News for hackers. Stuff that matters.
Re:153k Ether Stolen in Parity Multi-Sig Attack by AlexandrB on Wednesday July 19, 2017 @05:28PM (#14808126)
> The theft wasn't due to an issue in the core protocol of Ethereum

True enough, but what the parent pointed out is that this class of problems is due to a flaw in the core concept of Ethereum - which is much worse than just a flaw in the protocol.

To extend your analogy - Ethereum is like if a company advocated for building bridges using a process that made the bridge's integrity unverifiable using traditional engineering means. Some bridges may hold up, some may fail, with no clear way to identify which bridges will do what.

Re:153k Ether Stolen in Parity Multi-Sig Attack by 52-6F-62 on Wednesday July 19, 2017 @05:36PM (#14808192)
I understand your counterpoint, but I don't think it's accurate. I mean, if it isn't verifiable, then how would it at all be exploitable, and then patchable?

Even so, any product designed for the network could be tested to death on any of the available testnets. It would be foolish not to ram any project up against everything in that environment, which is why I suggest poor practice as a primary cause.

It was an oversight, to be sure, and a major one. (that's not nearly strong enough language, but I want to be civil)

Re:153k Ether Stolen in Parity Multi-Sig Attack by AlexandrB on Wednesday July 19, 2017 @05:54PM (#14808333)
> I mean, if it isn't verifiable, then how would it at all be exploitable, and then patchable?

Let's assume you're right and smart contracts are verifiable. Verifiable by whom? I can assure you that my non-techie friends could not verify a smart contract themselves, so they will have to trust some authority that verifies the contract for them. The chain of trust now moves entirely into meatspace again and will be subject to the same economic and social forces as existing financial systems. So what has Ethereum accomplished other than adding an automated intermediary to transactions?

For a real-life example of what this might look like consider HTTPS. In theory SSL allows you to cryptographically verify the identity of the site you're looking at. In practice your ability to do this is still bounded by the competence of third parties like browser vendors and the integrity of CAs issuing certificates.

Re:153k Ether Stolen in Parity Multi-Sig Attack by 52-6F-62 on Wednesday July 19, 2017 @07:18PM (#14808833)
Well you've picked up on very difficult bit of semantics, and one that is probably worth its own discussion entirely.

The code is verifiable by a skilled engineer (in good faith) -- so there is a catch. Any body that produces a smart contract requires the trust of those who take part. Alternatively, it requires trust in one's own expert engineer to verify the content and functioning of a smart contract.

Where Ethereum is trustless is in the execution of the contract once verified. There is then no course for non-delivery if the code is designed this way.

So, it's trustless at one level, and requires trust at another. When I say it's semantics it's just this last point.

Personally I don't see the problems other see with that, because I don't see blockhain tech and tokens replacing everything all in one go, including the need for governing bodies and law. I don't see it as a choice between one or the other. For what it's worth, I'm closer to a socialist than the usual libertarian ranks that flock to these things. I think the world would benefit from the efficiency it could bring about, once the kinks are worked through.