Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zerocoin implementation bug

zcoin.io

Post reply on HN
Print view View original

81–90 of 142 posts

Re: Zerocoin implementation bug

#81

Post by nickodell »

X86BSD wrote: post #22
wmf wrote: post #2

What's better that stealing magic Internet money? Creating anonymous magic Internet money out of thin air, then selling it. Brilliant. But seriously, I'm not sure which is worse: Watching your stolen money move around the blockchain knowing you are helpless to do anything about it, or being provably unable to even tell the difference between "real" and "counterfeit" coins.

That's NO different than what the "Federal reserve" does. Creates paper money out of thin air.

I mean, at least they do it on purpose.

Re: Zerocoin implementation bug

#82

Post by dwaltrip »

obstinate wrote: post #73
wyager wrote: post #40

Earlier quoted context omitted.

> regulatory enforcement The only place regulatory enforcement could hit Bitcoin is at the fiat exchanges, which are already beholden to KYC/AML. > social stigmatization People have already tried that; "Bitcoin is only for illegal drugs and guns!" Didn't work.

It didn't?

Have you checked the charts? Usage and price are essentially at all time highs, and are creeping higher.

Re: Zerocoin implementation bug

#83

Post by dwaltrip »

matt4077 wrote: post #49
X86BSD wrote: post #22

Earlier quoted context omitted.

That's NO different than what the "Federal reserve" does. Creates paper money out of thin air.

Considering programmers almost exclusively deal in abstract ideas, and even their manifestation is in the realm invisible to the naked eye, it's surprising how hard it appears for many to grasp concepts such as "law", "culture", or "trust". So here we have a bunch crypto-anarchists with their usual "fiat is fiction"-spiel. Let me ask you to put your worthless paper money[0] where your mind is: I have drawn this wonde…

I think it's because it's difficult for even programmers to deeply grasp the slippery nature of the small scale abstractions we use in software projects. This is why design patterns are so easily misused. It's tricky stuff.

The large scale, society-level abstractions and shared fictions, such as money, are a whole different beast.

Re: Zerocoin implementation bug

#84

Post by ballenf »

ianmiers wrote: post #67

what went wrong: TLDR probably Ctrl-C,Ctrl-V. (Just to be clear, this is about Zcoin, not Zcash/Zerocash. The two are completely different) The fix is here. https://github.com/zcoinofficial/zcoin/commit/33796c839f7d4d... What happened? First, some stylized facts about ZCoin: 0) ZCoin is a fork of Bitcoin that uses a 4 year old academic research library, libzerocoin, to make anonymous payments using the Zerocoin proto…

Any idea why they would describe the code error as "a single additional character in code"? It looks like about 10 characters or so based on your link. There are also some other code changes associated with that commit

Re: Zerocoin implementation bug

#85

Post by ianmiers »

ballenf wrote: post #84
ianmiers wrote: post #67

what went wrong: TLDR probably Ctrl-C,Ctrl-V. (Just to be clear, this is about Zcoin, not Zcash/Zerocash. The two are completely different) The fix is here. https://github.com/zcoinofficial/zcoin/commit/33796c839f7d4d... What happened? First, some stylized facts about ZCoin: 0) ZCoin is a fork of Bitcoin that uses a 4 year old academic research library, libzerocoin, to make anonymous payments using the Zerocoin proto…

Any idea why they would describe the code error as "a single additional character in code"? It looks like about 10 characters or so based on your link. There are also some other code changes associated with that commit

I have no idea. If you can find a single character edit in the commit history, I will look at it.

But this certainly is a bug. And it would allow you to steal funds.

Re: Zerocoin implementation bug

#86

Post by taspeotis »

ballenf wrote: post #84
ianmiers wrote: post #67

what went wrong: TLDR probably Ctrl-C,Ctrl-V. (Just to be clear, this is about Zcoin, not Zcash/Zerocash. The two are completely different) The fix is here. https://github.com/zcoinofficial/zcoin/commit/33796c839f7d4d... What happened? First, some stylized facts about ZCoin: 0) ZCoin is a fork of Bitcoin that uses a 4 year old academic research library, libzerocoin, to make anonymous payments using the Zerocoin proto…

Any idea why they would describe the code error as "a single additional character in code"? It looks like about 10 characters or so based on your link. There are also some other code changes associated with that commit

I think the single character fix is this [1], GP seems to be describing [2].

