Time for another hard fork!
153k Ether Stolen in Parity Multi-Sig Attack
291–300 of 754 posts
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#292Earlier quoted context omitted.
Because the cryptocurrency space attracts only the brightest minds .
i know that you're not really serious when you generalize against all of us crypto simpletons, but anytime theres a stupid amount of money on the table people are bound to rush to pick it up. and that means mistakes. the work being done on public blockchains is unlike anything else done before. You don't have he luxury of keeping your db behind a vpn running on a vm platform secured and maintained by the worlds large…
These mistakes are predictable and inexcusable.
The Ethereum developers sold a vision of smart contracts, where the code is the contract. However, their hubris lead to them attempting to implement a complex language, instead of starting the endeavor with a small, simple, verifiable language. Similarly, their belief in their own infallibility lead them to write code that is not tested, and to create capabilities that are literally untestable.
This was bound to result in multiple massive failures. The dao was one. This is another. There will be more, because it's an overly complex implementation.
It doesn't matter, though. Only dumb-fuck crypto futurist suckers have ether exposure, so it won't matter that they get zero'd out once a competent team enters the space. That said, the space attracts incompetence like lights attract moths, so it'll take a while to find a team that is technically competent and also has the marketing chops to get traction.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#293Earlier quoted context omitted.
> If you were the attacker and you now have the ETH in your wallet, how do you cash out without anyone identifying you and maximising your profits? Exchange to BTC, mix it, exchange to USD. > Also has the attacker broken a law by exploiting a bug in the contract? There are no laws. Only contracts.
This won't work in the US. It's very hard to get USD out of Bitcoin. And then the IRS will want to know where you are suddenly getting a huge amount of money from. You could use localbitcoins to offload one coin at a time on an as-needed basis. That'd be pretty sweet, and the IRS won't be able to know anything strange is happening if you avoid depositing your USD into a bank. But paying rent in all-cash is rather ske…
Given that you don't need to work anymore, there's no issues with just moving out of the US
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#294Earlier quoted context omitted.
Won't happen. People need to believe that the justice system will hear their pleas and consider factors on-balance, and then proceed in fairness. In real law, there are several potential overrides available to stop egregiously unfair outcomes that would otherwise be legally valid (estoppel, unconscionability, etc.). People will not accept a system that does not have the appearance of fairness (regardless of its actua…
Not sure why you're being downvoted because you're exactly right. The crypto-anarchists love to say "the code is the law", but the reality is that losing your retirement savings because somebody forgot to mark a method private is a pretty shitty outcome. For all its warts, a legal system backed by a jury of your peers is still the best way of sorting out the actual intent of a contract when the shit hits the fan.
Well then ethereum is not for THOSE people.
It is fine if you don't like those features. But it turns out that a lot of people DO want them.
The people who want to court system can already use the court system. Now we just have more options and choices.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#295Earlier quoted context omitted.
The DAO held nearly 14% of all ethereum in existence, 153,000ETH is less than .2%. 153,000 / 93,405,120[0] = 0.001638025838 [0] https://etherscan.io/stat/supply
And there's more Ethereum now. The DAO was a ~$50 million fraud. This was a ~$30 million fraud. Obviously this is totally different and there's nothing we can do about it and it's just fine. People should have known better than to use parity with this bug in it.
Reminds me of the Winston Churchill story:
“Churchill: "Madam, would you sleep with me for five million pounds?" Socialite: "My goodness, Mr. Churchill... Well, I suppose... we would have to discuss terms, of course... "
Churchill: "Would you sleep with me for five pounds?"
Socialite: "Mr. Churchill, what kind of woman do you think I am?!"
Churchill: "Madam, we've already established that. Now we are haggling about the price.”
We've already established that they will fork. Now we are haggling about the price.
[1] http://www.goodreads.com/quotes/300099-churchill-madam-would...
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#296Let me guess... another hard fork to undo this.
I know this is a joke, but what would prevent the thief from attaching high transaction costs to the withdrawal of ETH from the target wallets? Say they place 50% of the value into the transaction costs - miners would assume a healthy profit off of the theft and it wouldn't be beneficial for them to rollback the chain.
Takes longer for such a change to propagate than for the miner to just move his coins. Unless you implement it as some kind of history tracking for wallets, but then the hacker can just send a tiny transaction to literlaly every wallet around, and everone's paying the 50% cost.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#297Earlier quoted context omitted.
