Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

351–360 of 629 posts

Re: Critical Update on DAO Vulnerability

#351

Post by caf »

verroq wrote: post #138
746F7475 wrote: post #132

Earlier quoted context omitted.

So can random people who agree with each other completely control everything that happens with the currency? So if there is a company who they dislike can they just decide that they have no money?

Majority of ethereum holders would want to rollback. That is consensus. If they don't hard fork they can keep running an old node. What is the problem?

The incentive here isn't to pick the side of the fork you agree with; it's to pick the side of the fork you believe will win. So you can't really say that the rollback side winning means that most miners agreed with the rollback - rather it means that most miners thought the rollback side would win. There's a strong element of "self-fulfilling prophesy" here.

Re: Critical Update on DAO Vulnerability

#352

Post by mbrock »

raisedbyninjas wrote: post #313
mbrock wrote: post #215

Earlier quoted context omitted.

Ethereum is a P2P accounting system, like Bitcoin, but allowing users to upload automatic contracts that decide autonomously what to do with the tokens they possess. For example, you could upload a contract that lets some specific set of accounts withdraw money unless the balance goes under 500 ETH (which is the basic Ethereum currency). "The DAO" is such a contract but with more complex logic that amounts to a kind…

Correct me if I'm wrong, but the patch is not in the DAO contract. It's in the Ethereum platform. I don't know what the alternative would be to prevent the attacker from draining the DAO, but this patch seems incredibly hacky. Will this just be an ever-growing oopsie transaction blacklist in the code?

I don't know about ever-growing. The community is very actively discussing the implications of this bug, whether and how to mitigate it, etc. Probably the failure of "The DAO" will be an important event in the Ethereum history that people will refer to, for example to point out the importance of contract security diligence... But yeah, your concern is shared by many.

Re: Critical Update on DAO Vulnerability

#353

Post by mootothemax »

kauffj wrote: post #335
nsajko wrote: post #317

Earlier quoted context omitted.

Why are prediction markets a huge boon for the world? Isn't that just a fancy term for betting anyway?

They provide a far more accurate insight into the likelihood of events than any other alternative. You can think of it as betting if you like, but it's betting with lots of positive externalities. Consider a business that needs to reason about the probability of a law passing, severity of global warming, or any number of other difficult to predict events. Prediction markets would provide by far the most accurate insi…

>Consider a business that needs to reason about the probability of a law passing, severity of global warming, or any number of other difficult to predict events. Prediction markets would provide by far the most accurate insight.

Surely such prediction markets are a guarantee of corruption?

That or I just don't understand - if a market exists that takes bets on human actions such as passing laws, how long someone will live etc, the betters will have a very active interest in doing everything they can to make a large profit, of which corruption alone is the most obvious target.

I mean in a way you're right - it is wisdom of crowds, albeit crowds of people that "know" only because they're corrupted the final event.

Re: Critical Update on DAO Vulnerability

#354

Post by RockyMcNuts »

Tinyyy wrote: post #188

> (The soft fork) will later be followed up by a hard fork which will give token holders the ability to recover their ether. Does this mean that transactions are going to be rolled back? If so, are they planning to do this everytime a vulnerability is exploited? Is The DAO too big to fail?

How easy is to tell if you're getting tainted coins? Just the mention of this sort of hard fork means anyone who is exchanging coins for USD or BTC is at risk of being stuck with a hot potato, with impacts on convertibility and confidence in the whole system.

Re: Critical Update on DAO Vulnerability

#357

Post by daxorid »

kalleboo wrote: post #198
pjc50 wrote: post #115

Well, that was kind of inevitable. Building a financial system out of pure code with no humans in the loop and no legal structure is building a self-distributing bug bounty piñata. It's decentralised, so there's nobody who can throw a breaker and shout "stop!"; cryptocurrency transactions are irreversible, so thefts are permanent; and it's somewhat anonymous, so thefts are hard to trace. It also demonstrates that bei…

I find it endlessly amusing that people are willing to bet their cold hard cash on "this code has no bugs". When widespread old and tested code like OpenSSL has massive security bugs, what chance does something as new and in-development as Bitcoin/Ethereum have? An in the case of Ethereum, the contracts themselves?

While I agree with your point, there is at least something to be said for blue sky codebases being able to use more secure languages/platforms and secure coding practices from the get-go, versus legacy codebases. Prevention of overflow and UAF vulns come to mind as an immediate win.

Re: Critical Update on DAO Vulnerability

#358

Post by abrkn »

joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

https://en.bitcoin.it/wiki/Value_overflow_incident

Re: Critical Update on DAO Vulnerability

#359

Post by JulianMorrison »

wslh wrote: post #255
imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

I see a different problem here: Ethereum and the DAO were not in a mature state to handle this amount of money. For example, there is a limited support for upgrading contracts in Ethereum and the DAO was not reviewed enough to handle hundreds of million dollars. Also, there are methods to make the software ultra secure using formal models.

Core problem: If contracts can be upgraded while in use, everything reduces to a game of Nomic.

Re: Critical Update on DAO Vulnerability

#360

Post by draw_down »

walrus01 wrote: post #29

It's almost as if a cryptocurrency system used by the grey market and black market sections of the internet contained actual blackhats. What a surprise. Much as I hate to link to reddit, for effective and biting criticism of cryptocurrencies: http://reddit.com/r/buttcoin

Yeah, I mean, did anyone NOT see this coming? All these crypto currencies are a disaster already, then someone has the bright idea to have them execute code. Gee, what could go wrong.
Post reply on HN