News for hackers. Stuff that matters.
[dead]
Re:Nomad drained of $150m due to a coding mistake by dang on Tuesday August 02, 2022 @03:58PM (#32323532)
Please don't respond to a bad comment by breaking the site guidelines yourself. It only makes things worse.

Especially please don't cross into personal attack. We ban accounts that do that.

https://news.ycombinator.com/newsguidelines.html

Edit: since you've actually been doing that a whole bunch recently, I've banned the account. Can you please not create accounts to break HN's rules with?

Re:Nomad drained of $150m due to a coding mistake by Test0129 on Tuesday August 02, 2022 @10:52AM (#32319276)
There is a reason technology that requires high levels of stability is mired in layers of approval, review, regulation, etc. It doesn't change much if at all once it works, because the probability of introducing a failure mode is so high with software.

There's a point where this level of of negligence should rise to criminal liability, no different than if someone wrote code for a new boeing that was so bad it moves beyond incompetence.

We are at this point, and crypto companies need to be held criminally liable for these hacks. If not at least, should be required to carry insurance and pass stringent security audits no different than other high value systems. This is pathetic, and it's not the first time, second time, or third time it happens. I do hope crypto dies. It's been co-opted by grifters and thieves, and even when it's not, grifters and thieves end up stealing the money anyway through hacks like this. Things like this could be somewhat remedied by teaching people to refuse to deal with coins that do not post several independently verifiable third party security audits but alas people don't care anyway.

Re:Nomad drained of $150m due to a coding mistake by endisneigh on Tuesday August 02, 2022 @10:47AM (#32319201)
This is terrible obviously, but if code is law and someone writes bad code and exploits that is it “illegal”?

The entire basis of even having judges, courts, etc is an acknowledgment that the “code” is imperfect and certain circumstances require human intervention.

Going without that is, well… YMMV.

Re:Nomad drained of $150m due to a coding mistake by harambae on Wednesday August 03, 2022 @01:25PM (#32334536)
I honestly wondered the same thing during the VW emissions scandal.

The requirement was that diesel emissions were at a certain level under those exact conditions... And they were OK under those exact exact conditions.

(Anyway it turned out there was a specific carve out for cheater devices and they did get in trouble)

Re:Nomad drained of $150m due to a coding mistake by bitxbitxbitcoin on Tuesday August 02, 2022 @11:24AM (#32319747)
Do people go to jail for writing bad laws?
Re:Nomad drained of $150m due to a coding mistake by Fargoan on Tuesday August 02, 2022 @10:49AM (#32319227)
Code is law is just a meme
Re:Nomad drained of $150m due to a coding mistake by RyanCavanaugh on Tuesday August 02, 2022 @11:33AM (#32319927)
If regular law is the ultimate arbiter of the correct location of funds in this system, then we don't need this complex network of energy-hungry computers constantly double-checking each others' work to make a financial system. We can just use regular computers, like before.
Re:Nomad drained of $150m due to a coding mistake by Fargoan on Tuesday August 02, 2022 @12:24PM (#32320754)
We don't need the web because we can go back to BBSs
Re:Nomad drained of $150m due to a coding mistake by misnome on Tuesday August 02, 2022 @10:55AM (#32319316)
Isn't it a consequence? If the entire foundation of your system is irreversibility and finality, then doesn't it effective becomes true? (unless you are big enough to force a network-wide rollback...).
Re:Nomad drained of $150m due to a coding mistake by cinntaile on Tuesday August 02, 2022 @10:57AM (#32319350)
If you ignore the fact that the actual law might have something to say about this, then sure.
Re:Nomad drained of $150m due to a coding mistake by ghaff on Tuesday August 02, 2022 @11:11AM (#32319551)
But that's exactly what the decentralized crowd is arguing. You encode transactions and no centralized authority (e.g. a country's judicial system backed by people with guns) can override it. A natural consequence is that no one can override a mistake either.

Legal contracts in the physical world can be poorly drafted as well. But courts don't usually allow ludicrous results arising from honest mistakes.

