Thoughts on the DAO Hack
hackingdistributed.com
hackingdistributed.com
You know how they always say "if only we knew then what we know now about Internet security, then we would've definitely made the Internet secure by default in the 90's!"
Except, even if they did know, they probably wouldn't have gone that path. There's always a strong incentive towards making stuff "easy to use", and the more secure you want to make it as well, the more work you have to put into it, to a point where the developers may think that it has "enough" security and they shouldn't waste too much funds on making it more secure (even though it's not really enough).
The "advantage" something like Ethereum has now compared to the Internet in the 90's, is that thousands of sophisticated attackers could try to hack it from day one, thus showing Ethereum developers how naive they are early on.
This is good news, because we'd rather have something like this happen early on, then 10-20 years from now after all of the world's banks and governments adopt it, and instead of a $40 million heist, we have a $4 trillion one.
I'd be happy to try something like this again, but I think the current iteration clearly needs work and should be dissolved / refunded so that we can make that choice at a later date.
You're saying you trusted it, got burned, and are already looking forward to the next one?
The DAO was described as "the code of the contract is the absolute truth, any other description is just a guideline", which was hailed as a new miracle by the investors, and now that it doesn't mean mountains of gold the founding principles are suddenly not important anymore?
The "hacker" simply used the DAO as it was meant to be used (i.e. according to the smart contract code), and deserves the funds. If there is a hard fork, I hope he sues slock.it for controlling the DAO, and stealing the funds he is owed according to their own terms ("The contract is king").
Actually, a bug was exploited.
By that reasoning, I should be allowed to legally contact Amazon customer service and socially engineer access to others' accounts, then place orders to be shipped to myself. If the customers call and cancel the orders as fraudulent, I should be awarded damages in a lawsuit against them.
It's also worth noting that, if you're a person that doesn't have any monetary interest in The DAO, you don't have any right to vote for anything, meaning you're no different than somebody standing near a poker table spouting out your philosophies about where others should put their money (aka in the industry as a railbird).
You don't have such an agreement with Amazon.
Regarding your edit: I don't want to vote for anything. I'm simply pointing out that there is a (real-life!) agreement, and a party (slock.it et al.) not holding themselves to that agreement, and that I'd enjoy seeing that played out in court, where it belongs.
I never decided that.
The idea of distributed investments and unstoppable tools that are distributed isn't about "f* the government" or anarchism; it's about not letting anyone other than a consensus of ourselves manipulate us.
> I'm simply pointing out that there is a contract, and a party not holding themselves to that contract, and that I'd enjoy seeing that played out in court, where it belongs.
The point is, if we disagree, what can you do, if you don't have any interest or control over this (hint: nothing)?
Regarding your last paragraph: I'm not sure why you're attacking me personally here.
> I'm not sure why you're attacking me personally here.
Are you sure you're replying to the right person?
That's called a loophole in a contract, and folks exploit those all the time.
You're on the receiving end, which sucks, but based on the rules of the DAO, you have no recourse.
The entire presupposition, when putting money into this thing, was that the code was the contract. Period.
If you failed to audit the code to find the loophole, you signed on to a financial arrangement without fully understanding the nature of the contract.
If you don't feel you're qualified to evaluate the terms of the contract, maybe we've just discovered a reason why "smart contracts" aren't such a great idea after all...
This actually exists, if you code for it. You can make your contract call out to functions in other contracts, and repoint if you need to upgrade.
But that means your users have to trust you not to abuse the power, so it's a tradeoff.