Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

411–420 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#411

Post by jupiter90000 »

true_religion wrote: post #171
sillysaurus3 wrote: post #154

Earlier quoted context omitted.

This won't work in the US. It's very hard to get USD out of Bitcoin. And then the IRS will want to know where you are suddenly getting a huge amount of money from. You could use localbitcoins to offload one coin at a time on an as-needed basis. That'd be pretty sweet, and the IRS won't be able to know anything strange is happening if you avoid depositing your USD into a bank. But paying rent in all-cash is rather ske…

Why is it very hard? Can't one simply use Coinbase? > And then the IRS will want to know where you are suddenly getting a huge amount of money from. In my experience, the IRS is largely unconcerned with where you are getting money from. They just want you to declare it, and pay taxes on it. If you treat Bitcoin as ordinary income and pay taxes on it at the highest available rate, the IRS will largely be satisfied. If…

Someone I know tried depositing btc sale proceeds to their wells fargo bank account. The bank promptly froze all their accounts. It eventually worked out I believe but it doesn't seem as easy as 'just sell them.'

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#412

Post by colordrops »

elviejo wrote: post #186
dvcc wrote: post #34

Earlier quoted context omitted.

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

For the same reason every variable in JavaScript is global by default... I.e. I don't have a clue how that could seem like a good idea.

Sounds like you don't know anything about JavaScript.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#413

Post by geofft »

grandalf wrote: post #21
finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

A few days ago people on HN were arguing that it's okay if cryptocurrencies use a decent fraction of the world's energy, because securing the blockchain and building a financial system that is decentralized and impossible for any human to gain control of is a major project for humankind and worth spending a decent fraction of the world's resources on.

Does that argument still hold up if you're going to have human insurance and human arbitration?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#414

Post by ceejayoz »

dahdum wrote: post #370
Taek wrote: post #323

Earlier quoted context omitted.

People write this stuff off so fast. Here we have a parity developer, probably one of the most competent in the Ethereum ecosystem, and he screwed up to the tune of losing $30m of other people's money. If HE can't get it right, what business do you have running around saying that anyone who can make a webpage can make a decentralized application? We are playing with money. Dealing with attackers is not as simple as r…

He may be brilliant, but he played fast and loose without real testing or concern, so I wouldn't call him the "most competent". For a wallet contract they knew would secure many millions of dollars, there should have been dozens of people auditing it before rolling out to users.

You're "no true Scotsman"ing so hard Mary, Queen of Scots doesn't even qualify.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#415

Post by int_19h »

Animats wrote: post #147
Analemma_ wrote: post #43

Earlier quoted context omitted.

> Unmarked functions default to public in Solidity What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

This is why I keep saying that "smart contracts" should be expressed in some declarative notation like decision tables. Byte-coded programs as contracts were a really bad idea. Contracts need to be readable, not just executable.

Time to revive Prolog, perhaps?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#416

Post by sum627u »

grandalf wrote: post #327
dragonwriter wrote: post #310

Earlier quoted context omitted.

It may not be uninsurable, but pretty clearly trying to use insurance on the platform to insure against risk that are in some sense endemic to the platform seems quite misguided.

> but pretty clearly trying to use insurance on the platform to insure against risk that are in some sense endemic to the platform seems quite misguided Absolutely, the risk posed by a malfunctioning VM is a systemic risk that applies to the entire platform. So there is a chance that contracts impacted by a VM bug could be unreliable across the pre and post bugfix VM. The insurance contract could be one of these. How…

> The meatspace system seems very stable until you realize that it's highly brittle. It's impossible to meaningfully measure firm solvency risk, because the behavior of the "VM" is so unpredictable.

Actually, it's not. Regulators and ratings companies do a pretty good job of it, and in extraordinary Great Recession type events there is usually concerted response to keep consumers from incurring any losses. Insured not getting paid due to counterparty issues is a blue moon, black swan risk for business, virtual never happens to consumers.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#417

Post by int_19h »

radlad wrote: post #253
Analemma_ wrote: post #43

Earlier quoted context omitted.

> Unmarked functions default to public in Solidity What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

This is the design of most high-level scripting languages (e.g. Javascript, PHP, Python, Ruby)...

Python is a bit different still: it doesn't have visibility specifiers to begin with, everything is public.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#418

Post by sniffles »

tzs wrote: post #333
dna_polymerase wrote: post #46

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

I realize that was probably satire or sarcasm or both, but since I've seen people actually seriously take that position I'm going to go ahead and respond as if it was serious. How do these smart contract deal with the real world? I can see how they can work for things that entirely involve activities that take place on the block chain (e.g., a smart contract that automatically pays a crowd funded project if and only…

Didn't you just describe an example where the ambiguity of human language is a problem and a smart contract may actually have a better chance of performing as expected?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#419

Post by xrd »

Will_Do wrote: post #358
corndoge wrote: post #332

Earlier quoted context omitted.

the story you are commenting on is a good example it should not be this easy to lose sixteen million dollars

Yes. If a similar scale thing were to happen in the U.S. banking system, 1% would be 160 billion dollars, not 16. I'm amazed that otherwise intelligence people really believe this is a better system than fiat currencies + banks.

Microtransactions.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#420

Post by xrd »

earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

This seems like a compiler bug, not a systemic issue with Ethereum. No?
Post reply on HN