Re:Nomad drained of $150m due to a coding mistake by cinntaile on Tuesday August 02, 2022 @11:15AM (#32319617)
The law doesn't care if I argue it doesn't apply to me.
Re:Nomad drained of $150m due to a coding mistake by dylan604 on Tuesday August 02, 2022 @11:21AM (#32319701)
Code is law only if you are an NPC. If you are a normal user, code is just rules that are potentially breakable
Re:Nomad drained of $150m due to a coding mistake by Night_Thastus on Tuesday August 02, 2022 @10:53AM (#32319285)
I have no sympathy for the end of a speculative trade engine that's been almost exclusively used to scam people. Watch the "Line Goes Up" video, it explains it very well. It's not perfect, but provides plenty of background on crypto in general. (Despite the title)
Re:Nomad drained of $150m due to a coding mistake by simonh on Tuesday August 02, 2022 @10:54AM (#32319314)
It's horrible technology, born from deeply misguided ideals that will hurt and is hurting a lot of people. I'm not going to celebrate it's repeated, persistent failures but I'm not going to deplore them either.
Re:Nomad drained of $150m due to a coding mistake by kstrauser on Tuesday August 02, 2022 @10:50AM (#32319233)
Was this actually theft? The smart contract basically said “ask and you shall receive”.

I’m trying to think of a banking analogy. Maybe their website has a page that says “enter your checking account number to get $1,000”, but the web service had the authorization code commented out. If someone discovers that and tells their friends, have they stolen from the bank?

Note that I’m thinking of “theft” and “stealing” from a legal point of view. The moral angle may be very different.

Re:Nomad drained of $150m due to a coding mistake by misnome on Tuesday August 02, 2022 @10:52AM (#32319283)
Yes, I imagine that would be counted as stealing, if it wasn't intended.

However, if the bank had spent large amounts of time absolutely promising irreversible transactions, and publicly opened itself to attackers, then - no, that's just an intended operation of the system.

Re:Nomad drained of $150m due to a coding mistake by johnbellone on Tuesday August 02, 2022 @10:54AM (#32319311)
This is akin to going to an ATM and finding a bug that lets you withdraw money out using the information from a receipt that someone threw out in the trash bin. It is definitely illegal.
Re:Nomad drained of $150m due to a coding mistake by mathattack on Tuesday August 02, 2022 @10:55AM (#32319324)
If you find a way to get the ATM to spit out $100K to you by mistake, legally you have to pay it back. Same if it’s the bank’s error.
Re:Nomad drained of $150m due to a coding mistake by googlryas on Tuesday August 02, 2022 @11:12AM (#32319566)
Sure, but banks and ATMs have never declared that code is law
Re:Nomad drained of $150m due to a coding mistake by Fargoan on Tuesday August 02, 2022 @12:09PM (#32320549)
Has Nomad ever said "code is law"? I really doubt they did.
Re:Nomad drained of $150m due to a coding mistake by badpun on Tuesday August 02, 2022 @10:55AM (#32319329)
I'm not sure if it's theft but they most certainly have to give the money back. It's just an honest mistake, an equivalent to accidentally dropping a wallet full of cash on the street.
Re:Nomad drained of $150m due to a coding mistake by tgv on Tuesday August 02, 2022 @11:01AM (#32319403)
But that wallet has a signed, notarized affidavit that says "finders keepers".
Re:Nomad drained of $150m due to a coding mistake by chrismorgan on Tuesday August 02, 2022 @11:10AM (#32319537)
But there’s a fair chance that the courts will eventually declare this style of affidavit invalid, being trumped by some law or other.
Re:Nomad drained of $150m due to a coding mistake by doix on Tuesday August 02, 2022 @11:43AM (#32320111)
But if you allow the courts to dictate which crypto transactions are legal/illegal and to undo illegal ones, what's the point of all the decentralisation? You can just use the existing systems.

Which country's laws apply? What if one country considers the Ethereum contract binding, but the other doesn't?

