News for hackers. Stuff that matters.
Re:Arrest of suspected developer of Tornado Cash by rvnx on Friday August 12, 2022 @07:28AM (#32436905)
It seems reasonable to expect that Ethereum operators share responsibility in case of usage of their network for malicious or criminal activity. They have the technical means to control what goes on there or not. Otherwise it's like if you run P2P nodes and claim pedo pictures aren't your problem.
Re:Arrest of suspected developer of Tornado Cash by yamrzou on Friday August 12, 2022 @07:39AM (#32436987)
> it's like if you run P2P nodes and claim pedo pictures aren't your problem.

It's more like being arrested for developing a Bittorrent client

Re:Arrest of suspected developer of Tornado Cash by paganel on Friday August 12, 2022 @07:58AM (#32437144)
I think the people behind those clients were clear targets back in the day, before the advent of services like Netflix and Spotify alleviated some of the financial troubles experienced by the entertainment industry.
Re:Arrest of suspected developer of Tornado Cash by rvnx on Friday August 12, 2022 @08:04AM (#32437213)
KaZaA for example (which became Skype indirectly)
Re:Arrest of suspected developer of Tornado Cash by josefx on Friday August 12, 2022 @07:56AM (#32437126)
After making it repeatedly clear that you think Bittorrent is the next big thing for pedos and that your client is intentionally optimized to keep pedos safe from the government.

Nearly every time someone gets arrested for developing software they where also advertising and in some cases outright advising people on how to get away with illegal shit using their software.

Re:Arrest of suspected developer of Tornado Cash by willcipriano on Friday August 12, 2022 @07:39AM (#32436986)
I thought standard procedure here is you pay a fine that is a fraction of your revenue, not jail time.

Like here: https://www.investopedia.com/stock-analysis/2013/investing-n...

Re:Arrest of suspected developer of Tornado Cash by Jensson on Friday August 12, 2022 @08:09AM (#32437259)
If they did this closed source he probably wouldn't get jailed, and instead the company would have gotten fined. But open source makes things easy to trace so you just jail the person who wrote the code.
Re:Arrest of suspected developer of Tornado Cash by willcipriano on Friday August 12, 2022 @08:14AM (#32437316)
I assure you it's even easier to find the CEO of a major bank.
Re:Arrest of suspected developer of Tornado Cash by Jensson on Friday August 12, 2022 @08:19AM (#32437378)
Yeah, but then they would imprison the CEO and not the developer. Very different, especially since it is easy for CEO's to say that they weren't aware of any criminal activity. A developer who directly develops the feature is much easier to blame.
Re:Arrest of suspected developer of Tornado Cash by biglearner1day on Friday August 12, 2022 @08:41AM (#32437633)
> Yeah, but then they would imprison the CEO and not the developer.

While they do get blamed, the Netherlands doesn't seem to care all that much. They seem very selective with how they react to supposed money laundering

https://www.reuters.com/article/us-ing-groep-settlement-mone...

https://www.dw.com/en/how-ing-bank-in-poland-helped-russians...

Re:Arrest of suspected developer of Tornado Cash by Jensson on Friday August 12, 2022 @08:44AM (#32437666)
They key difference is this:

> ING’s Chief Executive Ralph Hamers said no individual at the bank was found to be responsible for the failures

Closed source means it is easy to hide whose fault it was, and then all you can do is fine the company since you can't arrest everyone. This is also why companies are so keen on deleting old message logs etc, to avoid leaders going to prison.

Re:Arrest of suspected developer of Tornado Cash by Arnt on Saturday August 13, 2022 @08:11AM (#32449158)
I heard on IRC that the person they arrested was the one who generally merged PRs. With closed source the closest equivalent is the leader of the development team. I would be surprised if a law enforcement agency is unable to locate that developer.
Re:Arrest of suspected developer of Tornado Cash by jschlatter on Saturday August 13, 2022 @12:04AM (#32446786)
> They have the technical means to control what goes on there or not.

They have less control than you may think.

Any ethereum miners (or proof-of-stake validators) who block some class of transactions immediately become vulnerable to denial of service attacks.

