This is a great point. One name for it is 'Chesterton's Fence' [0]
I deposited 100 BTC to test it out.
First thing I did was to try to withdraw negative 100 BTC.
It sent me 100 BTC, but instead of a zero balance in the exchange, it said I now had 200 BTC.
So then I withdrew a negative 200 BTC, and it sent me 200 BTC and increased my exchange balance to 400 BTC.
I contacted the owner and returned the funds and he sent me a 100 BTC bug bounty.
Was entering a negative number in a web form "hacking"? Should that be illegal?
Many hacking laws were drafted in the 80s and are exceptionally broad. What you did was almost certainly illegal hacking, as the laws define it.
Of course, whether the victims would care to complain; and whether they could get the police to take them seriously; and whether they can find you; and whether you and they are in the same jurisdiction; are other matters. I certainly wouldn't recommend you rely on the CFAA to protect you from ransomware gangs.
of course, this is not quite the same as misunderstanding some subtleties in an explicit contract. for example, the mere fact that I did not understand an auto-renewal clause in a lease does not get me off the hook for payment. although I might have some recourse if the lease stipulates something absurd (eg, notice to vacate must be hand-delivered to office in antarctica).
crypto does not necessarily mean you get to do a complete end run around the laws of sovereign nations. what it might mean, if designed well, is that you don't have to depend on those nations enforcing things.
They need to go back and wrap all this stuff in actual legal boiler plate to have a meeting of the minds limiting what any individual digital contract can mean, if anything, rather than pretending this is orthogonal when it clearly is not.
To your original question, entering a negative amount in a web form should not be illegal. That's silly. But you're responsible for the effects and what you do after noticing the odd behavior. If an ATM machine vends me an extra $20 because the bills were stuck together, I should return the extra $20.
https://www.joelonsoftware.com/2000/04/06/things-you-should-...
> In the matter of reforming things, as distinct from deforming them, there is one plain and simple principle; a principle which will probably be called a paradox. There exists in such a case a certain institution or law; let us say, for the sake of simplicity, a fence or gate erected across a road. The more modern type of reformer goes gaily up to it and says, “I don’t see the use of this; let us clear it away.” To which the more intelligent type of reformer will do well to answer: “If you don’t see the use of it, I certainly won’t let you clear it away. Go away and think. Then, when you can come back and tell me that you do see the use of it, I may allow you to destroy it. [0]
[0] https://en.wikipedia.org/wiki/Wikipedia:Chesterton's_fence
"Do not carelessly denigrate social institutions or creative achievement."
Strike a "we", replace by "rich elites". "Small government" means in practice that most of what governments are doing now with taxpayer money at no-profit will be done by private for-profit companies, at a worse service level, or that regulations/regulatory agencies will be torn down.
For the first, just look at private prisons - make a lot of profit for their owners, while the level of care for the prisoners (access to healthcare, drug withdrawal treatment or education is often spotty, human rights abuse claims the norm).
For the second, look at how e.g. environment regulations were "relaxed" during the 45th.
It's all about the grifting opportunities.
I don't agree. My 'poor' leftie friends are all about tearing shit down, while most 'rich' people I know are pretty happy with the way things are, wanting only to make small tweaks here and there.
Maybe you didn't mean for your position to lead to private prisons. But it does, anyway, and that is all that matters.
The US is also not the only place where prisons are private[2], there's the southern hemisphere's Sweden a.k.a. big government paradise, and it has a private prison.
To say either "public" or "private" and ascribe some sort of good or bad to them without providing any reasoning is presumptuous in the least, but to then tell someone what their actual position is - in your view - after making such a presumption would only be to compound an error.
I know what I meant, try to focus on what you mean and fixing that before mischaracterising my views again, thank you.
[1] https://www.motherjones.com/politics/2016/06/history-of-amer...
[2] https://www.brennancenter.org/our-work/analysis-opinion/crit...
We do have private prisons. As you note, they started under Reagan, in response to Reagan's "anti-crime" policies. Reagan is notorious for claiming to support small government and balanced budgets while actually spending us deep into deficit in order to purchase boondoggles. How are your preferences different than Reagan's?
What’s the average length of a post on HN and where does that post stand?
> How are your preferences different than Reagan's?
You just stated that he acted contrary to his claims, if your position is that I say I’m for small government but wish to spend, spend, spend, then I can see why you’re confused. Try dropping the assumption I’m lying, the principle of charity is a wonderful thing.
