Ethereum Wallet and Mist Beta with Hard Fork choice | Hacker News Reader

Ethereum Wallet and Mist Beta with Hard Fork choice

github.com

66 pointsUrsium47 comments

Ethereum brushed off my bug bounty submission and then began this hard fork junk so I documented and packaged my exploit publicly. It hasn't gotten much exposure yet, please have fun with it.

"Walking Past Same-origin Policy, NAT, and Firewall for Ethereum Wallet Control" - https://medium.com/@rhodey/walking-past-same-origin-policy-n...

Nice post. It looks like a potential issue for someone specifically running geth with that config, but ok for an end-user using Mist or Metamask.

thanks! I didn't take the time to setup Mist but my understanding is that Mist is especially vulnerable because it's bundled with a wallet and used for browsing DAPPS which always require the JSON API to be enabled.

It's not since Mist (and Metamask) injects the web3 object into the page, no jSON-API is used. It also displays a confirmation dialog each time a transaction is generated. If setting up Mist too much trouble to try this, you can always try Metamask https://metamask.io/

It's been posted to r/ethereum. Check there.

https://www.reddit.com/r/ethereum/comments/4ta6go/walking_pa...

From the Medium blog:

> The cypherpunk, anarchist future wasn’t supposed to be about stronger banking guarantees and wealth redistribution among Reddit users.

I think your interests may fall more closely in line with what the Monero folks are doing. I'm not aware of any other cryptocurrency project with better privacy features. And they're working directly with the I2P developers to get better privacy at the network level(Kovri).

This looks really bad from the perspective of trusting the currency to actually retain its value. What if you end up on the wrong fork, and that thousands of dollars in Ethereum you accepted to send out physical goods ends up being worthless?

What's the point in saving the DAO if it kills the whole purpose behind the currency?

Won't you own Ether, and everything else, on both branches in the event of a fork?

Ether that you own (not related to the DAO) before the fork happens would be unaffected by the fork. But after the fork, suppose you accept payment for something. You can accept payment in cash, Bitcoin, Ether-on-left-side-of-fork, or Ether-on-right-side-of-fork. I suppose you could also insist on getting paid in BOTH "Ether-on-left-side-of-fork" and ALSO in "Ether-on-right-side-of-fork", but that starts to get really complicated.

In practice I think I'd sooner switch back to a non-forked cryptocurrency than try to deal with running multiple forks and ensuring that I'm getting paid on all of them. That sounds like a right huge mess to deal with, as you point out.

Not if the transactions happen after the fork, and on the "wrong" one. If you're purely using Ethereum as a store of value, and already have all your funds put into it, then this won't affect you, sure. But if you're actually trying to use it as a currency like intended, then you're screwed.

Money isn't very useful if you can't transact it at all for fear that new transactions won't be any good.

That's not confusing at all.

What do you mean?

I assume he's being facetious, because it is confusing. Especially imagine someone requesting payment in Ethereum, and you think you've paid, and then they come back and say that you paid with funds on the wrong chain, and to re-send the funds on a different chain. There isn't a client I'm aware of that supports simultaneous operation on multiple chains. It gets very hard to deal with very quickly.

Right, but that's simply how blockchains work.

As I understand it they only activate the fork if enough miners vote for it. If >50% of hashpower doesn't fork, then nobody forks. If >50% of hashpower forks, then that's known ahead of time since the vote was carried out in public by that same hashpower.

That's how the softfork worked before it got scrapped. A hardfork literally splits the network in in two, it's basically like creating a new coin shares the previous history.

How does the fact that it was a hardfork invalidate either of the statements above? It's known ahead of time, and if not enough people adopt it then it doesn't get activated at all.

This is also an existing problem in every cryptocurrency. Just because bitcoin hasn't done any controversial forks yet doesn't mean it will never happen.

There has been a push for a longer blockchain for quite a long time now and when the mines dry up it may become a very hot potato

The way it invalidates the above statement is that there's no code that decides whether the fork happens beside what flags the nodes are launched with. At the specific block number the nodes that accept the fork will only validate the hardfork blocks as correct while the nodes that don't support the fork will reject these blocks. Thus two chains will co-exist for an unknown amount of time, not just one or the other.

To some extend what you're saying is true though as it's very unlikely that both chains will remain active/retain it's value and therefore miners on the losing chain will likely move to the winning chain very fast to avoid losses incurred from the cost of power.

>there's no code that decides whether the fork happens beside what flags the nodes are launched with

That's not what you said above. You claimed that the mere fact that it's a hardfork means that you cannot implement anything to only activate if there's a majority. But it's extremely simple to do so. Just check whether a supermajority or a plain majority of recent blocks have signalled support for the hard fork, and only produce hardfork blocks if they have.

Quoting from the blog post https://blog.ethereum.org/2016/07/15/to-fork-or-not-to-fork/

>The community tool carbonvote will be used to set the default fork option for Geth. At block number 1894000 the votes will be tallied, and the outcome will determine whether the default is set to fork or not to fork. Then merging the DAO fork PRs will proceed, followed shortly by a release for both Geth and Mist.

