News for hackers. Stuff that matters.
Re:153k Ether Stolen in Parity Multi-Sig Attack by kbenson on Wednesday July 19, 2017 @06:47PM (#14808671)
I think a big part of the complaint is about the implicit assumption that because people are smart, and have experience with cryptography, they necessarily have the experience to design a sane and safe programming language given their goals.

They did put themselves way out there, and that takes ambition, but also hubris. I wish they were able to figure out which one was driving them at certain points a bit better, as while some of these problems are because they are doing new and interesting things, some are old as dirt for computing, and there's little defense.

If some company tried to tout a new language with all the pitfalls of C, but none of the benefits of being really inter-operable and known the same way, I'd like to think we could recognize that as having some very bad design choices given what we've learned from C, and at little benefit other than being different. Ignoring decades of research and experience on the topic through ignorance is not laudable, even if you've put yourself out there. I can't help but feel we have a similar scenario going on here.

Re:153k Ether Stolen in Parity Multi-Sig Attack by davidgerard on Wednesday July 19, 2017 @07:08PM (#14808781)
Actually, I think Solidity being designed to turn bad node.js coders into bad smart contract coders was key to Ethereum's success.

I've written a book on this (hit upload five minutes ago! release Monday!) which hammers on this point (and all the stuff surrounding this issue). I think Solidity is actually designed with worse is better in mind, because Ethereum is the first smart contract platform that anyone actually used. Some tried doing them in Bitcoin, but Ethereum's the first that gets lots of action. And so many other blockchains lift the smart contract functionality straight from Ethereum.

Re:153k Ether Stolen in Parity Multi-Sig Attack by kbenson on Wednesday July 19, 2017 @07:22PM (#14808859)
That may be, but if so, it might be worse. What's worse, not getting a lot of uptake for this idea that's been hard going for others, or getting the uptake because of trade-offs you made that make it a ticking time-bomb that may damage the reputation of the idea for years to come and set it back?
Re:153k Ether Stolen in Parity Multi-Sig Attack by dahdum on Wednesday July 19, 2017 @09:05PM (#14809318)
Solidity is like PHP in the 90's, easy to learn and easy to screw up. Though Solidity just compiles to the EVM, and there is no reason new, safer languages can't be built on top.

As far as I can remember, the EVM has never failed, just programmers.

Re:153k Ether Stolen in Parity Multi-Sig Attack by kbenson on Wednesday July 19, 2017 @09:38PM (#14809435)
That comparison may be apt. PHP at that time was a mix of some good ideas (ease of deployment) with some horrible ones (register globals on by default is unexcusable), and some poor planning. We all lived with the fallout of that for a very long time.

The register globals issue could have been avoided at very little cost, if any cost at all, to the popularity and spread of the language and many millions of dollars and much personal information would have been saved.

Re:153k Ether Stolen in Parity Multi-Sig Attack by shp0ngle on Thursday July 20, 2017 @06:39AM (#14811304)
I disagree, Solidity is really not easy to learn. It is easy to screw up, though.
Re:153k Ether Stolen in Parity Multi-Sig Attack by flashmob on Wednesday July 19, 2017 @08:31PM (#14809175)
You've wet my appetite. Got a link to your book?
Re:153k Ether Stolen in Parity Multi-Sig Attack by ucarion on Wednesday July 19, 2017 @08:47PM (#14809246)
Pedantry: you mean whet, not wet. To "whet" means to excite, stimulate.
Re:153k Ether Stolen in Parity Multi-Sig Attack by throwanem on Wednesday July 19, 2017 @10:18PM (#14809595)
Literally, to sharpen, as in "whetstone".
Re:153k Ether Stolen in Parity Multi-Sig Attack by sah2ed on Thursday July 20, 2017 @07:49AM (#14811599)
This should save anyone else a few clicks: https://www.amazon.com/dp/B073CPP581
Re:153k Ether Stolen in Parity Multi-Sig Attack by rainboiboi on Wednesday July 19, 2017 @09:29PM (#14809405)
Check out his profile.
Re:153k Ether Stolen in Parity Multi-Sig Attack by flashmob on Thursday July 20, 2017 @07:40PM (#14817102)
Thanks. Glad I checked the profile.
[dead]
Re:153k Ether Stolen in Parity Multi-Sig Attack by skj on Wednesday July 19, 2017 @07:59PM (#14809036)
I don't think your personal attacks lie within the standards set by this community. There are many ways of disagreeing, even vigorously, without being a jackass. It's discrediting to yourself.
Re:153k Ether Stolen in Parity Multi-Sig Attack by davidgerard on Wednesday July 19, 2017 @07:57PM (#14809027)
You appear to have misconstrued my words. I don't in any way think this is a good idea; just one that has the viral characteristics of "worse is better".

I spent about three thousand words on the smart contracts chapter, attempting to conclusively stab this bad idea in the face and supply a suitable rhetorical ammo dump for anyone faced with having to deal with these things to kill the idea stone dead. Absolutely everything about smart contracts is terrible and misconceived. I don't believe there is any way to do them right, because the idea is fundamentally wrong.

Here's (an older draft, need to update) what I actually say about Solidity and Ethereum smart contracts: https://davidgerard.co.uk/blockchain/ethereum-smart-contract...

Re:153k Ether Stolen in Parity Multi-Sig Attack by yourapostasy on Thursday July 20, 2017 @03:17AM (#14810588)
Are you asserting Szabo's original smart contracts idea "is terrible and misconceived", or Ethereum's implementation "is terrible and misconceived". The latter, I would have to agree; hard forking as a response to these kinds of security holes is neither sustainable nor scalable, and I'm very partial to mechanical proof-based designs and implementations as a result.
Re:153k Ether Stolen in Parity Multi-Sig Attack by davidgerard on Thursday July 20, 2017 @03:59AM (#14810753)
Szabo's idea was a hypothetical for two decades. Ethereum is the first smart contracts platform people actually write for. There were attempts to do it previously, but Ethereum is the one that actually took off.

So if you're talking about Ethereum as a bad implementation of a good idea, you're weighing up reality against something that was a hypothetical from 1994 to 2014.

In any case, there's plenty really obviously wrong with the idea of immutable smart contracts. Legal code is a bad match for computer code; immutability means changes in circumstances can't be allowed for; immutability means you must code with zero bugs; the oracle problem (getting real-world data in and out of your smart contract) ...

"Dr. Strangelove" is the story of a smart contract going wrong, unstoppably, immune to human intervention.

Szabo's stuff is better than the reality - he does actually understand law as well as code, and at least early on he considered there was a role for human intervention - but it's still the sort of thing that's "interesting" rather than "a good idea".