Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White hat hacker awarded $2M for fixing ETH-creation bug

cryptoadventure.com

Post reply on HN
Print view View original

31–40 of 354 posts

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#31

Post by sillysaurusx »

saurik wrote: post #3

Prior discussion of this incident (and the $2M bounty) here on Hacker News: https://news.ycombinator.com/item?id=30289240 My (I'm the hacker) article / post-mortem this blog post is referring to: https://www.saurik.com/optimism.html At the time of this last getting traction a few days ago, some people were sad that the title of my article and the discussion that resulted focused more on the bug instead of the bounty…

So how many lambos are you buying?

More seriously, will you keep it in the bank and extract $100k a year the rest of your life? What are you going to do?

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#32

Post by rosndo »

aqme28 wrote: post #30
rosndo wrote: post #12

Earlier quoted context omitted.

We have atomic swaps to monero now, cleaning your stolen eth is easier than ever.

How are you going to turn that into actual goods and services though? You'll still need to go through an exchange with KYC and AML and the IRS will still be asking questions.

IRS doesn’t care as long as you pay taxes on the money.

KYC and AML? Just lie that you mined the monero on a now defunct pool. I have a plenty of coins that I genuinely acquired in such manner and haven’t had issues selling them. The bank only cares about hearing a vaguely consistent story, they aren’t cops.

The KYC stuff will only become a problem if you get caught via some other means, because lying to the bank is a crime.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#33

Post by sillysaurusx »

jacquesm wrote: post #29
saurik wrote: post #24

Earlier quoted context omitted.

Yeah... and as the person in question who found and exploited this particular bug ;P, I can definitely state that I would not feel comfortable betting the rest of my life on my ability to safely launder a giant pile of crypto back through to fiat (and then, further, keep that secret for the rest of my life, which shouldn't be downplayed). I am much happier being able to get a bunch of clean money and then be able to…

The whole assumption that your ethics have a pricetag attached is faulty, it's not as if the choices were 'commit crime / get bounty'.

Everyone’s ethics have a price tag. It’s better not to pretend otherwise, since it clarifies a lot of human behavior.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#34

Post by jacquesm »

sillysaurusx wrote: post #33
jacquesm wrote: post #29

Earlier quoted context omitted.

The whole assumption that your ethics have a pricetag attached is faulty, it's not as if the choices were 'commit crime / get bounty'.

Everyone’s ethics have a price tag. It’s better not to pretend otherwise, since it clarifies a lot of human behavior.

I strongly disagree with that. You really can't claim to speak for everybody.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#35

Post by blendergeek »

aqme28 wrote: post #30
rosndo wrote: post #12

Earlier quoted context omitted.

We have atomic swaps to monero now, cleaning your stolen eth is easier than ever.

How are you going to turn that into actual goods and services though? You'll still need to go through an exchange with KYC and AML and the IRS will still be asking questions.

Or, the criminal could buy goods and services with the monero directly.

The IRS will ask questions of those people, but not the black hat "security researcher".

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#36

Post by saurik »

jacquesm wrote: post #29
saurik wrote: post #24

Earlier quoted context omitted.

Yeah... and as the person in question who found and exploited this particular bug ;P, I can definitely state that I would not feel comfortable betting the rest of my life on my ability to safely launder a giant pile of crypto back through to fiat (and then, further, keep that secret for the rest of my life, which shouldn't be downplayed). I am much happier being able to get a bunch of clean money and then be able to…

The whole assumption that your ethics have a pricetag attached is faulty, it's not as if the choices were 'commit crime / get bounty'.

Yeah: I definitely agree with this, and I think it is an endemic problem to discussion of ethics in technology: we tend to focus on "but I could"--which sometimes ignores the law but even when it doesn't tends to then get bogged down arguing the exact boundaries of the law--without instead trying to judge people on whether they "should" (maybe based on the ramifications it has on other people) or "would".

I just think it is also worth noting that, even if we do accept the false dichotomy, I would not be an effective criminal... which seems to continually disappoint some people ;P. (I'm sorry to be such a let down! lol)

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#37

Post by jacquesm »

saurik wrote: post #36
jacquesm wrote: post #29

Earlier quoted context omitted.

The whole assumption that your ethics have a pricetag attached is faulty, it's not as if the choices were 'commit crime / get bounty'.

Yeah: I definitely agree with this, and I think it is an endemic problem to discussion of ethics in technology: we tend to focus on "but I could "--which sometimes ignores the law but even when it doesn't tends to then get bogged down arguing the exact boundaries of the law--without instead trying to judge people on whether they "should" (maybe based on the ramifications it has on other people) or "would". I just thi…

Indeed, not everything that is permitted is ethical.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#38

Post by jacquesm »

rosndo wrote: post #32
aqme28 wrote: post #30

Earlier quoted context omitted.

How are you going to turn that into actual goods and services though? You'll still need to go through an exchange with KYC and AML and the IRS will still be asking questions.

IRS doesn’t care as long as you pay taxes on the money. KYC and AML? Just lie that you mined the monero on a now defunct pool. I have a plenty of coins that I genuinely acquired in such manner and haven’t had issues selling them. The bank only cares about hearing a vaguely consistent story, they aren’t cops. The KYC stuff will only become a problem if you get caught via some other means, because lying to the bank is…

A reminder not to take legal advice from HN.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#39

Post by berkes »

saagarjha wrote: post #6
saurik wrote: post #3

Prior discussion of this incident (and the $2M bounty) here on Hacker News: https://news.ycombinator.com/item?id=30289240 My (I'm the hacker) article / post-mortem this blog post is referring to: https://www.saurik.com/optimism.html At the time of this last getting traction a few days ago, some people were sad that the title of my article and the discussion that resulted focused more on the bug instead of the bounty…

I’m glad you seem to be happy with your payout, but can we talk for a moment about how much you got? For an exploit like this, especially given how much effort was put into it and how much the market rate of a security engineer like this would be, plus given how much this could be worth on the exploit market, $2 million is literally pennies. This could’ve easily been a bug worth hundreds of millions of dollars. I gue…

When you sell your car, and someone is paying more than usual. Should you keep looking for someone who might pay ten times that amount?

That person is there, maybe not today, maybe not within 10km. By wait a few years, or drive a few thousand KM or both.

Does that make the first, already above-average offer 'pennies'?

Off course not.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#40

Post by sillysaurusx »

jacquesm wrote: post #34
sillysaurusx wrote: post #33

Earlier quoted context omitted.

Everyone’s ethics have a price tag. It’s better not to pretend otherwise, since it clarifies a lot of human behavior.

I strongly disagree with that. You really can't claim to speak for everybody.

If you don’t play ball in certain parts of the world, you end up in a river. The price tag is just different.

Yours would likely be family or close relatives.

I think you’d take money to do something untoward if that was the alternative. Almost everybody would. And there’s nothing wrong with admitting that.

Post reply on HN