Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chasing the DAO Attacker’s Wake – A second exploit

pdaian.com

Post reply on HN
Print view View original

51–60 of 180 posts

Re: Chasing the DAO Attacker’s Wake – A second exploit

#51

Post by zmanian »

AJ007 wrote: post #20

Nearly a year ago I made the comment -- "Who are these people[1] and what credentials do they have to build and run a cryptocurrency platform?" [1] https://angel.co/ethereum-1 Today, not a single cryptographer, mathematician, or anyone with software security experience is listed on the Ethereum Foundation member list[2]. I am not attacking any individuals by themselves, but as a group this says a lot. For the record,…

You see a common pattern in crypto projects. The core of the project is passionate autodidacts and the experts are in periphery.

Tor and Ethereum have ample access to experts via academic research, security auditors and academic consultants.

Tor worked hard to build up this pattern by encouraging a robust outsider community to form around Tor. Ethereum has done the same from the get go.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#52

Post by rfrey »

JulianMorrison wrote: post #33
HoopleHead wrote: post #27

Every article I see on etherium mentions the DAO. Not one of them explains what it means. Gotta love unexplained acronyms!

Doubleclick drag rightclick search on Google. Here, I googled it for you https://daohub.org/

That's snarky and unnecessary. And your linked site actually doesn't define the term until the third page in, after using "DAO" many times. And even then it's not a definition, it's a sentence that happens to spell it out. I had to ctrl-F to find it.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#53

Post by [deleted] »

homakov wrote: post #41
AJ007 wrote: post #20

Nearly a year ago I made the comment -- "Who are these people[1] and what credentials do they have to build and run a cryptocurrency platform?" [1] https://angel.co/ethereum-1 Today, not a single cryptographer, mathematician, or anyone with software security experience is listed on the Ethereum Foundation member list[2]. I am not attacking any individuals by themselves, but as a group this says a lot. For the record,…

This is unfair to banish a company for not having enough "security experience". It could happen to anyone (i mean making such a design mistake), plus they afaik had some external audits. "Aha, no security background!" is wrong.

[deleted]

Re: Chasing the DAO Attacker’s Wake – A second exploit

#54

Post by afrenchcoder »

homakov wrote: post #41
AJ007 wrote: post #20

Nearly a year ago I made the comment -- "Who are these people[1] and what credentials do they have to build and run a cryptocurrency platform?" [1] https://angel.co/ethereum-1 Today, not a single cryptographer, mathematician, or anyone with software security experience is listed on the Ethereum Foundation member list[2]. I am not attacking any individuals by themselves, but as a group this says a lot. For the record,…

This is unfair to banish a company for not having enough "security experience". It could happen to anyone (i mean making such a design mistake), plus they afaik had some external audits. "Aha, no security background!" is wrong.

How is it unfair ? We're speaking about crypto-currency here. "crypto" is so damn hard than even experts make mistakes indesign or implementation, and very often in both. And when they don't, it still doesn't mean it's secure... And now it's ok to have no expert and to use the result to manage _currency_ ?!? It might sound weird, but yeah, I'd like to have knowledgeable people to deal with my money

Re: Chasing the DAO Attacker’s Wake – A second exploit

#55

Post by curiousgal »

freedaemon wrote: post #37
niftich wrote: post #23

This reads a little sensational. The original source [1] referred to in the article looks at the issue in more detail. [1] http://pdaian.com/blog/chasing-the-dao-attackers-wake/

Agreed the original article does a great job. However, without the "sensational" title and simpler explanation people were not paying proper attention to this. The original article discussed a bunch of other things as well -- everyone should read it to understand the details.

By people you mean traders. This sensationalism is utterly unnecessary since the non-traders involved with Ethereum read the original article and are capable of understanding it.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#56

Post by burkaman »

heliumcraft wrote: post #50
mjfl wrote: post #44

Earlier quoted context omitted.

It is absolutely fair to banish a company for security credentials if it's dangling $150 million out in the open air.

The Ethereum Foundation had nothing to do with the creation of the DAO.

That's like saying The Pirate Bay has nothing to do with piracy.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#57

Post by IvyMike »

JulianMorrison wrote: post #33
HoopleHead wrote: post #27

Every article I see on etherium mentions the DAO. Not one of them explains what it means. Gotta love unexplained acronyms!

Doubleclick drag rightclick search on Google. Here, I googled it for you https://daohub.org/

> A flexible decentralized autonomous organization leveraging the wisdom of the crowds to benefit the DAO Token Holders [...] The DAO is a for-profit DAO that will diligently use the ETH under its control to create value and provide benefits to its members while collaborating and improving the decentralised ecosystem as a whole.

Based on that, I feel like they are in tight competition with helena.co . http://gawker.com/i-have-no-idea-what-this-startup-does-and-...

Re: Chasing the DAO Attacker’s Wake – A second exploit

#58

Post by jerf »

mbrock wrote: post #12

I don't understand "you can't assume anything about the state of the contract." Surely the contract's state is only modified by the contract's own code, which means you can assume that the state is not altered arbitrarily but only according to the rules set up by the contract. Yes, you need to be careful about external calls that make altering calls to you.

The problem pointed out in this article isn't that it is impossible to write correct contracts. The problem is that it means that it is superhumanly difficult to write correct contracts, using the current feature set and infrastructure. This is especially true in what is theoretically an actively hostile environment, which the DAO hack proves is also actually an actively hostile environment.

It is theoretically possible to call out to another contract that has the ability to make further calls safely... but how can you be sure you've done it safely?

This isn't a unique problem. It arises in imperative-based programming all the time. But what in Javascript may be a bit of a coding error that means the next page of search results didn't load this time, in Solidity it means you may lose your shirt.

Also, I'd suggest that after-the-fact "static analysis" tools don't help. It's basically the same situation that real-world computer security is in, and right now, that world is massively advantage attacker, with generally far less direct incentive to attack than a blockchain functioning directly as money does. If the static analysis tool is open enough for "everyone" to use, the attackers get to use it too, and they can use it on all contracts at once because they're all open, and they have all the motivation to do so before the proper contract owners have time to fix their contracts. Every time the static analysis tools release a new check, it's an advantage-attacker race between exploiting the new check and fixing the contracts. The attackers are going to win big, repeatedly.

A Turing-complete blockchain needs to come out of the gate nearly 100% correct on this front, just as it needs to come out of the gate nearly 100% correct on the encryption security.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#59

Post by dang »

niftich wrote: post #23

This reads a little sensational. The original source [1] referred to in the article looks at the issue in more detail. [1] http://pdaian.com/blog/chasing-the-dao-attackers-wake/

Ok, we changed the url to that from https://blog.blockstack.org/solar-storm-a-serious-security-e..., and added the subtitle (of that post) to make the point clearer.

We also merged the comments from https://news.ycombinator.com/item?id=11934472 here, since there weren't that many of them and they were about the same post.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#60

Post by heliumcraft »

cel1ne wrote: post #48

So what they should have implemented is communicating sequential processes / actors instead of arbitrary calls. The more I read about ethereum's technical details, the more it sounds like a joke to me.

It's a code mistake by who did the DAO code. (DAO != Ethereum) It's more the equivalent of using eval in your nodejs code to evaluate some parameter received from a user. It's a stupid code mistake, but you wouldn't say the internet is a bad idea because some website got hacked.
Post reply on HN