Re:A hacker stole $31M of Ether – how it happened, and what ...
by pdkl95 on Friday July 21, 2017 @02:47AM
(#14818555)
> the model of 'public by default, opt in for security' is fundamentally daft in this context.
It's daft in most contexts, and is one of the largest sources of security problems. If your design requires enumerating badness[1], you're doing it wrong.
>> Just about every ICO, trust and company used the Parity multisig wallet, and that code was considered well-tested.
-sigh- This is, unfortunately, a common problem. "It worked ok the last N times" and "It passed a lot of tests" do not mean it's bug-free and safe to use. Richard Feynman was right during the Challenger investigation when he called this a childish attitude. (He was also right in not wanting to assign blame, instead asking "How do we educate the child?"[2])
It's daft in most contexts, and is one of the largest sources of security problems. If your design requires enumerating badness[1], you're doing it wrong.
> from: http://hackingdistributed.com/2017/07/20/parity-wallet-not-a...
>> Just about every ICO, trust and company used the Parity multisig wallet, and that code was considered well-tested.
-sigh- This is, unfortunately, a common problem. "It worked ok the last N times" and "It passed a lot of tests" do not mean it's bug-free and safe to use. Richard Feynman was right during the Challenger investigation when he called this a childish attitude. (He was also right in not wanting to assign blame, instead asking "How do we educate the child?"[2])
[1] http://www.ranum.com/security/computer_security/editorials/d...
[2] https://www.youtube.com/watch?v=4kpDg7MjHps#t=150