News for hackers. Stuff that matters.
Re:Status – A Mobile Ethereum OS by Aaron1011 on Thursday April 20, 2017 @10:04PM (#14162587)
> Letting the hacker walk away with millions at that point would have been silly.

The issue is, the person wasn't a 'hacker' in any meaningful sense of the word.

Etherium claims to be "a decentralized platform that runs smart contracts: applications that run exactly as programmed without any possibility of downtime, censorship, fraud or third party interference" (from etherium.org). That is, an Etherium program doesn't implement a written contract, it is the contract.

Despite this lofty goal, the core team saw fit to hard-fork the chain because they didn't like how a particular program was executing. The claim that the 'hacker' had 'stolen' funds from theDAO is ridiculous - you can only steal what doesn't belong to you, and ownership of theDAO's Ether is defined by the program itself!

More broadly, the hard-fork seems to imply that an Etherium contract is really made up of two contracts. One contract is the program itself, which explicitly spells out what is and not allowed. The other contract is an implicit understanding of what the program 'should' do, and exists only in the minds of the creators of the contract. The issue arises when this implicit 'contract' is used to override the real contract - flying in the face of how Etherium claims to work.

A much better solution would have been to try to address the underlying issues in Solidity - perhaps requiring future contracts to explicitly allow recursion? I personally question the decision to use a Turing-complete language to express contracts in the first place.

Re:Status – A Mobile Ethereum OS by RexetBlell on Friday April 21, 2017 @12:02AM (#14163018)
Turing-complete language is just the base layer. You could build more limited languages (decidable languages) on top, which are more appropriate for smart contracts.

There is a new decidable language that compiles to EVM bytecode: https://github.com/ethereum/viper Visually it looks similar to Python. The language is not turing complete, and one of the advantages of this is it's easier write bug free code and easier to verify that the code is doing what you think it's doing.

The reason why the entire EVM is turing complete (and not more limited) is because making it decidable instead is harder than making it Turing complete and would have made the protocol more complex: https://github.com/ethereum/wiki/wiki/White-Paper#computatio...

A Turing-complete language is base layer: you can build any paradigm you want on top.

Re:Status – A Mobile Ethereum OS by Aaron1011 on Friday April 21, 2017 @02:10PM (#14167840)
Thanks! I had mistakenly thought that Solidity was still the only way to write Etherium programs (other than directly using the bytecode).
Re:Status – A Mobile Ethereum OS by DennisP on Friday April 21, 2017 @11:14AM (#14166277)
If the hacker really thought he hadn't committed theft, he could have revealed his identity and sued the developers. My guess is he would have ended up in prison that way.

Since the hack, various small improvements have been made to Solidity, the Foundation hired someone to work full-time on formal verification, there's the new Viper language which is easier to verify, and the community has gotten a lot more serious about coding standards and security audits.

Re:Status – A Mobile Ethereum OS by Aaron1011 on Friday April 21, 2017 @02:04PM (#14167793)
> he could have revealed his identity and sued the developers

TheDAO very explicitly states that you can't do this: "Your use of the Software does not, in and of itself, create a legally binding contract in any jurisdiction and does not establish a lawyer-client relationship. Your communication with a non-lawyer will not be subject to the attorney-client privilege and (depending on your jurisdiction) may not be entitled to protection as confidential communication."

Honestly, though, I have absolutely no idea what would happen in a legal case involving 'smart contracts', as I don't think there's any precedent involving treating computer programs as contracts.

Re:Status – A Mobile Ethereum OS by davidgerard on Sunday April 30, 2017 @03:13PM (#14233302)
> TheDAO very explicitly states that you can't do this

It turns out the code of a smart contract doesn't override the legal system.

Re:Status – A Mobile Ethereum OS by dragonwriter on Sunday April 30, 2017 @03:28PM (#14233374)
> Honestly, though, I have absolutely no idea what would happen in a legal case involving 'smart contracts', as I don't think there's any precedent involving treating computer programs as contracts.

Smart contracts aren't legal contracts, though they may be evidence of the existence and content of one.

Of course, strictly speaking that's true of the written documentation of a contract, too.

Re:Status – A Mobile Ethereum OS by DennisP on Saturday April 22, 2017 @11:37AM (#14173009)
That quote doesn't seem like good news for the hacker, since it seems to say the contract code is not a legally binding contract (and therefore doesn't govern legal ownership).

It would be an interesting case, for sure.