News for hackers. Stuff that matters.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by saagarjha on Sunday February 13, 2022 @09:08AM (#30321838)
Surely someone with the skills to find bugs like these would be an expert in cashing out on those bugs?
Re:White hat hacker awarded $2M for fixing ETH-creation bug by revax on Sunday February 13, 2022 @09:21AM (#30321886)
Those skills are unrelated.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by saurik on Sunday February 13, 2022 @09:29AM (#30321932)
Yeah... and as the person in question who found and exploited this particular bug ;P, I can definitely state that I would not feel comfortable betting the rest of my life on my ability to safely launder a giant pile of crypto back through to fiat (and then, further, keep that secret for the rest of my life, which shouldn't be downplayed).

I am much happier being able to get a bunch of clean money and then be able to give talks on the subject at conferences and get a lot of "street cred" in the tech community for my effort than spending the rest of my life wondering if there's someone from a real-world mob out there trying to hunt me down to recover the $100M I "owe them".

Re:White hat hacker awarded $2M for fixing ETH-creation bug by jacquesm on Sunday February 13, 2022 @09:41AM (#30321988)
The whole assumption that your ethics have a pricetag attached is faulty, it's not as if the choices were 'commit crime / get bounty'.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by saurik on Sunday February 13, 2022 @09:53AM (#30322055)
Yeah: I definitely agree with this, and I think it is an endemic problem to discussion of ethics in technology: we tend to focus on "but I could"--which sometimes ignores the law but even when it doesn't tends to then get bogged down arguing the exact boundaries of the law--without instead trying to judge people on whether they "should" (maybe based on the ramifications it has on other people) or "would".

I just think it is also worth noting that, even if we do accept the false dichotomy, I would not be an effective criminal... which seems to continually disappoint some people ;P. (I'm sorry to be such a let down! lol)

Re:White hat hacker awarded $2M for fixing ETH-creation bug by jacquesm on Sunday February 13, 2022 @09:57AM (#30322078)
Indeed, not everything that is permitted is ethical.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by sillysaurusx on Sunday February 13, 2022 @09:47AM (#30322026)
Everyone’s ethics have a price tag. It’s better not to pretend otherwise, since it clarifies a lot of human behavior.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by jacquesm on Sunday February 13, 2022 @09:49AM (#30322036)
I strongly disagree with that. You really can't claim to speak for everybody.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by sillysaurusx on Sunday February 13, 2022 @10:01AM (#30322098)
If you don’t play ball in certain parts of the world, you end up in a river. The price tag is just different.

Yours would likely be family or close relatives.

I think you’d take money to do something untoward if that was the alternative. Almost everybody would. And there’s nothing wrong with admitting that.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by dahart on Sunday February 13, 2022 @12:20PM (#30323408)
> If you don’t play ball in certain parts of the world, you end up in a river. The price tag is just different.

Aside from the problems of this statement being a completely vague and unspecific and extreme hypothetical, isn’t there a problem with switching from talking about incentives to talking about threats? Being threatened with death isn’t the same as being offered money, and this ground has been well covered by philosophers who point out that there are things wrong with “admitting that” as you call it. Calling it a price tag seems misleading at best. There’s further a massive problem with suggesting a person’s ethics might be based on what someone threatening them with death wants them to do, no? If the action isn’t something you are choosing to do, and isn’t something you would do if not threatened, for any amount of money, then why would you consider it your actions or part of your ethics?

Re:White hat hacker awarded $2M for fixing ETH-creation bug by jacquesm on Sunday February 13, 2022 @10:02AM (#30322112)
My 'goalposts moved' detector just twitched.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by sillysaurusx on Sunday February 13, 2022 @10:18AM (#30322207)
If you say so. It’s the same thing, even if it’s more comfortable to believe it’s not.

It helps to frame it this way, because once you accept that you’d do that, you’re more likely to accept you would do something unethical for a billion dollars if it had no consequences to you. And from there, it’s a binary search to determine exactly what your price is.

Would you be able to say you wouldn’t lie to your wife if it meant you’d walk away with a billion dollars? Certainly this is contrived, but all examples in this territory are contrived.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by jacquesm on Sunday February 13, 2022 @10:49AM (#30322503)
Yes, but that's not what we're discussing, because then I can counter with:

"Would you sell your mother or your children at any price?"

And I hope - admittedly, that's speculation - I know what the answer to that would be.

So this is now an absurd discussion, whereas it started off from a rational point of view: there exist such people whose ethics can not be corrupted. The fact that you believe this is not the case says nothing about people in general.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by sillysaurusx on Sunday February 13, 2022 @11:00AM (#30322602)
People did in fact sell their children when faced with hard times, by the way. The 1920’s era was rough. https://www.ranker.com/list/story-behind-photo-of-children-f...

You are asking what I would personally do. But it’s better to think of limit cases that everyone would do — such as lie to their wife for a billion dollars. Since it’s guaranteed you fall into the bucket of “everybody”, that means you can locate your ethical price tag.

It’s helpful for people to do this mental exercise. At least, I find it comforting knowing my own price tags in advance.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by jacquesm on Sunday February 13, 2022 @11:29AM (#30322877)
You are still moving the goalposts.

My statement is pretty simple: ethical people exist.

You countered with "Everyone’s ethics have a price tag. It’s better not to pretend otherwise, since it clarifies a lot of human behavior."

