51–60 of 223 posts
I always wonder how these "five conditions ANDed together in an if" make it past code review in general (i know thats not where the actual bug was). I don't care how brilliant a programmer you are, but mistakes in those are very difficult to grasp.
So only 31 other cases to test for, now let's hope they did all those tests.
The error is here: https://github.com/zcoinofficial/zcoin/blob/81a667867b5d8489... and the line of code: zccoinSpend.denomination == libzerocoin::ZQ_LOVELACE; In other words, a statement with no effect. In D, such a line gives an error, not a warning: Error: == has no effect in expression You can force the statement to be accepted by casting it to void. It's really past time for languages to not accept such code any…
test.cpp: In function ‘int main()’:
test.cpp:13:11: warning: statement has no effect [-Wunused-value]
a == b;
^
Earlier quoted context omitted.
You're right. My contention is that the language itself should no longer accept such code, it shouldn't be relegated to an ignorable warning or a 3rd party tool that isn't run.
Yes, major improvements could be made by changing the defaults of the tools that beginners use. I edited my original comment to be more clear on this as well.
I can't think of a reason any modern language should accept such code.
If you're interested, I recommend the series "Air Disasters" on TV. Each episode analyzes one crash, where investigators determine the cause of the accident, and what the corrective action should be taken. Often, it comes down to "how could a pilot with 10,000 hours experience make such a mistake". While it would be easy for investigators to blame the pilot, often they find that the mistake was just too easy to make, and they recommend changing the design or procedures or both.
Note that this is unrelated to Zcash, the zk-SNARKS based cryptocurrency perhaps more known to HN.
yes but, shockingly , they have the same mastermind behind it: https://en.wikipedia.org/wiki/Zerocoin
Earlier quoted context omitted.
You're never beyond the reach of a civil suit. If you identify yourself with the scheme and you're in the same country where there's adoption, you could be easily targeted. Plus, the language in 18 U.S.C. § 1030(e)(2) (courtesy of CFAA) refers specifically to "any computer, when [it affects] use by or for [a] financial institution." And later it mentions "...affecting interstate or foreign commerce or communication..…
I would really like to see this happen. Without an EULA, is it even possible? Perhaps the next generation of cryptocurrencies can have a simple EULA that prohibits exploitation and can be used to firewall off stolen coins.
Earlier quoted context omitted.
People complained a lot for 10% of Zcash going to the founders (in the form of a 20% draw on the first half of mining). But that value and expertise are used to ensure bugs like this Zcoin attack do not occur.
> used to ensure bugs like this...do not occur Then compensate for that. Create a pool that pays out for each year without vulnerabilities.
Earlier quoted context omitted.
Do you think this is immoral? I am genuinely curious as to what the arguments would be one way or another. People are taking a risk with these things and they know they're risky. So it's not really stealing.
I believe it is a crime, both in spirit and on paper. In spirit, you took something that was not yours and not meant for you, and by selling the coins you decreased the value of everyone else's. On paper, let's say that the developers behind whatever coin you hack decide that they are going to take no action. You still run afoul of countless computer security laws designed, however poorly, to protect people from hack…
I'm content getting my kicks out of intentionally running the occasional red light.
But it takes all types. Imagine how boring the world would be without crime!
The error is here: https://github.com/zcoinofficial/zcoin/blob/81a667867b5d8489... and the line of code: zccoinSpend.denomination == libzerocoin::ZQ_LOVELACE; In other words, a statement with no effect. In D, such a line gives an error, not a warning: Error: == has no effect in expression You can force the statement to be accepted by casting it to void. It's really past time for languages to not accept such code any…
It seems that D never really got the love it deserved, perhaps because it didn't have a Google or Mozilla behind it.
The error is here: https://github.com/zcoinofficial/zcoin/blob/81a667867b5d8489... and the line of code: zccoinSpend.denomination == libzerocoin::ZQ_LOVELACE; In other words, a statement with no effect. In D, such a line gives an error, not a warning: Error: == has no effect in expression You can force the statement to be accepted by casting it to void. It's really past time for languages to not accept such code any…
You're absolutely right (to my surprise), it gives: test.cpp: In function ‘int main()’: test.cpp:13:11: warning: statement has no effect [-Wunused-value] a == b; ^ But only after enabling a warning that is not on by default. -Wall and -Werror should be the default.
if (condition);
dothis();
Earlier quoted context omitted.
Any C++ static analyzer worth its salt would catch this. I don't think this is so much of a C++ language issue, but more of an issue with C++ environments/compilers not doing static analyzing by default, and/or the authors of this software not being aware of the fact that they need to use static analyzers.
You're right. My contention is that the language itself should no longer accept such code, it shouldn't be relegated to an ignorable warning or a 3rd party tool that isn't run.