Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ethereum Contracts Are Going to Be Candy for Hackers

vessenes.com

Post reply on HN
Print view View original

81–85 of 85 posts

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#81

Post by colm__colm »

voidlogic wrote: post #26
fragsworth wrote: post #21

Earlier quoted context omitted.

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fear seems to stem from misunderstanding how Ethereum works or what it even is. Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or comple…

>Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. "will be effectively error-free" != "probably as good as the Linux kernel", not even close :D

The ethereum VM does not offer allow of functionality. You cant read or write to hard disk. You cant access the Network card. There for the attack surface is much smaller then Linux. It will probably be better than the Linux Kernel due to this.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#82

Post by colm__colm »

joosters wrote: post #41

The much-hyped 'DAO' that has crowd-funded over $100 million dollars worth of ether, is based upon one of the largest contract code seen so far. Even if it has been code reviewed, it's almost certain that bugs remain in there. All it takes is one hacker to find a flaw and $100 million will be gone in an instant

"is based upon one of the largest contract code seen so far" less than 2000 LOC.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#83

Post by colm__colm »

joosters wrote: post #41

The much-hyped 'DAO' that has crowd-funded over $100 million dollars worth of ether, is based upon one of the largest contract code seen so far. Even if it has been code reviewed, it's almost certain that bugs remain in there. All it takes is one hacker to find a flaw and $100 million will be gone in an instant

One bug does not mean disaster there is a function to update to a new contract. Also its unlikely that a major bug remains. Due to testing and review. I cant see how a serious bug can get past so many people and hide in less than 2000 Lines of code.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#84

Post by eru »

voidlogic wrote: post #26
fragsworth wrote: post #21

Earlier quoted context omitted.

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fear seems to stem from misunderstanding how Ethereum works or what it even is. Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or comple…

>Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. "will be effectively error-free" != "probably as good as the Linux kernel", not even close :D

The linux kernel is and has been pretty buggy, especially by cryptographic standards.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#85

Post by SkyMarshal »

eggy wrote: post #73
c2340596 wrote: post #69

Earlier quoted context omitted.

"it is easy to troubleshoot due to the interactive nature" isn't going to cut it. You cannot change the code of an etherum contract after the fact. Once it's used there is no second chance.

Thanks for bringing it back to the OP's topic, but I was specifically addressing the quote the OP made about number of errors per LOC tally. I was pointing out how it could be weak metric, since the languages used in the examples might contain many LOC of template boilerplate that would make for a low bug:LOC off the bat. An ADA hello world is 5 LOC vs. 1 for a lot of other languages. Java is not too different. J and…

I'm ok with boilerplate when it buys you something useful, like readability, explicitness, and security, as in Ada.
Post reply on HN