It feels like having your cake and eating it too. I met lots of crypto bros, they all talk about how they use it so they can be immune to government censorship/intervention etc. They gloat about using crypto to avoid taxes and laws.

Relying on the same institutions that you are trying to get away from to overcome flaws in your framework seems entirely hypocritical to me.

Re:Nomad drained of $150m due to a coding mistake by chrismorgan on Tuesday August 02, 2022 @12:47PM (#32321091)
And therein do you see the almost inevitable doom of the dream of decentralised cryptocurrency, because it’s never going to be able to stand up against the power of governments once they decide they don’t like it and have no vested interest in it surviving. All of this stuff, even up to Bitcoin, is only still around at the sufferance of governments that have not yet decided to clearly make it illegal. Most are currently preferring to regulate it (which does tend to undermine the principles of full decentralisation, as you rightly observe), but a few decide to cut it out like a gangrenous parasite that’s enjoying mixing metaphors too much, and others may at almost any time. Already cryptocurrencies flout things like copyright and privacy law, for they have made it fundamentally impossible to comply with various plausible court orders. And “we have designed it so that it is not possible for us to comply” does not impress courts.

And in your musings about which countries’ laws—therein also do you see the perennial mutterings of discontent at international policy, and globalisation shambling towards collapse. It may be averted. It may not.

Re:Nomad drained of $150m due to a coding mistake by powerhour on Tuesday August 02, 2022 @11:34AM (#32319948)
Unfortunately they won't be able to do much about it, besides jail someone (who may in fact be unable to make the victims whole).
Re:Nomad drained of $150m due to a coding mistake by chrismorgan on Tuesday August 02, 2022 @12:57PM (#32321247)
When the executives of cryptocurrency firms start getting jailed for contempt of court (when they fail to comply with a legitimate court order), the industry will collapse, which will take the value of cryptocurrency with it, which will return cryptocurrency to niche status, even if the governments in question don’t just decide to make it illegal.

This may not be the way things unfold, but it’s legally completely plausible.

Re:Nomad drained of $150m due to a coding mistake by oneoff786 on Tuesday August 02, 2022 @11:06AM (#32319476)
It’s like the story of the three little pigs except they just keep trying the straw houses and blaming the wolves
Re:Nomad drained of $150m due to a coding mistake by doix on Tuesday August 02, 2022 @10:51AM (#32319262)
Is it theft? If you go by the whole "code is law" (is that still a popular catch phrase? I don't keep up with crypto much anymore), then this is not theft. The contract let this happen, so it's legal.

Edit: heh, I see a lot of HN had the exact same thought process and we all commented at the same time. I'll leave this up anyway.

Re:Nomad drained of $150m due to a coding mistake by mach5 on Tuesday August 02, 2022 @10:51AM (#32319256)
to be fair it's really funny
Re:Nomad drained of $150m due to a coding mistake by Jerrrry on Tuesday August 02, 2022 @10:46AM (#32319191)
Non Sequitur.

You can do both logically.

You are a horrible convincer.

Re:Nomad drained of $150m due to a coding mistake by upupandup on Tuesday August 02, 2022 @11:04AM (#32319434)
But what about ppl who are trying to get rich off the downfall of others savings? This is web3, crypto
Re:Nomad drained of $150m due to a coding mistake by crest on Tuesday August 02, 2022 @11:26AM (#32319796)
Oh cry me a river. This is criminals applying the codified "law" against each-other for their temporary enrichment and the entertainment of the spectators.
Re:Nomad drained of $150m due to a coding mistake by doopy1 on Tuesday August 02, 2022 @10:46AM (#32319190)
Welcome to HN, where crypto is the devil and must be eradicated at all costs. Anyone who thinks otherwise here is either perceived to be an idiot or a grifter.
Re:Nomad drained of $150m due to a coding mistake by rjbwork on Tuesday August 02, 2022 @11:07AM (#32319489)
It should, perhaps, tell you something that a community with one of the most highly concentrated populations of technically literate people on the internet are so vehemently against a technology.

