7 ms·

> They created a situation in which bugs would be expected to arise in an environment in which bugs are legally exploitable. That is hacker heaven. Every singl

by cheez 10y ago

> They created a situation in which bugs would be expected to arise in an environment in which bugs are legally exploitable. That is hacker heaven. Every single system has this problem. You think banks aren't hacked?

pmorici 10y ago
What _legally_ exploitable bank bugs have you heard of? Keyword there being legally.
- cheez 10y ago
  It's effectively legal because a lot of financial fraud is not pursued. For example, people from different countries scamming old people out of $1000 for Prince Abu to free his millions. That being said, I can understand why you think something being legally exploitable is something new. Just like a loophole in a contract is a loophole in a contract. In the case of smart contracts, there is no recourse unless built in to the contract. This is by design. All that's going to happen is people will start writing smaller, more testable, less damaging contracts. This regime is different from legal contracts because many lawyers specifically write contracts to create problems later. In this new world, good contract writers will be gods. So if you're a good software engineer, there is potentially a huge market about to open up for you.
  - pmorici 10y ago
    Scamming old people isn't a bug with the bank.
    - cheez 10y ago
      It's a bug in the system though.
      - pmorici 10y ago
        No it isn't. People are meant to have free control over their money. Are advocating that banks should be required to protect people from themselves?
        cheez 10y ago
        Exactly.
  - viraptor 10y ago
    > It's effectively legal because a lot of financial fraud is not pursued. That's not what "legal" means. Just like killing people without leaving traces to find you is not "effectively legal". It may simply be not worth pursuing because of gain/effort trade off.
- cyphar 10y ago
  This exploit wasn't legal either. It was blatantly fraud. I've asked a lawyer for their opinion and it was a very simple question to answer. Contracts are never entirely literal and usually there are implied clauses in contracts. There is a very simple test called the "officious bystander": if there had been a neutral bystander who had asked "should we allow anyone to take $50 million dollars without our consent" then unless both parties would've said "of course!" then it isn't considered to be a clause of the contract and it is just simply fraud. The developers of theDAO wouldn't have said "of course" so it's fraud.
  - pmorici 10y ago
    Right I would tend to agree. They really went out of their way though to say that the "code is the contract nothing else matters" I think that is where some of the doubt comes in.
  - jbmorgado 10y ago
    So, you are trying to be a great libertarian by doing without the courts of law and the state but then, when everything goes wrong with your money, you call for the opinion of the courts of law and for the state to enforce that opinion. Oh the hypocrisy.
  - brohee 10y ago
    Right before the theft they would have said "off course", so sure their code was perfect... They made it abundantly clear the truth was in the code, and that men justice was an obsolete concept.
- DavidPlumpton 10y ago
  Jeremy Clarkson published his bank account details in his column to back up his assertion that you can send money to a bank account but not withdraw any. However apparently anybody can set up an automatic payment from any account to any other account...
  - tamana 10y ago
    Those were not legal automatic payments
mmanfrin 10y ago
Banks aren't legally exploitable.
- IanCal 10y ago
  Was the hack legal? A system letting you in if you poke it just right doesn't mean you are legally allowed in. I fail to see how a bug in banking software would be any different to the bug in the DAO.
  - mmanfrin 10y ago
    Because the point (as I understand it) of this whole experiment is that they were trying to create an altcoin that used strict contracts as the basis for transactions (with no human intervention). Essentially the code is the contract, so code behavior is necessarily abiding by its contract and anything done with that code is legitimate.
  - spilk 10y ago
    That depends on if The DAO's terms are enforceable - it basically says the code is the terms, so essentially if the code allows it, it is permitted. https://daohub.org/explainer.html https://daohub.org/explainer.html
  - JorgeGT 10y ago
    From The DAO Terms: The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code. Any and all explanatory terms or descriptions are merely offered for educational purposes and do not supercede or modify the express terms of The DAO’s code set forth on the blockchain; to the extent you believe there to be any conflict or discrepancy between the descriptions offered here and the functionality of The DAO’s code at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413, The DAO’s code controls and sets forth all terms of The DAO Creation. Basically, the code is the only authentic version of the contract. The attacker entered this contract and used its functionality as was programmed in the blockchain, he didn't modify a bit of the code. So it seems pretty legal.
xoa 10y ago
As other comments say, legality and hard failure are big differentiators here, and in fact the specific language you used invokes a really key point. Emphasis added: >You think banks aren't hacked? There has been a lot of general description of the individual or group that performed the splitting as an "attacker" or "hacker", but the very nature of the system in question subverts the conceptual foundation of "attacking". To be an "attack" rather then a legitimate execution of an agreement, the action would have to be "illegitimate", but when legitimacy is explicitly defined by the code itself, then how can any action allowed by the code be illegitimate? It'd be a different issue entirely if the underlying VM or a system had been exploited, but merely doing as the code allowed when the code is made the agreement's authority? Also, I've been using "agreement" here too rather then "contract" because, despite the label of "smart contract" Etherium has adopted I think there's a basic legal question about whether legally they're "contracts" at all. A contract is a subset of the space of agreements; all contracts are agreements, but not all agreements are necessarily contracts. There are many factors in determining validity of contracts and a huge body of contract law that has already been discussed a great deal, but all that depends on there being a contract at all, and for that there needs to be an agreement where the parties intend to be bound by the law (of whatever jurisdiction whose enforcement power they wish to invoke). There are many agreements where there is no intention to have legal enforceability, and in that case the courts have nothing whatsoever to say on the matter. Contract law never even enters the picture. The DAO, and Etherium in general, have made a big deal specifically about not invoking the courts. That was supposed to be part of the entire point of smart "contracts", that they'd have nothing at all to do with any common legal system and be self-contained in and of themselves. In turn though that could mean that any smart contract that declares itself fully self-definitional is in turn not a contract period, so there cannot be an "attacker" in the legal sense. Bank hacks in contrast aren't much different in concept from bank heists of any other kind. They are able to invoke real world power in response, and have multiple levels of fallbacks and insurance for their customers. It's by design a much softer fail, multiple level system with an expectation of occasional failure built-in and a strong human element. This adds expense and inefficiency, but provides benefits to imperfect human societies too. It came out of ages of real world experience and testing after all.
- cyphar 10y ago

