31–40 of 50 posts
I'm surprised and disappointed that EtherDelta doesn't use Content-Security-Policy headers. They pretty much solve XSS. Google has a good introduction to using them here: https://csp.withgoogle.com/
Earlier quoted context omitted.
The story is almost like the 2008 time where wall street wiz kids package the mortgages to special mortgages back securities/contacts and resell them over and over again to banks, mutual funds, etc. Hugh hype was created. Last time: It was safe because it was back by mortgage. This time: It is safe because it is back by crypto algorithm. Last time few smart insiders got billions richer and unload everything before th…
In 2007, I sold my business. In 2008, I put a bunch into the stock market and property. It was comparatively dirt cheap. I made a killing. I'd do the same with cryptocurrency, but I can't figure out how. My 2008 investments were pretty risk-free. Of course the economy was going to recover. It always does. I've no idea how to do that with cryptocurrency.
You could make a killing because you knew from history that the market usually overreacts and the 2007 financial crisis was such an event. Everything went down, even stuff that had good fundamentals, so you could scoop up lots of good stuff in 2008 at a cheap price.
Such events happen in cryptocurrencies every few months because of the increased pace. Like a few weeks ago when the whole market dumped 30% because China was flexing their muscles again and now we are about 20% up from that bottom.
So, that was easy money. But OTOH, if you bought in Q1 and just did hold since then, you would even be up 3x. Despite the dips in between. Insane performance but nobody knows if we are 10x next year or /10.
> Of course the economy was going to recover. It always does.
That's the important point. We have a long history of the stock market and we have some rules of thumb how it behaves.
We are in the exponential growth phase of a new technology and we don't know yet if the cryptocurrency hype has passed its top or not. The concept of cryptocurrencies is certainly here to stay but how much worth will it be and even more important, how much worth are the coins and tokens that exists now going to be?
Look at the history of other new technologies and try to decide where in that cycle we are right now. If that's easy money is up to you :-)
Earlier quoted context omitted.
Kinda like a knife -- it's a very useful tool if used well and a very painful tool if mishandled.
You're assuming it's possible to "use well". It's delusional to believe it's possible to understand the subtle interactions within and between "smart contracts". Even if we ignore the ambiguity of the real world, malicious actors, and other complexity multipliers, we already know it isn't possible to know if a "smart contract" will halt . Code will always have bugs, and you cannot truly understand how something writt…
There are also other contract languages aimed to solve some of the limitations you mention, like Tezos/Michelson [2][3], which facilitate formal verification.
The issues you point out are certainly valid, but I believe people in the space are cognizant of them and are working on solutions.
The smart contracts in Ethereum sounds awesome in practice and way more useful than Bitcoin mining but it seems like a giant security hole.
If you look at the kind of attacks that happen I feel like two major problems came from the fact that addresses can be real account addresses or contracts (it could have been good to segregate them) and errors/exceptions don't propagate well.
> I want to make one point clear: I believe that EtherDelta, in concept, is safer and more “trustworthy” than a traditional exchange. Everything about how EtherDelta functions is transparent and verifiable by users.... The attack detailed in this piece could have been identified by anyone before it was exploited, and if there had been a security review protocol in place, it would have been easily prevented. Even "in…
This blows my mind. These programmers can implement quite complex contacts-financial-exchanges on top of a quite complex distributed system, but then fail to sanitize user input in their web interface. It makes no sense.
https://news.ycombinator.com/item?id=15321015
"I put it to you that it’s impossible to write secure web apps."
Earlier quoted context omitted.
You're assuming it's possible to "use well". It's delusional to believe it's possible to understand the subtle interactions within and between "smart contracts". Even if we ignore the ambiguity of the real world, malicious actors, and other complexity multipliers, we already know it isn't possible to know if a "smart contract" will halt . Code will always have bugs, and you cannot truly understand how something writt…
Isn't that something that can be helped by having a good standard library though (e.g. STL)? OpenZeppelin [1] is one example that comes to mind. There are also other contract languages aimed to solve some of the limitations you mention, like Tezos/Michelson [2][3], which facilitate formal verification. The issues you point out are certainly valid, but I believe people in the space are cognizant of them and are workin…
It's limiting, but you can still have many of the fancier features by baking standard versions of them into the language/stdlib itself.
> I believe people in the space are cognizant of them and are working on solutions.
The problem with that is that this isn't a bug or engineering problem that we can solve with impossibly talented devs and a sufficiently large r&d budget. Questions about any non-trivial semantic behavior of a program (such as, "will the program halt"[2]) are known[3] too be undecidable[4].
[1] according to LangSec, the grammar needs to be deterministic context-free (or simpler). Anything more complex is undecidable.
[2] https://en.wikipedia.org/wiki/Halting_problem
I'm surprised and disappointed that EtherDelta doesn't use Content-Security-Policy headers. They pretty much solve XSS. Google has a good introduction to using them here: https://csp.withgoogle.com/
You will need to disable inline scripts which is inconvenient. CSP looks more like as hack for broken sites.
Earlier quoted context omitted.
Basically, how to bet that it is going to plummet in value and make money on that process. I figure it's a bubble and there's going to be a popping, even if it is done by force of law. These ICOs are starting to make powerful people angry. Thefts like this one are starting to get regular media coverage. At some point, probably soon, the governments are going to come and clamp down on it. Is there a way to long-term s…
Media coverage is negative only because that's what people like to click on. I think government regulation will only legitimize it and bring it to the masses.
Earlier quoted context omitted.
Media coverage is negative only because that's what people like to click on. I think government regulation will only legitimize it and bring it to the masses.
This very thread is about a negative. Would you rather they just ignore it?
News would be boring if it wasn't for the negative stuff.
All I'm saying that one should always question the motives of the media & not necessarily conclude a general opinion just by reading a bunch of articles that landed on the front page.
As for the exploit itself, it's hard to believe that in this day and age XSS is still a problem despite so many solutions & fixes for it.
Earlier quoted context omitted.
This blows my mind. These programmers can implement quite complex contacts-financial-exchanges on top of a quite complex distributed system, but then fail to sanitize user input in their web interface. It makes no sense.
Well, from my blog post three days ago, discussed here: https://news.ycombinator.com/item?id=15321015 "I put it to you that it’s impossible to write secure web apps."