levine has some thoughts [1] on that matter. [1] https://www.bloomberg.com/view/articles/2016-06-17/blockchai...

Great article!

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#175

Post by eek05 »

AlexandrB wrote: post #105
RexetBlell wrote: post #33

Earlier quoted context omitted.

Can't you say the same thing about software that uses encryption in general? For example your browser, yet you still trust it. Also, what you said applies to critical software in airplanes, and cars like Tesla, yet you still somehow trust it without reading the code. Maybe you should replace the word "Ethereum" with "sotware". "Software in general makes sense is all the following are true"

> Can't you say the same thing about software that uses encryption in general? For example your browser, yet you still trust it. Software in general doesn't exist in a vacuum - it's backed by all the centuries-old meatspace institutions like common law, courts, and lawyers that provide a recourse when something goes wrong. As I understand Ethereum's whole purpose is to replace a lot of these institutions with "smart…

Not necessarily. Without judging the suitability of Ethereum for this, if you have something that does automated contracts at e.g. 9 nines reliability (fails one time in a billion), it may be very much worthwhile even if you have to fall back to the court system for the one in a billion occurrence.

Now, I'm skeptical of Ethereum's suitability in this space - the design doesn't seem to be geared enough towards correctness. However, they've also done some things that I really like (e.g. rolling back The DAO), so I'm not counting them out just yet.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#176

Post by [deleted] »

codewiz wrote: post #157
swsieber wrote: post #126

Earlier quoted context omitted.

Because it's rolling back transactions that were done under "the law" (e.g. the ether contract stuff) by human intervention when the entire draw of the ether contract stuff was the promise of no human intervention

I don't think anyone could honestly promise that. The law is written in code, and clearly code can be changed by human intervention. It's even open source, so technically anyone can change the Ethereum protocol, at any time. Of course, changes to the law are effective only when there is overwhelming consensus, otherwise they're called minority forks.

[deleted]

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#177

Post by justinjlynn »

hirsin wrote: post #129
justinjlynn wrote: post #59

Earlier quoted context omitted.

Design... before Solidarity I had never seen such an abuse of the word.

I think the capitalization of a method making the difference between two very different outcomes might be my favorite example. It's that kind of stuff that makes me happy I have to go through api reviews at work - although seriously how does anyone sign off on these designs?

> sign off on these designs

I only wish people had to do that. Shit like this are why professional and civil engineers roll their eyes at the mention of software "engineering". There are best practices and available tools but people employ them far less often than they probably should. In the space, take a look at Kadena's Pact smart contract language. It's not perfect by any means (lisp-religious syntax and its tight integration with Kadena internal constructions, for example) but it is at the least, working on formal verification support.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#178

Post by dvcc »

Animats wrote: post #147
Analemma_ wrote: post #43

Earlier quoted context omitted.

> Unmarked functions default to public in Solidity What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

This is why I keep saying that "smart contracts" should be expressed in some declarative notation like decision tables. Byte-coded programs as contracts were a really bad idea. Contracts need to be readable, not just executable.

I'm kind of curious on what you think about Tezos and its Michelson language (https://www.tezos.com/static/papers/language.pdf) which offers provability of contracts.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#179

Post by earlz »

Analemma_ wrote: post #43
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

> Unmarked functions default to public in Solidity What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

My favorite critique of Solidity is this guy on hacker news from a few days back https://news.ycombinator.com/item?id=14691212

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#180

Post by codewiz »

urda wrote: post #141
codewiz wrote: post #106

Earlier quoted context omitted.

How is rolling back transactions that are clearly part of a robbery a bad thing?

... because it breaks the basic fundamentals of a block chain. A block chain is supposed to fight against roll backs not support them . Sure, the core team / devs are using the rollback for good. But will that always be the same in the future? It's an avenue for abuse and one of the primary reasons ether isn't going to take off.

The point is, if the core team made a change that's widely unpopular, clients would just refuse to upgrade to that version.

Discontent users simply switch to a different branch maintained by different developers. If there's enough consensus, people will call it "real" blockchain and the other one will be left behind with few users and hence no meaningful way to spend the balances.

Post reply on HN