Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

321–330 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#321

Post by codewiz »

urda wrote: post #190
codewiz wrote: post #180

Earlier quoted context omitted.

The point is, if the core team made a change that's widely unpopular, clients would just refuse to upgrade to that version. Discontent users simply switch to a different branch maintained by different developers. If there's enough consensus, people will call it "real" blockchain and the other one will be left behind with few users and hence no meaningful way to spend the balances.

The last thing you want with any currency is two different sides arguing what the real "truth" is. The moment that happens, the currency loses any influential power.

Exactly. You need overwhelming consensus to change the rules safely.

Bitcoin is currently in a state of disarray because groups of developers, miners, industry and users disagree on fundamental aspects of the scaling debate.

There are no fewer than 4 competing Bitcoin fork proposals on the horizon, each one with an unknown number of supporters. The only thing we can measure accurately is "signaling" in blocks, where miners declare their intention to follow one fork when the designated time comes: https://coin.dance/blocks

However, there is such a thing as "false signaling" for strategic reasons, and hashing power can rapidly shift (or just appear, if new mining rigs come online) in favor of a different proposal at any time.

This is indeed a deeply flawed voting system. In contrast, Ethereum still has a capable leadership with sufficient consensus that they can propose and execute hard-forks whenever they feel it's needed, without this level of uncertainty and drama.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#322

Post by ghayes »

legolassexyman wrote: post #282
theptip wrote: post #222

Earlier quoted context omitted.

Poking around in that project, I don't see any specific tests of the Wallet contract... would be interested to see what UTs/STs were included if anyone knows where they are -- or was it just manually tested on the testnet? It seems that a basic set of UTs for this contract should have caught this issue. It's not even in the category of weird timing attacks or complicated internal states allowing unexpected state tran…

As I said here last week "Also the lead developer is some kid who believes very much in moving fast and breaking things. This philosophy may work for a social network site but not for other people's money." This philosophy permeates the community of Etherum development. Bitcoin disabled most of the smart contracts op codes for a very good reason. I wouldn't recommend putting anything of value into an Etherum smart co…

Do you have examples of this, or just hearsay?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#323

Post by Taek »

legolassexyman wrote: post #282
theptip wrote: post #222

Earlier quoted context omitted.

Poking around in that project, I don't see any specific tests of the Wallet contract... would be interested to see what UTs/STs were included if anyone knows where they are -- or was it just manually tested on the testnet? It seems that a basic set of UTs for this contract should have caught this issue. It's not even in the category of weird timing attacks or complicated internal states allowing unexpected state tran…

As I said here last week "Also the lead developer is some kid who believes very much in moving fast and breaking things. This philosophy may work for a social network site but not for other people's money." This philosophy permeates the community of Etherum development. Bitcoin disabled most of the smart contracts op codes for a very good reason. I wouldn't recommend putting anything of value into an Etherum smart co…

People write this stuff off so fast. Here we have a parity developer, probably one of the most competent in the Ethereum ecosystem, and he screwed up to the tune of losing $30m of other people's money.

If HE can't get it right, what business do you have running around saying that anyone who can make a webpage can make a decentralized application?

We are playing with money. Dealing with attackers is not as simple as rebooting your server. Mistakes mean irreversible loss.

The devs in this industry are way over their heads and nobody is willing to admit it, because doing so destroys the entire core value prop of Ethereum, the poster child of the current bubble.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#325

Post by make3 »

radlad wrote: post #253
Analemma_ wrote: post #43

Earlier quoted context omitted.

> Unmarked functions default to public in Solidity What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

This is the design of most high-level scripting languages (e.g. Javascript, PHP, Python, Ruby)...

These aren't called "Solidity" and more importantly weren't built specifically to write a financial infrastructure of multiple hundreds of million dollars (though some of these languages are definitely used to manage money now)

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#326

Post by wheelerwj »

moeop wrote: post #292
wheelerwj wrote: post #212

Earlier quoted context omitted.

i know that you're not really serious when you generalize against all of us crypto simpletons, but anytime theres a stupid amount of money on the table people are bound to rush to pick it up. and that means mistakes. the work being done on public blockchains is unlike anything else done before. You don't have he luxury of keeping your db behind a vpn running on a vm platform secured and maintained by the worlds large…

These mistakes are predictable and inexcusable. The Ethereum developers sold a vision of smart contracts, where the code is the contract. However, their hubris lead to them attempting to implement a complex language, instead of starting the endeavor with a small, simple, verifiable language. Similarly, their belief in their own infallibility lead them to write code that is not tested, and to create capabilities that…

you don't think 200m ico's counts as marketing traction?

