Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

201–210 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#201

Earlier quoted context omitted.

This won't work in the US. It's very hard to get USD out of Bitcoin. And then the IRS will want to know where you are suddenly getting a huge amount of money from. You could use localbitcoins to offload one coin at a time on an as-needed basis. That'd be pretty sweet, and the IRS won't be able to know anything strange is happening if you avoid depositing your USD into a bank. But paying rent in all-cash is rather ske…

Why is it very hard? Can't one simply use Coinbase? > And then the IRS will want to know where you are suddenly getting a huge amount of money from. In my experience, the IRS is largely unconcerned with where you are getting money from. They just want you to declare it, and pay taxes on it. If you treat Bitcoin as ordinary income and pay taxes on it at the highest available rate, the IRS will largely be satisfied. If…

I think coinbase's withdrawal limits aren't quite high enough for this amount of cash

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#202
post #169

Earlier quoted context omitted.

> Unmarked functions default to public in Solidity Facepalm Wasn't this lesson learned long ago? C# defaults to private on unmarked members. Why would you ever want to default public?

It was designed to be like Javascript. Of all languages...

Wouldn't it make more sense to design it like Haskell? or something even more strict? A little bit of extra work seems like a small price to pay to prevent millions being stolen from your wallet because of a silly mistake like this...

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#203

Earlier quoted context omitted.

> Unmarked functions default to public in Solidity What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

This is why I keep saying that "smart contracts" should be expressed in some declarative notation like decision tables. Byte-coded programs as contracts were a really bad idea. Contracts need to be readable, not just executable.

Byteball (https://byteball.org/ has declarative smart contracts!

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#204
post #193

Earlier quoted context omitted.

Not sure why you're being downvoted because you're exactly right. The crypto-anarchists love to say "the code is the law", but the reality is that losing your retirement savings because somebody forgot to mark a method private is a pretty shitty outcome. For all its warts, a legal system backed by a jury of your peers is still the best way of sorting out the actual intent of a contract when the shit hits the fan.

He's being downvoted because he's replying to obvious sarcasm as if it was serious. You also appear to have taken the joke seriously.

Perhaps they were simply elaborating on the sarcasm on account of the fact that sarcasm does a shit job of justifying or explaining anything.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#205
post #193

Earlier quoted context omitted.

Not sure why you're being downvoted because you're exactly right. The crypto-anarchists love to say "the code is the law", but the reality is that losing your retirement savings because somebody forgot to mark a method private is a pretty shitty outcome. For all its warts, a legal system backed by a jury of your peers is still the best way of sorting out the actual intent of a contract when the shit hits the fan.

He's being downvoted because he's replying to obvious sarcasm as if it was serious. You also appear to have taken the joke seriously.

Sarcastic or not, "contract by code" and "lawyers are obsolete" are, in reality, major selling points used by Ethereum evangelists. The OP's post gives an opportunity to discuss this.

I did not assign any assertion or position to the OP, only followed up on his thread about the potential ramifications that ETH backers seriously advocate.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#206
post #54
post #27

https://etherscan.io/address/0x1dba1131000664b884a1ba2384641... -- white hat group exploited the vuln and are holding people's crypto for them.

I don't follow Ethereum closely at all, but I don't really understand a few things about this: - Who's the "white hat group"? Why do people have confidence in it? - Why does everyone believe they'll give back $75M+? If they decided to just keep it, what could anyone do? - How will people even be able to claim ownership of the ETH in a way that's verifiable so they know they're giving it back to the right person?

They might have a significant amount of money in ETH themselves and the overall success is beneficial to them? Pure conjecture.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#207
post #193

Earlier quoted context omitted.

Not sure why you're being downvoted because you're exactly right. The crypto-anarchists love to say "the code is the law", but the reality is that losing your retirement savings because somebody forgot to mark a method private is a pretty shitty outcome. For all its warts, a legal system backed by a jury of your peers is still the best way of sorting out the actual intent of a contract when the shit hits the fan.

He's being downvoted because he's replying to obvious sarcasm as if it was serious. You also appear to have taken the joke seriously.

