Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

621–629 of 629 posts

Re: Critical Update on DAO Vulnerability

#621

Post by im3w1l »

infodroid wrote: post #266
imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

This real highlights the genius of Satoshi imo. If she had not disappeared she would have surely become a benevolent dictator for life and thus a single point of failure. By being anonymous and going silent, that outcome was prevented.

Re: Critical Update on DAO Vulnerability

#622

Post by fridsun »

EGreg wrote: post #368
infodroid wrote: post #266

Earlier quoted context omitted.

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

Disagree. Over time, there will be less and less human intervention and people will be able to rely on a system of contracts assembled from tested and trusted components. And avoid expensive litigation fees. Look, self-driving cars required humans to take over and require updates to deal with new challenges -- until they don't, or very rarely do.

In the place of litigation fees you pay software development fees. Not that I am really against it as a developer.

Smart contracts are different from self-driving cars in that the former have competing intents within while the latter have a common goal of "not hitting anything".

Re: Critical Update on DAO Vulnerability

#623

Post by christo »

semi-extrinsic wrote: post #490
Eliezer wrote: post #455

Earlier quoted context omitted.

"Tiling agents" would be the most arguably relevant. Provably correct agents that approve the construction of other probably correct agents obeying similar invariants.

Is "probably" there meant to be "provably"? I assume so, but I'm not sure.

Probably.

Re: Critical Update on DAO Vulnerability

#624

Post by metaguri »

imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

> How do _you_ know your contract is secure?

Ideally, using formal methods [1], one can write a provably correct program. Just because software can have bugs does not mean it must have bugs. Human contract law has no analogue.

Personally I'd be wary of any electronic contract that wasn't formally verified. The DAO exploit is unsurprising.

1. https://en.wikipedia.org/wiki/Formal_methods

Re: Critical Update on DAO Vulnerability

#625

Post by forgetsusername »

carver wrote: post #316
forgetsusername wrote: post #289

Earlier quoted context omitted.

> and can't simply press a button or send out an order And the governmental powers-that-be can press a button and prevent citizens from exchanging cash?

The US government freezes bank accounts all the time.

Bank accounts aren't cash. They're a ledger of your balance with the bank.

Re: Critical Update on DAO Vulnerability

#626

Post by forgetsusername »

jonnycowboy wrote: post #301
forgetsusername wrote: post #289

Earlier quoted context omitted.

> and can't simply press a button or send out an order And the governmental powers-that-be can press a button and prevent citizens from exchanging cash?

Yes, easily by devaluing the currency.

Governmental currency printing has zero effect on the negotiated transaction between two people, and it does precisely nothing on my ability to choose to continue using that currency. That's the underlying freedom; use dollars or blueberry scones if you want. You just need to find a willing counter-party.

The anti-fiat crowd should think for a minute on how money actually works in practice.

Re: Critical Update on DAO Vulnerability

#627

Post by quirkot »

JoshTriplett wrote: post #449
quirkot wrote: post #333

Earlier quoted context omitted.

I actually found a typo of a 100x magnitude in a Washington, D.C. law about ten years ago. Submitted it, and it was administratively adjusted. No need to even take it back for another vote. I believe is happens with much greater frequency than anyone outside the business of maintaining legal documents imagines. [even had a typo in the first publish of this comment!]

Sounds like a story worth telling; details?

Just realized someone actually read my comment!

Situation was basically a table rendered in prose format. I can’t recall the precise verbiage, but it read something like: In 2015, the requirement shall be 0.05%. In 2016, the requirement shall be 0.7. In 2017, the requirement shall be 0.09%

Very subtle typo which, had it been treated as The Truth of The Text would have bankrupted anyone attempting to adhere to the regulation.

Re: Critical Update on DAO Vulnerability

#628

Post by quirkot »

cmdrfred wrote: post #371
quirkot wrote: post #333

Earlier quoted context omitted.

I actually found a typo of a 100x magnitude in a Washington, D.C. law about ten years ago. Submitted it, and it was administratively adjusted. No need to even take it back for another vote. I believe is happens with much greater frequency than anyone outside the business of maintaining legal documents imagines. [even had a typo in the first publish of this comment!]

> administratively adjusted That sounds like a terrible amount of power to give someone without a vote.

A legislative body is a conflict resolution mechanism, and one that is basically in the business of writing the code of law (literally). For something to be considered a typo, there must be negligible conflict over that interpretation. If not, the legislative body addresses it again or it’s handled by the judiciary. The legal register who maintains the official version of the text works at the behest of the legislative body. These things are not occurring without supervision.

Re: Critical Update on DAO Vulnerability

#629

Post by andygates »

jobigoud wrote: post #390
pjc50 wrote: post #115

Well, that was kind of inevitable. Building a financial system out of pure code with no humans in the loop and no legal structure is building a self-distributing bug bounty piñata. It's decentralised, so there's nobody who can throw a breaker and shout "stop!"; cryptocurrency transactions are irreversible, so thefts are permanent; and it's somewhat anonymous, so thefts are hard to trace. It also demonstrates that bei…

> a self-distributing bug bounty piñata I think this is great actually. Maybe not for the people involved right now but there will be a very strong Natural Selection pressure on contracts. It will be interesting what type of contract emerge and survive over time, the type of languages used to improve or proof robustness, etc.

Assuming that the "trust nobody" model survives these hard selection events. One more and the big money will dry up.
Post reply on HN