Critical Update on DAO Vulnerability • Hacker News Board

Re: Critical Update on DAO Vulnerability

#601

Post by mrep » Sat, Jun 18, 2016, 3:18 AM UTC

developer2 wrote: post #383

cplease wrote: post #339

Oh, nobody saw that coming. Completely unforeseeable. What other mature, ready-for-primetime autonomous altcoin networks can I dump my savings into for no apparent reason? Edit: "DAO token holders and ethereum users should sit tight and remain calm. Exchanges should feel safe in resuming trading ETH." No they shouldn't. They should running screaming for the exit doors. Less than two months after the launch of this my…

WTF. There is the equivalent of millions of dollars in this blockchain? How?! Who willingly puts real cash up front for this kind of thing? Just... what?!

Two words: Ignorance and greed.

Re: Critical Update on DAO Vulnerability

#602

Post by dang » Sat, Jun 18, 2016, 3:56 AM UTC

specialist wrote: post #434

"The "hacker" simply used the DAO as it was meant to be used ... and deserves the funds." Exactly. DAO is CoreWar meets Nomic. https://en.wikipedia.org/wiki/Core_War https://en.wikipedia.org/wiki/Nomic Designers of rulesets (laws, board games, markets, control systems) ignoring Gödel's incompleteness theorems should themselves be ignored. Just like we ignore inventors of perpetual motion machines who ignore the laws…

We detached this subthread from https://news.ycombinator.com/item?id=11923240 and marked it off-topic.

Re: Critical Update on DAO Vulnerability

#603

Post by themusicgod1 » Sat, Jun 18, 2016, 5:08 AM UTC

mikeash wrote: post #458

programmarchy wrote: post #418

Earlier quoted context omitted.

Keep in mind Ethereum is less than a year old, the DAO is even younger. It's still new, risky, and fraught with problems that need to be solved. If you're not familiar with anarcho-capitalist theory, there's a concept called a DRO -- dispute resolution organization [1] -- that can perform arbitration functions in a decentralized manner, i.e. without a monopoly on judicial services like the state. In the future, as th…

What's crazy to me about the whole thing isn't the bug in the DAO nor the fact that it's being taken advantage of. As you say, it's all very early stuff, and there's no surprise that it hasn't been fully worked out yet. What does surprise me is that people poured the equivalent of tens of millions of dollars into this new, unproven thing. To me, this says that while Ethereum itself may be technologically fine, the co…

To be fair, people poured millions of dollars into a drunken pirate investment company (pirateat40). "I'm going to take your money and drink it away, har har" was somehow better than the alternatives, which often involve basically-impossible-to-circumvent paperwork requirements(buying stock without a phone/mailing address, say), obtrusive spy-on-your-customer policies, risk of having your wealth appropriated by governments like the government of Venezuela and so on.

Re: Critical Update on DAO Vulnerability

#604

Post by themusicgod1 » Sat, Jun 18, 2016, 5:15 AM UTC

twoodfin wrote: post #299

Joeboy wrote: post #294

Earlier quoted context omitted.

> I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? George Soros wasn't (afaik) breaking any law or contract when he drained a billion dollars from the Bank of England in 1992. I think most people in the UK would be OK with describing that as an attack.

I like this analogy, but no one tried to reengineer finance or the law to prevent Soros from spending his earnings.

A better analogy is probably Thaksin Shinawatra, where the rules are very much still up in the air, and where depending who has sway in Thailand, he can expect vastly different treatment.

Re: Critical Update on DAO Vulnerability

#605

Post by themusicgod1 » Sat, Jun 18, 2016, 5:21 AM UTC

kalleboo wrote: post #198

pjc50 wrote: post #115

Well, that was kind of inevitable. Building a financial system out of pure code with no humans in the loop and no legal structure is building a self-distributing bug bounty piñata. It's decentralised, so there's nobody who can throw a breaker and shout "stop!"; cryptocurrency transactions are irreversible, so thefts are permanent; and it's somewhat anonymous, so thefts are hard to trace. It also demonstrates that bei…

I find it endlessly amusing that people are willing to bet their cold hard cash on "this code has no bugs". When widespread old and tested code like OpenSSL has massive security bugs, what chance does something as new and in-development as Bitcoin/Ethereum have? An in the case of Ethereum, the contracts themselves?

> I find it endlessly amusing that people are willing to bet their cold hard cash on "this code has no bugs".

