Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chasing the DAO Attacker’s Wake – A second exploit

pdaian.com

Post reply on HN
Print view View original

61–70 of 180 posts

Re: Chasing the DAO Attacker’s Wake – A second exploit

#61

Post by drcode »

AJ007 wrote: post #20

Nearly a year ago I made the comment -- "Who are these people[1] and what credentials do they have to build and run a cryptocurrency platform?" [1] https://angel.co/ethereum-1 Today, not a single cryptographer, mathematician, or anyone with software security experience is listed on the Ethereum Foundation member list[2]. I am not attacking any individuals by themselves, but as a group this says a lot. For the record,…

Your comment from a year ago was pretty much entirely wrong: The ethereum platform has so far been stable and without exploits to this date. The exploits of theDAO and the exploits described in the article are smart program exploits, not exploits in the underlying platform.

Could the solidity programming language have some more features to protect inexperience smart contract programmers from themselves? Certainly, nobody is disputing that.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#62

Post by jsprogrammer »

heliumcraft wrote: post #29
AJ007 wrote: post #20

Nearly a year ago I made the comment -- "Who are these people[1] and what credentials do they have to build and run a cryptocurrency platform?" [1] https://angel.co/ethereum-1 Today, not a single cryptographer, mathematician, or anyone with software security experience is listed on the Ethereum Foundation member list[2]. I am not attacking any individuals by themselves, but as a group this says a lot. For the record,…

you are looking at a page listing boards and advisors, of course those wouldn't be the technical people. Look at the core teams behind the different tools (too many to list here quickly), as well as the devs working in companies in the ecosystem such as consensys and ethcore, they are all quite qualified and smart people. Two examples come to mind are vlad zamfir and Dr. Christian Reitwiessner.

Why would boards and advisors of course not be technical?

Re: Chasing the DAO Attacker’s Wake – A second exploit

#64

Post by vessenes »

bouk wrote: post #15

Seems like this is what mutexes were invented for

The typical solidity dev is "but mutexes cost so much gas!"

There's an optimization problem not yet sorted out here. If I were king of ethereum, (happily I'm not), I'd make a very cheap mutex support part of the eth vm and encourage solidity and serpent devs to use it as needed.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#65

Post by mst »

thom_nic wrote: post #31

Interesting Ethereum uses the term "function" however in programming we understand a pure function to be an operation that always returns the same result given the same inputs. I don't know anything about Ethereum, but if functions rely on external shared state then they aren't pure functions, are they?

Well, solidity is kinda javascript-style syntax and that's the keyword from javascript.

On a pedantic level, you're absolutely correct, but real-world usage generally makes 'function' equivalent to 'subroutine', hence why we have the specific term pure function to disambiguate.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#66

Post by lotsoflumens »

thom_nic wrote: post #31

Interesting Ethereum uses the term "function" however in programming we understand a pure function to be an operation that always returns the same result given the same inputs. I don't know anything about Ethereum, but if functions rely on external shared state then they aren't pure functions, are they?

No - a pure function is a function that has no side-effect (other than heat loss).

You are talking about referential transparency. Even functions that are not pure can be referentially transparent.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#67

Post by dang »

mjfl wrote: post #44
homakov wrote: post #41

Earlier quoted context omitted.

This is unfair to banish a company for not having enough "security experience". It could happen to anyone (i mean making such a design mistake), plus they afaik had some external audits. "Aha, no security background!" is wrong.

It is absolutely fair to banish a company for security credentials if it's dangling $150 million out in the open air.

> What are you talking about?

Please don't be uncivil. It's damaging to collegial conversation, and it's against the rules (https://news.ycombinator.com/newsguidelines.html). Please edit such stuff out of your comments here.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#68

Post by Inthenameofmine »

AJ007 wrote: post #20

Nearly a year ago I made the comment -- "Who are these people[1] and what credentials do they have to build and run a cryptocurrency platform?" [1] https://angel.co/ethereum-1 Today, not a single cryptographer, mathematician, or anyone with software security experience is listed on the Ethereum Foundation member list[2]. I am not attacking any individuals by themselves, but as a group this says a lot. For the record,…

Generally speaking the longer someone has been in a specific field, the lower the probability of them thinking of a new method or agreeing with new things. This is a general pattern across the board with anything ews, startups, projects, etc.

As somebody working with a lot os startups, having somebody with 30 years of a specific core competency on the founding team is a huge red flag.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#69

Post by drcode »

heliumcraft wrote: post #18

"This impacts all contracts on Ethereum, not just the DAO. This is an issue with Ethereum’s JavaScript-like programming language (Solidity)." No it doesn't, no it's not. It affects contracts that use this functionality with arbitrary untrusted contracts (which is a bad idea), and most contracts just don't use this functionality at all.

Yeah, all this shadenfreude from people who (wrongly) predicted ethereum would never work, and who want to feel vindicated, is predictable but frustrating.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#70

Post by cel1ne »

heliumcraft wrote: post #60
cel1ne wrote: post #48

So what they should have implemented is communicating sequential processes / actors instead of arbitrary calls. The more I read about ethereum's technical details, the more it sounds like a joke to me.

It's a code mistake by who did the DAO code. (DAO != Ethereum) It's more the equivalent of using eval in your nodejs code to evaluate some parameter received from a user. It's a stupid code mistake, but you wouldn't say the internet is a bad idea because some website got hacked.

I know that DAO != Ethereum.

Letting programs call arbitrary function on each other is a fundamental design-flaw in every concurrent system.

Post reply on HN