Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

271–280 of 629 posts

Re: Critical Update on DAO Vulnerability

#271

Post by techdragon »

runn1ng wrote: post #236
justusw wrote: post #203

Earlier quoted context omitted.

I share your bitterness. The meaning of the word "safe" seems to vary from person to person. The ETH and contract devs think safe means having a static PL to capture contracts. But in reality it is safe as in, whoever exploited the vulnerability now has a "safe" source of income in a few weeks. Perhaps it is a lesson better learnt now than later when the stakes are even higher.

Well, she doesn't, they will block the attacker outright by a centralized decree. What's the better proof that decentralized solutions work than blacklisting accounts and making ad-hoc forks for each attack.

A system not vulnerable to such simple attacks?

Re: Critical Update on DAO Vulnerability

#273

Post by [deleted] »

mbrock wrote: post #215
spdionis wrote: post #193

Can someone eli5 what DAO and ethereum are?

Ethereum is a P2P accounting system, like Bitcoin, but allowing users to upload automatic contracts that decide autonomously what to do with the tokens they possess. For example, you could upload a contract that lets some specific set of accounts withdraw money unless the balance goes under 500 ETH (which is the basic Ethereum currency). "The DAO" is such a contract but with more complex logic that amounts to a kind…

[deleted]

Re: Critical Update on DAO Vulnerability

#274

Post by ProfChronos »

Why do everyone mixes a decentralized system with a self-controlled system? Decentralization doesn't mean there is no power to regulate or no coordination between users/agents, it is just a model of architecture for a system where power belongs to local entities. That absolutely doesn't mean that there aren't rules and bodies to defend them [1]. [1] https://www.intgovforum.org/cms/wks2015/uploads/proposal_bac...

Re: Critical Update on DAO Vulnerability

#275

Post by CyberDildonics »

While it is easy to cherry pick past comments and pretend it was insight instead of luck, I have to say my intuition was pretty quickly validated that so much money in something so untested and complicated was excessively risky:

https://news.ycombinator.com/threads?id=CyberDildonics&next=...

Re: Critical Update on DAO Vulnerability

#277

Post by vertex-four »

joosters wrote: post #254
mcherm wrote: post #231

Earlier quoted context omitted.

> but they didn't halt trading until they were asked to, so clearly it wasn't totally in their interests? Not at all. This is a classic "coordination problem". It is advantageous for many participants in the overall system to take an action, but only if the other participants are ALSO taking the action. In such a case, a widely followed and popular leader is one possible coordinating mechanism. And it does not give t…

a widely followed and popular leader is one possible coordinating mechanism. That's the exact opposite of decentralized. Are we going to have to redefine the word?

Nobody has to follow the leader. Want to keep your exchange trading? Go ahead - nobody can stop you. It just so happens that everybody agrees this time.

Re: Critical Update on DAO Vulnerability

#278

Post by panic »

LoSboccacc wrote: post #248
0x006A wrote: post #223

Earlier quoted context omitted.

> How do _you_ know your contract is secure? It most likely is not, looking at the recent post on contract security, most if not all examples ever posted as best practice are flawed and can be exploited: https://blog.ethereum.org/2016/06/10/smart-contract-security... (currently down, cached version https://webcache.googleusercontent.com/search?q=cache:https:... )

that's the gist of the problem Turing machine, meet halting problem.

The halting problem is easy to solve for Ethereum programs by design. Programs are made of instructions, each instruction requires fuel to run, and fuel is limited, so every program must halt eventually.

Re: Critical Update on DAO Vulnerability

#279

Post by RubyPinch »

bArray wrote: post #253
tankenmate wrote: post #162

Use this link because the ethereum blog is suffering. http://pastebin.com/xW16N7Ye

Thanks! I don't understand why the site should be suffering so much? All these sites seem to suffer when a link gets posted in a few places. Do they all have something in common?

excessively large userbase compared to the amount of people who vote/comment is what I figure

+ I'd imagine quite a lot of people were expecting this blogpost, probably anyone who put more than $50 towards the DAO, and is currently awake

Re: Critical Update on DAO Vulnerability

#280

Post by ar0 »

infodroid wrote: post #266
imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

Agreed. If this soft and hard fork idea really goes through, it seems that now you are in fact getting the worst of both worlds: For your contract, you have to write code that apparently is very hard to get right and bug-free[1], while at the same time you are at the whim of a "community" -- whose decisions (sorry, "suggestions") can apparently be announced by one guy in a blog post -- not to deem what you are doing an "attack".

PS: Also a second thought: Given that the "attacker" used apparently existing functionality of the DAO and that the DAO site clearly states "[n]othing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code", I am wondering: If this (as measured by the DAO code: rightfully obtained) ether is now taken from him/her, might this not be an opportunity to sue the developers implementing this fork in a real-world court?

[1]: http://hackingdistributed.com/2016/06/16/scanning-live-ether...

Post reply on HN