by cheez 10y ago

pmorici 10y ago

What _legally_ exploitable bank bugs have you heard of? Keyword there being legally.

cheez 10y ago
It's effectively legal because a lot of financial fraud is not pursued. For example, people from different countries scamming old people out of $1000 for Prince Abu to free his millions. That being said, I can understand why you think something being legally exploitable is something new. Just like a loophole in a contract is a loophole in a contract. In the case of smart contracts, there is no recourse unless built in to the contract. This is by design. All that's going to happen is people will start writing smaller, more testable, less damaging contracts. This regime is different from legal contracts because many lawyers specifically write contracts to create problems later. In this new world, good contract writers will be gods. So if you're a good software engineer, there is potentially a huge market about to open up for you.
- pmorici 10y ago
  Scamming old people isn't a bug with the bank.
  - cheez 10y ago
    It's a bug in the system though.
    - pmorici 10y ago
      No it isn't. People are meant to have free control over their money. Are advocating that banks should be required to protect people from themselves?
      - cheez 10y ago
        Exactly.
- viraptor 10y ago
  > It's effectively legal because a lot of financial fraud is not pursued. That's not what "legal" means. Just like killing people without leaving traces to find you is not "effectively legal". It may simply be not worth pursuing because of gain/effort trade off.
cyphar 10y ago
This exploit wasn't legal either. It was blatantly fraud. I've asked a lawyer for their opinion and it was a very simple question to answer. Contracts are never entirely literal and usually there are implied clauses in contracts. There is a very simple test called the "officious bystander": if there had been a neutral bystander who had asked "should we allow anyone to take $50 million dollars without our consent" then unless both parties would've said "of course!" then it isn't considered to be a clause of the contract and it is just simply fraud. The developers of theDAO wouldn't have said "of course" so it's fraud.
- pmorici 10y ago
  Right I would tend to agree. They really went out of their way though to say that the "code is the contract nothing else matters" I think that is where some of the doubt comes in.
- jbmorgado 10y ago
  So, you are trying to be a great libertarian by doing without the courts of law and the state but then, when everything goes wrong with your money, you call for the opinion of the courts of law and for the state to enforce that opinion. Oh the hypocrisy.
- brohee 10y ago
  Right before the theft they would have said "off course", so sure their code was perfect... They made it abundantly clear the truth was in the code, and that men justice was an obsolete concept.
DavidPlumpton 10y ago
Jeremy Clarkson published his bank account details in his column to back up his assertion that you can send money to a bank account but not withdraw any. However apparently anybody can set up an automatic payment from any account to any other account...
- tamana 10y ago
  Those were not legal automatic payments