Crypto is just a paperclip maximizer for silicon and electrons that does what traditional companies have been doing for at least 60 years. Only 100000x less efficiently.

Re:Nomad drained of $150m due to a coding mistake by sneak on Tuesday August 02, 2022 @11:11AM (#32319548)
This community is nowhere near consensus on this matter. A small minority of loud naysayers is.
Re:Nomad drained of $150m due to a coding mistake by JumpCrisscross on Tuesday August 02, 2022 @11:15AM (#32319610)
> This community is nowhere near consensus on this matter. A small minority of loud naysayers is

There's an information bubble. It's not the crypto skeptics. There's a reason when governments around the world have moved to ban crypto there's been little to no popular resistance beyond angry 4channers.

Re:Nomad drained of $150m due to a coding mistake by sneak on Tuesday August 02, 2022 @11:26AM (#32319793)
Substantually more governments have invested time, money, and regulatory effort into the crypto ecosystem than have banned it.

The facts don't support the narrative to which you seem to be attached.

a16z is a large investor in the space and proponent, as well as several other prominent tech investment firms. Are they angry 4channers?

It's ok to be personally against it, but please don't misrepresent the facts.

Re:Nomad drained of $150m due to a coding mistake by JumpCrisscross on Tuesday August 02, 2022 @11:39AM (#32320022)
> more governments have invested time, money, and regulatory effort into the crypto ecosystem than have banned it

Lots of chatting. Looking at actual dollars and laws, we're weighing the elephants of China, India and increasingly the EU against...Singapore, El Salvador and Malta?

Outside young men, disproportionately minorities, crypto has a limited beachhead [1]. It was an easy money phenomena with historic comparison. We're now seeing the regulatory mood shifting decisively against it with limited competent pushback.

> a16z is a large investor in the space and proponent

They're notable for where they're prominent and where they're not. Aggressive fundraising followed by SoftBank/Tiger style deployment. Tweets and blog posts galore. Yet middling returns, even on an internal basis, and absolutely zero presence worth mentioning in D.C.

I'm no greybeard. But I've worked in finance long enough to see the game they're playing.

[1] https://www.pewresearch.org/fact-tank/2021/11/11/16-of-ameri...

Re:Nomad drained of $150m due to a coding mistake by rjbwork on Tuesday August 02, 2022 @11:14AM (#32319593)
I don't think it is a minority. In my personal and work life, it does seem to be something like 80/20 or 90/10.

You might be right though, it's impossible to tell without doing some kind of vaguely rigorous poll.

Re:Nomad drained of $150m due to a coding mistake by FabHK on Tuesday August 02, 2022 @04:35PM (#32323959)
> Only 100000x less efficiently.

You're being too kind to crypto there, I think, by a few orders of magnitude.

Re:Nomad drained of $150m due to a coding mistake by yarg on Tuesday August 02, 2022 @05:07PM (#32324315)
Only 2^200 times less efficiently (even that's generous).
Re:Nomad drained of $150m due to a coding mistake by FabHK on Tuesday August 02, 2022 @05:25PM (#32324480)
I'd say between 1e7 and 1e11. 1e5 is too generous, 1e60 is way too harsh.
Re:Nomad drained of $150m due to a coding mistake by yarg on Tuesday August 02, 2022 @06:20PM (#32324999)
When a fundamental part of token generation is brute-forcing secure hashes?
Re:Nomad drained of $150m due to a coding mistake by FabHK on Thursday August 04, 2022 @05:42PM (#32348672)
Yes, but you still need, say, one computer to run what Bitcoin does (without the PoW hashing - just checking and recording 5 transactions per second). BTC uses around 15 GW currently, a computer say 15 to 150 W, so we are talking a factor of 1e9 (Giga) to 1e10.
Re:Nomad drained of $150m due to a coding mistake by Ekaros on Tuesday August 02, 2022 @01:20PM (#32321618)
Actually yes. I think crypto promoters are either idiots or grifters...