Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

521–530 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#521

Post by arjo1 »

int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

Fixing the language is one step. It will still not prevent hax0rs from targeting the bytecode of the VM itself.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#523

Post by mbrock »

gst wrote: post #503
riffraff wrote: post #465

Earlier quoted context omitted.

Isn't the team also working on a new language targeting the same VM? If so, they might be useful.

There are lots of different languages targeting EVM. The (IMO) most promising so far is https://github.com/ethereum/viper

You can also just write bytecode directly. It's a simple stack machine, and contracts should be as simple as possible.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#524

Post by ikken »

trevor-e wrote: post #466
int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

Can someone explain to me why they chose to make their own language instead of creating a DSL inside of an existing language?

This is because running code on Ethereum VM and storing data is hugely expensive (rightly so, as it's being done on all nodes in the world). Therefore Solidity will try to compile into a VM code that uses the least numbers of cheapest instructions and pack data into as small memory package as possible.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#525

Post by djhworld »

On the parity website they state the following

> Every single line in our codebase is fully reviewed by at least one expert developer (and routinely two or more) before being placed in the main repository. We strive for excellence; static code checking is used on every compile to cut out bad idioms. Style is enforced before any alteration may be made to the main repository. Continuous integration guarantees our codebase always compiles and tests always pass.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#526

Post by LeonidasXIV »

vog wrote: post #458
int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

I never understood why they chose such a hacky language (an a VM model that encourages these kinds of languages), and expect people to write supposedly secure (in the sense of: obviously correct!) code with it. Any remotely popular functional programming language created over the last years shows a better design (and taste) than this one. And if that only attracts a certain type of programmers? (pun intended) That is…

> Well, that's exactly kind of people you to attract to write your security-sensitive code.

Unsurprisingly, Tezos is actually written by OCaml people who seem to value the correctness of the contract language.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#527

Post by Jabanga »

moeop wrote: post #292
wheelerwj wrote: post #212

Earlier quoted context omitted.

i know that you're not really serious when you generalize against all of us crypto simpletons, but anytime theres a stupid amount of money on the table people are bound to rush to pick it up. and that means mistakes. the work being done on public blockchains is unlike anything else done before. You don't have he luxury of keeping your db behind a vpn running on a vm platform secured and maintained by the worlds large…

These mistakes are predictable and inexcusable. The Ethereum developers sold a vision of smart contracts, where the code is the contract. However, their hubris lead to them attempting to implement a complex language, instead of starting the endeavor with a small, simple, verifiable language. Similarly, their belief in their own infallibility lead them to write code that is not tested, and to create capabilities that…

Predictable, but not necessarily inexcusable. What is gained and learned in attempting more complex smart contracts sooner rather than later when all the building blocks for absolutely secure smart contracts are built can certainly justify the approach.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#528

Post by bigdubs »

ikken wrote: post #524
trevor-e wrote: post #466

Earlier quoted context omitted.

Can someone explain to me why they chose to make their own language instead of creating a DSL inside of an existing language?

This is because running code on Ethereum VM and storing data is hugely expensive (rightly so, as it's being done on all nodes in the world). Therefore Solidity will try to compile into a VM code that uses the least numbers of cheapest instructions and pack data into as small memory package as possible.

"Normal" and "secure" languages don't do this already?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#529

Post by thegavsie »

vog wrote: post #520
avaer wrote: post #461

Earlier quoted context omitted.

99 out of 100 questions. Solidity is ostensibly designed to let people write smart contracts for Ethereum. More realistically, it is a marketing tool for enabling and onboarding people onto the Ethereum platform, which Ethereum benefits monetarily (enormously so) from. Security and design are secondary goals to the extent that they help prevent disasters which hurt adoption or churn developers away. Through this lens…

> 99 out of 100 questions. Curious question of a non-native speaker: What does this phrase mean? (in general, and in this context)

The answer to why most things are done is... Money !

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#530

Post by jaytagdamian »

vog wrote: post #520
avaer wrote: post #461

Earlier quoted context omitted.

99 out of 100 questions. Solidity is ostensibly designed to let people write smart contracts for Ethereum. More realistically, it is a marketing tool for enabling and onboarding people onto the Ethereum platform, which Ethereum benefits monetarily (enormously so) from. Security and design are secondary goals to the extent that they help prevent disasters which hurt adoption or churn developers away. Through this lens…

> 99 out of 100 questions. Curious question of a non-native speaker: What does this phrase mean? (in general, and in this context)

http://persuasive.net/what-is-the-answer-to-99-out-of-100-qu...
Post reply on HN