Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

291–300 of 629 posts

Re: Critical Update on DAO Vulnerability

#291

Post by xioxox »

imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

I don't know much about Ethereum, but why aren't the contracts declarative? Surely, it would be much easier to see the logic behind the contract and avoid the impossible task of a bug free turing complete language.

Re: Critical Update on DAO Vulnerability

#293

Post by Udo »

lmm wrote: post #284
Udo wrote: post #262

As an outsider, this is stunning to me: why isn't there a contract revokation mechanism? Considering these things are programmable, it could be something as simple as a killswitch hash sitting in a lawyer's safe somewhere, right?

The whole point of the exercise is to not have it under human control.

It seems that's a very expensive exercise with very predictable results. And "human control" is a very malleable concept, too. Obviously, there are humans in control of Ethereum somewhere, and obviously the DAO was set up by humans, too. For a decentralized commercial entity to have a lawyer on retainer doesn't seem like an inappropriate betrayal of principles to me, but of course the DAO people see it differently.

Re: Critical Update on DAO Vulnerability

#294

Post by Joeboy »

sznurek wrote: post #195

I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition. Isn't…

> I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"?

George Soros wasn't (afaik) breaking any law or contract when he drained a billion dollars from the Bank of England in 1992. I think most people in the UK would be OK with describing that as an attack.

Re: Critical Update on DAO Vulnerability

#295

Post by defenestration »

Some numbers to get a grasp of the scale:

> There is 2.436.828 Ethereum in the account of the attacker (see: https://etherchain.org/account/0x304a554a310c7e546dfe434669c...)

> That's about 3% of all Ethereum mined (source: http://coinmarketcap.com/currencies/ethereum/)

> The Ethereum in the account of the attacker has a value of $41 million

> The volume is about 30% of all Ethereum trade today

Re: Critical Update on DAO Vulnerability

#296

Post by datashaman »

Udo wrote: post #262

As an outsider, this is stunning to me: why isn't there a contract revokation mechanism? Considering these things are programmable, it could be something as simple as a killswitch hash sitting in a lawyer's safe somewhere, right?

Ethereum's byline is: Build unstoppable applications.

Re: Critical Update on DAO Vulnerability

#297

Post by dagw »

cmdrfred wrote: post #281
drinchev wrote: post #260

Earlier quoted context omitted.

Indeed, but you have bug-safety law around the world which incorporates something like : "If there is a typo, error, fraud, crime etc. a contract is considered invalid or the part of the contract that is flawed" With software bugs you have something similar : > NO WARRANTY. THE SOFTWARE IS PROVIDED TO YOU “AS IS” AND “WITH ALL FAULTS.”

Who decides what a typo is? "Oh, that contact for 1000 dollars is really 10 dollars because they 'missed' a decimal place. You still have to uphold your part though." Corruption of judges can be a problem in that space and that is in part what this is attempting to solve. A lofty goal, maybe even impossible, but certainly worth the time to try.

There are relatively few cases where $1000 and $10 are both reasonable numbers. It should be pretty obvious to both parties from context which is the 'correct' interpretation.

Re: Critical Update on DAO Vulnerability

#298

Post by sznurek »

ar0 wrote: post #280
infodroid wrote: post #266

Earlier quoted context omitted.

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

Agreed. If this soft and hard fork idea really goes through, it seems that now you are in fact getting the worst of both worlds: For your contract, you have to write code that apparently is very hard to get right and bug-free[1], while at the same time you are at the whim of a "community" -- whose decisions (sorry, "suggestions") can apparently be announced by one guy in a blog post -- not to deem what you are doing…

Commenting on your second thought: I hoped that people behind DAO (and Ethereum?) will stick to the terms they themselves proposed but it seems they will push hard for forking the chain (see: Ethereum blog).

Re: Critical Update on DAO Vulnerability

#299

Post by twoodfin »

Joeboy wrote: post #294
sznurek wrote: post #195

I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition. Isn't…

> I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? George Soros wasn't (afaik) breaking any law or contract when he drained a billion dollars from the Bank of England in 1992. I think most people in the UK would be OK with describing that as an attack.

I like this analogy, but no one tried to reengineer finance or the law to prevent Soros from spending his earnings.

Re: Critical Update on DAO Vulnerability

#300

Post by [deleted] »

mbrock wrote: post #206
Tinyyy wrote: post #188

> (The soft fork) will later be followed up by a hard fork which will give token holders the ability to recover their ether. Does this mean that transactions are going to be rolled back? If so, are they planning to do this everytime a vulnerability is exploited? Is The DAO too big to fail?

There's a lot of people who disagree with the hard fork idea and instead only want miners and clients to soft fork boycott the stolen coins. What will happen depends on the collective decision of the community which is still being actively hashed out.

[deleted]
Post reply on HN