Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ethereum Wallet and Mist Beta with Hard Fork choice

github.com

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Ethereum Wallet and Mist Beta with Hard Fork choice

#21

Post by heliumcraft »

HappyFunGuy wrote: post #17
heliumcraft wrote: post #12

Earlier quoted context omitted.

smart "contracts" = essentially a severless service running on a decentralized platform smart "contracts" != legal contracts

How decentralized is a platform that hardforks via human intervention? What happens when the 51% choose to take the money of the 49%? If your blockchain changes the rules, because someone followed the rules of the code, but following those rules led to the "wrong" people losing money. Then your blockchain is more harmful than useful.

"your blockchain"?.. This is not a football team or a clan, there is no "my"/"your"...

Decentralized systems work by consensus and by choice, for the DAO the consensus of the community is to stop the theft. Some might disagree and move to their own fork.

In the scenario of the "51%" you described, the "49%" would simply move to their own forked chain if they so choose.

Re: Ethereum Wallet and Mist Beta with Hard Fork choice

#22

Post by rhodey_orbits »

Ethereum brushed off my bug bounty submission and then began this hard fork junk so I documented and packaged my exploit publicly. It hasn't gotten much exposure yet, please have fun with it.

"Walking Past Same-origin Policy, NAT, and Firewall for Ethereum Wallet Control" - https://medium.com/@rhodey/walking-past-same-origin-policy-n...

Re: Ethereum Wallet and Mist Beta with Hard Fork choice

#23

Post by heliumcraft »

rhodey_orbits wrote: post #22

Ethereum brushed off my bug bounty submission and then began this hard fork junk so I documented and packaged my exploit publicly. It hasn't gotten much exposure yet, please have fun with it. "Walking Past Same-origin Policy, NAT, and Firewall for Ethereum Wallet Control" - https://medium.com/@rhodey/walking-past-same-origin-policy-n...

Nice post. It looks like a potential issue for someone specifically running geth with that config, but ok for an end-user using Mist or Metamask.

Re: Ethereum Wallet and Mist Beta with Hard Fork choice

#25

Post by rhodey_orbits »

heliumcraft wrote: post #23
rhodey_orbits wrote: post #22

Ethereum brushed off my bug bounty submission and then began this hard fork junk so I documented and packaged my exploit publicly. It hasn't gotten much exposure yet, please have fun with it. "Walking Past Same-origin Policy, NAT, and Firewall for Ethereum Wallet Control" - https://medium.com/@rhodey/walking-past-same-origin-policy-n...

Nice post. It looks like a potential issue for someone specifically running geth with that config, but ok for an end-user using Mist or Metamask.

thanks! I didn't take the time to setup Mist but my understanding is that Mist is especially vulnerable because it's bundled with a wallet and used for browsing DAPPS which always require the JSON API to be enabled.

Re: Ethereum Wallet and Mist Beta with Hard Fork choice

#26

Post by ikeboy »

CydeWeys wrote: post #7

This looks really bad from the perspective of trusting the currency to actually retain its value. What if you end up on the wrong fork, and that thousands of dollars in Ethereum you accepted to send out physical goods ends up being worthless? What's the point in saving the DAO if it kills the whole purpose behind the currency?

As I understand it they only activate the fork if enough miners vote for it. If >50% of hashpower doesn't fork, then nobody forks. If >50% of hashpower forks, then that's known ahead of time since the vote was carried out in public by that same hashpower.

Re: Ethereum Wallet and Mist Beta with Hard Fork choice

#27

Post by heliumcraft »

rhodey_orbits wrote: post #25
heliumcraft wrote: post #23

Earlier quoted context omitted.

Nice post. It looks like a potential issue for someone specifically running geth with that config, but ok for an end-user using Mist or Metamask.

thanks! I didn't take the time to setup Mist but my understanding is that Mist is especially vulnerable because it's bundled with a wallet and used for browsing DAPPS which always require the JSON API to be enabled.

It's not since Mist (and Metamask) injects the web3 object into the page, no jSON-API is used. It also displays a confirmation dialog each time a transaction is generated. If setting up Mist too much trouble to try this, you can always try Metamask https://metamask.io/

Re: Ethereum Wallet and Mist Beta with Hard Fork choice

#28

Post by curiousgal »

rhodey_orbits wrote: post #22

Ethereum brushed off my bug bounty submission and then began this hard fork junk so I documented and packaged my exploit publicly. It hasn't gotten much exposure yet, please have fun with it. "Walking Past Same-origin Policy, NAT, and Firewall for Ethereum Wallet Control" - https://medium.com/@rhodey/walking-past-same-origin-policy-n...

It's been posted to r/ethereum. Check there.

https://www.reddit.com/r/ethereum/comments/4ta6go/walking_pa...

Post reply on HN