8 ms·

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fe

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fear seems to stem from misunderstanding how Ethereum works or what it even is. Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or complex as you like. If you're afraid of bugs, don't put money into any complex smart contracts. If there's a lot of money involved, then spend some money/time reviewing the smart contract. Also, contracts can set precedent once they are in the ecosystem. If a contract has been heavily used prior to your desire to use it, you can copy it, and be relatively confident that it will be secure for you to use.

voidlogic 10y ago
>Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. "will be effectively error-free" != "probably as good as the Linux kernel", not even close :D
- aab0 10y ago
  The security history of the JVM suggests that one shouldn't be optimistic there either.
  - rtpg 10y ago
    counterpoint: I haven't really heard of any "javascript escaping the container" bugs in a really long time (excepting node.js-related issues)
    - ChristianBundy 10y ago
      JavaScript doesn't run on the JVM.
      - cloudjacker 10y ago
        thanks for saying this, sometimes I'm like "wow" on hackernews comments, because you kind of assume people know what they're talking about but then its like not really.
        rtpg 10y ago
        I know that Javascript isn't run in the JVM, my point was that it's possible to write a virtual machine that doesn't get exploited every 5 minutes. the JVM is a bit special because there are a large amount of escape hatches, native code and a complex trust model, which has caused a lot of the exploits you end up seeing.
    - astrodust 10y ago
      JavaScript has several mature, thoroughly scrutinized implementations. Ethereum has one brand new implementation. To put it mildly: There will be blood.
      - andrewflnr 10y ago
        There are at least two ethereum implementations, the main one and one in Rust.
      - danfinlay 10y ago
        There are actually eight different implementations at this time, although the go client has a slight majority of users according to ethstats.net http://ethdocs.org/en/latest/ethereum-clients/index.html http://ethdocs.org/en/latest/ethereum-clients/index.html
    - TheDong 10y ago
      Funny, most pwn2owns there are multiple successful escapes of any of a number of js sandboxes. I hear about it at least yearly, if not more often.
    - Chris2048 10y ago
      But. JS was designed with this in mind, and has been tested for it for years. It's actually one of the greatest strengths of JS, but I imagine it was a lot of work (except, perhaps, maybe functional languages).
- colm__colm 10y ago
  The ethereum VM does not offer allow of functionality. You cant read or write to hard disk. You cant access the Network card. There for the attack surface is much smaller then Linux. It will probably be better than the Linux Kernel due to this.
- eru 10y ago
  The linux kernel is and has been pretty buggy, especially by cryptographic standards.
geographomics 10y ago
Hopefully a lot better than the Linux kernel: http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html...
- dmix 10y ago
  Linus doesn't view security bugs as a special category of bugs. So he doesn't prioritize them they way most infosec people would like them to. The lack of a strong security advocate in their leadership is largely the reason why Linux isn't the best example. The other big reason being that it's a giant blob of C and a large attack surface. All of these factors could be easily avoided or simply don't exist for an Ethereum contract developer.
  - anonbanker 10y ago
    don't forget the fact that he was approached by the NSA to insert backdoors into linux, a fact his father testified to on the record before EU parliament[0]. 0. http://falkvinge.net/2013/11/17/nsa-asked-linus-torvalds-to-install-backdoors-into-gnulinux/ http://falkvinge.net/2013/11/17/nsa-asked-linus-torvalds-to-...
easytiger 10y ago
> effectively error-free - probably as good as the Linux kernel I encounter major glaring issues as well as continual regressions in the linux kernel on weekly basis. I don't even know what you mean by as correct as the linux kernel
descript 10y ago
Ethereum faces a similar situation as counter-terrorism: There only needs to be one sizeable incident that slips through the cracks for confidence to be shot.

voidlogic 10y ago

>Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. "will be effectively error-free" != "probably as good as the Linux kernel", not even close :D

aab0 10y ago
The security history of the JVM suggests that one shouldn't be optimistic there either.
- rtpg 10y ago
  counterpoint: I haven't really heard of any "javascript escaping the container" bugs in a really long time (excepting node.js-related issues)
  - ChristianBundy 10y ago
    JavaScript doesn't run on the JVM.
    - cloudjacker 10y ago
      thanks for saying this, sometimes I'm like "wow" on hackernews comments, because you kind of assume people know what they're talking about but then its like not really.
      - rtpg 10y ago
        I know that Javascript isn't run in the JVM, my point was that it's possible to write a virtual machine that doesn't get exploited every 5 minutes. the JVM is a bit special because there are a large amount of escape hatches, native code and a complex trust model, which has caused a lot of the exploits you end up seeing.
  - astrodust 10y ago
    JavaScript has several mature, thoroughly scrutinized implementations. Ethereum has one brand new implementation. To put it mildly: There will be blood.
    - andrewflnr 10y ago
      There are at least two ethereum implementations, the main one and one in Rust.
    - danfinlay 10y ago
      There are actually eight different implementations at this time, although the go client has a slight majority of users according to ethstats.net http://ethdocs.org/en/latest/ethereum-clients/index.html http://ethdocs.org/en/latest/ethereum-clients/index.html
  - TheDong 10y ago
    Funny, most pwn2owns there are multiple successful escapes of any of a number of js sandboxes. I hear about it at least yearly, if not more often.
  - Chris2048 10y ago
    But. JS was designed with this in mind, and has been tested for it for years. It's actually one of the greatest strengths of JS, but I imagine it was a lot of work (except, perhaps, maybe functional languages).
colm__colm 10y ago
The ethereum VM does not offer allow of functionality. You cant read or write to hard disk. You cant access the Network card. There for the attack surface is much smaller then Linux. It will probably be better than the Linux Kernel due to this.
eru 10y ago
The linux kernel is and has been pretty buggy, especially by cryptographic standards.

geographomics 10y ago

Hopefully a lot better than the Linux kernel: http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html...

dmix 10y ago
Linus doesn't view security bugs as a special category of bugs. So he doesn't prioritize them they way most infosec people would like them to. The lack of a strong security advocate in their leadership is largely the reason why Linux isn't the best example. The other big reason being that it's a giant blob of C and a large attack surface. All of these factors could be easily avoided or simply don't exist for an Ethereum contract developer.
- anonbanker 10y ago
  don't forget the fact that he was approached by the NSA to insert backdoors into linux, a fact his father testified to on the record before EU parliament[0]. 0. http://falkvinge.net/2013/11/17/nsa-asked-linus-torvalds-to-install-backdoors-into-gnulinux/ http://falkvinge.net/2013/11/17/nsa-asked-linus-torvalds-to-...

easytiger 10y ago

> effectively error-free - probably as good as the Linux kernel I encounter major glaring issues as well as continual regressions in the linux kernel on weekly basis. I don't even know what you mean by as correct as the linux kernel

descript 10y ago

Ethereum faces a similar situation as counter-terrorism: There only needs to be one sizeable incident that slips through the cracks for confidence to be shot.