mmanfrin 10y ago

Banks aren't legally exploitable.

IanCal 10y ago
Was the hack legal? A system letting you in if you poke it just right doesn't mean you are legally allowed in. I fail to see how a bug in banking software would be any different to the bug in the DAO.
- mmanfrin 10y ago
  Because the point (as I understand it) of this whole experiment is that they were trying to create an altcoin that used strict contracts as the basis for transactions (with no human intervention). Essentially the code is the contract, so code behavior is necessarily abiding by its contract and anything done with that code is legitimate.
- spilk 10y ago
  That depends on if The DAO's terms are enforceable - it basically says the code is the terms, so essentially if the code allows it, it is permitted. https://daohub.org/explainer.html https://daohub.org/explainer.html
- JorgeGT 10y ago
  From The DAO Terms: The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code. Any and all explanatory terms or descriptions are merely offered for educational purposes and do not supercede or modify the express terms of The DAO’s code set forth on the blockchain; to the extent you believe there to be any conflict or discrepancy between the descriptions offered here and the functionality of The DAO’s code at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413, The DAO’s code controls and sets forth all terms of The DAO Creation. Basically, the code is the only authentic version of the contract. The attacker entered this contract and used its functionality as was programmed in the blockchain, he didn't modify a bit of the code. So it seems pretty legal.

xoa 10y ago

As other comments say, legality and hard failure are big differentiators here, and in fact the specific language you used invokes a really key point. Emphasis added: >You think banks aren't hacked? There has been a lot of general description of the individual or group that performed the splitting as an "attacker" or "hacker", but the very nature of the system in question subverts the conceptual foundation of "attacking". To be an "attack" rather then a legitimate execution of an agreement, the action would have to be "illegitimate", but when legitimacy is explicitly defined by the code itself, then how can any action allowed by the code be illegitimate? It'd be a different issue entirely if the underlying VM or a system had been exploited, but merely doing as the code allowed when the code is made the agreement's authority? Also, I've been using "agreement" here too rather then "contract" because, despite the label of "smart contract" Etherium has adopted I think there's a basic legal question about whether legally they're "contracts" at all. A contract is a subset of the space of agreements; all contracts are agreements, but not all agreements are necessarily contracts. There are many factors in determining validity of contracts and a huge body of contract law that has already been discussed a great deal, but all that depends on there being a contract at all, and for that there needs to be an agreement where the parties intend to be bound by the law (of whatever jurisdiction whose enforcement power they wish to invoke). There are many agreements where there is no intention to have legal enforceability, and in that case the courts have nothing whatsoever to say on the matter. Contract law never even enters the picture. The DAO, and Etherium in general, have made a big deal specifically about not invoking the courts. That was supposed to be part of the entire point of smart "contracts", that they'd have nothing at all to do with any common legal system and be self-contained in and of themselves. In turn though that could mean that any smart contract that declares itself fully self-definitional is in turn not a contract period, so there cannot be an "attacker" in the legal sense. Bank hacks in contrast aren't much different in concept from bank heists of any other kind. They are able to invoke real world power in response, and have multiple levels of fallbacks and insurance for their customers. It's by design a much softer fail, multiple level system with an expectation of occasional failure built-in and a strong human element. This adds expense and inefficiency, but provides benefits to imperfect human societies too. It came out of ages of real world experience and testing after all.

cyphar 10y ago