Professional security audits of The DAO's smart contract code never caught this bug. This conclusively shows it's impossible for a mere mortal developer (or even a team of seasoned security professionals) to write smart contracts that behave in predictable ways. As an outsider, I will never use Ethereum for this reason.

The EVM may be reliable, but the humans that use it are completely unreliable, and it's the humans that form the foundation of any distributed system.

It doesn't seem that rational to stop using Ethereum simply because a single smart contract contained a bug. It's a new project so there's bound to be bugs here and there. Of course, maybe your position is that you will never use any Ethereum-like software, which might become impractical in the future.

It's almost like you didn't read the comment. They had experts review their code, and they didn't catch the bug. They had huge public interest, and nobody caught the bug. So the chances are, unless big, breaking changes to the platform are made, the vast majority of contracts that will ever be written will be buggy.

But wasn't the smart contract system the selling point for the novelty of Ethereum? If it doesn't work reliably, why should we use it over the more mature and stable Bitcoin?

It works reliably, insofar as you are fully able to write and execute a desired contract, but also able to write a contract that shoots you in the foot.

Like a certain programming language's features, it may happen to be easier than not.

That's a strange way to design a financial contract system. I mean, just like Rust checks for memory safety at compile time, can't the contract language make similar checks? Or perhaps the contracts can run in a simulator first?

Yes, you can write a contract language (or improve an existing one) which contains static checks. That hasn't been implemented yet probably because of lack of resources. The higher level contract language is compiled down to byte code.

You can in addition implement these safety checks to be executed during runtime, but that costs money.

It's not a financial contract system. It's a decentralized general purpose computing platform. It can be used for financial contracts.

My understanding is that the bug was in a particular contract written using the Ethereum contract "language", not Ethereum itself. E.g., one does not stop using Python because there's a bug in Quora

The people who screwed up the DAO smart contract can't fix the problem from within the DAO, and they want to change the rules of Etherium to fix the DAO's problem. The fact that the same people are behind Etherium, the DAO, and the programmable door-lock startup makes this possible. It also makes it suspicious. In the Bitcoin world, all too often we've seen an "outside hack" that turned out to be insiders.

>and the programmable door-lock startup

The door lock company is the funniest part of the whole thing. It makes this meltdown so much less surprising tbh.

Oh god, its some random IoT company that is using the blockchain to run its IoT platform for no reason, and then decided to pivot into a decentralized investment fund.

It's all the same guy, Vitalik Buterin. He's behind Etherium, the DAO, and the door lock company, "Slock.it UG".

Whats up with the door lock thing? I haven't heard about that.

Probably refers to this: http://www.ibtimes.co.uk/ethereum-based-slock-reveals-first-...

Somewhat related: the lock in my apartment is actually based on cryptography too. It uses SHA-1, which is somewhat scary, because it's not considered "safe" anymore. The algorithm was probably chosen because it uses less energy compared to safer ones, as the lock gets the energy from the turning of the key.

Sha-1 is only unsafe if an attacker can get a copy of the hashed password