Anyway, I think that "Code is law" is a bad phrase. A more appropriate (but still silly) phrase would be "Code is law enforcement". The laws themselves still need to be written by people, should still be subject to context-dependent interpretation and should still have room to be changed.
That’s an interesting approach. The popular conception from the evangelists is that code is law, because it’s meant to be a major advantage. By saying it’s not, what real benefits does a DAO/on chain contract offer? Certainly nothing like legal recourse like you’d get in an actual court in the real world.
And ultimately, it appears that code is neither law nor law enforcement. It’s just an opportunity for hackers to occasionally wipe everyone out and a community to scramble to roll things back with significant mud on face
The "real world" is full of corrupt institutions and people in positions of authority that are not working with the interests of ordinary citizens in mind.
The "real world" is also a place where people have ubiquitous access to the internet, but don't have access to banking systems, easy credit or fast/cheap ways to settle minor disputes.
For these situations, a system that can provide an alternative to the established, well-functioning institutions is better than nothing, even if flawed.
None of this is static. The DAO hack showed a flaw in the then-current practices of smart contracts. Developers learned from it, changes were made to the system. The system became more robust after it.
Much like any organism living in an ambient with evolutionary pressure, different mutations come up. After the DAO hack, some prefer to write their contracts in a way that allow some level of control by trusted admins, some of them still don't like the idea of privileged access to the contracts but will favor adoption of contracts only after formal verification. Some saw that as opportunity to specialize in contract security and become auditors.
None of these approaches are perfect by themselves. Other bugs will come, other "hacks" will exist, and hopefully each of these will act as evolutionary filter on the existing system.
Without a central authority, this is the only I see for systems to evolve. And if the whole point is to create an alternative that does not depend on a central authority, I'm fine with the current approaches to risk management.
Didn't the first DAO cause a fork of Ethereum? And isn't the most important part of investing understanding what you're investing in?
Apparently these contacts as code are so complex in practice (DSLs require understanding it and all its dependencies.) they tend to be foot guns, waiting for someone more dedicated to find and exploit them.