Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

341–350 of 629 posts

Re: Critical Update on DAO Vulnerability

#341

Post by forbiddenlake »

Annatar wrote: post #177
deftnerd wrote: post #170

Earlier quoted context omitted.

With all due respect, this wasn't very constructive. HN is full of new and strange acronyms. Most of us either skip the article about it if we're not interested or simply google the term. Ethereum is a blockchain based cryptocurrency that also lets you submit programs to the blockchain that nodes around the world run in exchange for a small fee. I don't know what Uncles are, other than the brother of your father. The…

Well I mean the topic just assumes one knows everything there is to know about the subject, and to me, that's just wrong. I had no idea what any of that stuff meant, so I went to research it, and came back even more confused than I was when I started. Nevertheless, I thank you kindly for taking the time to explain.

Context-free headlines are a pattern on HN, and apparently are acceptable. Examples include this submission and things like "Buffer layoffs" which was not about staggering layoffs, but about a company named Buffer. Who knew?

Re: Critical Update on DAO Vulnerability

#342

Post by cpa »

DasIch wrote: post #337
cpa wrote: post #233

Earlier quoted context omitted.

Obviously you're right, that's tautological! The "attacker" didn't do more than what the system allowed her to do. People have expectations about what the DAO is and isn't. I'd guess that very few people bothered to read the source code of the contract, let alone look for vulnerabilities. So you have a group of people who have agreed on an informal contract (we pool money, votes are weighted by the sum I've put…) but…

What you call an informal contract could also be seen as an incorrect interpretation of a contract. If you're not willing to call that simply an incorrect interpretation, you end up with two systems - software and people that push the blockchain forward - that interpret contracts differently. You also give precedence to the latter, which will lose the ability to effectively enforce its interpretation the more distrib…

Totally agree. Which interpretation is correct is a decision for the Ethereum community to make (or whoever is in charge, I don't know muck about the governance).

From the article: > The development community is proposing a soft fork, (with NO ROLLBACK; no transactions or blocks will be “reversed”) […] preventing the ether from being withdrawn by the attacker […]. This will later be followed up by a hard fork which will give token holders the ability to recover their ether.

We'll see how the community reacts!

Re: Critical Update on DAO Vulnerability

#343

Post by kerkeslager »

It seems to me that the DAO is a large enough player in the Ethereum community that this plan is likely to succeed. If it does, it will be the first example I know of where a 51% attack was successfully executed against a popular blockchain.

Whether or not this is a desirable thing depends on your goals. From the perspective of the Ethereum community, which is heavily invested in the DAO, it makes a lot of sense. Even if this vulnerability causes you to write off the DAO as a failed experiment, it makes sense to recover some of your lost value before you exit.

However, for my goals, this causes me to write off Ethereum as a cryptocurrency I will never, ever use. It's breaking the fundamental benefits of the cryptocurrency to fix the problems of one group. And further, if this is possible for Ethereum, it makes me think that a 51% attack is more plausible for other cryptocurrencies. This worries me. I'd like to see more research put into defending against 51% attacks.

Re: Critical Update on DAO Vulnerability

#344

Post by qwtel »

imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

This hopefully provides further evidence that smart contracts currently are not and probably never will be a replacement for traditional contracts and court systems. Instead they are a low-cost alternative for specific off-the-shelf problems (like ownership) for which battle-tested implementations will eventually exist.

In that sense smart contracts are a tool for a specific purpose (and maybe a replacement for people who don't have the luxury of a working court system) as opposed to the end-all-be-all solution that some make it out to be.

Re: Critical Update on DAO Vulnerability

#345

Post by simondelacourt »

6d6b73 wrote: post #237

Hm, I wonder why people are panicking over virtual money and acting like they've lost something tangible. It's like crying over Monopoly dollars. :)

It does not matter if the money is virtual or not. It matters whether it is regarded as valuable. If a large group of people trust a certain currency to hold a certain value it becomes relevant to those people. They might invest other forms of money or energy in to that currency. If something happens with that money or currency people do panic, because something they have invested in is under attack.

And even with Monopoly, during that game the virtual monopoly dollars hold value. Just during the timespan of the game. They give you certain privileges during that game.

Re: Critical Update on DAO Vulnerability

#346

Post by Chris2048 »

pjc50 wrote: post #252
Chris2048 wrote: post #240

Earlier quoted context omitted.

> participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent Stuff like patent-trolling (and patents) suggest to me the law isn't so consistently trustworthy as you suggest.

Patent law is not contract law.

Are they not overseen by judges and lawyers also?

Re: Critical Update on DAO Vulnerability

#347

Post by mbrock »

Zelmor wrote: post #338
mbrock wrote: post #215

Earlier quoted context omitted.

Ethereum is a P2P accounting system, like Bitcoin, but allowing users to upload automatic contracts that decide autonomously what to do with the tokens they possess. For example, you could upload a contract that lets some specific set of accounts withdraw money unless the balance goes under 500 ETH (which is the basic Ethereum currency). "The DAO" is such a contract but with more complex logic that amounts to a kind…

Now there are a couple things I still do not understand. 1. How do I exchange this cryptocurrency for something that I can go and buy a sandwich with at the Deli? 2. Why is there a need for this instead of using traditional methods with contracts, banks, etc? Money as is, is a collective illusion we all subscribe to anyway, and these things aren't any more different from that. What is the purpose of this cryptocurren…

1. You just make an agreement with someone who would like to buy your tokens for some national currency. If you ever played an MMORPG or Diablo 2 or something, you know that "imaginary" digital items can be traded for "real" money. There are many exchanges where you can do this conveniently.

2. For one example, consider how tedious it is to open a new bank account; with cryptocurrency, you just make a new keypair. Smart contracts improve on normal contracts in that they are executed automatically and cheaply. One of the first theoreticians of smart contracts wrote:

"A canonical real-life example, which we might consider to be the primitive ancestor of smart contracts, is the humble vending machine. Within a limited amount of potential loss (the amount in the till should be less than the cost of breaching the mechanism), the machine takes in coins, and via a simple mechanism, which makes a freshman computer science problem in design with finite automata, dispense change and product according to the displayed price. The vending machine is a contract with bearer: anybody with coins can participate in an exchange with the vendor. The lockbox and other security mechanisms protect the stored coins and contents from attackers, sufficiently to allow profitable deployment of vending machines in a wide variety of areas. Smart contracts go beyond the vending machine in proposing to embed contracts in all sorts of property that is valuable and controlled by digital means."

http://szabo.best.vwh.net/smart_contracts_idea.html

3. Lots of different people. Many of them probably purchased the tokens when the network was young and the exchange rates were much lower, or mined the tokens themselves. The sum of the market value of these networks starts at zero and gets bigger as the tokens become scarce and valuable.

Re: Critical Update on DAO Vulnerability

#348

Post by makomk »

rlpb wrote: post #100
joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

If there is consensus that this is a problem and shouldn't be allowed, then there presumably is also consensus for even a hard fork if necessary. As an outside observer, I don't see why this is a demonstration that the decentralised system can be manipulated, is not fault tolerant, or censored. Since if this is a problem and will be fixed, it will presumably be by consensus. We already know that with consensus the en…

slock.it are now implying that opponents of the proposed hardfork are probably the thief and asking people to contact them with information about the identity of anyone who organizes opposition to it: https://twitter.com/christopherhesh/status/74379447973649612... It's going to be a very interesting kind of "consensus", that's for sure.

Re: Critical Update on DAO Vulnerability

#349

Post by abrkn »

kerkeslager wrote: post #343

It seems to me that the DAO is a large enough player in the Ethereum community that this plan is likely to succeed. If it does, it will be the first example I know of where a 51% attack was successfully executed against a popular blockchain. Whether or not this is a desirable thing depends on your goals. From the perspective of the Ethereum community, which is heavily invested in the DAO, it makes a lot of sense. Eve…

> On August 15 2010, it was discovered that block 74638 contained a transaction that created over 184 billion bitcoins for two different addresses. This was possible because the code used for checking transactions before including them in a block didn't account for the case of outputs so large that they overflowed when summed. A new version was published within a few hours of the discovery. The block chain had to be forked. Although many unpatched nodes continued to build on the "bad" block chain, the "good" block chain overtook it at a block height of 74691. The bad transaction no longer exists for people using the longest chain.

https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposu...

Re: Critical Update on DAO Vulnerability

#350

Post by [deleted] »

imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

[deleted]
Post reply on HN