Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

211–220 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#211

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Except for that DAO of last summer, in that case the law changed...

Ethereum's original sin

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#212
post #140
post #34

Earlier quoted context omitted.

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

Because the cryptocurrency space attracts only the brightest minds .

i know that you're not really serious when you generalize against all of us crypto simpletons, but anytime theres a stupid amount of money on the table people are bound to rush to pick it up. and that means mistakes.

the work being done on public blockchains is unlike anything else done before. You don't have he luxury of keeping your db behind a vpn running on a vm platform secured and maintained by the worlds largest companies. These engineers put themselves out there, waaaaaaaay out there to try and make shit happen. And they mostly do good work. But if banks and major retailers who have huge budgets can get hacked, of course we can too.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#213

Let's play hypotheticals. If you were the attacker and you now have the ETH in your wallet, how do you cash out without anyone identifying you and maximising your profits? Also has the attacker broken a law by exploiting a bug in the contract?

Exchange as much as possible via Shapeshift (accessed via Tor) and other exchanges that don't care about KYC to Zcash, Monero, and BTC. BTC is not anonymous but it's unlikely that BTC transactions are blocked and it will allow to convert to other currencies later on. Once you got Zcash and Monero you can anonymously convert to BTC and cash out via Coinbase. Make sure to only move small amounts at a time, so that the exchange can't block all of your funds.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#214
post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Seems like something a code review would have caught. Then again, code reviews and other slow processes are probably not the par for startups.

Precisely. Code reviews and software quality assurance aren't just corporate redtape, they can save your rear.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#215
post #140
post #34

Earlier quoted context omitted.

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

Because the cryptocurrency space attracts only the brightest minds .

My favorite smack-talk so far is "Dunning-Krugerrands".

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#216

Earlier quoted context omitted.

If we enter a contract that we all know is intended to be immutable, why would a judge not enforce that? I can understand buried and obfuscated immutability clauses, but if the parties know exactly what they're getting into, the parameters of justice are contained.

the parameters of justice are contained It just doesn't work like this.

Thank you for this.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#217

Earlier quoted context omitted.

Won't happen. People need to believe that the justice system will hear their pleas and consider factors on-balance, and then proceed in fairness. In real law, there are several potential overrides available to stop egregiously unfair outcomes that would otherwise be legally valid (estoppel, unconscionability, etc.). People will not accept a system that does not have the appearance of fairness (regardless of its actua…

Not sure why you're being downvoted because you're exactly right. The crypto-anarchists love to say "the code is the law", but the reality is that losing your retirement savings because somebody forgot to mark a method private is a pretty shitty outcome. For all its warts, a legal system backed by a jury of your peers is still the best way of sorting out the actual intent of a contract when the shit hits the fan.

Ignoring the fact that he was responding to a post that was sarcasm, if we really stop to think about it, how many people are judged by their peers and how many are judged by people who are the furthest from it?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#218
post #178

Earlier quoted context omitted.

This is why I keep saying that "smart contracts" should be expressed in some declarative notation like decision tables. Byte-coded programs as contracts were a really bad idea. Contracts need to be readable, not just executable.

I'm kind of curious on what you think about Tezos and its Michelson language ( https://www.tezos.com/static/papers/language.pdf ) which offers provability of contracts.

Just looking at this language, it makes me feel like we are going back in time in regards to readability and ease of use. I understand that security and provability of contracts is more important in these cases, but one can dream!

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#219
post #37

Forgive me for being harsh: Why is there no "pen-test" phase to any crytocurrency which hits the market. So, let me understand; you're ostensibly smart enough to (perhaps as a body of contributors, even) develop a cryptocurrency offering - yet youre also fucking stupid enough to not have same/wider network of ppl attempt to hack the fuck out of your plan? Does this already occur? or some savant comes and owns them? W…

*HIPAA. I remember it as "hippo", or "H-I-P-P-Oh darn, I spelled it wrong again!"

I know - call me dislexic...

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#220
post #193

Earlier quoted context omitted.

Not sure why you're being downvoted because you're exactly right. The crypto-anarchists love to say "the code is the law", but the reality is that losing your retirement savings because somebody forgot to mark a method private is a pretty shitty outcome. For all its warts, a legal system backed by a jury of your peers is still the best way of sorting out the actual intent of a contract when the shit hits the fan.

He's being downvoted because he's replying to obvious sarcasm as if it was serious. You also appear to have taken the joke seriously.

Poe's law: Sufficiently advanced satire is indistinguishable from fanatical confusion.

And many people do promote the "code is law, and nothing else" idea -- at least Ethereum Classic stuck to it!

Post reply on HN