More to the point, as you are confused by sarcasm in the service of proof by contradiction, I’ll rephrase:
Would you claim that the government was historically small in 1983?
Is today’s government smaller or bigger?
How do both of your answers correlate with the increasing number of private prisons?
Finally, since your answers should be no, bigger, and bigger government correlates with more private prisons, what on Earth are you on about?
And yet you're going to avoid defending it, or even looking at, nor answering any of my questions and then accuse me of such matters. Ironic.
> This is an awful lot of words to avoid the question
What is it with those who support big government ascribing mendacity to their opponents? I'm not avoiding anything (except fallacies like ad hominem and false dilemmas).
> whether the small-government philosophy you personally subscribe to, whatever it may be
Here you admit that there is more than one possible outlook, yet you go on to produce this:
> If you prefer contracts, stop arguing, if you don't, explain why you think the operation of prisons is a proper function of a small government. It's not hard.
A false dilemma. Make your mind up, are there many types or only one?
Perhaps if my questions were answered I might feel more in the mood to answer those from people who accuse me of avoiding theirs.
> would prefer that government contract out prison services, or run them itself
My answer is either, it's irrelevant. The government is regulator and enforcer. It should promote (high) standards which it then enforces regardless of whom is running a service. Problems may arise when:
a) the one running the service is also the regulator, a clear conflict of interest and though in some cases permissible, it's not one for incredibly powerful entities like government.
b) the ones providing the service are also over-represented in government i.e. they have more than a vote, they have lobbying power (or straight up corruption) which in this case would lead to criminalising essentially non-criminal behaviours to produce whatever positive outcome for them and not for the populace they're supposed to serve. How many people are in gaol for marijuana possession?[1]
More criminals means more prisons, more tax money, more staff and budget (hence more power), more cheap labour… how does that sound anything like small government?
This[2] will come in handy for you.
[1] https://www.drugtestpanels.com/blogs/articles/jail-time-for-...
i think the bit where you talked about Sweden being in the southern hemisphere places it in the top tier of 'confusing' for me...
there's the southern hemisphere's Sweden a.k.a. New Zealand, the big government paradise
I can't edit now but thanks for pointing out something in a reasonable way.
A program that does not implement its intention is buggy.
This is still starting from scratch. The design may be conventional, but you're benefiting from a modern approach to processes and design from the beginning.
I mean this is the best way possible, the Falcon 1 didn’t reinvent the wheel. They basically said what’s the simplest useful rocket for getting stuff to orbit copying as much of the design as they could, and built that.
I'd say that if you are gluing together a bunch of known-good components into a specific configuration that isn't a full copy of something else, you're building from scratch.
Take say all those identical looking highway overpasses. Even if one of those projects started with a blank file, applying standard solutions to standard problems isn’t starting from scratch.
You alright?
Inefficiency implies that we can fathom a way to navigate the same space more efficiently. Do we? Or do we, for this mental gymnastics to work, actually have to change the space, to one where people are kind and the whole complicated system is less so?
Certainly having lawyers in big business must be efficient enough that they beat not having lawyers or else the market would adjust around that, no?
Lynching/mob justice is much more efficient than lawyers and courts, and that is what comes to mind seeing how the crypto reacts.
My point here is that it happens time and time again - people do revolution, be it real bloody one like French or Russian or just a tech one like crypto, and from the very beginning dispense with the old mature system and replace it with what they see as a very efficient new one - like the "emergency committee" system of Russian revolution which was able to quickly execute millions of "counter-revolutionaries" - yet with time the system again matures into what is perceived as a very inefficient one.
In what way specifically ?
The implementation can be formally written and verified, but the specification itself cannot be automatically verified.
That's effectively what a contract is anyway - it's a specification for a 'legal agreement' which is this sort of invisible obligation that is created after it is signed (for instance, the time spent in contract negotiations is usually spent debating what should happen in edge-cases).
It turns out some of the inefficiency is necessary for everything to function, and ultimate efficiency is a dumb idea. Who knew?
A formally verified X is just a reliable X.
If X is wrong, then you just have something that will reliably do the wrong thing.
i.e. just because analogs exist, don't expect their performance characteristics to be invariant
Tech people tend to think of technology as computerized things, but all those things you listed are also technologies that solve real problems that people encountered in the past.
