Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

301–310 of 629 posts

Re: Critical Update on DAO Vulnerability

#301

Earlier quoted context omitted.

Actually, I'd say the fact that he has to publicly ask for exchanges to stop the trades, and can't simply press a button or send out an order, shows the decentralization. Decentralization doesn't prevent coordination.

> and can't simply press a button or send out an order And the governmental powers-that-be can press a button and prevent citizens from exchanging cash?

Yes, easily by devaluing the currency.

Re: Critical Update on DAO Vulnerability

#302
post #297

Earlier quoted context omitted.

Who decides what a typo is? "Oh, that contact for 1000 dollars is really 10 dollars because they 'missed' a decimal place. You still have to uphold your part though." Corruption of judges can be a problem in that space and that is in part what this is attempting to solve. A lofty goal, maybe even impossible, but certainly worth the time to try.

There are relatively few cases where $1000 and $10 are both reasonable numbers. It should be pretty obvious to both parties from context which is the 'correct' interpretation.

To a rational person without ulterior motives yes, but remember in my country "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause" means "Go ahead and take papers (cash) from peoples cars without warrants, and then the burden is on them to prove they obtained it legally"

I certainly distrust the American legal system enough to use something like this in the future.

Re: Critical Update on DAO Vulnerability

#303
At the risk of being heavily downvoted, I think it is discussable if the hackers deserve their money or not when all the security and ethics are based on code since hacking is a pure part of it. Note that I said "discussable" and not right or wrong.

A good thread is evolving about this here: https://www.reddit.com/r/btc/comments/4oibqw/ding_dong_the_d...

Re: Critical Update on DAO Vulnerability

#304

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

IMO smart contracts are more about decentralized "serverless" services than they are about law contracts.

Personally I hate the term "smart contracts" because of the confusion they create on what they actually are.

Re: Critical Update on DAO Vulnerability

#305
I cant help but imagine the attacker party/their associates read reddit and online forums, and thus would be vocal in criticizing the soft/hard fork decision. The theft of $50m is being rendered useless in front of their eyes - a maddening situation I'm sure.

Re: Critical Update on DAO Vulnerability

#306

Earlier quoted context omitted.

Remember that when they say it's a suggestion, it's truly a suggestion. If a majority of the miners refuse to accept the update, then what anyone at the Ethereum foundation wants them to do is irrelevant. There is definitely a lot of social pressure to consider here, but there is still no central switch. I'm generally not a huge fan of cryptocurrency (as currencies that is, I love the tech), but I fail to understand…

Rubbish, this is as centralised as you can get. Of course it will go through, because the alternative will cause forks and chaos. Miners have little to no choice but accept this decision from on high.

By the same standard, any theoretically forkable open source project with an even slightly non-isotropic community surrounding it is "as centralized as you can get". What exactly is decentralized then?

Re: Critical Update on DAO Vulnerability

#307
post #250

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

I'm mostly an ethereum skeptic, but maybe this doesn't actually indicate that all smart contracts are doomed? Maybe all it means is that bespoke ethereum contracts are risky, and people will have to use boilerplate contracts that have proven robust in the past. I sort of assumed this DAO thing was intended in this spirit, as an experimental stab on the path to robust contracts.

> I sort of assumed this DAO thing was intended in this spirit, as an experimental stab on the path to robust contracts.

With millions of dollars in prizes if you could exploit it?

Re: Critical Update on DAO Vulnerability

#308
post #250

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

I'm mostly an ethereum skeptic, but maybe this doesn't actually indicate that all smart contracts are doomed? Maybe all it means is that bespoke ethereum contracts are risky, and people will have to use boilerplate contracts that have proven robust in the past. I sort of assumed this DAO thing was intended in this spirit, as an experimental stab on the path to robust contracts.

There are bugs in critical shared software infrastructure like Linux, libc, OpenSSL, and so on as well and not just a few minors ones.

Why would it be any different for "bespoke ethereum contracts"?

Re: Critical Update on DAO Vulnerability

#309
post #291

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

I don't know much about Ethereum, but why aren't the contracts declarative? Surely, it would be much easier to see the logic behind the contract and avoid the impossible task of a bug free turing complete language.

The Turing-completeness of the language is the whole point of Ethereum. That's what differentiates it from other (Bitcoin-like) crypto currencies. It allows anyone to build arbitrary business logic--an exchange, a venture capital firm, a game--that is run directly by the participants in the blockchain.

Re: Critical Update on DAO Vulnerability

#310

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

There is nothing stoping you from getting involved in a much more complex scheme of contracts. You could easily set up a system where a web of trust filtered, community funded "court" creates a wallet that is used for mitigating disputes. If a judgement (done by key signing votes) goes against a user you decrement how much they are going to get after the period ends and you increment how much the claimant gets. If nobody gets into a conflict at the end of the period everybody votes to send back all the money to everyone's respective wallets.
Post reply on HN