Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

631–640 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#631

Post by federicobond »

Animats wrote: post #147
Analemma_ wrote: post #43

Earlier quoted context omitted.

> Unmarked functions default to public in Solidity What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

This is why I keep saying that "smart contracts" should be expressed in some declarative notation like decision tables. Byte-coded programs as contracts were a really bad idea. Contracts need to be readable, not just executable.

The problem is that decision tables usually end up really big for anything but the most trivial smart contracts.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#632

Post by federicobond »

dragonwriter wrote: post #306
stale2002 wrote: post #302

Earlier quoted context omitted.

Ok, and now what if the two parties are anonymous or one lives in Russia? In that case the judge can't do shit. If you want the protections of courts, there is already a perfectly easy way to do that. And that is to use a real contract. But if you explicitly do NOT want that, and explicitly DO want code to be law, that is what ethereum is for. a judge can't take away the crytocurrencies of some anonymous other party.

> Ok, and now what if the two parties are anonymous or one lives in Russia? > In that case the judge can't do shit. In the latter case, I'm pretty sure that (even leaving aside other mechanisms that might apply), judges and courts exist in Russia. Agreements where the parties are based indifferent countries have long been a thing, and long been enforceable by courts. Unmasking anonymous parties, obviously, can be (th…

They may be enforceable but for many cases, it's just not cost effective to pursue legal action.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#633

Post by nihonde »

tawayway wrote: post #560
nihonde wrote: post #496

Earlier quoted context omitted.

Your enumerated conditions apply to traditional legal contracts as well.

Traditional contracts aren't immutable in the same sense though, right? They can be appealed, annulled, ignored...

Actually, there are only limited public policy exceptions to contract enforcement. In theory, almost any court should enforce whatever the parties agreed to. When they encounter "bugs" (usually ambiguity), the court might need to choose a side. Sounds a lot like choosing a fork, right?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#634

Post by mullen »

richardknop wrote: post #577
sleepychu wrote: post #539

Earlier quoted context omitted.

Maybe they estimated that this was the proportion that would protect their gains from a hard fork

I agree. Probably game theory reasons. Don't steal so much it will cause the community to unite and hard fork. 30 million is enough to retire and probably not enough to cause hard fork and rollback of txs. They played it safe.

I think this is what happened and it makes sense if you think about it. If they steal enough to get rich but not enough to force a rollback, then they can keep their ill gotten gains.

30 million is enough for a small group of hackers to live comfortably for the rest of their lives.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#635

Post by dullgiulio »

grandalf wrote: post #68
twblalock wrote: post #38

Earlier quoted context omitted.

> Ethereum offers immutability, and blockchains can foster new kinds of trust, but trust still has to grow organically in the ecosystem. If you need a source of trust outside of the blockchain, why would you need the blockchain after such trust has been obtained?

> outside of the blockchain The blockchain offers characteristics (immutability, consensus, distributed backup) that allows entities to trust each other efficiently. But when you introduce a non-trivial smart contract, there is a chance that it (a black box) has behavior that is not obvious from its source code. Since the behavior of the contract will cause immutable changes to the blockchain, and since humans can't…

> The blockchain offers characteristics (immutability, consensus, distributed backup) that allows entities to trust each other efficiently.

Nope. All of these can be achieved without using proof-of-work which is terribly inefficient.

The parties would have to trust each other... but well, they have to in Ethereum too :)

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#636

Post by Taek »

vasilipupkin wrote: post #597
vasilipupkin wrote: post #422

Earlier quoted context omitted.

It's only a bubble if you can identify it ahead of time. Stating that something became much more valuable over a short period of time doesn't mean you know how to identify bubbles. Bitcoin is 70-80 times more valuable now than when it was at 32, and had you bought it then you would be up a lot. So, to say crypto is in a bubble today is the same thing as to predict that in a few years it will be worth less than today.…

Downvoters, since you know how to indentify bubbles, I'm assuming you shorted ethereum on margin on GDAX when it hit 400 and made a ton? No? If not, why not, if you knew definitely it was a bubble ?

Because it's very hard to figure out where the top of a bubble is, and if you short a bubble asset too long before the peak, you go broke, even if you are correct.

Don't short hopium.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#637

Post by geofft »

kalleboo wrote: post #482
kccqzy wrote: post #437

Earlier quoted context omitted.

I'm inclined to agree but I must say this traditional system is unscalable. Sure it can detect millions of dollars of fraudulent transactions, but what if it's a single person who's the victim of identity theft and lost just a few thousand dollars? A few thousand dollars is nothing in the grand scheme of things but they are a lot to a single individual.

Doesn't this happen every day, over trivially small sums? You've never heard of a credit card chargeback?

Right, and also, a good part of why credit cards have 2-3% overhead is essentially insurance against chargebacks. I'd rather pay $51 for groceries every week than $50 for groceries plus a risk of irrevocably losing tens of thousands of dollars at some point with no warning.

If cryptocurrencies think that they can provide this service for substantially cheaper than 2-3% (note that this is an additional service on top of simply making the transfer happen, so mining fees aren't the right thing to compare), that sounds awesome, but also I'd like to understand why it's possible.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#638

Post by seangrogg »

positivecomment wrote: post #598
MaxfordAndSons wrote: post #462

Earlier quoted context omitted.

> Block scoping is default now in JS The default best practice, you mean? Declaring with 'var' will still get you the same lexical scoping rules as always. I believe OP meant 'inherited from pre-ES6 JS'

I thought using "var" is deprecated... If there's anyone who has the chance to use let/const but still doesn't, I'd be very curious to learn about their reasoning

Bad habits, arguably. Been using JS for years so occasionally instances where a more vigilant self would use "let" still get "var" instead. I think part of this is because of issues with previous versions of v8/node where using let at the global level or without 'use strict' threw errors.

That being said, "const" is already hardwired.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#639

Post by riffraff »

lsc wrote: post #493
riffraff wrote: post #471

Earlier quoted context omitted.

They did this already? I'm guessing it happened in the dao accident? If so, this seems terrifying, what if I had accepted stolen ETH to sell physical goods?

It seems to match the real world in some ways; If I barter and end up accepting stolen physical goods, things can go rather badly for me.

yes, but in many (most?) legal systems you cannot change the rules so you are liable for past events.

I.e. if you accept counterfeit money, it's on you, but your money should not become counterfeit overnight.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#640

Post by mrkgnao »

federicobond wrote: post #622
avaer wrote: post #461

Earlier quoted context omitted.

99 out of 100 questions. Solidity is ostensibly designed to let people write smart contracts for Ethereum. More realistically, it is a marketing tool for enabling and onboarding people onto the Ethereum platform, which Ethereum benefits monetarily (enormously so) from. Security and design are secondary goals to the extent that they help prevent disasters which hurt adoption or churn developers away. Through this lens…

Being a good, secure language for writing smart contracts is absolutely one of the most important goals for Solidity. I can say so because I have been involved as a regular contributor to the compiler for more than a year. If onboarding a lot of people to the platform quickly were the goal instead, they would have ported some crippled version of Java or JS and called it a day. The problem is that it's just not easy t…

To pick just one: mutable state by default is very difficult to justify as being a decision intended to promote security in a tool that is literally meant to construct financial/contractual instruments.
Post reply on HN