IMHO, crypto is like a new car with the revolutionary new feature of not having seat belt technology. Maybe the inventor has some dumb idiosyncratic or ideological hatred of seat belts, and maybe some people buy into it... Then the new cars get popular, people start crashing them in numbers, and we realize, "hey maybe seat-belts weren't so dumb after all."
Of course, when that happens someone in that community will call it a seat-strap and claim it's a revolutionary new invention.
Crypto is like that new car that can have a seat belt but you don't need to. The fact that it still doesn't have that seat belt doesn't means much, just that you need to be aware of it.
For sure any new paradigms will takes time to solve every indirect issues that comes with it, Rome wasn't build in one day.
> Of course, when that happens someone in that community will call it a seat-strap and claim its a revolutionary new invention.
Oh seems like you acknowledge that... but twist it like a bad thing? For sure it will be a great thing to add to cryptos, you just said it yourself that it's something lacking in cryptos...
What's amazing about crypto is the flexibility, the openness, the accessibility. Anyone can join theses networks, thus it can be done anywhere too, and because of the financial incentive, it's gonna happen anywhere. You'll probably say, but there's Western Union, Paypal, Visa, banks, etc... for all that... but check the Chikaordery story from Pleasant Green (as a Canadian I often laugh when the list include Venmo, or any US exclusive service, that just show how so many forget that the US isn't the world).
So yeah, some people will makes mistakes from time to time in their smart contract, it will happens, but we will get better each time to avoid that, when it's needed, just like we did with the previous ways of doing things. We will accept the risk when it can't be done, and that will be it (never heard of fraud using credit card, or bouncing checks? We are just used to them and accept the risks.)
> Crypto is like that new car that can have a seat belt but you don't need to. The fact that it still doesn't have that seat belt doesn't means much, just that you need to be aware of it.
You're missing the point. To put it slightly differently: crypto is like the overconfident kid who thinks seat belts are stupid because he doesn't truly realize he can get into an accident, let alone die. He actually does need a seat belt, he's just not wise enough to realize it. When he gets in an accident and files out his windshield, then he'll discover he wants to use one.
>> Of course, when that happens someone in that community will call it a seat-strap and claim its a revolutionary new invention.
> Oh seems like you acknowledge that... but twist it like a bad thing?
Reinventing the wheel when everyone else around you is riding in cars and on bicycles is not actually inventing anything, let alone anything revolutionary. Then, if you'd previously spent the previous few years mocking wheels as stupid and useless, there's the angle of refusing to acknowledge that you were wrong.
God didn't come down and give us governments.
We started without order and survival based on individual output.
And every single living thing beyond a threshold of intelligence agreed that it sucked.
If you assume that adding more government always makes things better, then why not go all the way to complete totalitarianism?
If you agree that totalitarianism is too far, then I don't see why reasonable people can't disagree on which direction (more government or less government) is an improvement on the status quo.
any anarchy is just one step away from despotism. when power lies on the ground, it doesn't take much for anyone to pick it up and wield it. you really need a strong government to preserve anarchy.
"Liberty" is a wonderful lag measure, but a terrible lead measure.
The only thing you can really do to immediately create more liberty is deregulating. But in a world without laws, the only law is that of the jungle.
In which case we have a might makes right tyranny.
But as a lag measure you can do things like legislate worker rights, minimum wages, term limits, etc. With the long-term effect of more "liberty and freedom"
“Why would anyone need light bulbs? There are gas lamps and oil everywhere that do the same thing.”
“Why would anyone need email? There are post offices that do the same thing.”
Reading this a hash collision was exploited:
https://rekt.news/polynetwork-rekt/
> Well... here's the actual sighash of the target function:
> http://ethers.utils.id ('putCurEpochConPubKeyBytes(bytes)').slice(0, 10)
> '0x41973cd9'
> And the sighash that the attacker crafted...
> http://ethers.utils.id ('f1121318093(bytes,bytes,uint64)').slice(0, 10)
> '0x41973cd9'
> Fantastic. No private key compromise required! Just craft the right data and boom... the contract will just hack itself!
So yes. As the main point of digital contracts seems to be that they are self-enforcing, then it seems to follow that there can be no complaining about the results of using them.
I believe if you lied in the game that would constitute a written/verbal contract and what you did is fraud. Some games enforce written agreements, others say it's the wild west so too bad, this is role playing by a character, not the person. I'm not sure if either has ever been tested in court.
