Live data from Hacker News

White hat hacker awarded $2M for fixing ETH-creation bug

cryptoadventure.com

91–100 of 354 posts

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#92

Earlier quoted context omitted.

Do you think that a bank or a government would've handled fixing such a flaw as well has optimism did? All tokenization schemes are ponzi scams including USD, it's just that some use violence to stay relevant, and other use bug bounties.

I have no problem with white hat hackers, I'm saying more power to them in the broken web3 space, which that is a complete scam. However, I can use USD, GBP or any fiat currency in my local grocery store. Can I use Bitcoin, Shib, Doge, or even Orchid at my grocery store without waiting hours in the queue for the transaction to complete and no huge fees?

Not yet, but I don't think that we're too far away from using USD, GBP or any fiat currency as a unit of account at the POS and letting software handle ensuring that the buyer loses whatever assets they want to pay in and the seller receives whatever assets they want to be paid in.

But that's orthogonal to how quickly the maintainers of these tokens can make changes in response to threats.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#93

Earlier quoted context omitted.

Please read this thread to see the pitfalls that might potentially lie ahead: https://www.reddit.com/r/AskReddit/comments/24vo34/comment/c... It's about winning the lottery but still applicable to some extent, and shows how people's lives go horribly wrong.

Not sure it's actually applicable. That Reddit comment is about poor people winning lots of money by chance, not smart people earning lots of money by working. The risks are very different, not to say that the scale between 2 million and 170 million is way bigger than you seem to think.

Poor people aren’t stupid

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#94
post #30
post #12

Earlier quoted context omitted.

We have atomic swaps to monero now, cleaning your stolen eth is easier than ever.

How are you going to turn that into actual goods and services though? You'll still need to go through an exchange with KYC and AML and the IRS will still be asking questions.

Swap to monero, buy an NFT from yourself, convert to fiat, pay taxes. Now your money is clean, taxed, and you have an explanation for where it came from.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#95

This just proves how insecure the blockchain / web3 / cryptocurrency space is. It's good to see white hat hackers in this space trying to fix what is already broken. But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid.

Tell me you don't know what DeFi is without telling me you don't know what DeFi is.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#96

Earlier quoted context omitted.

Please read this thread to see the pitfalls that might potentially lie ahead: https://www.reddit.com/r/AskReddit/comments/24vo34/comment/c... It's about winning the lottery but still applicable to some extent, and shows how people's lives go horribly wrong.

Not sure it's actually applicable. That Reddit comment is about poor people winning lots of money by chance, not smart people earning lots of money by working. The risks are very different, not to say that the scale between 2 million and 170 million is way bigger than you seem to think.

I did say that it's applicable to some extent and I'd bet that extent is more than you think!

There are plenty of horror stories that are below $10 million.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#97
post #79

Earlier quoted context omitted.

Not on capital gains. At least in the US that’s only taxed at 15% with no tiering. The deck is stacked for the investment class

Even long term capital gain for “the investment class” is more like 20%. This is not even a capital gain - this is straight income at 35+

LTCG tax for the rich is more like 23.8%, when you include the net investment income tax of 3.8% (which I had two financial advisors miss).

Plus state income taxes.

https://www.schwab.com/taxes/net-investment-income-taxes

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#98

This just proves how insecure the blockchain / web3 / cryptocurrency space is. It's good to see white hat hackers in this space trying to fix what is already broken. But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid.

>But sorry to be that person, just a timely reminder of the truth: All cryptocurrencies and 'DeFi projects' are ponzi scams including Orchid. Seems like just an opinion to me, and a poorly opinionated one at that.

Can you name any examples of cryptocurrencies being used that are not scams, ponzi schemes or for speculative purposes?

All I see are people holding coins and not using them at all for anything else other than 'I want coin to go up'.

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#99
post #21
post #17

Earlier quoted context omitted.

Your postmortem page throws a "Error code: SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM" in Firefox under Fedora.

Hah! When I added SSL to my site a few days ago, I really cranked those settings hard trying to optimize for "security" on the Qualy's SSL Server Test. Do you know what the most secure cipher suite you actually support is (and are you sure the issue isn't that you aren't merely using a particularly-out-of-date copy of Firefox)?

I can confirm this issue. It’s related to Fedora’s crypto-policies which are more restrictive than Firefox. In this case it seems to be caused by the SHA1 DigiCert root in your cert chain, not by your nginx settings.

Edit to add: It’s possible to run update-crypto-policies --set=DEFAULT:SHA1 and avoid enabling the whole LEGACY policy

Re: White hat hacker awarded $2M for fixing ETH-creation bug

#100
post #16

Earlier quoted context omitted.

Congratulations. I'm not sure if this was discussed in the previous thread, but does the bug allow the creation of real ETH coins, or it just increase the counter in the Optimism database (or whatever system they are using)?

Optimism is a blockchain quite a bit like Ethereum, so the "database" mental model might be a bit confusing for a frame here (as it isn't like they are some centralized service), but no: this doesn't let you directly create ETH (which would be much much more devastating); it only lets you create something we might call "OETH", which is Optimism-specific. The native currency on Optimism (used to pay gas, like ETH is u…

But you could drain out all the ETH in the Optimism reserve by asking to withdraw, since you've fooled the network into thinking you own an arbitrary amount of OETH? Which would keep working until the main L1 Eth network rejects transactions for transferring ETH it doesn't have?
Post reply on HN