News for hackers. Stuff that matters.
Re:'People were sucked into schemes': Inside Molly White’s c... by dmitriid on Saturday October 22, 2022 @03:08AM (#33296188)
> there ARE crypto projects that have interesting applications

Name some. Some that can't be better done with an sqlite database running on a Raspberry Pi.

Re:'People were sucked into schemes': Inside Molly White’s c... by selestify on Saturday October 22, 2022 @03:24AM (#33296244)
I’m flabbergasted by how often HN commentators who should know better keep refusing to acknowledge the trade-offs in the technical implementations of crypto. What SQLite database running on raspberry pi is immune from seizure by relevant government authorities for helping with criminal transactions? Compare and contrast with Tornado Cash, which still works fine despite being OFAC sanctioned.

Now, you may not care for law evasion, and that’s fine. But it’s asinine to pretend that crypto tech is not better for such purposes than “an SQLite database running on a raspberry pi.”

Re:'People were sucked into schemes': Inside Molly White’s c... by throwaway290 on Saturday October 22, 2022 @03:37AM (#33296301)
> Now, you may not care for law evasion, and that’s fine.

I for example don't think it's a technical feature.

> Compare and contrast with Tornado Cash, which still works fine despite being OFAC sanctioned.

This is why it might just be the thing that ends unrestricted access to Internet. P2P sharing music or torrenting movies caused a lot of noise but in the end violating copyright is not a big concern compared to laundering proceeds from criminal activities.

Re:'People were sucked into schemes': Inside Molly White’s c... by vkou on Saturday October 22, 2022 @04:00AM (#33296388)
TC works just fine, if your definition of fine is 'I want to send my money into a black hole'.
Re:'People were sucked into schemes': Inside Molly White’s c... by grey-area on Saturday October 22, 2022 @05:18AM (#33296725)
> What SQLite database running on raspberry pi is immune from seizure by relevant government authorities

What cryptocurrency is? The answer is none, because there are several weak points to any cryptocurrency and if state agencies choose to take them seriously they can easily shut them down.

Re:'People were sucked into schemes': Inside Molly White’s c... by dmitriid on Saturday October 22, 2022 @05:55AM (#33296868)
> keep refusing to acknowledge the trade-offs in the technical implementations of crypto.

No, we don't. The thing is, every time a "good application of crypto" comes up the next question is "show these to us". And invariably those "good applications" have no idea what they are doing, require centralized trusted entities to function, and can be run from a Raspberry Pi.

Re:'People were sucked into schemes': Inside Molly White’s c... by Nextgrid on Saturday October 22, 2022 @09:04AM (#33297991)
The only real use-case of crypto is value transfer that is immune to government interference - I don't think anyone is denying that.

But for the vast majority of businesses which interact with the real world, it doesn't matter whether the actual logic is on a bulletproof, uncensorable VM if the government can just go after the few input/output points where the system interacts with the real world.

Therefore, it's no better than just running SQLite and much worse because crypto makes significant tradeoffs (to be resistant to adversary interference) that aren't actually useful here.

Re:'People were sucked into schemes': Inside Molly White’s c... by shriphani on Saturday October 22, 2022 @03:20AM (#33296230)
- Ethereum's PKI allowed an e2ee messenger app to be built w/o a phone number https://twitter.com/dwr/status/1575248197454135296
Re:'People were sucked into schemes': Inside Molly White’s c... by api on Saturday October 22, 2022 @03:30AM (#33296275)
Why do you need cryptocurrency for that? Just make a p2p app and trade public keys. The only reason Signal uses phone numbers is convenience in locating people and restoring accounts.
Re:'People were sucked into schemes': Inside Molly White’s c... by shriphani on Saturday October 22, 2022 @03:46AM (#33296330)
the pki does make life easy - ethereum address as a global unique id + seed phrase around for recovery + integrate this thing with the rest of the ethereum ecosystem (e.g. other apps can require ownership of an account on this app by looking for a signed message on chain)
Re:'People were sucked into schemes': Inside Molly White’s c... by postcynical on Saturday October 22, 2022 @03:31AM (#33296277)
Bitcoin. Ethereum. Etc.

They don't go down if you turn off your Raspberry Pi.