For the hacking thing I don't really agree that all hacking is 'allowed', phishing is of course a type of fraud, your access is unauthorised even with the correct credentials - authority to enter a building does not derive from stealing a key from someone. Likewise a buffer overflow is 'allowed' much the same way a window allows itself to be broken by a brick.
Actually...
https://www.gwern.net/docs/rotten.com/library/bio/crime/crim...
>Patrick had an interesting mating ritual: Apparently the task of convincing a girl to meet you involves sending her a digital photograph of your wang, as Naughton did on several occasions. He described his flights of fantasy as role-playing as himself, pretending to be a successful, rich executive with everything going his way. When he bragged about running a company and owning a boat in chat sessions, he was telling the truth, unlike so many chatters before him. [...]
>If Mickey cried a little that night then certainly Michael Eisner had a bad day after learning that his young Vice-President in charge of E-mail and Chat Rooms had been arrested for, well, very un-Disneylike behavior. [...]
>Despite all of the evidence and the decades of prison time hanging over him, Naughton would eventually walk free. The jury in his trial deadlocked over the more serious charge and to avoid a retrial, he plead out to lesser charges.
https://www.latimes.com/archives/la-xpm-1999-dec-10-fi-42422...
Former Internet Exec Says Online Pursuit of Girl Was Role-Playing
DEC. 10, 1999 12 AM PT
>Taking the stand in his own defense, former Internet executive Patrick Naughton testified Thursday that he never intended to have sex with a minor and that his steamy online encounters with an undercover FBI agent posing as a teenage girl were part of a fantasy life he pursued to escape emotional problems and mounting pressures at work. [...]
>Naughton’s unexpected appearance represented a bold move by a defense team that is pursuing what many consider a risky and unprecedented legal strategy. Their central argument is that Naughton’s statements online and subsequent actions aren’t incriminating because they were grounded in an online fantasy world. [...]
>While claiming that role-playing is rampant online, Naughton admitted that he always provided accurate information about himself during online chats, even pointing his supposed 13-year-old correspondent--actually an agent--to one Web site that had a news article about him and another that had a picture of his exposed genitals.
>Asked why he furnished such information if fantasy was his real objective, Naughton replied: “The role I was playing was a character of me. If you ask my psychiatrist, I have a lot of self-image and ego problems. I was looking for approval.”
https://en.wikipedia.org/wiki/Patrick_Naughton#Novel_defense
>His line of defense was that he claimed he was persuaded to participate online in a ritualized sexual role-playing exercise, dealing with a mature woman acting as a girl.[14] His then-novel defense, became known as the fantasy defense for pedophiles.[2]
https://en.wikipedia.org/wiki/Fantasy_defense
>The fantasy defense is where a defendant accused of attempting a crime (enticing minors into sexual activity, for example) claims that they never intended to complete the crime. Instead, they claim they were engaged in a fantasy and, in the case of luring a minor, believed they were dealing with an adult.[1]
>The fantasy defense was developed by Donald B. Marks, the attorney for Patrick Naughton,[2] the Disney executive who eventually pleaded guilty to traveling in interstate commerce with the intent to have sex with a minor, in violation of 18 U.S.C. § 2423(b).[3][4][5] The "fantasy defense" used in the Naughton case was novel; however, since the closely watched Naughton fantasy defense was successful, defense lawyers were expected to use it to help other clients.[4]
https://digitalcommons.law.scu.edu/lawreview/vol41/iss2/6/
>Donald S. Yamagami, Comment, Prosecuting Cyber-Pedophiles: How Can Intent Be Shown in a Virtual World in Light of the Fantasy Defense?, 41 Santa Clara L. Rev. 547 (2000).
This is all about the level of abstraction
The ‘laws of physics’ in a game may allow you to do unintended things, it’s a complex system. Doesn’t mean that it’s OK at a higher abstraction.
I know what we did constituted a violation of terms of service, and we were subject to bans at any time. However, I was reasonably confident there was little Jagex could do to pursue legal action against us. Generally, we were relatively small fish compared to things like the Mod Jed scandal.
I am not sure the courts would find this to be in any way illegal. But I find it very interesting.
KempQ on YouTube does a lot of videos on modern luring methods. There's also a guy on YouTube called Hermano, a former Venezuelan gold farmer, who has some interesting insights into the real world value of osrs gold and why Venezuelans do it.
