Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

361–370 of 629 posts

Re: Critical Update on DAO Vulnerability

#361

Post by Chris2048 »

Alexx wrote: post #258
Chris2048 wrote: post #240

Earlier quoted context omitted.

> participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent Stuff like patent-trolling (and patents) suggest to me the law isn't so consistently trustworthy as you suggest.

I don't think that is the same - There is no claim that rules of written law always gives the most favourable outcome. But rather that the written law (or contract, in this case) allows for the reality of human error or omission by leaving space for human interpretation, enforcing the underlying intent, rather than strictly enforcing 'bugs' in the contract. After all, there are almost always small mistakes in complex…

There are no bugs, there is just the contract, and the intent, and the difference between the two.

My point is, the institution of law needs to be trusted, yet patent-trolling exists because the institution has failed to apply fair judgment and common sense such that ridiculous legal structures have prevailed.

Re: Critical Update on DAO Vulnerability

#362

Post by sp332 »

runn1ng wrote: post #236
justusw wrote: post #203

Earlier quoted context omitted.

I share your bitterness. The meaning of the word "safe" seems to vary from person to person. The ETH and contract devs think safe means having a static PL to capture contracts. But in reality it is safe as in, whoever exploited the vulnerability now has a "safe" source of income in a few weeks. Perhaps it is a lesson better learnt now than later when the stakes are even higher.

Well, she doesn't, they will block the attacker outright by a centralized decree. What's the better proof that decentralized solutions work than blacklisting accounts and making ad-hoc forks for each attack.

The attack runs within the rules of the DAO and so does the counterattack. It's still distributed.

Re: Critical Update on DAO Vulnerability

#363

Post by makomk »

johncolanduoni wrote: post #197
Tinyyy wrote: post #188

> (The soft fork) will later be followed up by a hard fork which will give token holders the ability to recover their ether. Does this mean that transactions are going to be rolled back? If so, are they planning to do this everytime a vulnerability is exploited? Is The DAO too big to fail?

Remember that when they say it's a suggestion, it's truly a suggestion. If a majority of the miners refuse to accept the update, then what anyone at the Ethereum foundation wants them to do is irrelevant. There is definitely a lot of social pressure to consider here, but there is still no central switch. I'm generally not a huge fan of cryptocurrency (as currencies that is, I love the tech), but I fail to understand…

A lot of social pressure is probably an understatement. slock.it are implying that people who oppose the hard fork are likely to be the attacker and asking people to contact them with information about the identity of anyone who organizes opposition to it: https://twitter.com/christopherhesh/status/74379447973649612...

Re: Critical Update on DAO Vulnerability

#364

Post by kachnuv_ocasek »

joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

But if the hack can't be stopped, then… it demonstrates that the currency can't be manipulated…? Wait a minute.

Re: Critical Update on DAO Vulnerability

#365

Post by knodi123 »

sznurek wrote: post #195

I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition. Isn't…

> I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"?

It's just a philosophical distinction. Suppose someone who had never built a software program in his life, successfully got a patent for "online marketplace for smartphone apps", and then went and successfully sued random weak-looking people for uploading their apps to the google play store.

Obviously he's abusing the system, and obviously he's a parasite preying on the weak with zero moral justification, in a way that threatens the very foundation of the tech industry... But what he's doing is not illegal; he's just exploiting a flaw.

Is he an attacker?

/shrug

Depends on how you define things, but the context makes the meaning clear in this case, I think.

Re: Critical Update on DAO Vulnerability

#366

Post by vessenes »

joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

This is FUD, broadly speaking. The devs have put out a patch for miners which allows them to decide whether or not they wish to fork over these transactions. Centralization is not required for this decision, instead, distributed consensus.

The counterpoint to your statements is simply that consumers need safety with their money. It is no badge of honor to let unsophisticated technical people lose money for some extreme libertarian ideals.

Re: Critical Update on DAO Vulnerability

#367

Post by tveita »

Joeboy wrote: post #324
gexla wrote: post #307

Earlier quoted context omitted.

> I sort of assumed this DAO thing was intended in this spirit, as an experimental stab on the path to robust contracts. With millions of dollars in prizes if you could exploit it?

My hope is that the people putting millions of dollars into it are well off people who are OK with putting their spare money into something obviously risky and experimental. Edit: If this is not how it is, I'd be interested to know who is putting money into the DAO, sociologically speaking. I hope nobody's investing their life savings in it.

My impression is that the DAO people are early adopters mostly from the Ethereum Foundation itself, so the "150 million dollars" number that is bandied about would be mostly paper profits from a much smaller investment. It doesn't mean they ever had 150 million dollars in actual money between them, or any practical way to get it.

Re: Critical Update on DAO Vulnerability

#368

Post by EGreg »

infodroid wrote: post #266
imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

Disagree. Over time, there will be less and less human intervention and people will be able to rely on a system of contracts assembled from tested and trusted components. And avoid expensive litigation fees.

Look, self-driving cars required humans to take over and require updates to deal with new challenges -- until they don't, or very rarely do.

Re: Critical Update on DAO Vulnerability

#369

Post by infodroid »

EthanHeilman wrote: post #336
infodroid wrote: post #266

Earlier quoted context omitted.

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

>But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. It is the beginning of a precedent but precedent is fairly weak because Ethereum in its early stages and very experimental (many hard forks are in Ethereum future). Bitcoin rolled back the blockchain at one point as well but it wouldn't happen today. >So what now are…

Even if we agree that Ethereum is still in its early stages we have to ask whether this response is setting a good or bad precedent going forward.

Will the project leadership offer a soft- and/or hard-fork every time a poorly-implemented smart contract is exploited in a manner that is not intended by the contract creators?

If every smart contract is going to be "guaranteed" in this way, then this introduces significant overheads for the project and can also create moral hazard.

Alternatively, if only some contracts are "guaranteed" but not others, this can introduce opportunities for favouritism or discrimination...

Are cases only considered when they affect the ether price or where there is personal involvement with the contract? Is that fair?

Interventions and their resolution can also quickly get politicized just like the bank bailouts from the financial crisis.

It is not clear this is setting a good precedent.

Edit: reworded for clarity

Post reply on HN