Comment by nadaviv | Hacker News Reader

Comment by nadaviv | Hacker News Reader

Parent Full thread

> Light nodes have the same guarantees about the integrity and irreversibility that full nodes do.

This is not true. SPV nodes blindly follow the longest chain and are at the mercy of miners. Running a full node guarantees you that all the protocol rules are being followed to the letter, while an SPV node cannot verify chain validity rules (like the 21M coin limit) and could be fooled to accept payments with money made out of thin air.

> Ethereum is that it had a hard fork to revert a millionaire hack caused by a bug in early stages of the project; whereas something not too different also happened to Bitcoin

The Bitcoin developers fixed a bug in the Bitcoin protocol. The Ethereum developers bailed-out a buggy smart contract written by a third-party, where the bug had nothing to do with the Ethereum protocol itself. I don't think the two are comparable.

Something that would've been comparable is the Bitcoin developers doing a chain-rollback to save the funds lost by MtGox. Which of course would be a horrible idea.

Also, when that happened in 2010, Bitcoin was a pet project valued at $0.08, with a total market cap of ~$250k. Ethereum was nearly a two-billion dollars project when they bailed out the DAO!

> where the bug had nothing to do with the Ethereum protocol itself. I don't think the two are comparable.

You're defining "bug" to fit your purposes. It wasn't "just a faulty contract". The entire protocol had a reentrancy situation that wasn't intended by any of its developers nor expected by any of its users, and that went against the expected semantics of its official programming language; it was a protocol bug, for any sensible definition. I don't see anyone neutral arguing it wasn't.

If you argue The DAO hacker had the right for the Ether he got because "that's what the code said", you could also claim the Bitcoin address had the right to claim his billions BTC, because that's what the code said back then. He only followed protocol rules and got all his money taken away by the hard fork.

> see anyone neutral arguing it wasn't.

Well, FWIW, I've never heard _anyone_, neutral or not, claiming the DAO hack was a bug in the Ethereum protocol before now...

And that's because, well, it very clearly isn't. hackingdistributed has a good overview[0] of the coding bug in the DAO that enabled the hack which I recommended you to read.

Looking at this another way, this could've been avoided by the DAO developers if they developed the smart contract more carefully. And the exact kind of bug that lead to the hack was still possible on Ethereum following the bail-out hardfork. So how can one claim the hardfork fixed a protocol bug?

> If you argue The DAO hacker had the right for the Ether

I didn't say that. I only argued about the differences between fixing a protocol bug and bailing-out companies that build on top of the protocol.

[0] http://hackingdistributed.com/2016/06/18/analysis-of-the-dao...

> So how can one claim the hardfork fixed a protocol bug?

If I understand it, it isn't fixable without affecting every existing contract, so, the best fix was to patch the problems it caused, patch Solidity, introduce safer opcodes that avoid it, and invest heavier on security, which is exactly what was done (just see how much the EF is spending on security-related grants...)

I agree it wasn't a bug in the protocol. However, it was an issue that people in general weren't aware of, and even the official tutorial code on ethereum.org had similar vulnerabilities. For that reason I think the fork was reasonable.

By comparison, Parity's wallet bugs were just a result of carelessness, and independent audits probably would have discovered them. Consequently, the community strongly pushed back when Parity tried to get a fork for the second one.

Reply on news.ycombinator.com