Is that wrong? Is it part of the game? Obviously there would be something wrong if you sold people your digital tokens and then took them away from players - you agreed to give them digital tokens and then took them away. But if an in-game character is making false representations as part of the game, that seems different.
agreed
> A digital contract was used in a way that complied with the contract that the bonehead writers of that contract did not intend. That's it
I kind of disagree in philosophy here. If there's a bug in a bank API that lets me transfer funds to my account, I'm still "hacking", even if I'm doing exactly what the API lets me do, because I know very well that I'm not supposed to.
Then again, as you say, the whole spiel of digital contracts is that theyre far too clever to need silly courts and judges and common sense and all that, so... meh
You are likely also violating the terms of usage of the API and various other legally enforceable contracts by breaching the API.
If a smart contract included a terms of use however, it would be interesting to see whether this could be considered enforceable.
There is no one physical server. I think this is misleading.
From a moral standpoint, it's like, if you accidentally leave behind your wallet with cash on a park bench with a lot of passer-by, then it's your fault for leaving it there and whoever finds it deserves to keep it. I'm sure you're familiar with the "finders keepers, losers weepers" saying... After all, it's in public, similar to how public blockchains work, right?
However, different people may come to different conclusions about this. In some countries in the world, the overwhelming consensus would be to return the wallet to the owner, even if it's found in public. I guess it's because it doesn't matter if you had to break through the window, or simply reach out and grab it from the bench; the property does not belong to you.
A lost wallet is accidentally left there. The context of it being available to be taken by anyone is not intended. There is no declaration of rules by which you may take it by the owner.
You can't just expect people not to take free money laying out on a park bench with their name on it...
The debate being had is whether the sign was sufficiently well written ("It's the code's fault") vs. whether the sign system is just a terrible idea regardless of sign quality and you should use normal societal systems to transfer the wallet.
• As a device to programmatically ensure the “owner” of some resource is the one who controls it; or
• As a system that decides who controls a resource, whomsoever controls the resource has a right to it, there can only be one.
The sensible interpretation (imo) is the first one, unless we're doing away with our conception of property rights. (Which would be an interesting experiment, but given the philosophical background of a lot of this cryptocurrency stuff I don't think that's what's intended.)
Blockchain are just databases. But they still run due to consensus and the consensus is made up by humans and it is humans who uphold it.
For example, humans came to a consensus that there will there will only ever be 21 million Bitcoin. However, we cannot guarantee that one day there may be more than 21. They also came to a consensus that that this shall never change. However, all that is protecting this consensus is a meme. The source code can be changed should everyone agree, especially if the future humans find that such a cap does not work.
The benefits of decentralization is that the consensus is hard to change by individuals or centralized organisations... Consensus must be reached by all of the participants of the network.
Previous relevant comment of mine on the matter of "Code is law": https://news.ycombinator.com/item?id=28132994
https://en.wikipedia.org/wiki/The_DAO_(organization)
>In June 2016, users exploited a vulnerability in The DAO code to enable them to siphon off one-third of The DAO's funds to a subsidiary account. On 20 July 2016 01:20:40 PM +UTC at Block 1920000, the Ethereum community decided to hard-fork the Ethereum blockchain to restore virtually all funds to the original contract.[10] This was controversial, and led to a fork in Ethereum, where the original unforked blockchain was maintained as Ethereum Classic, thus splitting the Ethereum blockchain into two branches, each with its own cryptocurrency.
I think its an important point to be made.
Such an intention doesn't cause laws and courts to stop existing or make things so courts won't interpret certain actions as theft. But it complicates things.
Anything outside the that was exploiting bad implementations and therefore a hack.
Some here might think the the code is a contract because that's the name. But that had never really been the case: public human statements supercede code.
Arguably things like this should make the future a bit more secure, from what gets learnt. In the same way other code industries learn from found bugs or exploits.
Where do we put a border?
But that’s antithetical to the value prop of smart contracts.
Such a weak take. I guess we are also tools for using Ethereum after The DAO.
An error like this in the contract stack should have been caught by the auditor, Certik. It's not a fundamental flaw in PolyNet's system, just a very unfortunate oversight.
If someone had physically or electronically broken into systems and illicitly copied private keys that would be a different story. Here someone executed permissible actions on chain that people didn't like, wah wah.
You have to be an absolute tool to use the poly network for anything serious ever again.