Hacker News Reader

Comment by cocktailpeanuts | Hacker News Reader

Solidity needs to get rid of features like library and inheritance. If you write an unstoppable contract that is responsible for holding hundreds of millions of dollars, you alone should be responsible for it, and not some library you used.

Better yet, people who have the mindset that it's ok to have these hipster "modular" features that spread out the responsibility (for whose benefit?) should really not be working on such fundamental pieces of technology. If you write software that holds people's money and you fuck up, you and only you are responsible for it.

This is a recurring theme with the Ethereum community where people complain about how there was a bug in the system which resulted in a huge hack and people losing tons of money, and developers say "hey don't blame me I just used some library, it's the library's fault".

View on HN

In this case the library was also written by Parity. They were trying to minimize the gas cost of deploying a new wallet, which imho doesn't seem like the best thing to worry about optimizing, for a contract that may hold millions of dollars.

Yeah - they saved what 50$ in gas?

Certainly each person rolling their own is going to end up worse than the use of modules that are improved over time.

Most of the trouble is on the module boundary, so improving the modules themselves probably isn't worth as much as you'd think.

Since contracts are immutable, you need modularity to be able to fix bugs like what happened with Parity. The problem is that Solidity libraries are also immutable, which means you can't fix them. The solution is easy: just use contract modules, not libraries.

No you don't. That's a myth.

Having modularity in these things only amplifies the damage when something DOES happen.

I'm not saying it is bad to have a centralized auditing of contracts, but I am saying it's not a good thing to simply import libraries and inherit some other abstract contract you don't fully understand when it comes to irreversible contracts.

This is a new type of problem we as a humanity have never faced before, so we need a different type of solution.

> This is a new type of problem we as a humanity have never faced before, so we need a different type of solution.

Could you elaborate on that? How is it a new problem? I would think it's similar to problems with hardware components or FPGA libraries, but maybe I'm missing something?

Crypto used to be a purely technological problem, which means if you have a secure cryptographic lock in your bank account and someone steals it from the bank, the bank is responsible to get it back to you.

But with cryptocurrencies, it's not just about technology but ties into other issues that normally have been tackled on a social level. So in this case there is no "bank" you can complain to or no one to sue.

Of course, you could say Ethereum as a whole can do a hard fork just for this, but that's another discussion altogether.

Parity actually used a contract module in this case.

> hey don't blame me I just used some library, it's the library's fault

Who really says that?

Equifax: https://www.infosecurity-magazine.com/news/equifax-blame-bre...

When people blamed Ethereum for being the cause of the DAO, the devs said it's not Ethereum's fault but the ones who wrote the DAO, which is technically true, which is why I'm making this point. It's not about technology, it's about responsibility.

Also, a while ago some guy complained about how he lost his money using myetherwallet, and the problem was NOT because of myetherwallet but a library they used. So the guy from myetherwallet told reddit that it's not their fault, which is again technically true, but again fits into what I'm talking about.

Dependency spreads out responsibility, which works out fine for traditional finance because everything is reversible, but not in this new economy.

The whole point of Ethereum is for people to be able to use custom contracts. People would be using Bitcoin if they only wanted to be able to use contracts by the Ethereum -- er, cryptocurrency developers.

Contracts in the real world are written with the understanding that they rest on the shoulders of millions of pages of legislature and legal precedents.

For the most part, they work just fine.

That's because contracts in the real world are reversible.

Given the DAO fork, and the upcoming fix to Eth, so are Eth contracts.

Not sure if you're arguing for the sake of arguing.

Reply on news.ycombinator.com