This space doesn't atract incompetence, it atracts everyone. When you have tech thats so transparent and accessible, degrees and diplomas don't get to decide who can or cannot work on it. Plus, the world most experience blockchain developer has at most, 9 years of experience. That's not a lot of time to work out the kinks.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#327

Post by grandalf »

dragonwriter wrote: post #310
sum627u wrote: post #304

Earlier quoted context omitted.

This is nonsense. Ethereum is uninsurable. The turtles-all-the-way-down notion that you can wrap a bad "smart contract" in a bad "smart insurance contract" and buy Ethereum insurance from an Ethereum insurer and prove that there will be enough Ethereum there to make everyone whole economically should everything go to shit because a fundamental problem in Solidity lets anyone unilaterally blow the whole thing up... I…

It may not be uninsurable, but pretty clearly trying to use insurance on the platform to insure against risk that are in some sense endemic to the platform seems quite misguided.

> but pretty clearly trying to use insurance on the platform to insure against risk that are in some sense endemic to the platform seems quite misguided

Absolutely, the risk posed by a malfunctioning VM is a systemic risk that applies to the entire platform. So there is a chance that contracts impacted by a VM bug could be unreliable across the pre and post bugfix VM. The insurance contract could be one of these.

However, all things considered, I think it's interesting to contemplate a binary future "contract" about whether there will be a VM-bug-necessitated ETH hard fork in the next 30 days. What would the ideal exchange be to take a position on that future? I think it would probably be a different, but largely similar, smart contracts platform very similar to ETH, possibly even ETC.

Notably the meatspace financial system does a horrible job at identifying much less hedging against systemic risks. Identification is hard because the interactions between multiple regulatory systems and ambiguous and variable enforcement mechanisms are nearly impossible to model or to understand. It's like having a bunch of inter-related contracts all of which run on their own buggy VM.

The meatspace system seems very stable until you realize that it's highly brittle. It's impossible to meaningfully measure firm solvency risk, because the behavior of the "VM" is so unpredictable.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#328

Post by wheelerwj »

eropple wrote: post #244
wheelerwj wrote: post #212

Earlier quoted context omitted.

i know that you're not really serious when you generalize against all of us crypto simpletons, but anytime theres a stupid amount of money on the table people are bound to rush to pick it up. and that means mistakes. the work being done on public blockchains is unlike anything else done before. You don't have he luxury of keeping your db behind a vpn running on a vm platform secured and maintained by the worlds large…

One of the more important skills in this craft is the combination of intuition and knowledge to know when you don't know something well enough to achieve the goal. The difference between "ambition" and "hubris" is small but critical.

That's a valid point. But its hard to be humble when you work on something that was designed to topple national banks.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#329

Post by mmgutz »

eco wrote: post #144
Deimorz wrote: post #54

Earlier quoted context omitted.

I don't follow Ethereum closely at all, but I don't really understand a few things about this: - Who's the "white hat group"? Why do people have confidence in it? - Why does everyone believe they'll give back $75M+? If they decided to just keep it, what could anyone do? - How will people even be able to claim ownership of the ETH in a way that's verifiable so they know they're giving it back to the right person?

It's the same group that rescued funds during The DAO attack so they have a good history of benevolent hacking. They are just going to deploy new multi-sig contracts with a fix and make the original owners the owners of the new contracts. Pretty easy to do. They are actually paying for the gas to do the fix using donations they received for their work on The DAO attack so the original wallet owners aren't even out th…

Please ELI5. I thought contracts were fixed but they're going to deploy a "new" contract reverting back the owners? Contracts can change at any time?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#330

Post by vasilipupkin »

Taek wrote: post #323
legolassexyman wrote: post #282

Earlier quoted context omitted.

As I said here last week "Also the lead developer is some kid who believes very much in moving fast and breaking things. This philosophy may work for a social network site but not for other people's money." This philosophy permeates the community of Etherum development. Bitcoin disabled most of the smart contracts op codes for a very good reason. I wouldn't recommend putting anything of value into an Etherum smart co…

People write this stuff off so fast. Here we have a parity developer, probably one of the most competent in the Ethereum ecosystem, and he screwed up to the tune of losing $30m of other people's money. If HE can't get it right, what business do you have running around saying that anyone who can make a webpage can make a decentralized application? We are playing with money. Dealing with attackers is not as simple as r…

Dear god, I've been thinking crypto is a bubble since 2010. At some point, we have to admit this is not just a bubble. It's a new unproven evolving technology
Post reply on HN