This came up back in 2016 with the DAO hack on ethereum[1]. Some ethereum miners considered blocking transactions that moved the stolen funds, but then realized that this was infeasible: if you block such transactions, then the DAO hacker can spam you with them. Such spam on ethereum is usually prevented by requiring the sender to spend money on each transaction (ie pay gas fees). But that fee is only charged when the transaction is included in a block -- if you refuse to include it, then the spammer pays nothing. The kicker is that, by Rice's theorem, there is no way in general to distinguish "malicious" transactions from non-malicious ones (for _any_ definition of "malicious") short of just executing them to see what they do.

So if you as an ethereum miner (or validator) try to block certain transactions, you can be forced to do unbounded amounts of work for free, ie DoS'd.

[1] https://hackingdistributed.com/2016/07/05/eth-is-more-resili...

Re:Arrest of suspected developer of Tornado Cash by ajhurliman on Friday August 12, 2022 @01:51PM (#32441842)
You mean the miners? Mining Ethereum doesn’t allow for much inspection of what you’re validating in each block.

It’s just a program that runs and guesses a bunch of salts that hopefully result in a hash that meets some particular parameters (e.g. starts with 5 zeros). You want to be the first to guess correctly so you win the reward for that block, so any sort of investigation doesn’t make sense. From what data was stored on-chain in that block and whether it may be problematic (or even what the data represents), to which contracts were involved (and whether they have criminal ties), it’s just not reasonable for any miner to take responsibility for the block chain operating as expected.

I think this is the core issue with the block chain, is that society has always expected there to be some moral agent that you could hold responsible. Except in cases of natural disasters, you can normally blame someone.

But with blockchains, it’s a lot harder to place blame on someone, or link a physical person to the online identity.

Similarly with the 2008 GFC, everything was abstract enough that almost nobody got in trouble for a situation that was most certainly man-made, but hard to place the blame. At least then, though, the government had some amount of control over the banks and also relied on them to return society to normal.

Through the government’s eyes, block chain doesn’t appear necessary for society to operate and is very difficult to regulate, so I’m sure their tolerance is a lot lower for blockchains when financial crimes crop up from it.

Re:Arrest of suspected developer of Tornado Cash by legutierr on Friday August 12, 2022 @08:04PM (#32445443)
> Mining Ethereum doesn’t allow for much inspection of what you’re validating in each block.

Yes and no. It depends on what you mean by “validating”.

If your objective is to restrict the types of transactions that end up in the blocks you yourself create, you can recompile geth with a custom mempool implementation, and use that custom mempool to inspect the data of any pending transaction you want. This is how MEV works.

In other words, it is 100% possible for a technically-competent miner to only create new blocks that exclude blacklisted accounts, or that restrict transactions according to any number of criteria.

On the other hand, once a new block has already been mined and propagated to the network, there is nothing that a single miner can do to stop it.

If you start rejecting otherwise-valid blocks because they include blacklisted transactions, you will only fork yourself from the network. The rest of the miners will keep on building on top of the block you wanted to drop.

Re:Arrest of suspected developer of Tornado Cash by Tepix on Friday August 12, 2022 @07:47AM (#32437054)
That depends on what are reasonable technical means to prevent things.

Is it reasonable for the postal service to examine every single piece of mail to check if it is illegal?

Re:Arrest of suspected developer of Tornado Cash by rvnx on Friday August 12, 2022 @08:01AM (#32437175)
They are held responsible to a certain point yes, and shipping services actively control high-risk shipments (up to the point they check the box contents, for airplane shipping, for batteries for example).

It's forbidden to send money through mail in many places. When you go to the post office to send money, the post office verifies your identity, the payment method, the sanctions list, etc and keeps the records for the authorities.

If you decide to violate the rules and send cash in a letter, the postal service allows the authorities to access the raw packages and full information, and full access to it, whether to use cash sniffing dogs (they really exist), etc.

Also, a fundamental difference with crypto exchanges:

Whether you send large amount of cash for criminal activity via the postal service or whether you send a large amount of books the postal service isn't going to benefit more, so they don't have to encourage criminal activity.

