Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

421–430 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#421

Post by int_19h »

cesarb wrote: post #266
oh_sigh wrote: post #173

Earlier quoted context omitted.

Yes, and that 'feature' of block chains is never really touted by blockchain supporters. Basically, if 51% of the network think you have too much money, they can just take it from you with no recourse available.

> Basically, if 51% of the network think you have too much money, they can just take it from you with no recourse available. That's not how it works. Even if you had 99.99% of the hash rate, you still have to work within the rules of the chain, so a "give me your money" without a valid signature would still be rejected as invalid by every full node (and you just wasted your hashing power). What having 51% or more of…

This is a nice illustration that all property in general is a social construct: you only truly own something if the rest of the society agrees that you do. Blockchain is one particular way to set the rules, but our regular property laws are not any different in principle.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#422

Post by vasilipupkin »

Taek wrote: post #388
vasilipupkin wrote: post #330

Earlier quoted context omitted.

Dear god, I've been thinking crypto is a bubble since 2010. At some point, we have to admit this is not just a bubble. It's a new unproven evolving technology

Crypto has had at least 3 distinct bubbles. There's the current one, marked by Eth's absurd rise to $300. The previous one was when Bitcoin made an absurd rise to $1200 in 2014. There was a bubble before that where Bitcoin rose to $266 in 2011. And one before that I believe where Bitcoin rose to $32 in 2010. Though crypto has risen past the high point of each of these bubbles, each price point can be definitively cla…

It's only a bubble if you can identify it ahead of time. Stating that something became much more valuable over a short period of time doesn't mean you know how to identify bubbles. Bitcoin is 70-80 times more valuable now than when it was at 32, and had you bought it then you would be up a lot. So, to say crypto is in a bubble today is the same thing as to predict that in a few years it will be worth less than today. Do you know that definitively ? I don't

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#423

Post by sum627u »

moeop wrote: post #292
wheelerwj wrote: post #212

Earlier quoted context omitted.

i know that you're not really serious when you generalize against all of us crypto simpletons, but anytime theres a stupid amount of money on the table people are bound to rush to pick it up. and that means mistakes. the work being done on public blockchains is unlike anything else done before. You don't have he luxury of keeping your db behind a vpn running on a vm platform secured and maintained by the worlds large…

These mistakes are predictable and inexcusable. The Ethereum developers sold a vision of smart contracts, where the code is the contract. However, their hubris lead to them attempting to implement a complex language, instead of starting the endeavor with a small, simple, verifiable language. Similarly, their belief in their own infallibility lead them to write code that is not tested, and to create capabilities that…

There's essentially no legitimate use case for crypto-currency. Cypherpunks have been at it for decades and all they have to show for it is drugs, ponzis, assassination markets, and conspiracy theories.

It would be nice to see some sort of casual hawala-type federated micropayments system based on real national currency, with instant settlement, low fees, and no fake money value store. But, that would be a pre-9/11 idea. Nowadays that's basically illegal and useless.

Paypal is more or less good enough, and hopefully regulators and market forces will control the fees and abuses.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#424

Post by shrewduser »

ceejayoz wrote: post #414
dahdum wrote: post #370

Earlier quoted context omitted.

He may be brilliant, but he played fast and loose without real testing or concern, so I wouldn't call him the "most competent". For a wallet contract they knew would secure many millions of dollars, there should have been dozens of people auditing it before rolling out to users.

You're "no true Scotsman"ing so hard Mary, Queen of Scots doesn't even qualify.

I wish I could see how the op is employing the no true Scotsman fallacy, but I can't.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#425

Post by ceejayoz »

shrewduser wrote: post #424
ceejayoz wrote: post #414

Earlier quoted context omitted.

You're "no true Scotsman"ing so hard Mary, Queen of Scots doesn't even qualify.

I wish I could see how the op is employing the no true Scotsman fallacy, but I can't.

https://twitter.com/SatoshiLite/status/887781929726038016

"If the creator of Solidity, Gavin Wood, cannot write a secure multisig wallet in Solidity, pretty much confirms Ethereum is hacker paradise."

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#426

Post by kanzure »

kevinwang wrote: post #354
sillysaurus3 wrote: post #314

Earlier quoted context omitted.

My argument has remained the same. The Ethereum reference wallet is by far the most vetted wallet. Use that. (And yes, I use the Bitcoin Core wallet.) If you used Parity because it has 1,700 stars on Github and was written in Rust, you're doing it wrong . Stop. You can't assess merit based on what everyone else is doing. The only hope in a situation where you don't know what you don't know is to stick with fundamenta…

If being highly vetted is your main heuristic for safety, then isn't popularity (large number of github stars) directly correlated with that?

popularity does not correspond to vetting (see the recent parity multisig vulnerability), and highly reviewed software is not necessarily popular (how many people know about libsecp256k1?).

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#427

Post by glitch003 »

DennisP wrote: post #119
sidthekid wrote: post #51

Earlier quoted context omitted.

Seems like something a code review would have caught. Then again, code reviews and other slow processes are probably not the par for startups.

About half my day job is auditing Solidity code for startups. And yes this should have been caught.

Can you share where you work? I'm looking for someone to audit some Solidity code.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#428

Post by dingo_bat »

dna_polymerase wrote: post #46
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Unless you're the lead developers and lost money. Then we'll just hard fork the entire protocol.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#429

Post by maksimum »

sniffles wrote: post #418
tzs wrote: post #333

Earlier quoted context omitted.

I realize that was probably satire or sarcasm or both, but since I've seen people actually seriously take that position I'm going to go ahead and respond as if it was serious. How do these smart contract deal with the real world? I can see how they can work for things that entirely involve activities that take place on the block chain (e.g., a smart contract that automatically pays a crowd funded project if and only…

Didn't you just describe an example where the ambiguity of human language is a problem and a smart contract may actually have a better chance of performing as expected?

I feel like anything humans can use to communicate to each other could be considered a human language.

More relevantly, creating a synthetic language that's a subset of natural languages will mean that multiple natural concepts will map onto the same synthetic one.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#430

Post by Amanda343 »

lomnakkus wrote: post #395
buckie wrote: post #361

Earlier quoted context omitted.

It's closest to the middle, assuming that you meant that you're stating the properties that you want to test. It does more than that, but at its base that's effectively how it works so it's close enough for a solid intuition. We're working on a paper about it now -- or at least a sub-paper in the clutch of papers that pertain to a public chain version -- that I'll link to when it's out (a couple weeks probably).

Oh. Dear? (I mean, I understand the pressures of academia, but... ridiculously bad timing, yeah?)

I get paid over $95 per hour working from home with 2 kids at home. I never thought I'd be able to do it but my best friend earns over 10k a month doing this and she convinced me to try. The potential with this is endless. Heres what I've been doing, •••••••••>>https://is.gd/qKRnJt
Post reply on HN