Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

701–710 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#701

Post by roryokane »

d21d3q wrote: post #681
git-pull wrote: post #434

Earlier quoted context omitted.

Some explanation of what's happening here: The initial poster posted this link: https://github.com/paritytech/parity/blob/master/js/src/cont... Where "master" is the branch which normally has the latest code. And #L216 automatically scrolls down to the 216th line. The issue is that line isn't permanent since the code in the master branch is subject to change. So in order to make a reliable link, you can link to the r…

BTW, how does y shortcut works? With what is bonded? What effects brings on other sites?

It's only for GitHub. GitHub has custom JavaScript on their site that listens to every key press. If they detect you pressed 'y', they look up the commit hash of the version of the code you are looking at and then set the page URL to a page that shows the code for that version.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#703

Post by h1d »

federicobond wrote: post #623
joncampbelldev wrote: post #460

Earlier quoted context omitted.

they are excellent observations, but it seems pretty clear the team would be unable to implement them properly this late in the game, or worse unable to understand why they are a good idea.

Most of these observations are well-known to the Solidity devs. I know because I participate in many of the conversations around it. While it's not easy to evolve a language (the API surface is pretty wide compared to many other programs), Solidity is indeed changing and improving regularly, only limited by the available time of their contributors.

I thought they had enough funding to hire just about anyone.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#704

Post by h1d »

alper wrote: post #506
int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

I am amazed/not amazed that they write financial applications in this language (and do not have the common sense to not do it).

Everything about the blockchain is a test now, it's just the investors who mindlessly invest hoping for a quick 5x is making it bigger than they should be.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#705

Post by goldfeld »

lomnakkus wrote: post #238
dvcc wrote: post #34

Earlier quoted context omitted.

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

It's a good indicator that these people may be experts in one area, but not necessarily in others. Language design is actually notoriously difficult in general[1], but if you're doing language design for a security-critical language[2]... well, that requires actual mechanized proof , IMO. Not just proof of "design", but proof of the implementation. Anything else is a huge gamble. (And I'm sure there are some 'investo…

Experts in what area? Not in programming, to think exposing functionality by default is a good design concept.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#706

Post by drcode »

runeks wrote: post #504
ericb wrote: post #276

As Charlie Lee said: If the creator of Solidity, Gavin Wood, cannot write a secure multisig wallet in Solidity, pretty much confirms Ethereum is hacker paradise. https://twitter.com/SatoshiLite/status/887781929726038016

I'm confused. Did Gavin Wood write the code for the Parity wallet, forgetting that he had created a language where function visibility defaults to "public"?

Charlie Lee is wrong: The bug was introduced by another, less experienced, developer submitting a commit to the repo (though of course Gavin Wood arguably still bears some responsibility as leader on the parity project)

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#707

Post by netsharc »

honestoHeminway wrote: post #489
sum627u wrote: post #423

Earlier quoted context omitted.

There's essentially no legitimate use case for crypto-currency. Cypherpunks have been at it for decades and all they have to show for it is drugs, ponzis, assassination markets, and conspiracy theories. It would be nice to see some sort of casual hawala-type federated micropayments system based on real national currency, with instant settlement, low fees, and no fake money value store. But, that would be a pre-9/11 i…

Sorry, but have you looked on the democracy and justice-culture index maps worldwide? The democratic, end-of-history, justice-seperatly-delivered state is currently in full retreat. I agree, the futurists got it the wrong way around, assuming something cyper-punk-currency enough would blow the state away and allow for crypto-anarchy to rule. Instead, we got states that on slight economic decline implode on themselves…

When my work introduced me to the guy that explains to us how the retirement fund works, I asked him if the Euro is safe (this was 2011-12), and what the safest investment is. He said "the safest investment is to buy a farm and grow your own food, because you can't eat money or gold.".

And in this Somalia 2.0 future of yours, how will the computers and networks be powered?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#708

Post by mifeng »

pmarreck wrote: post #649
mifeng wrote: post #641

Earlier quoted context omitted.

Unit tests do help, and they are relatively easy in Truffle, the most used JS framework for Solidity. I guess I need to move to more of a TDD style than I'm used to.

I cannot say enough good things about TDD, but YMMV. I also don't stick to it always... it's just that when I take the time to, my code clearly ends up better. I would imagine it's even MORE beneficial in code that deals with a money...

I find it hard to write tests when I'm still formulating the logic of how a problem should be solved. For money-based logic in Solidity, I now like to model it in MS Excel first, write code afterwards, and then finally tests.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#709

Post by phreeza »

int_19h wrote: post #448

Just skimming through the Solidity docs, I see a lot of unwise decisions there aside from the weird visibility defaults. All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default. Both are overridable by explicit specifiers, much like C++ "const", but you have to remember to do so. Even then, the current implementation doesn't enforce this for fun…

How bound are people to using Solidity? How hard would it be to come up with a competing, more verifiable langauge specification? I don't know much about Ethereum, but I assume the Solidity gets compiled to some sort of bytecode to run on the VM?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#710

Post by taspeotis »

stupidcar wrote: post #336
taspeotis wrote: post #111

Earlier quoted context omitted.

Matt Levine has some thoughts [1] on that matter. [1] https://www.bloomberg.com/view/articles/2016-06-17/blockchai...

That dude's read a lot of DFW.

There's a little bit more information here [1].

[1] https://www.reddit.com/r/badeconomics/comments/6cnzs8/matt_l...

Post reply on HN