It's not "this code has no bugs" it's "this code has less visible bugs than the lower hanging fruit". If it's harder to find than any bug in any system with bitcoin (or other ethereum) in it, then people will find that stuff first. Bitcoin gave us out here in the IT world, for the first time in history, a realistic way to measure the large-scale security of various kinds of systems. Microsoft, for example, has not had the bitcoin from any of their wallets stolen. With every flaw that's found, we get the chance of learning how not to fail in the future.

Furthermore you have to invest in something. And it's remarkably hard to invest these days. Just try buying a house with ethereum, see how frustrating it is.

Re: Critical Update on DAO Vulnerability

#606

Post by naasking » Sat, Jun 18, 2016, 6:15 AM UTC

rsync wrote: post #539

rspeer wrote: post #507

Earlier quoted context omitted.

Not sure where you're saying Gödel's incompleteness theorems come in, but I agree that DAO is a game of Nomic. Now... the ability to hard-fork is kind of in the rules as well. So it's a Nomic with a complicated endgame. Some guy just won the Nomic, but now he's finding that not only do you want to win, you want to win subtly , or else a majority can vote to undo your win. But anyone who still thinks DAO is an investm…

"Not sure where you're saying Gödel's incompleteness theorems come in, but I agree that DAO is a game of Nomic." I know what he means - he's suggesting that you can't ever get a bulletproof or watertight set of rules or guidelines for a system because ... blah blah ... Gödel's incompleteness theorem. This is a very tempting idea and I myself have given it a lot of thought over the years. The problem is, Gödel's incom…

> The problem is, Gödel's incompleteness theorem applies to a system that contains the complexity of the set of all real numbers

As others have corrected that this should be naturals, I'll just also note that you can derive incompleteness just from addition and multiplication over naturals. So while you're correct that plenty of systems don't need full multiplication, you run into limitations quickly. Then you need proper theorem proving to recover the missing verification power.

Re: Critical Update on DAO Vulnerability

#607

Post by Bombthecat » Sat, Jun 18, 2016, 7:44 AM UTC

I mostly invested only in bitcoin. I knew already that they will win at end anyway. I think I invested around 10% in dao / ether. More for fun then anything else.

Seems like I was right.

Re: Critical Update on DAO Vulnerability

#608

Post by johnhenry » Sat, Jun 18, 2016, 8:20 AM UTC

For me, the interesting part is that the creators of Ethereum have decided that the owners of the address in question have committed a "crime" and to change the way the blockchain works in order to punish them specifically. Sure, users can "vote" by choosing whether or not to accept the fork in the code that does this, but because of the way it's set up, the community isn't going to take it that way. I'm afraid that this sets a precedent that would discourage development (what if we change the way the entire internet works every time someone hacks a website?) and also allow powerful entities within the system an unfair advantage (would we do this for everyone who used a contract of which they didn't understand the full implications? Or is this only in the case of the DAO because of it's high profile?).

Re: Critical Update on DAO Vulnerability

#609

Post by aws_ls » Sat, Jun 18, 2016, 9:11 AM UTC

Oh, I didn't know that you could make recursive calls on the DAO! Gosh, to me plain for loops (what people call Turing complete) itself looked a bit too much, from scaling point of view. I wrote my thoughts on the same 23 days back, when there was an article on CoinBase praising Ethereum in comparison to Bitcoin[1].

I have no axe to grind against Eth vis-a-vis Bitcoin. Infact support both. But, try to look at parts of the former skeptically which I think are over sold, without being looked at critically.

[1] https://news.ycombinator.com/item?id=11772397

edit: minor rephrase

Re: Critical Update on DAO Vulnerability

#610

Post by alvarosm » Sat, Jun 18, 2016, 9:35 AM UTC

infodroid wrote: post #318

wslh wrote: post #255

Earlier quoted context omitted.

I see a different problem here: Ethereum and the DAO were not in a mature state to handle this amount of money. For example, there is a limited support for upgrading contracts in Ethereum and the DAO was not reviewed enough to handle hundreds of million dollars. Also, there are methods to make the software ultra secure using formal models.

I always wondered why there was such a rush to launch the DAO. As opposed to what Ethereum itself did: develop a proof of concept for over a year, then release a beta version and provide bounties for security bugs, all the while collaborating with testers and security researchers to stress the software.

It's pretty obvious and simple. Because they want to run away with your money NOW. Ethereum had money already so they could survive while waiting to scam you even more.