Comment by Meekro | Hacker News Reader

Comment by Meekro | Hacker News Reader

This is actually super-clever, let me try to explain. Electrum is unique in that it's not a "real" bitcoin wallet. To save time and computer resources, it doesn't download the entire blockchain but rather connects to an Electrum Server which will do the blockchain stuff on your behalf.

The Electrum Servers (anyone can run one) can check your balance and send bitcoin on your behalf. Thanks to the magic of cryptography, this is all perfectly safe. If you send bitcoin through them, they couldn't redirect it to themselves. The worst they could do is refuse to send it.

Turns out Electrum Servers are allowed to return custom error messages to the client, though. So this guy set up a bunch of these servers and had them always return a message saying "Please update your electrum here: http://github.com/my-hostile-electrum/steal-yo-coins.git". What's worse, because Electrum is using the QT QMessageBox, these errors are displayed with full HTML rendering, making them look even more convincing.

So, crap. Bitcoin is, as they say, a bug bounty on the entire world.

Here is a picture from the Reddit thread [0].

Absolutely unacceptable design not to account for something like that when programming software. There should be an explicit notice of where the message is coming from. I see people blaming users for trusting a new GitHub repository, but the fault rests solely on the contributors to the project responsible for this.

[0] https://user-images.githubusercontent.com/29142493/50359293-...

You're right, and Electrum actually has a history of severe security bugs. I think there was one a while back where any website you visit could use JS to connect to Electrum's RPC interface and do things on your behalf.

It seems unfair to claim that anything is "unacceptable" in free software. If you're not paying for it then be thankful for whatever you get. No one is forced to use it.

I don’t get it. Why should anyone be thankful that they lost bitcoins, simply because the software was free? I really dislike this trend of absolving free software of literally any quality standards whatsoever. Don’t act entitled, sure, but you’re doing no one any favors by refusing to even express desire for better quality.

If a friend gave me a free safe, and then a thief cracked it open easily due to a fragile lock and stole my money, I wouldn't blame my friend.

What if your friend gave you a free coffee with poison in it?

All coffee has poison in it. Acrylamide is a known carcinogen. Caffeine is also poisonous: if you drink about 100 cups of coffee it will literally kill you.

You'll have to be more specific about the type and quantity of poison.

have you ever considered acting in good faith on the internet?

Have you considered that the question was obviously not asked in good faith? Ask a silly question, get a pedantic answer.

Personal attacks are not ok here, regardless of how wrong or annoying some other comment is. Please review https://news.ycombinator.com/newsguidelines.html and post civilly and substantively, or not at all.

The word “blame” carries a different connotation than the word “unacceptable” which was used in this thread.

I would!

If you're going to be so negligent that you don't care to design your free product in such a way that it doesn't let people's money get stolen so easily, it's better not to release at all.

Complicated security vulnerabilities, I get. It's tough. But just the basic thought to inform someone that a message is not from the Electrum "team" would be nice.

It's unreasonable to expect everyone to read every bit source code of all open (or closed) source software they use.

If I were to use Linux for free, and in this imaginary world all of the sudden I had my banking credentials stolen from a similar lack of care, I think I'd be justifiably upset.

Should the people who lost money be thankful they got to use Electrum in the first place?

There's no negligence in giving software away for free. No one is stopping users from doing their own security audits, or hiring experts to do it for them. Beggars can't be choosers, and if users are upset at anyone it should be the thief.

Cryptocurrencies are speculative trading vehicles, not money. No one actually lost anything of real value. A fool and his coins are soon parted.

If Visual Studio Code, which is open source software I use daily and have not audited, tells me to update and I lose something of value to me from it, I'm going to be furious.

You can debate about the "real value" of Bitcoin or lack thereof, but I'm sure it had "real value" to the people who lost it. If people will pay $5 for Bitcoin, its worth at the time is $5, if $3,000, "real value" is $3,000. But that's besides the point.

Again, I've never really used Bitcoin and don't find it particularly promising, it's not my hill to die on. I do care about an issue like this, though.

