And now for a critical update regarding the DAO vulnerability...
Error establishing a database connection
Critical Update on DAO Vulnerability
241–250 of 629 posts
Re: Critical Update on DAO Vulnerability
#242This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…
100% agreed and anyone who expects these types of smart contracts to replace typical contracts is overlooking this.
The real void smart contracts fill is the type of contracts that cannot be trusted to be enforced by the current court systems.
For example, consider prediction markets. Just about any economist or rational person will tell you these are a huge boon to the world, but the CFTC shut down InTrade just a few years ago. It makes a lot of sense for these types of contracts to move onto ETH or similar.
Re: Critical Update on DAO Vulnerability
#243Re: Critical Update on DAO Vulnerability
#244[deleted]
Re: Critical Update on DAO Vulnerability
#245Earlier quoted context omitted.
The longest fork wins.
Isn't that basically measuring which side has more hashing power? It's not obvious to me why that necessarily represents "the majority of ethereum holders". Or am I missing a mechanism?
The hashing power is the voting power. Since it is not obvious how one could even define what "the majority of ethereum holders" even means (and who says that every ethereum holder who is a physical person has to have the same voting power? If this were the case one would simply split your ethereum "account" into many who are hold by stooges).
Re: Critical Update on DAO Vulnerability
#246I always though that Etherium had a huge attack surface. Each script has to be security audited, etc. That's the thing about Bitcoin. It's as simple as possible while still being secure and useful and has been beat up and audited by the best security pros in the world. Distributed Systems are not easy. Secure distributed systems with Byzantine fault tolerance are even harder. Etherium is just trying to do too much.
Most people really don't understand the difficulties involved. It's an incredibly hard thing to get right.
Turing machine, meet the halting problem
It's not just hard.
Re: Critical Update on DAO Vulnerability
#247Earlier quoted context omitted.
It has been proven impossible to reach full consensus at scale in a fully decentralized, asynchronous system (the FLP theorem). So, in computer science terms, consensus algorithms are about approximating distributed consensus in the face of benign and malicious threats or communication failures, which devolves to "quorum / majority" pretty quickly in a crisis. After the crisis, some kind of compensation, reconciliati…
So that means if you are against majority thought you are shit out of luck. Just think of any time when majority consensus hasn't been the optimal solution.
If you believe that there is a better way to find a consensus in a distributed system than majority you are free to implement a system based on it. I consider it as quite plausible that such a system exists, but cannot even imagine how it might look like.
Re: Critical Update on DAO Vulnerability
#248This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…
> How do _you_ know your contract is secure? It most likely is not, looking at the recent post on contract security, most if not all examples ever posted as best practice are flawed and can be exploited: https://blog.ethereum.org/2016/06/10/smart-contract-security... (currently down, cached version https://webcache.googleusercontent.com/search?q=cache:https:... )
that's the gist of the problem
Turing machine, meet halting problem.
Re: Critical Update on DAO Vulnerability
#249This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…
I agree completely. 'Smart' contracts are terribly flawed in this regard. Operating outside of contract law is a weakness, not a strength. No-one can write bug-free code, so why are these people building a huge, expensive system that relies on no bugs being found?
I agree, for now. What I argue is that just like nobody can write bug free code, nobody can write bug free contracts as well. I think this might have a good use case down the road once all the bugs are worked out. That said, it's not ready for prime time yet.
Re: Critical Update on DAO Vulnerability
#250This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…
I'm mostly an ethereum skeptic, but maybe this doesn't actually indicate that all smart contracts are doomed? Maybe all it means is that bespoke ethereum contracts are risky, and people will have to use boilerplate contracts that have proven robust in the past.
I sort of assumed this DAO thing was intended in this spirit, as an experimental stab on the path to robust contracts.