Hacker News Reader

Comment by whynotminot | Hacker News Reader

Yes absolutely.

There’s definitely a bit of a cult of open source. Just because I can look at your code does not inherently, magically make it more secure. Especially in a world where the black market pays better than bug bounty programs.

Not necessarily advocating for closed source approaches, but it’s something to bear in mind.

View on HN

It's not like this stuff is hard to reverse but those skills are a bit more scarce and it requires more effort.

My opinion is that you'll get relatively more blackhat "eyes" on your code and fewer whitehat "eyes" if you go closed source.

Personally, I don't know anyone who would reverse a closed-source wallet to report bugs "out of the goodness of their hearts", but I do know a bunch of people who would report bugs in good faith to open-source projects.

Wait a second. The biggest problem here with a crypto system that is not open is not that "it may have not passed through a lot of eyes", it's that it may have not passed through EVEN A SINGLE EYE. The closed system could very well be "we xor this with ILUVPUPPIES repeated ad infinitum" and very few people would the wiser.

An open system at least means _you_ can have a quick look into it. Every other advantage is not guaranteed, but with the amount of pure snake oil out there this one guaranteed advantage is friggin important.

Hopefully (blind coders aside), the code's passed through, at the very least, one set of eyes. GPT-3's not that good at writing code yet!

> Especially in a world where the black market pays better than bug bounty programs.

In crypto/DeFi/croins/crokens/whatever, the bug bounty can be the entire holdings. And there are no legal ramifications or manners of recourse/restitution.

The whole point of the game is that the tokens belong to whoever got the code to run to transfer them to them, isn't it? Complaining that someone "stole" your tokens is like complaining that someone "stole" your gold in an MMORPG.

> And there are no legal ramifications or manners of recourse/restitution.

I'd appreciate a source on that... Both seem unlikely to me. More difficult perhaps, but impossible you say?

Well in crypto there does seem to exist a somewhat widespread notion of "code is law". If the existing business logic is used to do something undesirable (transfer all money to another person) - in such axiom set that action would be considered in line with the " law".

"code is law" has yet to be tested in courts. It is highly suspect that actual humans in a jury would all agree this is the case.

We'll have an answer (applicable to the U.S. at least) soon enough: https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-...

Time to write code that indebts the user to you forever, then get FAMAGMA to use it.

Code is law.

Code law? You must be kidding. It is OK to chat about "Code Law" among like minded individuals always on the lookout to crack open the pirate's chest. It is a different story to explain to a judge: "sir, the bank had left the vault open during the fire alarm. I just helped myself with few $M. It is the bank's fault". Good luck.

If the smart contract is not the contract, then where is the actual contract? I imagine the judge would like to know that. If there's no contract, they'll have a hard time convincing anyone that there was a breach of contract.

This notion is only used in context of smart contracts and on-chain virtual machine code.

This is in contrast to wallet implementations.

Https://rekt.news - plenty of references

A list of compromises or exploits isn't a source for the claim that there aren't legal repercussions or avenues of recourse that could be pursued.

Most hackers can't even be found, since it goes to tornado Cash and owners are clueless or it's an intern job.

So plenty of examples on that site.

What would the recourse be if none of the malicious actors can be found? ( In almost all cases).

Wait, are you saying that there is recourse for reversing blockchain transactions?

See the DAO hack for precedent.

There's no result in court. So what's the recourse now at this moment ?

Additionally, they were lucky they could find the 16 yr old kid, otherwise they wouldn't known in which jurisdiction to sue :)

Welcome to the decentralized world!

Sorry, not following. The recourse I was referring to was a fork and modification of the transactions in question.

Okay, part of the subject was "legal repercussions" and i thought it was related to that.

And open source projects likely pay nothing! I've certainly never heard of a paid bug bounty for any open source project, which doesn't mean they don't exist, it just means it's not that common.

There definitely are a few, kubernetes actually has a dedicated one that hacker one runs. Here are a few examples:

https://www.hackerone.com/internet-bug-bounty

https://huntr.dev/

https://securitylab.github.com/bounties/

https://www.mozilla.org/en-US/security/bug-bounty/

There are some but for of the projects I’ve looked at, you are almost certainly getting a better payout by selling the vulnerability (monetarily not karma wise) to zerodium et al.

Reply on news.ycombinator.com