Re:Ethereum Contracts Are Going to Be Candy for Hackers
by voidlogic on Wednesday May 18, 2016 @07:33PM
(#11726886)
>Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0.
"will be effectively error-free" != "probably as good as the Linux kernel", not even close :D
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by aab0 on Wednesday May 18, 2016 @07:59PM
(#11726998)
The security history of the JVM suggests that one shouldn't be optimistic there either.
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by rtpg on Wednesday May 18, 2016 @09:51PM
(#11727388)
counterpoint: I haven't really heard of any "javascript escaping the container" bugs in a really long time (excepting node.js-related issues)
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by TheDong on Thursday May 19, 2016 @01:37AM
(#11728233)
Funny, most pwn2owns there are multiple successful escapes of any of a number of js sandboxes. I hear about it at least yearly, if not more often.
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by astrodust on Thursday May 19, 2016 @12:44AM
(#11728033)
JavaScript has several mature, thoroughly scrutinized implementations. Ethereum has one brand new implementation.
To put it mildly: There will be blood.
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by danfinlay on Thursday May 19, 2016 @03:28AM
(#11728618)
There are actually eight different implementations at this time, although the go client has a slight majority of users according to ethstats.net
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by andrewflnr on Thursday May 19, 2016 @02:00AM
(#11728317)
There are at least two ethereum implementations, the main one and one in Rust.
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by ChristianBundy on Wednesday May 18, 2016 @10:12PM
(#11727467)
JavaScript doesn't run on the JVM.
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by cloudjacker on Thursday May 19, 2016 @01:46AM
(#11728270)
thanks for saying this, sometimes I'm like "wow" on hackernews comments, because you kind of assume people know what they're talking about but then its like not really.
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by rtpg on Thursday May 19, 2016 @03:43AM
(#11728674)
I know that Javascript isn't run in the JVM, my point was that it's possible to write a virtual machine that doesn't get exploited every 5 minutes.
the JVM is a bit special because there are a large amount of escape hatches, native code and a complex trust model, which has caused a lot of the exploits you end up seeing.
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by Chris2048 on Thursday May 19, 2016 @06:02AM
(#11729081)
But. JS was designed with this in mind, and has been tested for it for years. It's actually one of the greatest strengths of JS, but I imagine it was a lot of work (except, perhaps, maybe functional languages).
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by eru on Sunday May 22, 2016 @09:05PM
(#11751099)
The linux kernel is and has been pretty buggy, especially by cryptographic standards.
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by geographomics on Wednesday May 18, 2016 @07:59PM
(#11727000)
Hopefully a lot better than the Linux kernel: http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html...
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by dmix on Wednesday May 18, 2016 @08:15PM
(#11727063)
Linus doesn't view security bugs as a special category of bugs. So he doesn't prioritize them they way most infosec people would like them to. The lack of a strong security advocate in their leadership is largely the reason why Linux isn't the best example.
The other big reason being that it's a giant blob of C and a large attack surface.
All of these factors could be easily avoided or simply don't exist for an Ethereum contract developer.
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by anonbanker on Friday May 20, 2016 @10:47PM
(#11742955)
don't forget the fact that he was approached by the NSA to insert backdoors into linux, a fact his father testified to on the record before EU parliament[0].
0. http://falkvinge.net/2013/11/17/nsa-asked-linus-torvalds-to-...
Re:Ethereum Contracts Are Going to Be Candy for Hackers
by easytiger on Thursday May 19, 2016 @06:52AM
(#11729246)
> effectively error-free - probably as good as the Linux kernel
I encounter major glaring issues as well as continual regressions in the linux kernel on weekly basis. I don't even know what you mean by as correct as the linux kernel
Your fear seems to stem from misunderstanding how Ethereum works or what it even is.
Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or complex as you like. If you're afraid of bugs, don't put money into any complex smart contracts. If there's a lot of money involved, then spend some money/time reviewing the smart contract.
Also, contracts can set precedent once they are in the ecosystem. If a contract has been heavily used prior to your desire to use it, you can copy it, and be relatively confident that it will be secure for you to use.