Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

371–380 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#371

Post by rubidium »

patejam wrote: post #355
corndoge wrote: post #332

Earlier quoted context omitted.

the story you are commenting on is a good example it should not be this easy to lose sixteen million dollars

I feel like we shouldn't be expressed in dollars, but in percentage of total funds. In this case 16 million is about 1% of the total. This would be a $16 billion case if the US banking system was the target and used this technology.

That... doesn't make a difference in my mind. Losing 1% of people's money is _very_ unacceptable and worth being laughed at for.

Financial institutions are accurate to tiny tiny fractions of percentage points. Not "eh we got 99% of it right".

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#372

Post by coinme »

Better techniques are required. Solidity is clearly not ready to be used to secure billions of dollars that can be anonymously stolen in an instant. Fuzz testing should be an absolute minimum. Formal proofs, and a simpler language should be the ultimate goal.

Hopefully the ethereum foundation takes note because this problem is not going away, and they are responsible for 20B$ market cap of value. I realise that ethereum is still young but they have chosen to build a product that can be used in a multitude of ways without enough thought about how to keep the value secure. I wouldn't even know where to start when deciding whether it's safe to use a smart contract, and I understand the concepts well. If ethereum is ever going to grow into it's current market cap if will have to be safer for use by everybody.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#373

Post by radlad »

make3 wrote: post #325
radlad wrote: post #253

Earlier quoted context omitted.

This is the design of most high-level scripting languages (e.g. Javascript, PHP, Python, Ruby)...

These aren't called "Solidity" and more importantly weren't built specifically to write a financial infrastructure of multiple hundreds of million dollars (though some of these languages are definitely used to manage money now)

I was responding to this statement from the parent...

> This would be a stupid decision in any language

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#374

Post by dahdum »

kbenson wrote: post #284
davidgerard wrote: post #261

Earlier quoted context omitted.

Actually, I think Solidity being designed to turn bad node.js coders into bad smart contract coders was key to Ethereum's success. I've written a book on this (hit upload five minutes ago! release Monday!) which hammers on this point (and all the stuff surrounding this issue). I think Solidity is actually designed with worse is better in mind, because Ethereum is the first smart contract platform that anyone actually…

That may be, but if so, it might be worse . What's worse, not getting a lot of uptake for this idea that's been hard going for others, or getting the uptake because of trade-offs you made that make it a ticking time-bomb that may damage the reputation of the idea for years to come and set it back?

Solidity is like PHP in the 90's, easy to learn and easy to screw up. Though Solidity just compiles to the EVM, and there is no reason new, safer languages can't be built on top.

As far as I can remember, the EVM has never failed, just programmers.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#375

Post by youdontknowtho »

moeop wrote: post #292
wheelerwj wrote: post #212

Earlier quoted context omitted.

i know that you're not really serious when you generalize against all of us crypto simpletons, but anytime theres a stupid amount of money on the table people are bound to rush to pick it up. and that means mistakes. the work being done on public blockchains is unlike anything else done before. You don't have he luxury of keeping your db behind a vpn running on a vm platform secured and maintained by the worlds large…

These mistakes are predictable and inexcusable. The Ethereum developers sold a vision of smart contracts, where the code is the contract. However, their hubris lead to them attempting to implement a complex language, instead of starting the endeavor with a small, simple, verifiable language. Similarly, their belief in their own infallibility lead them to write code that is not tested, and to create capabilities that…

I like your point about language complexity. Can you point to a language that would fit the simple and verified criteria? I don't really follow the subject, so it would be interesting reading.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#376

Post by saghm »

notsofastbuddy wrote: post #8

Parity shipped with a built-in Solidity contract to implement multi-sig wallets. That contract had a vulnerability that is now being exploited. Importantly, the contract is not part of the Ethereum protocol, so other implementations and non-multi-sig Parity wallets are safe.

> Importantly, the contract is not part of the Ethereum protocol, so other implementations and non-multi-sig Parity wallets are safe.

Safe from this bug, maybe. But there's nothing to say that they might not also have bugs of their own.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#377

Post by patio11 »

davidw wrote: post #324

I miss patio11's posts on these things.

Sorry -- been a bit too busy with work and a 5 month old to understand Ethereum deeply enough to feel like my get-some-popcorn genre of posts would add value.

On the plus side, Bitcoin popcorn futures continue their steady progress up and to the right.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#379

Post by vasilipupkin »

0x0 wrote: post #108
Woofles wrote: post #63

Earlier quoted context omitted.

IANAL but if someone leaves their front door open, it's still illegal to walk in and take their possessions. I would imagine this falls under a similar ruling.

In most cases yes, but isn't ethereum all about "the code _is_ the contract"? If you as the owner of a house put an ad in the paper saying "if you can manage to enter my house feel free to take whatever you want", should you complain if someone did exactly that?

The analogy is if you accidentally leave the door of your house unlocked, it doesn't make it legal fir someone to walk in and steal your piano
Post reply on HN