And have been moving the goalposts ever since. The fact that unethical people exist was never up for debate.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by sillysaurusx on Sunday February 13, 2022 @11:42AM (#30323021)
I had to scroll up and re-read to make sure we were on the same page.

Since you’re misquoting yourself, it sounds like you don’t want to have this debate, or you may not have realized what you said. But “The whole assumption that ethics have a price tag attached is faulty” is not at all the same thing as “ethical people exist.” It’s not a pedantic distinction; one is debating whether people will take compensation for acting unethically, even if they feel they’re the most ethical person on the planet — I think the answer is “yes” — whereas “ethical people exist” is a point no one could disagree with.

It’s a bit unexpected for you to omit your “price tag” words and then continue with my argument.

But we’re past the point that readers are having a nice time reading this. If you’d like to continue, I’m happy to do so, but we need to restrict ourselves to a high caliber of debate, if only for HN’s sake.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by jacquesm on Sunday February 13, 2022 @12:14PM (#30323343)
The distinction is pedantic because you are making it so.

Whereas in fact it is anything but pedantic.

"The whole assumption that ethics have a price tag attached is faulty"

For everyone.

> But we’re past the point that readers are having a nice time reading this.

You seem to be in a habit of projecting your own feelings onto everybody else.

> If you’d like to continue, I’m happy to do so, but we need to restrict ourselves to a high caliber of debate, if only for HN’s sake.

Suit yourself.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by sillysaurusx on Sunday February 13, 2022 @12:34PM (#30323565)
I'm saddened that a repeat of our debate from seven years ago won't be forthcoming today. https://news.ycombinator.com/item?id=8901682 I was looking forward to it.

If you ever do want to probe deeper into the question of ethics vs cost, I think it would be interesting. But since you keep talking about me rather than the idea, the interest feels one-sided.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by jacquesm on Sunday February 13, 2022 @01:04PM (#30323905)
Three different people have now made the same point in three different ways and you simply ignore it, consider the possibility that you are simply wrong about something.

Ethics problems typically do not lend themselves to be translated into a caricature of the market economy. The habit of assigning price tags to stuff can help if the original problem is cost related, but it tends to be a crutch when things of a more principal nature are discussed, which would have a valid meaning absent such things as money or physical rewards. As long as you keep framing it like that you won't get further.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by maxerickson on Sunday February 13, 2022 @11:39AM (#30322988)
If you believe everyone has a price shouldn't your goal be to not find your own?

(Like, work to avoid creating the situation where you have to compromise, if possible)

Re:White hat hacker awarded $2M for fixing ETH-creation bug by sillysaurusx on Sunday February 13, 2022 @11:51AM (#30323116)
That’s a very interesting question. Thanks for that.

The way I view it is that it’s important to seek out yours ahead of time -— to game out different scenarios, and to consider whether you would do X or Y if forced to choose. That way, when you’re in a situation where you feel like compromising, you’ll remember your limits.

In other words, I was less tempted to act unethically in the moment than I would have been if I’d been surprised by the opportunity.

This is especially important in scientific circles. It’s often trivial to falsify data, and the rewards for doing so are generally high. It’s also not always an active, conscious decision; it’s easy to make small mistakes that have favorable outcomes for yourself.

The exercise has helped me steer far away from any of those. I’ve watched peers fall into a trap that I’d label “scientific hype,” i.e. claim that you’re doing something impressive when in reality you’re nowhere close. This is a very easy mistake to make, and if I hadn’t mentally found my boundaries ahead of time then I’d have been vulnerable to making the same error. Or I may have stayed silent when my peers were doing something naughty.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by snowwrestler on Sunday February 13, 2022 @11:36AM (#30322970)
Positive and negative consequences are not the same thing in ethics.

Compare “kill this person to save your son’s life” with “kill this person to earn $1 million.” They’re not equivalent, even if both might be metaphorically referred to as a price.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by sillysaurusx on Sunday February 13, 2022 @12:01PM (#30323217)
On the contrary — the decisions you have to make to avoid negative consequences are often the best test of your ethics. Consider how many people would’ve been punished for speaking out against what plantation owners were doing in the 1800’s, for example.

The illusion that they feel different is extremely powerful. It’s worth resisting. It helps uncover all kinds of ways that we contribute to unethical behavior, if only through inaction.

The concept of having a price attached to your ethics is essential. Without it, people fool themselves into believing they’re above temptation. In my experience those same people tend to be the most vulnerable to it.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by jancsika on Sunday February 13, 2022 @01:26PM (#30324134)
> If you don’t play ball in certain parts of the world, you end up in a river.

OP branched here: "it's not as if the choices were 'commit crime / get bounty'."

Any example relevant to OP's branch cannot end with the subject in a river. The very fact that you are discussing it proves we've jumped to the other branch of the conditional-- the one where the choice is exclusively between `commit crime / get bounty` (by threat of death in your example)

tldr; goto considered harmful on HN

Re:White hat hacker awarded $2M for fixing ETH-creation bug by Consultant32452 on Sunday February 13, 2022 @09:18PM (#30327744)
People choose the river regularly.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by aaaaaaaaata on Sunday February 13, 2022 @06:26PM (#30326647)
Many people's ethics have a price tag.

Don't bleed all over us!, or let others bleed on us.