Re:Arrest of suspected developer of Tornado Cash by darkcha0s on Friday August 12, 2022 @09:42AM (#32438501)
I know I will get a hail of downvotes for this, but again you're comparing apples and oranges. The operators are using crypto for a wide range of applications. Using a mixer has probably 99.9% illegal reasons and 0.1% legitimate uses. Making money laundering harder is a good thing, no matter how many people here will try to convince you it isn't.
Re:Arrest of suspected developer of Tornado Cash by tyrfing on Friday August 12, 2022 @12:28PM (#32440824)
> Using a mixer has probably 99.9% illegal reasons and 0.1% legitimate uses

Similar to people using paper money or end-to-end encryption really. Nobody needs military-grade encryption or anonymous currency unless they're trying to hide something.

Re:Arrest of suspected developer of Tornado Cash by Arnt on Friday August 12, 2022 @04:26PM (#32443473)
That's not actually true.

Say I sell software, or SaaS. Then I may need military-grade encryption because I need to sell, a few potential customers (may) need that, and I need to keep my costs down so supplying the latest and greatest cipher to everyone is the right default. It may waste a bit of CPU but it saves the time of the sales and support people, and human time is expensive.

Say I'm going to buy something tomorrow, and I don't like SPoFs. There's a card in my wallet, or maybe two, but if the card reader in the shop is down, that's a SPoF unless I also carry some cash.

Re:Arrest of suspected developer of Tornado Cash by A4ET8a8uTh0 on Friday August 12, 2022 @01:46PM (#32441796)
That is the fun part, isn't it. Government is now ok with crypto, because it can easily track it. But you try to make it actually not being able to track, booy howdy, it will come down on you like a ton of brick.
Re:Arrest of suspected developer of Tornado Cash by akimball on Friday August 12, 2022 @11:42AM (#32440230)
Only if you presume that private deeds are illegitimate. That appears to reverse the presumption of innocence, without which the law becomes nothing more than a tool to destroy the enemies of the prosecutors.
Re:Arrest of suspected developer of Tornado Cash by diogenes1 on Friday August 12, 2022 @01:13PM (#32441375)
unlike 'peer 2 peer' cash usecases of crypto. ethereum added a lot of social elements to it with ens names. All sorts of common folk use tornado cash to keep their private transactions separate from their public address
Re:Arrest of suspected developer of Tornado Cash by jobs_throwaway on Friday August 12, 2022 @05:18PM (#32444040)
> Making money laundering harder is a good thing, no matter how many people here will try to convince you it isn't.

What a useless, puerile argument

Re:Arrest of suspected developer of Tornado Cash by Arnt on Saturday August 13, 2022 @05:16PM (#32453873)
The most important countries in the world are democracies. Even if the demos is occasionally influenced by poor arguments, the laws made are valid anyway. And the laws say (simplifying) that those who carry out money transfers have to take reasonable precautions against money laundering. Details vary, particularly wrt what's reasonable.

"Doing nothing" isn't reasonable though, and the people has decided. Calling the people's arguments puerile or useless makes no difference.

Re:Arrest of suspected developer of Tornado Cash by JohnHaugeland on Saturday August 13, 2022 @11:53AM (#32451013)
We don't generally speak in insults here.
Re:Arrest of suspected developer of Tornado Cash by jobs_throwaway on Monday August 15, 2022 @02:37PM (#32473548)
just a description
Re:Arrest of suspected developer of Tornado Cash by biglearner1day on Friday August 12, 2022 @07:57AM (#32437129)
> They have the technical means to control what goes on there or not.

Imagine the scenario wherein potential "illegal" crypto is mixed through another service. How would you expect Tornado to verify that without straight-up blocking specific services through transaction patterns?

Re:Arrest of suspected developer of Tornado Cash by fzfaa on Friday August 12, 2022 @07:35AM (#32436957)
> Otherwise it's like if you run P2P nodes and claim pedo pictures aren't your problem.

If the network is completely p2p, they really aren't.

OTOH, it seems foolish to develop/run a p2p network and publish your real name along with it. It's asking for trouble.