I also can be 99.9999% sure that they run correctly and Ethereum itself is pretty unhackable, as proven by the multi-billion bug-bounties.

The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable, i'm sure no malicious person/business can hack or change it, and if they do it has an auditable backlog.

Re:'People were sucked into schemes': Inside Molly White’s c... by brazzy on Saturday October 22, 2022 @05:04AM (#33296666)
> The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable, i'm sure no malicious person/business can hack or change it

And equally sure that any bug in there (and there will be bugs in there) is unfixable and any funds stolen through it unretrievable.

"smart contracts" are neither.

Re:'People were sucked into schemes': Inside Molly White’s c... by dmitriid on Saturday October 22, 2022 @05:55AM (#33296866)
> Bitcoin. Ethereum. Etc.

This is tech. Not its applications.

> The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable,

Ah, to once again have a child's wonder and belief in magic. Just add th incantation "blockchain ethereum smart contracts", and all is right with the world.

Meanwhile reality [1] just in the past ten days:

--- start quote ---

Insufficient validation on an OHM smart contract at Bond Protocol allowed an attacker to drain 30,437 OHM (~$300,000) from the Olympus DAO defi protocol.

Olympus DAO wrote in an announcement that "This bug was not found by 3 auditors, nor by our internal code review, nor reported via our Immunefi bug bounty."

---

On October 14, Ethereum reached a milestone that alarms many who have pushed for blockchains as "censorship-proof" technology. More than 51% of blocks produced in the preceding 24 hours were processed by relays that filtered out transactions involving Tornado Cash

---

The defi project Earning.Farm lost 748 ETH (~$971,000) to a hacker using a flash loan attack. The project contract was missing a check that a flash loan was initiated by the protocol, so the attacker was able to instruct the project to withdraw large amounts of funds

---

Rabby Swap, a feature of the Rabby crypto wallet, was exploited a month after it was first rolled out. An attacker discovered an apparent vulnerability in the Rabby Swap smart contract that enabled them to arbitrarily transfer other users' funds.

--- end quote ---

[1] https://web3isgoinggreat.com/

Re:'People were sucked into schemes': Inside Molly White’s c... by pjc50 on Saturday October 22, 2022 @06:23AM (#33297017)
> i'm sure no malicious person/business can hack or change it

Words that precede every DeFi hack with a ridiculous nominal dollar value.

Re:'People were sucked into schemes': Inside Molly White’s c... by postcynical on Monday October 24, 2022 @02:26AM (#33313526)
Wrong conclusion. The hacks never targeted the underlying platforms and security. It was always the bugs on the smart contract level. The same way you can't blame Java/Ruby/Python being insecure because of SQL injection attacks.
Re:'People were sucked into schemes': Inside Molly White’s c... by Nextgrid on Saturday October 22, 2022 @09:08AM (#33298012)
What useful thing do those smart contracts achieve in practice? The only place they have authority over is their respective blockchain. They are powerless in the real world, always relying on some centralized entity to sync real-world state with blockchain state, but doing so inherently throws away all the benefits of running on a blockchain, so you may as well just let the centralized entity run a good old database and call it a day.
Re:'People were sucked into schemes': Inside Molly White’s c... by marshmallowmad on Saturday October 22, 2022 @03:21AM (#33296231)
Do you trust a single Rasperry Pi over a secured blockchain? If so, I think we can agree to disagree.
Re:'People were sucked into schemes': Inside Molly White’s c... by shawabawa3 on Saturday October 22, 2022 @03:25AM (#33296252)
A lot of crypto projects require trust in the governing body, who are very often pseudonymous and untrustworthy

In which case it doesn't matter if it's on a Blockchain or a raspberry pi because the consensus layer being trusted is secondary

Re:'People were sucked into schemes': Inside Molly White’s c... by Nursie on Saturday October 22, 2022 @08:47AM (#33297882)
"A secured blockchain" is hilarious in concept to me. Looking at cryptographic constructions in general, 'secure' tends to mean "some multiple of the current total computing power of the world, running for hundreds of thousands to billions of years, might be able break the system".

With blockchains we have "a subset of the current compute power on the planet could start subverting it immediately".