[1] https://github.com/zcoinofficial/zcoin/commit/b20c177032de3c...

[2] https://github.com/zcoinofficial/zcoin/commit/33796c839f7d4d...

Re: Zerocoin implementation bug

#87

Post by matt4077 »

dwaltrip wrote: post #83
matt4077 wrote: post #49

Earlier quoted context omitted.

Considering programmers almost exclusively deal in abstract ideas, and even their manifestation is in the realm invisible to the naked eye, it's surprising how hard it appears for many to grasp concepts such as "law", "culture", or "trust". So here we have a bunch crypto-anarchists with their usual "fiat is fiction"-spiel. Let me ask you to put your worthless paper money[0] where your mind is: I have drawn this wonde…

I think it's because it's difficult for even programmers to deeply grasp the slippery nature of the small scale abstractions we use in software projects. This is why design patterns are so easily misused. It's tricky stuff. The large scale, society-level abstractions and shared fictions, such as money, are a whole different beast.

I don't think the principle of money is actually that difficult. We've all had that moment in middle school where we realised that money would be worthless if everyone stopped caring about it.

It's just that some people stopped running around wide-eyed telling others about this revelation a few days later.

I guess we did get lucky in that the object of obsession they chose wasn't the law. Please don't tell them that murder is only a crime because enough people believe it to be or they'll throw us all in blockchains.

Re: Zerocoin implementation bug

#88

Post by nickodell »

rtpg wrote: post #71
guard-of-terra wrote: post #36

Earlier quoted context omitted.

> how superior centralized systems are Tell us? Because around here, I saw a huge number of bank fraud basically unpunished. "Yes those guys duplicated your SIM and stole all your funds. Too bad for you since we're not going to even try to catch them." Centralized systems might be efficient but the rule is, they don't care about you, so it's not your problems that they're going to solve. At least I can have some fait…

wait a sec. Someone steals my credit card, and if I notice within 2 months, I can get everything back. Another advantage is that it doesn't take several hours (and huge amounts of wasted electricity) for a transaction to go through. My bank hasn't been siphoning my funds either. I wouldn't trust any cryptocurrency exchange with holding even 10% of my monthly salary. Sure, governments can get my bank records. But my b…

>And "code is law" is not really extendable across society. We have contracts, of course. But almost all contracts include a "Use common sense"-style clause, which is the whole point lawyers and judges exist in the first place.

I would characterize the development of law and contracts as something meant to protect parties from common sense. If all we needed was common sense, every contract would just say (a la Raikoth)

>In all situations, the parties will take the normatively correct action.

...and nothing else. Law is essentially shaping common sense into something predictable and useful. So, why wouldn't it be possible to take something deterministic, and shape that into something predictable and useful? It doesn't need to be perfect - it just needs to be better than what already exists.

Re: Zerocoin implementation bug

#89

Post by skolsuper »

ianmiers wrote: post #67

what went wrong: TLDR probably Ctrl-C,Ctrl-V. (Just to be clear, this is about Zcoin, not Zcash/Zerocash. The two are completely different) The fix is here. https://github.com/zcoinofficial/zcoin/commit/33796c839f7d4d... What happened? First, some stylized facts about ZCoin: 0) ZCoin is a fork of Bitcoin that uses a 4 year old academic research library, libzerocoin, to make anonymous payments using the Zerocoin proto…

Another major bug caused by copy+paste. I seem to remember a security researcher article months (years?) ago that identified this theme, showed a way to grep a codebase for likely c+p errors and found a load of bugs in real production code that had remained hidden for years. I think I landed there from HN, but my google-fu is failing me now, can anyone else remember it?

Re: Zerocoin implementation bug

#90

Post by ianmiers »

taspeotis wrote: post #86
ballenf wrote: post #84

Earlier quoted context omitted.

Any idea why they would describe the code error as "a single additional character in code"? It looks like about 10 characters or so based on your link. There are also some other code changes associated with that commit

I think the single character fix is this [1], GP seems to be describing [2]. [1] https://github.com/zcoinofficial/zcoin/commit/b20c177032de3c... [2] https://github.com/zcoinofficial/zcoin/commit/33796c839f7d4d...

That is a one character change. And it is labeled "urgent fix". So it's certainly possible.

But that change appears to do exactly what the variable name suggests setting it to zero would to : stop zcoin tx's from being included in a block.

That strongly suggests someone attempted to fix the issue by simply disabled all private transactions.

Post reply on HN