81–90 of 440 posts
Is it possible to track where the money goes from the hackers account onwards? Or is then opaque? How easy will it be for the hacker to move the funds around so it cannot be traced back to the theft?
I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…
Your reasoning is flawed. Once a contract is developed that proves to be secure, it can be used over and over at no additional cost.
Doesn't seem to quite work like that in real life.
I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…
The Ethereum developers create Solidity with the goal to make it "super easy" for developers to create dapps. Security wasn't the #1 priority. And now the ecosystem will pay for that design decision. Whether the decision still ends up being a net positive in the long term, it remains to be seen.
However, keep in mind that Ethereum as a platform is still in its very early days, with not even 0.01% of the population using it. If $30 million can be stolen just like that, what happens when 10% of the population uses it and there are trillions of dollars invested in it? (assuming it will be the "next internet" or whatever)
Earlier quoted context omitted.
> This isn't a normal loss by the way, where you can prosecute someone or sue somebody. No, this is the instant, digital theft of the entire value of the contract, to an anonymous digital address where it will be quickly blended in with hundreds of millions of dollars of similar thefts a month. Also worth pointing out that a non-trivial number of people would say that no theft at all has occurred, as the smart contra…
That's a fascinating point. Can any lawyers comment on how the law might see this?
Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established. Our community cannot continue operating in the hacker mode wherever money is involved.
I think you're vastly underestimating the number of deadly mistakes doctors and lawyers and other such licensed professionals make every day. Just look at Enron! Maybe such a system would keep out the very worst programmers but I doubt someone hacking on Ethereum smart contracts falls into that bucket anyways.
What exactly are you arguing for here? Obviously, humans are imperfect and corrupt - but you can impose some order and ethics and error correction into any community when you get organized.
OP said one of the creators of Etherium was responsible for the bug, how much more 'expert' can you get? The problem is one of programmer craft, or the lack thereof.
I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…
Earlier quoted context omitted.
That just makes the price of a "programmer" go up. And the normal people responsible for putting together said requirements know that in the end it would just make their IT costs go up, so therefore they don't (which is fine with me)
Darn right, it's costly! But how else will we rope in foolish devs from doing foolish things like eval() in the context of a user's wallet except by policing our community? You can expect businesses to do it...
I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…
I grant your point, but disagree with your framing of the problem. I think a good analogy here is to compare to American settlers. You're going to have a few waves: the explorers who move into totally uncharted territory and take on significant risk by using smart contracts. These are kinda crazy people who love the innovation, and I'd argue this is the majority of people in the space right now. Eventually there will…
For example, stock option agreements are usually pretty straightforward... until a termination date has to be decided on. How does the termination get put into the contract?
Though I suppose smart contracts could exist as an automation mechansim , but there's a "wrapper contract" that provides "real deal" legal protection against abuse?
Earlier quoted context omitted.
Your reasoning is flawed. Once a contract is developed that proves to be secure, it can be used over and over at no additional cost.
Once code is developed that proves to be bug free, it can be used over and over with no bugs! Doesn't seem to quite work like that in real life.
I mean some of these things have bugs still, but generally when you have something of fixed scope then there are less bugs over time. Especially if you're restricting your scope to something simple
I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…
Is formal verification of contracts feasible? Is anyone working on it? Also, here's a possibly crazy idea: could one create bug bounties for algorithms (or even arbitrary software) on the Ethereum blockchain by writing the algorithm into a contract such that if you somehow break it you receive the bounty? An example of this would be the massive implicit bounty currently placed on the crypto algorithms (SHA256, ECDSA/…
There are already useful tools for symbolic execution, and I have a hunch that this kind of verification will be important along with model checking.