If having quality software is important to you then you might want to actually pay a vendor that you can hold accountable rather than depending on the kindness of strangers. Free software is great! I use it all the time. But I'm under no illusions about imaginary negligence or accountability.

So does that extend to publishing text without software? No one is forced to believe my free phishing message right? Or my free advice about drinking arsenic to cure cancer?

It is a growing trend to annotate the readme of an open source repo with a kind of statement of confidence. "This is code I'm not vouching for but want to share because it may be useful to others" and "this is my open source project that I consider to be production ready and will tie my reputation to" are very different things.

This was very obviously the second, so ethical duties involving lying to people for your own benefit and concepts of due diligence clearly come in to play.

And even if this makes no sense in your ethical system, at least be aware that people think that way and will remember your name in these kinds of circumstances even if they have no legal recourse.

In a worldwide software ecosystem there is no universal standard for ethics or diligence. Unhappiness in human interactions can usually be traced back to a mismatch of expectations. When I use software I expect nothing more than the formal legal agreement explicitly spells out. That way I'm often pleasantly surprised when software does anything useful at all!

For production software I've found it's wise to have a paid vendor to hold accountable (single throat to choke). Paid support is available for most major FOSS packages.

Ok, you convince everyone in the world of that system of ethics and problem solved!

Until then, set expectations explicitly so that people who make different assumptions from you don't get mad at you. It takes 5 minutes to be explicit in your readme.

Somehow everyone else in the world deals with similar issues without the special pleading so common in software. Software isn't that different, despite your wish to be unbound from normal expectations to not cause harm through misleading communication because you are behind a screen.

Can you please not take HN threads on flamewar tangents, and please not post in the flamewar style? Some of your comments have crossed into incivility, or at least testiness. That has a degrading effect on discussion.

https://news.ycombinator.com/newsguidelines.html

Even better, the fake link looks more legit than the legit link.

FAKE link: hxxxs://github.com/electrum-wallet

LEGIT link: https://github.com/spesmilo/electrum

Yeah they should have moved the repos to an org.

A redditor reported that the source posted contained the malware. Ie: compiling from source would not have saved you (unless you did the diff yourself and inspected the changes).

Repo deleted

Is this just a roundabout way to get paid for finding the bug ;)

So Electrum was not hacked itself, but was not designed to avoid fishing?

It was not hacked, but I would say it was designed in a way that enabled a particularly pernicious kind of phishing.

Seems pretty hacky to me.

Agreed.

I find it interesting that we call our subculture "hacker" subculture but "hacky" is a universally pejorative adjective.

yes to the first part.

to the second part, I would rephrase that to: it has vulnerabilities related to phishing.

"Electrum is prone to fishing"

Feels like you are couching the famous DAO additive the code is the law.

If the code allows it then it isn’t a bug/hack it’s a feature...only in the world of blockchain(s) of course.

If you walked into your bank and someone in the lobby told you complete your transaction at a (fake) bank next door, would you say the bank was hacked?

You mean if you make up a completely different hypothetical scam not involving software at all? No I think the word “hack” in this context is directly related to software.

Now If I login to my bank app and upon logging in I revealed my login credentials to a third party and my account was subsequently zeroed out...yes I’d call that a hack.

I think a better parallel would be "your bank's website has advertisements and one of them says 'click here to pay off your credit cards' but it's actually just a phishing attempt"

That said, I wouldn't call such a scenario a hack.

It is still sounds like super-dumb to me.

Bad design and you still relies on somebody else's computer who can veto your transaction.

People use non-full-node SaaS Wallet because they don't understand the true value of cryptocurrency. If they got veto from the SaaS service they are using. They practically lost their property. A money never used is a lost money.

Also, That's why they manually download the fake update from URL that doesn't belong to the first-party. Because they are dumb enough to use SaaS wallet.

They can't veto your transaction for very long. Remember, there are many Electrum servers and anyone can run one. An Electrum user can just transmit their transaction to other servers.

Reply on news.ycombinator.com