Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

571–580 of 629 posts

Re: Critical Update on DAO Vulnerability

#571

Post by jobigoud »

mikeash wrote: post #458
programmarchy wrote: post #418

Earlier quoted context omitted.

Keep in mind Ethereum is less than a year old, the DAO is even younger. It's still new, risky, and fraught with problems that need to be solved. If you're not familiar with anarcho-capitalist theory, there's a concept called a DRO -- dispute resolution organization [1] -- that can perform arbitration functions in a decentralized manner, i.e. without a monopoly on judicial services like the state. In the future, as th…

What's crazy to me about the whole thing isn't the bug in the DAO nor the fact that it's being taken advantage of. As you say, it's all very early stuff, and there's no surprise that it hasn't been fully worked out yet. What does surprise me is that people poured the equivalent of tens of millions of dollars into this new, unproven thing. To me, this says that while Ethereum itself may be technologically fine, the co…

Consider the fact that many who bought ETH did so with BTC, and that these BTC might have been acquired for a lot less than what the equivalent ETH are now worth.

Re: Critical Update on DAO Vulnerability

#572

Post by CoryG89 »

lazaroclapp wrote: post #557
arghnoname wrote: post #489

Earlier quoted context omitted.

In other words, this contract is too big to fail?

Perhaps, but: a) It is being bailed out by referendum, not mandate. Everyone gets a vote, if you don't want to install the patch, don't do it. b) The funds to bail it out are those stolen by the attacker. Nobody is asking people without DAO tokens to suddenly contribute their ether to restoring the DAO or take debt.

I disagree in part with (b). A hard fork could split the community and cause the price of ether to crash further. While miners who fork may not actually lose ether in the process, they may actively cause it to lose whatever value it has left.

Of course, miners not associated with the DAO would never normally consider risking such a thing, but the rapidly falling price of their ether may convince them that it's the safest move.

Re: Critical Update on DAO Vulnerability

#573

Post by cmdrfred »

danielweber wrote: post #528
cmdrfred wrote: post #410

Earlier quoted context omitted.

This is hacker news. If this was some code rather than in meatspace and you trusted a single client to modify a turning complete config file for everyone else you'd call it a massive security vulnerability. I don't understand how having humans involved changes that. Yes, they probably have good intentions but has that assumption ever worked out in human history? If it's not used today for something nefarious, it will…

> This is hacker news Which is why people don't understand basic human institutions and are surprised when they run into issues trying to re-invent from scratch

Grace Hopper said it best 'The most dangerous phrase in the language is, "We've always done it this way."'

Re: Critical Update on DAO Vulnerability

#574

Post by drewm1980 »

sidthekid wrote: post #305

I cant help but imagine the attacker party/their associates read reddit and online forums, and thus would be vocal in criticizing the soft/hard fork decision. The theft of $50m is being rendered useless in front of their eyes - a maddening situation I'm sure.

It looks to me like the "thief" has already won; it has turned into an ideological debate; I would be surprised if ~any proposal to fork reaches a majority.

Re: Critical Update on DAO Vulnerability

#575

Post by cmdrfred »

drinchev wrote: post #544
cmdrfred wrote: post #281

Earlier quoted context omitted.

Who decides what a typo is? "Oh, that contact for 1000 dollars is really 10 dollars because they 'missed' a decimal place. You still have to uphold your part though." Corruption of judges can be a problem in that space and that is in part what this is attempting to solve. A lofty goal, maybe even impossible, but certainly worth the time to try.

I UPvoted your comment. Aside from everything. In writing a contract, it's very common to write price with numbers and letters in brackets next to them. E.g. 1000$ ( one thousand dollars ), exactly because typos happen. The decision what a typo is is made by the parties, in case of dispute then by several courts ( based on the evaluation of the contract ). That's at least in continental law system. There's a way to s…

It's impossible to corrupt a 3rd party judge (shouldn't all courts be third parties?), or 3 judges? I agree it's the best system we have today, but it won't be tomorrow.

Re: Critical Update on DAO Vulnerability

#576

Post by will_brown »

genmon wrote: post #495
jchrisa wrote: post #312

Earlier quoted context omitted.

Maybe someone can write an insurance contract that future DAO authors can hire, as an alternative to interventions. It would have to be bug free.

This is a smart response. The insurance company could also review the contract code in order to provide cover -- this would give investors extra confidence.

Something like this: https://news.ycombinator.com/item?id=11789829

Re: Critical Update on DAO Vulnerability

#577

Post by rsync »

voxic11 wrote: post #568
rsync wrote: post #546

Earlier quoted context omitted.

I think this comment on the original blog post says it very well: "To be clear, if this happened due to an exploit in the software, then I can accept a hard fork fixing the issue. However, if the DAO team made a mistake in the way they designed their smart contract, as an issue of principle, they should not be "bailed out" by the Ethereum team because they are "to big to fail." Hard lessons like these teach the crypt…

Do you own ethereum that will undoubtedly fall in value if the attacker is allowed to start dumping their earnings? It's within the network at larges interest to fork, so that is what will happen.

"Do you own ethereum that will undoubtedly fall in value if the attacker is allowed to start dumping their earnings?"

No, I do not own any ethereum and have had only a casual interest in the entire project. My own investments have been in "Oh By Codes"[1] most recently :)

[1] https://0x.co

Re: Critical Update on DAO Vulnerability

#578

Post by powera »

I always thought nobody had any actual plans as to how the DAO could do anything useful.

Now I guess we know it won't. Either "hackers" will bankrupt it, or all the decentralization zealots will back out (and bankrupt it).

Re: Critical Update on DAO Vulnerability

#579

Post by akhilcacharya »

lazaroclapp wrote: post #557
arghnoname wrote: post #489

Earlier quoted context omitted.

In other words, this contract is too big to fail?

Perhaps, but: a) It is being bailed out by referendum, not mandate. Everyone gets a vote, if you don't want to install the patch, don't do it. b) The funds to bail it out are those stolen by the attacker. Nobody is asking people without DAO tokens to suddenly contribute their ether to restoring the DAO or take debt.

1) TARP arguably had a referendum immediately afterward in the form of the election.

2) The American people were paid back.

Re: Critical Update on DAO Vulnerability

#580

Post by roywiggins »

panic wrote: post #278
LoSboccacc wrote: post #248

Earlier quoted context omitted.

that's the gist of the problem Turing machine, meet halting problem.

The halting problem is easy to solve for Ethereum programs by design. Programs are made of instructions, each instruction requires fuel to run, and fuel is limited, so every program must halt eventually.

I'm not familiar with Ethereum programs, but it seems to me that it's not possible to answer the practically-identical question, "How much gas does this program need to start with to guarantee it will either get into a loop or halt of its own accord before it runs out of gas?"

Or, to put it another way, it sounds like the language is Turing complete in roughly the same way C is Turing complete even though every C program ever instantiated is actually a linear bounded automaton because there's no such thing as an infinite tape.

Like, I can announce that my C-like language will always halt after a trillion-trillion operations and therefore the halting problem is "solved" for it, but for all other purposes it's almost exactly as difficult to reason about as a Turing machine.

Post reply on HN