Except the "code is law" meme is a view that many crypto anarchists actually espouse.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#208

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Won't happen. People need to believe that the justice system will hear their pleas and consider factors on-balance, and then proceed in fairness. In real law, there are several potential overrides available to stop egregiously unfair outcomes that would otherwise be legally valid (estoppel, unconscionability, etc.). People will not accept a system that does not have the appearance of fairness (regardless of its actua…

You're right on the facts, although I don't quite get why you ridicule this idea as a "sense of justice and moral righteousness" with only the "appearance of fairness".

A system of laws devoid of all ambiguity and emotion isn't even possible, let alone desirable, because at some point these contracts have to come into contact reality, and the humans in it. And these humans happen to be, well: human.

I guess there's an ideology at play that would love to change humans to fit within their neatly arranged algorithms. And if that means some grandmother loses her house because she signed the wrong smart contract when buying cat-food, there'd be a lot expressions of sympathy on Twitter, but she really needs to understand that it's just not possible to do anything about, because principles etc etc.

Here and there, some of these people may, very privately, consider it a feature of the system that others less intelligent than them sometimes happen to die on the streets because of that one Saturday morning where they didn't audit all 500k lines of brainfuck in that contract for chinese takeout.

With less snark: the idea of ambiguity or emotions as being something negative is a somewhat naive view of reality, somewhere on the spectrum between Star Trek's ideal of Spock and the social darwinism of Ayn Rand. It's most often seen in the currently popular misunderstanding of how judges should behave, and how journalism supposedly used to work.

For an example that maybe is a bit less inflammatory than anything about journalism, check any recent threat about the Google vs Uber lawsuit: the presiding judge is almost a legend for his diligence in learning the technology in the Oracle vs. Google lawsuit a few years back. Yet people criticise him for a lack of decorum whenever he uses language that doesn't pretend to be a robot following an algorithm: "This judge is clearly biased! The contract clearly only says $50,000, and there's no law that gives him the authority to say those are USD. When the defendant says it means Canadian Dollars, it's he-said-she-said and undecidable"

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#209

Earlier quoted context omitted.

This won't work in the US. It's very hard to get USD out of Bitcoin. And then the IRS will want to know where you are suddenly getting a huge amount of money from. You could use localbitcoins to offload one coin at a time on an as-needed basis. That'd be pretty sweet, and the IRS won't be able to know anything strange is happening if you avoid depositing your USD into a bank. But paying rent in all-cash is rather ske…

Why is it very hard? Can't one simply use Coinbase? > And then the IRS will want to know where you are suddenly getting a huge amount of money from. In my experience, the IRS is largely unconcerned with where you are getting money from. They just want you to declare it, and pay taxes on it. If you treat Bitcoin as ordinary income and pay taxes on it at the highest available rate, the IRS will largely be satisfied. If…

You're saying you could declare "I now have $30 million in assets" on your IRS forms and it wouldn't trip any alarms?

I mean, I don't personally know which alarms would be tripped, or what effect that would have. But that just seems so unlikely.

It'd be fascinating if this were true, though, so any info would be appreciated.

Re: coinbase, it'd be foolish to use them because they have a history of disabling accounts for any reason they feel like. A friend of mine had their account disabled, so I know firsthand this is true. Also it's unlikely they'd send you such a large amount of money unless you were a business in good standing or had a long history with them. (I'm just guessing, though.)

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#210
post #170

Earlier quoted context omitted.

> personally reviewing the code. With the insane decision to use a Turing-complete language, the contract's behavior undecidable . You don't even know if the contract will halt . Limited "gas" (execution time) isn't the solution, because the lesson of the Halting Problem isn't that a program might not terminate. Even if the program halts within a finite time (or "gas"), the behavior of the program on the current inpu…

> With the insane decision to use a Turing-complete language, the contract's behavior undecidable. OTOH, if the language isn't Turing-complete, there will almost certainly be things you'll want a contract to do that it can't. You can have generality or decidability, but not both.

Right. It will take time, but eventually Solidity (or some other alternative smart contracts approach) will likely be very trustworthy and secure.
Post reply on HN