Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White hat hacker awarded $2M for fixing ETH-creation bug

cryptoadventure.com

Post reply on HN
Print view View original

261–270 of 354 posts

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#261

Post by mandarax8 »

rschachte wrote: post #127
saurik wrote: post #3

Prior discussion of this incident (and the $2M bounty) here on Hacker News: https://news.ycombinator.com/item?id=30289240 My (I'm the hacker) article / post-mortem this blog post is referring to: https://www.saurik.com/optimism.html At the time of this last getting traction a few days ago, some people were sad that the title of my article and the discussion that resulted focused more on the bug instead of the bounty…

Really cool to see Saurik posting here casually. You’re work on Cydia when I was 12 years old is what got me into programming in the first place. Nice work!

Wow I knew I recognised that name from somewhere, Cydia brings back some memories of 10yo me too. Glad he's still on it after all this time.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#262

Post by wonnage »

capableweb wrote: post #84
heliodor wrote: post #54

Earlier quoted context omitted.

Please read this thread to see the pitfalls that might potentially lie ahead: https://www.reddit.com/r/AskReddit/comments/24vo34/comment/c... It's about winning the lottery but still applicable to some extent, and shows how people's lives go horribly wrong.

Not sure it's actually applicable. That Reddit comment is about poor people winning lots of money by chance, not smart people earning lots of money by working. The risks are very different, not to say that the scale between 2 million and 170 million is way bigger than you seem to think.

The first example he gives is an already-rich guy though

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#264

Post by VectorLock »

jollybean wrote: post #28

In other words: ETH was an insecure blockchain and once compromised, there is no legal or operational recourse, with the implication that issues could indeed exist today. House of Cards.

Ethereum has forked to roll-back hacks in the past, likely for something as big as making ETH from thin air they'd do the same with even less hesitation.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#265

Post by __MatrixMan__ »

NovemberWhiskey wrote: post #196
__MatrixMan__ wrote: post #177

Earlier quoted context omitted.

The lack of agility shows up when I buy something with your credit card number. It gets delivered, and then the bank reverses the transaction because they later learn that I'm not you. Now I get a bank-subsidized thing and you're not missing any money. It creates a drag on the whole economy, because instead of doing productive work to get the thing, it's often easier to play games with the system. The fact that credi…

In the situation you describe, the one who is "out" is the merchant. In the card-not-present situation, the merchant has the option to use tools like CVV and address validation to reduce the risk in the transaction, and always has the option to decline a transaction that seems risky. That seems, to me, like a sensible risk balancing approach. In the cryptocurrency "all sales are final" world - you're the loser. I don…

Whether it's the merchant or the bank that's left holding the bag often depends on the particulars like whether it was a chip or a magstripe transaction, but the larger point is that in card-not-present scenarios you can't pay once without also exposing secrets that allow whoever gets them to make subsequent transactions without your permission.

Better would be to have whatever secret authorizes spend (private key) be separate from the account identifier (public key) and to push money, rather than sharing a symmetric secret which authorizes whoever has it to pull money.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#266

Post by [deleted] »

colesantiago wrote: post #247
birracerveza wrote: post #239

Earlier quoted context omitted.

https://thegraph.com is one example. Tokens are used to have a stake as an indexer (data provider) and to pay for query fees (data consumption), and if indexers tamper with the data they lose their stake. It was released last year and has a long way ahead to mature, but it's an amazing product and tokens/blockchain is essential to its decentralized nature. Simply put, there is no way to accomplish this if the network…

Again, this can be done without using a blockchain. Just like all the other coins, the only use case is burning up the planet by using Ethereum, BTC, etc, racking up high fees and being used by speculators while everyone else who invests in the ponzi scheme lose their money when it all crashes. Nothing has changed.

[deleted]

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#267

Post by blendergeek »

aqme28 wrote: post #199
blendergeek wrote: post #35

Earlier quoted context omitted.

Or, the criminal could buy goods and services with the monero directly. The IRS will ask questions of those people, but not the black hat "security researcher".

I want a mansion. How do I buy that with monero?

Land will be harder (though not impossible) to purchase with crypto. next, find a construction company ready to accept payment in crypto. Mansion attained. Perhaps, buy said mansion in Keene, New Hampshire where more crypto users live.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#268

Post by birracerveza »

colesantiago wrote: post #247
birracerveza wrote: post #239

Earlier quoted context omitted.

https://thegraph.com is one example. Tokens are used to have a stake as an indexer (data provider) and to pay for query fees (data consumption), and if indexers tamper with the data they lose their stake. It was released last year and has a long way ahead to mature, but it's an amazing product and tokens/blockchain is essential to its decentralized nature. Simply put, there is no way to accomplish this if the network…

Again, this can be done without using a blockchain. Just like all the other coins, the only use case is burning up the planet by using Ethereum, BTC, etc, racking up high fees and being used by speculators while everyone else who invests in the ponzi scheme lose their money when it all crashes. Nothing has changed.

>Again, this can be done without using a blockchain.

How so?

I won't bother with the rest of the post as it's your usual crypto bad spiel that has absolutely nothing to do with the discussion we're currently having and has absolutely nothing to back up its claims (as do the rest of your posts, which I'm surprised aren't flagged/dead yet considering their low quality, but I guess HN is ok with them since they're anti crypto), but I'm curious to see how you would build a decentralized system that lets developers build data indexing programs, allows anyone to join the decentralized network as a data provider to run those programs, and lets consumers query that data from the network while also ensuring that the data is valid and hasn't been tampered with by the providers without blockchain/tokens.

Please, do enlighten me, I'm curious.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#269

Post by sizzle »

easrng wrote: post #218
londons_explore wrote: post #190

Earlier quoted context omitted.

Or until someone notices... All the balances and stuff are public on the blockchain. It only takes one person to write a script to verify that the locked up amount matches the number of tokens out there. and when it doesn't, alert. That then means any attacker will have to be very quick with their theft, and if so, there is still a good chance whatever coins they get will end up blacklisted or the transactions revers…

Just get the ETH into Tornado Cash ASAP, that should avoid any potential blacklisting.

I mean even if you got it in there after blacklisting, how would they know the wallet that received it?

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#270

Post by karamanolev »

phphphphp wrote: post #116
toolz wrote: post #102

Earlier quoted context omitted.

If you're poor and gambling, then you're making a stupid financial decision. So the odds of you being financially stupid seem likely to be high.

For most people, gambling isn't a financial decision, it's an entertainment decision. The value of thinking about winning (regardless of how unlikely it is) is worth the $1 cost of a lottery ticket, so labelling gambling a "stupid financial decision" is like labelling owning a TV while poor a "stupid financial decision"... but poor people deserve entertainment as much as rich people.

I'd argue that for most gambling, it's not a decision, but an addiction or false hope financial decision. Those that treat it as a entertainment don't really gamble that much money.

Not sure if that's true by number of gamblers, but my gut says it's mostly true weighed by the amount of money gambled away. I say mostly, because we don't count rich kids / oligarchs wasting money for fun, who might dominate the value chart.

Post reply on HN