Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZeppelinOS: tools for smart contract applications

blog.zeppelin.solutions

Post reply on HN
Print view View original

31–39 of 39 posts

Re: ZeppelinOS: tools for smart contract applications

#31

Post by currymj »

heliumcraft wrote: post #12
currymj wrote: post #10

Earlier quoted context omitted.

it's pretty hard to write even a simple smart contract that doesn't have horrible vulnerabilities. far harder, I would say, than writing C code that can't be buffer-overflowed on an old system with no protections in place. and solidity the language does NOT make this any easier. read all the resources you can. there are really counterintuitive best practices. the reason for all these hacks is not stupidity or lazines…

Quite the exaggeration, this silly meme has to stop. You make it sound like writing even a hello world would have horrible vulnerabilities or something. There are thousands of perfectly safe contracts deployed, one can't take some isolated incidents and make such conclusions from such a small sample.

maybe not a hello world, but even very rudimentary 20 LoC contracts for, say, keeping account balances can have reentrancy vulnerabilities when written in the obvious way. so your customer could just give themselves an infinite balance.

i don't think it's impossible to write secure smart contracts but it takes quite a bit of care even for simple stuff.

there are many issues that arise because your functions might be called by an adversary who has set up the stack in an evil way.

Re: ZeppelinOS: tools for smart contract applications

#33

Post by xellisx »

hossbeast wrote: post #29

Sounds interesting and important, but you probably need a new term for this category of software. "OS" is taken, and it means something else.

Also it's built on top of Ethereum Virtual Machine. Quick look at http://ethdocs.org/en/latest/introduction/what-is-ethereum.h..., which calling that a VM from what I read isn't screaming VM to me, more like a distributed computing application.

Re: ZeppelinOS: tools for smart contract applications

#34

Post by tom_mellior »

xellisx wrote: post #33
hossbeast wrote: post #29

Sounds interesting and important, but you probably need a new term for this category of software. "OS" is taken, and it means something else.

Also it's built on top of Ethereum Virtual Machine. Quick look at http://ethdocs.org/en/latest/introduction/what-is-ethereum.h... , which calling that a VM from what I read isn't screaming VM to me, more like a distributed computing application.

Which sense of virtual machine do you mean? There are already at least two. One is a virtualization thing like VMware. Ethereum is not that. The other sense is a bytecode interpreter/compiler like the Java Virtual Machine. Ethereum is like that. Except that it duplicates computations across many physical machines.

Re: ZeppelinOS: tools for smart contract applications

#35

Post by spalladino2 »

mattl wrote: post #20
edjere wrote: post #19

Earlier quoted context omitted.

It's an operating system insofar as it's a layer of services on top of the "bare metal" that is the EVM. Through those services it allows the development of complex applications in the same way a normal OS does.

How does that differ from installing a web framework, or an application? That doesn't seem like an operating system to me.

Good question. Both libraries and frameworks (the main difference between the two being the inversion of control) are addenda to your application, aimed at providing more features and building blocks to set up more complex behaviours.

zOS takes this one step further, including not only libraries for SC development, but also aiming at defining interoperability standards, mechanics and economics for having independent contracts interact between them as independent actors (or processes, if you will) on a shared computing space that is the blockchain.

I think the key here in terms of semantics is that zOS is not just an Operating System, but rather an Operating System for the blockchain. And when we go there, we don't have many definitions available, but are rather waiting to be made.

Re: ZeppelinOS: tools for smart contract applications

#36

Post by spalladino2 »

xellisx wrote: post #32
hossbeast wrote: post #29

Sounds interesting and important, but you probably need a new term for this category of software. "OS" is taken, and it means something else.

Should be OSS. What is strange is that the refer to the core of their software as a "Kernel".

OSS meaning operational support system?

Re: ZeppelinOS: tools for smart contract applications

#37

Post by edjere »

currymj wrote: post #31
heliumcraft wrote: post #12

Earlier quoted context omitted.

Quite the exaggeration, this silly meme has to stop. You make it sound like writing even a hello world would have horrible vulnerabilities or something. There are thousands of perfectly safe contracts deployed, one can't take some isolated incidents and make such conclusions from such a small sample.

maybe not a hello world, but even very rudimentary 20 LoC contracts for, say, keeping account balances can have reentrancy vulnerabilities when written in the obvious way. so your customer could just give themselves an infinite balance. i don't think it's impossible to write secure smart contracts but it takes quite a bit of care even for simple stuff. there are many issues that arise because your functions might be…

Agree with this, especially with the "it takes quite a bit of care even for simple stuff", but this should not discourage developers to do so. One of the reasons to build this kind of infrastructure is to set proper standards for smart contracts development which are currently missing. As long as we are aware that we need to be careful, and we raise the quality of the code and keep on developing tools to improve development as a whole things should keep on moving forward.

Re: ZeppelinOS: tools for smart contract applications

#39

Post by edjere »

throwaway91111 wrote: post #27
edjere wrote: post #19

Earlier quoted context omitted.

It's an operating system insofar as it's a layer of services on top of the "bare metal" that is the EVM. Through those services it allows the development of complex applications in the same way a normal OS does.

Seems like "framework" or "library" would be better; this isn't exactly a scheduler or resource allocator in the same way an os implies.

↑↑ Check the reply above by spalladino2.
Post reply on HN