Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

611–620 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#611

Post by wslh »

int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

And you are not saying anything about the VM itself which behaves differently in certain cases... Look at our last article on this specific topic: https://blog.coinfabrik.com/smart-contract-short-address-att...

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#612

Post by kaputsmack »

vog wrote: post #458
int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

I never understood why they chose such a hacky language (an a VM model that encourages these kinds of languages), and expect people to write supposedly secure (in the sense of: obviously correct!) code with it. Any remotely popular functional programming language created over the last years shows a better design (and taste) than this one. And if that only attracts a certain type of programmers? (pun intended) That is…

Why did you bundle an equally experimental language like kotlin amid those other well established and widely used languages?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#613

Post by Anderkent »

sillysaurus3 wrote: post #308
Anderkent wrote: post #288

Earlier quoted context omitted.

Are you saying everyone needs to write their wallet from scratch?

No... Just the opposite. Stick with core tech. If it's not core, don't use it. It's as simple as that.

Why do you think the core tech is going to be less buggy then the popular tech? One would think the most used wallets are going to be the ones that find the bugs earlier.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#614

Post by lightbyte »

calafrax wrote: post #60
cl0rkster wrote: post #23

A much more useful explanation: https://press.swarm.city/parity-multisig-wallet-exploit-hits...

> The Swarm City Core team is more committed than ever to the development of Swarm City. The real value of our token lies in the community, and the technology the developers are creating. Black hat hackers, vulnerabilities, and bugs will not stop us from creating the decentralized sharing economy our community and the world craves. What?!? That seems like a pretty relaxed response for someone who just lost 8m dollars…

Their whole statement is pretty concerning. They do not seem to be taking responsibility for writing a very basic and obvious bug that lost them millions of dollars. That'd end most companies.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#615

Post by redm »

I'm not sure why everyone is piling on Solidity. At the end of the day, bugs happen in all languages, to all programmers eventually, and if you want to point the finger, it has to be at Parity.

If anything, it shows there needs to be a better process for peer review and some defaults in Solidity should be changed for security.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#617

Post by shuntress »

nebulous1 wrote: post #312
sillysaurus3 wrote: post #297

Earlier quoted context omitted.

I believe there have been scam wallet implementations for BTC in the past, though I don't have any info. They're your coins. Throw them off a bridge if you want. Meanwhile, people who stick with core tech have been burned zero times. Why does the obsession with shiny new convenient thing outweigh people's good sense not to risk thousands or hundreds of thousands of dollars? If that amount of money were printed out in…

So you use the Bitcoin Core wallet do you? You've veered away from your original statement towards one that I don't disagree with. Of course you shouldn't just trust any software you find on the internet. That's not the same as "only trust Ethereum core". Slandering "third party" as if that has any meaning is silly. You should treat everything on its individual merits, including the Ethereum reference wallet.

>Slandering "third party" as if that has any meaning is silly

This feels like a good opportunity to point out that a big part of decentralized infrastructure is that there isn't a 'First Party'

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#618

Post by jes5199 »

avaer wrote: post #461
vog wrote: post #458

Earlier quoted context omitted.

I never understood why they chose such a hacky language (an a VM model that encourages these kinds of languages), and expect people to write supposedly secure (in the sense of: obviously correct!) code with it. Any remotely popular functional programming language created over the last years shows a better design (and taste) than this one. And if that only attracts a certain type of programmers? (pun intended) That is…

99 out of 100 questions. Solidity is ostensibly designed to let people write smart contracts for Ethereum. More realistically, it is a marketing tool for enabling and onboarding people onto the Ethereum platform, which Ethereum benefits monetarily (enormously so) from. Security and design are secondary goals to the extent that they help prevent disasters which hurt adoption or churn developers away. Through this lens…

a marketing tool that gets your money stolen is probably counterproductive in the long run

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#619

Post by federicobond »

vog wrote: post #458
int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

I never understood why they chose such a hacky language (an a VM model that encourages these kinds of languages), and expect people to write supposedly secure (in the sense of: obviously correct!) code with it. Any remotely popular functional programming language created over the last years shows a better design (and taste) than this one. And if that only attracts a certain type of programmers? (pun intended) That is…

None of the languages that you mention target the EVM, and the changes required to do so would turn them into restricted versions that look kind of like the original ones but have several differences that you need to keep in mind while programming in them. It makes quite a lot of sense to create a new language that takes advantage of the particular features provided by the EVM.

It's also quite hard for programmers to reason about performance or complexity in most functional languages. In the EVM, all functions should either be O(1) or bounded O(n) and should strive to use the most economical bytecode available to perform each task.

Disclaimer: I am a regular contributor to Solidity.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#620

Post by philh »

albertgoeswoof wrote: post #596
0x0 wrote: post #108

Earlier quoted context omitted.

In most cases yes, but isn't ethereum all about "the code _is_ the contract"? If you as the owner of a house put an ad in the paper saying "if you can manage to enter my house feel free to take whatever you want", should you complain if someone did exactly that?

Yes because that would still be a crime. Expanding on your analogy - if I declare right now that it's ok to murder me, it's still not ok to come and murder me. Same principle applies to EULAs and Terms of Service, you're not bound to it just because it's in there. If the hacker was entitled to those funds based on the agreement between the concerned parties (implicit OR explicit in the contract) it would not be theft…

> Yes because that would still be a crime. Expanding on your analogy - if I declare right now that it's ok to murder me, it's still not ok to come and murder me.

The comparison to murder doesn't work because you can't consent to murder, but you can consent to theft.

It's not clear to me whether that situation would be taken as consent, but unless you know something I don't, it probably shouldn't be clear to you either.

Post reply on HN