Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

481–490 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#481

Post by lugg »

trevor-e wrote: post #466
int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

Can someone explain to me why they chose to make their own language instead of creating a DSL inside of an existing language?

Hubris.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#482

Post by kalleboo »

kccqzy wrote: post #437
geofft wrote: post #407

Earlier quoted context omitted.

> But if banks and major retailers who have huge budgets can get hacked, of course we can too. Here's the thing: banks and major retailers can't get hacked. At least, not in the sense you're using "hacked". When Target's credit card systems were compromised, resulting in the CEO resigning and and about $300M in costs to the company to deal with the breach, not one customer lost a penny. When $171M from Union Bank of…

I'm inclined to agree but I must say this traditional system is unscalable. Sure it can detect millions of dollars of fraudulent transactions, but what if it's a single person who's the victim of identity theft and lost just a few thousand dollars? A few thousand dollars is nothing in the grand scheme of things but they are a lot to a single individual.

Doesn't this happen every day, over trivially small sums? You've never heard of a credit card chargeback?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#483

Post by matt_wulfeck »

codewiz wrote: post #106
matt_wulfeck wrote: post #100

I'm sure they'll just hard fork again. And nobody cares because ethereum isn't actually being used for anything real, just a bunch of enthusiasts trying to get rich.

How is rolling back transactions that are clearly part of a robbery a bad thing?

It would be great if ether/crypto currencies could support some way to "chargeback" fraudulent purchases. They could call them chargebacks.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#484

Post by gradys »

riffraff wrote: post #465
joncampbelldev wrote: post #460

Earlier quoted context omitted.

they are excellent observations, but it seems pretty clear the team would be unable to implement them properly this late in the game, or worse unable to understand why they are a good idea.

Isn't the team also working on a new language targeting the same VM? If so, they might be useful.

Can people outside of the Ethereum org implement their own languages that target that VM?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#485

Post by vuyani »

earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

But also, a quick fix to this is to add a modifier that throws if m_owners[1] is already initialized

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#486

Post by spiralx »

kccqzy wrote: post #437
geofft wrote: post #407

Earlier quoted context omitted.

> But if banks and major retailers who have huge budgets can get hacked, of course we can too. Here's the thing: banks and major retailers can't get hacked. At least, not in the sense you're using "hacked". When Target's credit card systems were compromised, resulting in the CEO resigning and and about $300M in costs to the company to deal with the breach, not one customer lost a penny. When $171M from Union Bank of…

I'm inclined to agree but I must say this traditional system is unscalable. Sure it can detect millions of dollars of fraudulent transactions, but what if it's a single person who's the victim of identity theft and lost just a few thousand dollars? A few thousand dollars is nothing in the grand scheme of things but they are a lot to a single individual.

I've had calls from my bank's fraud detection department about single transactions of less than fifty pounds that they were concerned weren't from me, so clearly the traditional system is plenty scalable enough.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#487

Post by blunte »

trevor-e wrote: post #466
int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

Can someone explain to me why they chose to make their own language instead of creating a DSL inside of an existing language?

Naivety, youth.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#488

Post by blunte »

imron wrote: post #463
dvcc wrote: post #34

Earlier quoted context omitted.

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

Imagine the court case: Your honour, in my defence, the contract clearly specified that anyone could reset the wallet, and if that's not what they wanted, they shouldn't have agreed to it.

I cannot imagine the court case. The courts are utterly incapable of understanding enough of the technical aspects of far simpler software cases.

So like most court cases, it will simply be a matter of human influence winning the case.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#489

Post by honestoHeminway »

sum627u wrote: post #423
moeop wrote: post #292

Earlier quoted context omitted.

These mistakes are predictable and inexcusable. The Ethereum developers sold a vision of smart contracts, where the code is the contract. However, their hubris lead to them attempting to implement a complex language, instead of starting the endeavor with a small, simple, verifiable language. Similarly, their belief in their own infallibility lead them to write code that is not tested, and to create capabilities that…

There's essentially no legitimate use case for crypto-currency. Cypherpunks have been at it for decades and all they have to show for it is drugs, ponzis, assassination markets, and conspiracy theories. It would be nice to see some sort of casual hawala-type federated micropayments system based on real national currency, with instant settlement, low fees, and no fake money value store. But, that would be a pre-9/11 i…

Sorry, but have you looked on the democracy and justice-culture index maps worldwide? The democratic, end-of-history, justice-seperatly-delivered state is currently in full retreat. I agree, the futurists got it the wrong way around, assuming something cyper-punk-currency enough would blow the state away and allow for crypto-anarchy to rule. Instead, we got states that on slight economic decline implode on themselves (a whole thinker caste in denial about human nature hunting scape goats) and suddenly the crypto-currency nonsense doesent look idiotic, because it can work on, even as the state becomes hostile.

Thats the vision- a somalia like decline, but society moves on, with schools back uped to youtube, with contracts backed up to the block chain, with the currency back uped to bitcoin. I find the ideals of crypto-anarchy laughable (those guys would be gunned down on the first corner, in a real anarchic world), and yet, i can agree to the path we taken. Cellphones and facebook, to have a culture of shame, that fights wild mobs and public hysteria, because the internet does not forget your lowest point. Anyone in power in fear of getting caught in public, for the world to see as just another corrupt, well fed monkey?

Yes, that is something to work towards.

Post reply on HN