Congratulations! A month after the first real test of the "distributed", "safe" cryptocurrency featuring "enforcable" contracts, it turns out it's none of this.
Critical Update on DAO Vulnerability
191–200 of 629 posts
Re: Critical Update on DAO Vulnerability
#192> (The soft fork) will later be followed up by a hard fork which will give token holders the ability to recover their ether. Does this mean that transactions are going to be rolled back? If so, are they planning to do this everytime a vulnerability is exploited? Is The DAO too big to fail?
I don't think they're going to roll back transactions but rather build in the functionality to "give token holders the ability to recover their ether".
Re: Critical Update on DAO Vulnerability
#193Can someone eli5 what DAO and ethereum are?
Re: Critical Update on DAO Vulnerability
#194> (The soft fork) will later be followed up by a hard fork which will give token holders the ability to recover their ether. Does this mean that transactions are going to be rolled back? If so, are they planning to do this everytime a vulnerability is exploited? Is The DAO too big to fail?
You're right, this can't happen every time.
If users truly want to embrace the decentralization then I see issues with the Ethereum maintainers doing very centralized and specific fixes to solve individual problems.
DAO != ETH, but I see how this is an act of self-preservation due to the amount of stakes the maintainers have themselves in ETH.
Re: Critical Update on DAO Vulnerability
#195I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"?
I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition.
Isn't the whole idea of that kind of contracts worthless if people are still rolling back effects of it when "it does not what it was meant to do"?
Re: Critical Update on DAO Vulnerability
#196Can someone explain what is going on here?
I'd also appreciate an explanation for audience who's never heard of DAO or Etherium.
A Turing complete blockchain was used to create a crowd-funded venture fund [TheDAO].
There was a bug in TheDAO's code. It got exploited in order to siphon off cryptocurrency worth many millions in USD.
Re: Critical Update on DAO Vulnerability
#197> (The soft fork) will later be followed up by a hard fork which will give token holders the ability to recover their ether. Does this mean that transactions are going to be rolled back? If so, are they planning to do this everytime a vulnerability is exploited? Is The DAO too big to fail?
Remember that when they say it's a suggestion, it's truly a suggestion. If a majority of the miners refuse to accept the update, then what anyone at the Ethereum foundation wants them to do is irrelevant.
There is definitely a lot of social pressure to consider here, but there is still no central switch. I'm generally not a huge fan of cryptocurrency (as currencies that is, I love the tech), but I fail to understand why so many people who are oppose this move so rabidly. They're in the same situation with respect to forking that they were yesterday: whatever 51% of the community decides to do will happen.
Re: Critical Update on DAO Vulnerability
#198Well, that was kind of inevitable. Building a financial system out of pure code with no humans in the loop and no legal structure is building a self-distributing bug bounty piñata. It's decentralised, so there's nobody who can throw a breaker and shout "stop!"; cryptocurrency transactions are irreversible, so thefts are permanent; and it's somewhat anonymous, so thefts are hard to trace. It also demonstrates that bei…
I find it endlessly amusing that people are willing to bet their cold hard cash on "this code has no bugs".
When widespread old and tested code like OpenSSL has massive security bugs, what chance does something as new and in-development as Bitcoin/Ethereum have? An in the case of Ethereum, the contracts themselves?
Re: Critical Update on DAO Vulnerability
#199Well, that was kind of inevitable. Building a financial system out of pure code with no humans in the loop and no legal structure is building a self-distributing bug bounty piñata. It's decentralised, so there's nobody who can throw a breaker and shout "stop!"; cryptocurrency transactions are irreversible, so thefts are permanent; and it's somewhat anonymous, so thefts are hard to trace. It also demonstrates that bei…
Exactly what I was thinking. If they had some sort of fraud-related authorized structure, which was able to "reverse" the result of an obvious software bug, I would say that it should've been much more stable financial system.
They sorta do have that. If most of the community agrees to run a software update that rolls back the theft, then it'll happen.
Re: Critical Update on DAO Vulnerability
#200This pretty directly contradicts a lot of the hype around Ethereum. Yes, bad contract code is bad, but a lot of money is about to evaporate. If it isn't easy to write secure contracts then there is a serious deployment problem.
This is what really annoys me about the Ethereum VM, there was no need for turing completeness. Bitcoin has a perfectly good scripting system that they keep adding opcodes to, and is not vulnerable to some of these kind of attacks.
Could you point me to some resources showing recently added opcodes?
Last time I looked at the Bitcoin code they had actually disabled some of the original opcodes due to security concerns. I'd be interested to see that this trend had reversed.