Whether it's an online service or a local wallet with an embedded buggy smart contract, your coins are just as gone. If you're perfectly happy to use it, you're perfectly happy to lose everything. How many millions need to be lost before this lesson is learned?
Again, you haven't made any case for not using open source third party software. The other other example you've come up with was a close source proprietary internet service. Very few people, for instance, use the official Bitcoin Core wallet.
I believe there have been scam wallet implementations for BTC in the past, though I don't have any info.
They're your coins. Throw them off a bridge if you want. Meanwhile, people who stick with core tech have been burned zero times.
Why does the obsession with shiny new convenient thing outweigh people's good sense not to risk thousands or hundreds of thousands of dollars? If that amount of money were printed out in front of you, you'd take extreme measures to protect it. "Don't use an un-audited third party piece of software that controls the fate of your life savings" is the most basic step.
It occurs to me that you might be arguing against this because you have a large sum stored in some third-party tech. If that's the case, I urge you to snap out of it and transfer your coins somewhere safe immediately.
I say "snap out of it" because that's the phrasing I would've used with myself, right before I lost money in Mt Gox. The only reason that happened is because I never stopped to ask myself "Is this a good idea?"
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#298Earlier quoted context omitted.
Right. It will take time, but eventually Solidity (or some other alternative smart contracts approach) will likely be very trustworthy and secure.
No, being Turing complete makes it impossible to be 100% secure and trustworthy, by definition. It is possible to have trusted contracts, iff their logic is (mathematically) proven. But the VM can't make contracts more secure by itself.
> No, being Turing complete makes it impossible to be 100% secure and trustworthy, by definition.
Being Turing-complete means it's possible to write some contracts/programs for which certain features are undecidable by analysis.
It doesn't mean that programs that could be also be written in any more limited language can't have all the properties about then that could be proven in the non-Turing complete language proven when written in the Turing-complete language.
> It is possible to have trusted contracts, iff their logic is (mathematically) proven.
Trustworthiness of programs (including “smart contracts”, which are only loosely analogous to traditional contracts) is about whether the actual people using them get what they expect out of their behavior. Mathematical proofs of formal properties may be useful to that in some cases, but are not generally sufficient.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#299Earlier quoted context omitted.
I think a big part of the complaint is about the implicit assumption that because people are smart, and have experience with cryptography, they necessarily have the experience to design a sane and safe programming language given their goals. They did put themselves way out there, and that takes ambition, but also hubris. I wish they were able to figure out which one was driving them at certain points a bit better, as…
Actually, I think Solidity being designed to turn bad node.js coders into bad smart contract coders was key to Ethereum's success. I've written a book on this (hit upload five minutes ago! release Monday!) which hammers on this point (and all the stuff surrounding this issue). I think Solidity is actually designed with worse is better in mind, because Ethereum is the first smart contract platform that anyone actually…
I agree that it was a key to the success; but it will also be a key to it's failure.
Because it's a financial system, and normal sane people don't want money that is demonstrably worse for nearly all the things that normal sane people do with money.
Ethereum is a great political statement, and a fun toy... but when you recast the worse is better story into this context, you're just demonstrating that you don't really understand the meaning of the words that you are mindlessly parroting.
Thanks for warning us that you're about to release a terrible book, with an incredibly stupid central idea.
You might as well have just written that MySpace is the future of social networking. Because while crypto will have an interesting place in the future; only a complete moron would make the argument that Ethereum is a success, or that worse is better applies here. Congratulations on being that moron.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#300The great thing about reading this comment thread is that I basically already read it a couple of weeks ago, because a friend of mine (David Gerard, of Wikipedia, RationalWiki and Rocknerd Internet fame) let me preview his forthcoming e-book _Attack of the 50-Foot Blockchain_. There's a whole section in there about smart contracts, Ethereum, and The DAO that goes over much of what commenters here have mentioned ("non-reversibility, till it's our money at stake", the requirement that everyone write and read code perfectly, the problems with the very idea of immutability in contracts, etc.)
If people are interested, it's on Amazon: http://amzn.to/2trOjJS (I have no financial interest in it, but I bet a lot of people in this thread would enjoy reading it and/or writing long diatribes on why he is wrong about everything in it.)