Hacker News Reader

Comment by pjc50 | Hacker News Reader

Well, that was kind of inevitable. Building a financial system out of pure code with no humans in the loop and no legal structure is building a self-distributing bug bounty piñata. It's decentralised, so there's nobody who can throw a breaker and shout "stop!"; cryptocurrency transactions are irreversible, so thefts are permanent; and it's somewhat anonymous, so thefts are hard to trace.

It also demonstrates that being first-to-market trumps security. If the DAO had waited until a full formal verification system exists and had been applied, they wouldn't have been able to pick up the $160m of overenthusiastic money keen to rush headlong into the hands of hackers.

View on HN

I find it endlessly amusing that people are willing to bet their cold hard cash on "this code has no bugs".

When widespread old and tested code like OpenSSL has massive security bugs, what chance does something as new and in-development as Bitcoin/Ethereum have? An in the case of Ethereum, the contracts themselves?

While I agree with your point, there is at least something to be said for blue sky codebases being able to use more secure languages/platforms and secure coding practices from the get-go, versus legacy codebases. Prevention of overflow and UAF vulns come to mind as an immediate win.

> I find it endlessly amusing that people are willing to bet their cold hard cash on "this code has no bugs".

It's not "this code has no bugs" it's "this code has less visible bugs than the lower hanging fruit". If it's harder to find than any bug in any system with bitcoin (or other ethereum) in it, then people will find that stuff first. Bitcoin gave us out here in the IT world, for the first time in history, a realistic way to measure the large-scale security of various kinds of systems. Microsoft, for example, has not had the bitcoin from any of their wallets stolen. With every flaw that's found, we get the chance of learning how not to fail in the future.

Furthermore you have to invest in something. And it's remarkably hard to invest these days. Just try buying a house with ethereum, see how frustrating it is.

> a self-distributing bug bounty piñata

I think this is great actually. Maybe not for the people involved right now but there will be a very strong Natural Selection pressure on contracts.

It will be interesting what type of contract emerge and survive over time, the type of languages used to improve or proof robustness, etc.

Assuming that the "trust nobody" model survives these hard selection events. One more and the big money will dry up.

Exactly what I was thinking.

If they had some sort of fraud-related authorized structure, which was able to "reverse" the result of an obvious software bug, I would say that it should've been much more stable financial system.

Except that would require human intervention. And the whole reason why people love cryptocurrencies is removing the "man in the loop", with administrative power to deny, reject, roll back, or deem illegal their transactions.

It's like these people have never seen War Games.

(It also attracts the kind of people who think that banks, financial institutions, VISA and Paypal are "very likely" to defraud them while something entirely new and unproven with no legal structure is somehow less likely to defraud them or lose their money. See also people who think that bitcoin might be more stable than the US dollar.)

They sorta do have that. If most of the community agrees to run a software update that rolls back the theft, then it'll happen.

Yes! Someone tried something new and difficult, and failed on their first try, therefore it must be impossible!

Reply on news.ycombinator.com