The hacker should sue them for violating the contract by trying to fork and block him!
Critical Update on DAO Vulnerability
421–430 of 629 posts
Re: Critical Update on DAO Vulnerability
#422Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…
> If this hack can be stopped, then it demonstrates that the currency can be manipulated, that the decentralised system is not so fault tolerant or uncensored after all, and that people out there know this.
My thought exactly. And despite putting a little money into the DAO myself, this is the kind of risk I was willing to take. I should lose my money. Miners should vote strongly against this fork.
I know in the Bitcoin community this wouldn't be accepted, not so sure about Ethereum though where the developers have a lot more control (than they should IMO).
Re: Critical Update on DAO Vulnerability
#423This is an example of why I created my mantra for high-assurance security: "tried and true beats novel and new." Another is to wait at least 10 years for specific tech and techniques to prove themselves out before betting lives or entire businesses on them (startups an exception).
The blockchain and DAO models are very new. They introduce new mathematical constructs, complex code, security issues we haven't thought about, coordination among many for such issues, and so no. Ethereum even includes an interpreter or something, which has its own set of risks. So, I refused to bet on such models given enormous risk means stuff is going to happen to them that isn't going to happen to regular, financial processing. We also have mitigations for most of its risks.
Today is a good example. This is the kind of thing you're not going to see the Federal Reserve, VISA/Mastercard, most banks, or even large eCommerce sites announce. It probably won't be the last announcement of an unusual issue. So, anyone wanting stable currency + commerce should avoid stuff like Ethereum unless they're just investing small amounts to help them experiment & improve. Risk/reward doesn't make sense on such immature tech.
Re: Critical Update on DAO Vulnerability
#424This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…
Keep in mind Ethereum is less than a year old, the DAO is even younger. It's still new, risky, and fraught with problems that need to be solved. If you're not familiar with anarcho-capitalist theory, there's a concept called a DRO -- dispute resolution organization [1] -- that can perform arbitration functions in a decentralized manner, i.e. without a monopoly on judicial services like the state. In the future, as th…
This is fascinating. How do ancaps propose that DRO's will enforce their judgments? With violence? What's to stop the losing party from just gathering a bigger militia and shooting back to prevent collection?
Re: Critical Update on DAO Vulnerability
#425Earlier quoted context omitted.
I agree completely. 'Smart' contracts are terribly flawed in this regard. Operating outside of contract law is a weakness, not a strength. No-one can write bug-free code, so why are these people building a huge, expensive system that relies on no bugs being found?
> No-one can write bug-free code Perhaps, but nobody can write a bug-free legal contract either, and no legal system is without bugs. Sadly, for the legal system, many of the bugs are due to corruption, so they are actually more akin to systematic exploits being done again and again by malicious actors (who often happen to be wealthy or powerful). Also, in terms of how drastic this bug is, suppose $5M gets stolen ove…
> Perhaps, but nobody can write a bug-free legal contract either, and no legal system is without bugs.
The difference is that when there is an issue with a legal contract you can defer to an arbiter (a judge) and discuss whether that is a bug or a feature as soon as a divergence of interpretation is detected.
Hell, even just having a sentient empowered human in the loop is sufficient, with fully automated response systems we'd never have survived the cold war as a civilisation, the first false-positive detection (and there have been several) would have ended it.
Re: Critical Update on DAO Vulnerability
#426Earlier quoted context omitted.
Agreed - this is a problem with the DAO, not with the ethereum network itself.
It seems that we need formal verification for smart contracts and maybe a more restricted language that makes it easier to reason about correctness. Obviously it's not enough to just say "some guys did a security audit and everything looks fine."
Yes! It's not like the technology isn't already there, well documented, and waiting for use.
Re: Critical Update on DAO Vulnerability
#427Earlier quoted context omitted.
I agree completely. 'Smart' contracts are terribly flawed in this regard. Operating outside of contract law is a weakness, not a strength. No-one can write bug-free code, so why are these people building a huge, expensive system that relies on no bugs being found?
No-one can write bug-free code No, we can. We just don't, because it's very expensive, and we lack proper tooling to make it cheaper and/or faster. The flaw as I see it is that ETH jumped the gun, and tried to move to software law enforcement without investing the right amount of time/money in the code. Worthwhile goal (though the desirability and practicality remains debatable), bad execution.
> No, we can.
There's no evidence of that, and lots of evidence to the contrary.
Re: Critical Update on DAO Vulnerability
#428Earlier quoted context omitted.
I see a different problem here: Ethereum and the DAO were not in a mature state to handle this amount of money. For example, there is a limited support for upgrading contracts in Ethereum and the DAO was not reviewed enough to handle hundreds of million dollars. Also, there are methods to make the software ultra secure using formal models.
Core problem: If contracts can be upgraded while in use, everything reduces to a game of Nomic.
Why is that a problem?
Re: Critical Update on DAO Vulnerability
#429Earlier quoted context omitted.
What you're trying to solve is something very similar to the recursive self improvement problem that MIRI[1] and friends are trying to solve in the sphere of "friendly" artificial intelligence. If something rewrites its own source code, how can you assert invariants that can be relied upon? So going and looking over there at what they've come up with may be fruitful. [1] https://intelligence.org/
Very interesting! Looking at the papers and going to read them. Any specific papers you'd recommend?
Sorry, not qualified to have an opinion. Opening this question to the floor?
Re: Critical Update on DAO Vulnerability
#430Earlier quoted context omitted.
They provide a far more accurate insight into the likelihood of events than any other alternative. You can think of it as betting if you like, but it's betting with lots of positive externalities. Consider a business that needs to reason about the probability of a law passing, severity of global warming, or any number of other difficult to predict events. Prediction markets would provide by far the most accurate insi…
>Consider a business that needs to reason about the probability of a law passing, severity of global warming, or any number of other difficult to predict events. Prediction markets would provide by far the most accurate insight. Surely such prediction markets are a guarantee of corruption? That or I just don't understand - if a market exists that takes bets on human actions such as passing laws, how long someone will…
They don't guarantee corruption, because if the corruption shows up on the prediction market it has occurred (or will occur) elsewhere already, and if large amounts of money are betting on a certain outcome, others will follow, and thus the payout won't be as large.