So they're only going to merge the hardfork code if they already have the votes.

i did not mean to imply that a hardfork can't be implemented in that fashion, I should indeed have written "the hardfork" instead of "a hardfork" as that's the way this specific hardfork has been implemented, I appologies English is not my native language.

My understanding of that blog post is only what the default value of supporting or not supporting is meaning the hardfork code will be merged in either case and that it's only whether it's active by default that's changed depending on the vote.

Not that it really matters anymore as block number 1894000 has already passed and the code merged with hardfork support enabled by default.

It's a good thing that smart contracts have allowed us freedom from human error and bias.... I guess we can just call them "contracts." now.

Human error and bias are pretty much impossible to eliminate in any system that involves humans making choices.

Intersting idea. Perhaps we should have a system of governance of the "contracts" whereby we elect "representatives" who appoint "judges".

Dude, we could even name it something cute, like when you're trying to get a girl to marry you... Courting, yes, we could call it a Court!

Poe's law in full effect.

If you're serious: Why not make use of existing infrastructure (current courts, laws, etc) rather than reimplementing all that again on top of ethereum? Also, what prevents this new layer from becoming as corrupt and bureaucratic as the one we currently have in place?

I was being facetious :)

I think that's kinda where http://urbit.org/ is going with its constitution.

Without irony, it would be awesome to have a court system on the internet.

smart "contracts" = essentially a severless service running on a decentralized platform

smart "contracts" != legal contracts

How decentralized is a platform that hardforks via human intervention? What happens when the 51% choose to take the money of the 49%? If your blockchain changes the rules, because someone followed the rules of the code, but following those rules led to the "wrong" people losing money. Then your blockchain is more harmful than useful.

> What happens when the 51% choose to take the money of the 49%?

What happens when the 51% desires to violate the rights of the 49% in general? (Or, more commonly in the real world, 10% desires to violate the rights of 0.5% and 85% don't care.) Direct democracy refuses to solve that issue in any way other than assuming that the minority will be successful at returning violence against the majority, or that everyone will just get along.

In practice, though, nobody's actually stealing your money here... you can still use the old chain if you want, it'll just be devalued to the point of uselessness.

"your blockchain"?.. This is not a football team or a clan, there is no "my"/"your"...

Decentralized systems work by consensus and by choice, for the DAO the consensus of the community is to stop the theft. Some might disagree and move to their own fork.

In the scenario of the "51%" you described, the "49%" would simply move to their own forked chain if they so choose.

I was a hardcore Ethereum fanboy, but this fork completely turned me off.

Too many of the Ethereum devs had way too much of their currency tied up in the DAO. It's a classic conflict of interest. Don't forget that Ethereum had a significant premine as well (which is very shady in its own right), so the early devs and adopters have a lot of ETH to throw around.

> Too many of the Ethereum devs had way too much of their currency tied up in the DAO.

Do you have any evidence of that? I know about the address that was found in both the Foundation wallet and as a DAO holder but I haven't seen any other developer shown to be DAO holders. Stephan Taul would obviously be a big DAO holder as one of the people behind it but he's not with the Ethereum Foundation anymore (having left to work on Slock.it and The DAO).

Even if they have a conflict of interest they seem to be going out of their way to let the community decide what to do.

I'd expect that Gavin Wood has substantial DAO holdings. He might not be a foundation member, but the way that ethcore is acting here doesn't make me think it's operating in an unbiased fashion.

  "The creatures outside looked from smart contracts to    
   regular contracts, and from regular contracts to smart  
   contracts, and from smart contracts to regular contracts 
   again; but already it was impossible to say which was which."

Fiat currency bad, cryptocurrency good!

It's just kind of crazy to me the amount of DAO-specific lines of code that have been put into apparently Mist and Geth, e.g. just search "DAO" on these links [1], [2]

How many many man hours have been spent on introducing a single DAO-fork feature into the code? They didn't even build it as a generic "community referendum fork" feature just something specific to this situation? They can say "the community decides" but the community didn't decide to dedicate that amount of dev resources to putting a band-aid on a single community member's fuckup. What a mess.

[1] https://github.com/ethereum/go-ethereum/commit/1b2941cd56d69...

[2] https://github.com/ethereum/mist/commits/0.8.1

I think this is what they call throwing the baby out with the bath water? We didn't need immutability right?

You know what's funny about a hard fork "choice?" If you don't own majority shares, or have social influence with the majority, you get to choose to go along with the mass, or screw yourself. Great choice!

So, uh, in layman's terms, where's the money now?

On both sides of the fork.

The bet is that one side would die out, and most of the exchanges agreed that they would stop operations until a clear winning fork is determined.

THey'll only halt deposits/withdrawals. Trading will be uninterrupted.

Reply on news.ycombinator.com