News for hackers. Stuff that matters.
Re:ZeppelinOS: tools for smart contract applications by heliumcraft on Thursday July 27, 2017 @03:53PM (#14868819)
Quite the exaggeration, this silly meme has to stop. You make it sound like writing even a hello world would have horrible vulnerabilities or something. There are thousands of perfectly safe contracts deployed, one can't take some isolated incidents and make such conclusions from such a small sample.
Re:ZeppelinOS: tools for smart contract applications by nosuchthing on Thursday July 27, 2017 @04:21PM (#14869086)

  If the creator of Solidity, Gavin Wood, cannot write a 
  secure multisig wallet in Solidity, pretty much confirms 
  Ethereum is hacker paradise. 
[1] https://t.co/WAR3eltfWl

[2] https://www.cryptocoinsnews.com/hackers-seize-32-million-in-...

Re:ZeppelinOS: tools for smart contract applications by heliumcraft on Thursday July 27, 2017 @04:37PM (#14869222)
That's tweet is factually incorrect.

Gavin Wood DID NOT write the change that caused that bug, he was not the assigned reviewer either. https://github.com/paritytech/parity/pull/3773

Re:ZeppelinOS: tools for smart contract applications by nosuchthing on Thursday July 27, 2017 @05:20PM (#14869682)
Gavin Wood is the designer of solidarity and the founder of Parity.

https://en.wikipedia.org/wiki/Solidity

http://gavwood.com/

Re:ZeppelinOS: tools for smart contract applications by yarrel on Thursday July 27, 2017 @06:17PM (#14870143)
Yes but that doesn't mean that they wrote this particular code. Authorship isn't transitive.
Re:ZeppelinOS: tools for smart contract applications by heliumcraft on Thursday July 27, 2017 @06:31PM (#14870271)
I know who Gavin Wood is. The fact is he didn't write the change the tweet claimed.
Re:ZeppelinOS: tools for smart contract applications by sillysaurus3 on Thursday July 27, 2017 @04:10PM (#14868980)
There are thousands of contracts where no vulnerabilities have been discovered yet. Mostly because there are larger targets to go after.

It's not true to say that something is secure just because it hasn't been broken yet.

I agree with your call for balance, but it's unnecessary to jump to the opposite extreme.

Re:ZeppelinOS: tools for smart contract applications by currymj on Friday July 28, 2017 @12:26AM (#14871958)
maybe not a hello world, but even very rudimentary 20 LoC contracts for, say, keeping account balances can have reentrancy vulnerabilities when written in the obvious way. so your customer could just give themselves an infinite balance.

i don't think it's impossible to write secure smart contracts but it takes quite a bit of care even for simple stuff.

there are many issues that arise because your functions might be called by an adversary who has set up the stack in an evil way.

Re:ZeppelinOS: tools for smart contract applications by edjere on Friday July 28, 2017 @10:04AM (#14874332)
Agree with this, especially with the "it takes quite a bit of care even for simple stuff", but this should not discourage developers to do so. One of the reasons to build this kind of infrastructure is to set proper standards for smart contracts development which are currently missing. As long as we are aware that we need to be careful, and we raise the quality of the code and keep on developing tools to improve development as a whole things should keep on moving forward.