Hacker News Reader

Comment by seibelj | Hacker News Reader

> If the attacker managed to liquidate their Zcoins at an average price of $1.25, they may have netted themselves upto USD 750,000.

If you are a skilled programmer / security expert / mathematician, crypto currency exploit creation seems to be an extremely lucrative hobby.

View on HN

Indeed. Everything that crypto-currency touches gets an automatic bug bounty. With rewards that are much nicer than limited editions t-shirts.

Depends what side of the reward you are on.

the savant programmer obviously

There's even room for marginally technically skilled to rake it in. I think Karpeles is still out on bail. And there's a few that did well with just marketing skill and vaporware mining gear.

Don't "mine" gold, sell shovles.

Don't "sell shovles", license spellcheck software.

I'd take that as not even needing to sell what's needed, sell approximately what's needed. Your snake oil just needs to make their cough hurt a bit less, not cure their tuberculosis.

spellcheck? I have no need for this, I am not a witch.

Especially because a lot of the exploits end up being simple integer overflows or failed copy-paste

Do you think this is immoral?

I am genuinely curious as to what the arguments would be one way or another. People are taking a risk with these things and they know they're risky. So it's not really stealing.

I believe it is a crime, both in spirit and on paper. In spirit, you took something that was not yours and not meant for you, and by selling the coins you decreased the value of everyone else's. On paper, let's say that the developers behind whatever coin you hack decide that they are going to take no action. You still run afoul of countless computer security laws designed, however poorly, to protect people from hacking, so at least in the first world you could find yourself in a legal bind if your identity is ever discovered. Even if the devs don't go after you, the rest of the community may, or the government may of its own accord. Now, in keeping your identity private, you have to launder the money, putting you in violation of even more laws and ones that the government will most definitely care about. The biggest player left is probably the IRS, who will take all kinds of interest in either your newfound, undisclosed wealth, or your half million dollars in untraceable gambling wins. It's an extremely reckless move unless you are effectively a pirate living in some lawless part of the world with good connections to foreign banks.

The OP's point was about morality, and it is as immoral as cheating in any system. Whether it's a crime is entirely different. Crime necessitates a judicial system, and the whole framework of crypto currencies has be outside the purview of any government or judicial systems. So the word crime itself doesn't mean anything in this context. Secondly, your argument relies heavily on the gravity of this act, which is entirely derived from the implied value of the coin. In isolation, this is no different from someone cheating in a computer game. Note that you cannot make the computer game analogy with other markets and banking systems easily because of dependence on other inputs. This, in contrast, is completely isolated from the rest of the world. As such, the guy may not do anything with the coins, and they would cease to exist (in their universe much like how they came into being). Would your argument still hold ? The fact that people have created a secondary market out of the coins, which came into existence out of thin air in the first place, doesn't automatically determine the criminality of the act.

This doesn't really address the morality issue. Suppose you could get away with it. The question remains, did you hurt people who didn't expect it etc.

When someone comes to play poker with chips, is it immoral to beat them and take their chips? No, they factored it in.

However, is it immoral to figure out a new collusion strategy and beat them?

Was it immoral to figure out a card counting strategy to beat casinos?

In other words, is it immoral to figure out new strategies in what is essentially an experimental game where participants assume there is risk?

In well established games like poker, which explicitly have gentlemen's agreements of "no collusion", it may be immoral.

But in a new experimental system such as a cryptocurrency whose software may be buggy, is taking advantage of the bugs really immoral?

When is it "buyer beware" and "a fool and his gold are soon parted"?

Isn't there any threshold for taking the money of a risktaker?

> You still run afoul of countless computer security laws

Only if you're citizen of/doing it in a country with such laws.

And with all that said, this type of activity is still attractive to some folk.

I'm content getting my kicks out of intentionally running the occasional red light.

But it takes all types. Imagine how boring the world would be without crime!

Well, crypto/bitcoin businesses in general tend to be quite lucrative. However lots of risks as well. For a security researcher there are no downside risks as much.

> crypto/bitcoin businesses in general tend to be quite lucrative.

That's called a pyramid, or ponzi scheme.

Just to clarify: are you saying Bitcoin is a Ponzi scheme?

Which is a great thing for the whole

Well, same thing goes to paper note forgery.

Except that, for the moment, paper note forgery is illegal but creating "extra" crypto coins doesn't seem to be.

You're never beyond the reach of a civil suit. If you identify yourself with the scheme and you're in the same country where there's adoption, you could be easily targeted.

Plus, the language in 18 U.S.C. § 1030(e)(2) (courtesy of CFAA) refers specifically to "any computer, when [it affects] use by or for [a] financial institution." And later it mentions "...affecting interstate or foreign commerce or communication...". This statute is one that gives so much leeway to prosecutors that it's frequently abused.

I would really like to see this happen. Without an EULA, is it even possible?

Perhaps the next generation of cryptocurrencies can have a simple EULA that prohibits exploitation and can be used to firewall off stolen coins.

Uhhh, no. The whole point of cryptocurrencies is that they are permissionless.

Government censorship of coins or transactions is an attack vector, not a feature.

An EULA ("End-User License Agreeement") has to do primarily with copyright (17 USC [1]). As such it's pretty much orthogonal to the criminal statutes related to this act of "misusing" cryptocoins.

> next generation of cryptocurrencies can have a simple EULA

This is anathema to the nature of cryptocurrencies, all (?pretty sure all that matter anyways) of which have Open Source implementations.

Really, most cryptocoins which are worth anything have already had a big market cap "bounty" that has effectively proven their safety.

We don't need a EULA. Like I said, you could maaaybe sue for damages. Unfortunately there's no easy way to undo the impact to a coin's reputation once it's shown to have a weakness like this. Even once the bug's patched and the nodes all get back on board, exchange rates will suffer for a long time.

[1] https://en.wikipedia.org/wiki/Title_17_of_the_United_States_...

You are getting attacked for poor wording. It's reasonable (and there is precedent) for something like a blockchain fork that voids the value of bad coins. You'd need some implementation of majority vote, though (a jury of your peers, weighted by hashrate?)

TOR + Shapeshift

or in the case of Zcoin just come back into the clear chain.

And paper notes have the unfortunate characteristic of being.. paper.. the risk:reward logic is much different if you can pick your own jurisdiction to operate from and hide behind 7 proxies. It's also a very modern business model to avoid big capex expenses like printers and special paper.

Reply on news.ycombinator.com