8 ms·

"DAO Hacker" and "getting away" are very loaded bits of language that point to an interpretation of events that differ, AFAICT, from reality. The DAO contract

by rsync 10y ago

"DAO Hacker" and "getting away" are very loaded bits of language that point to an interpretation of events that differ, AFAICT, from reality. The DAO contract was neither hacked nor broken. This individual used the features and functions of the contract in unexpected ways, but ways that were legitimate nonetheless.

ahelwer 10y ago
This argument also rests on an assumption over and above the function of the system: that the result of executing a contract is immutable and thus beyond reproach. As was demonstrated, the result is subject to ratification by miners. To miners on the new chain, the DAO hacker is a hacker. Certainly it was the case that ethereum contacts were advertised as immutable and beyond reproach, but if you bought into that, well... you'd be making the same error you see in your ideological opponents! It is a separate question whether ethereum contacts ought to be immutable, but that requires a different type of argument.
- grandalf 10y ago
  The issue in my opinion is that the Ethereum maintainers actively helped create a hard fork to steal Ether from the so-called "hacker". This crosses a line. Sadly, the DAO had major bugs and the time to do something about them was before it launched. It's not the end of the world, though it does place Ethereum in the category of "easily corruptible human organizations" which makes it largely ineffective for the sorts of things that made it most exciting. Ethereum may become more distributed which would make this sort of consensus more difficult to achieve, or it may be replaced by something that has a more corruption-resistant governance structure. The basic idea underlying the holocaust, the Iraq war, and pretty much any human atrocity is that the ends justify the means. This is exactly the argument that hard forkers made. But, much like the Iraq war, the president should not have ever had the sole discretion to launch a war, nor should such a small number of interested people have the ability to launch a hard fork. Apologies for the hyperbole, but I think it's helpful to illustrate the core issue.
  - lawnchair_larry 10y ago
    The problem with that hyperbole is that it begs the question of whether or not this was even an atrocity at all. The ends don't justify an atrocity as the means, but that isn't the same thing as the ends never justifying the means. Ends justifies the means is just a fancy way of saying that the cost/benefit analysis is favorable to the decider. That is a sane decision making framework. Presumably, you just disagree with the assesment of the cost.
    - grandalf 10y ago
      > Ends justifies the means is just a fancy way of saying that the cost/benefit analysis is favorable to the decider. I think it's more accurately defined as the decider acknowledging that the costs are not something he/she would typically approve of, but the desired or touted ends are so worthwhile for everyone (as determined by the decider on behalf of everone) that it's worth doing. In other words, an un-democratic greater good argument. It turns out that there was majority consensus among ETH miners to do a hard fork, but only after the Ethereum maintainers signaled their bias by researching and writing the hard fork code.
  - zem 10y ago
    the hacker actively exploited a flaw in the ethereum system to steal money from unwi{tt,ll}ing users. saying that that was okay because the platonic nature of smart contracts allowed it is saying that the means justified the ends, which does not work either.
    - grandalf 10y ago
      > the hacker actively exploited a flaw in the ethereum system This is not the case. There was not a bug in the Ethereum "system", it was a bug in the Slock.it smart contract code ONLY. The smart contract code behaved exactly as written. There is nothing to interpret. Those who invested in that smart contract invested in it as written, and failed to have it properly vetted. Think of the fraud that is possible with poorly vetted contracts... It's absurd to think that rewinding the tape is any sort of legitimate remedy for code bugs in smart contracts.
- matt_morgan 10y ago
  Smart points but rsync's comment stands--this article takes a very one-sided tone. It doesn't even attempt to state why so many of the people involved don't think that punishing the "attacker" (their term!) is a priority. So it's also kind of half-baked, actually.
draw_down 10y ago
Nobody involved wants to admit that's the case. It's pretty ridiculous.
ryan-c 10y ago
How is using features and functions in an unexpected way not hacking?
- EdHominem 10y ago
  This is why computer security is a dog's breakfast and always will be as long as we can run crying to a judge. Your mistakes are your failures, not my hacks. Even calling an SQL injection or buffer-overflow with malware payload a hack misses the point. This is just an extreme example because there weren't invalid inputs, etc. Everything was used as intended but the intentions weren't very well thought through.
will_brown 10y ago
>The DAO contract was neither hacked nor broken. Broken, is an interesting choice of words, because by your very definition the DAO could never be broken it simply is whatever the code says it is, thus could never be broken. However, as much as some people want to claim the DAO as executed is exactly what investors contracted for, it is not. The creators of the DOA solicited investment based on marketing material in plain language that was entirely inconsistent with the code of the DAO. Under the law one can't market and solicit investment based on representations that are untrue...that is fraud and but for the false representations many/if not all investors would not have invested. Moreover, it is generally not enough to include a little disclaimer at the end of the marketing material acknowledging the marketing may not be accurate and that the investors are investing at their own risk and in the DAO "as-is".
- pavel_lishin 10y ago
  While I recognize that the law almost certainly disagrees, isn't ETH's "The Code is the Contract" ethos morally override any complaints people could make about unfair marketing? If you're using Ethereum, you're implicitly buying into the "the code is the contract" philosophy; it's 100% 'caveat emptor'.
  - will_brown 10y ago
    >isn't ETH's "The Code is the Contract" ethos morally override any complaints people could make about unfair marketing? I am no moral authority, though I certainly have my opinions. I think the moral question breaks down to the following: 1. Do I have a moral obligation to perform a contract that I entered only as a result of fraud? Let me ask you, what if you and I enter a contract where I will pay you $10 to pull a string of my choice and you agree. After you enter the contract I show you the string and it is tied off to a trigger on a gun pointed to someones head, does the contract ethos morally override my unfair disclosure? That is obviously an extreme, but how about if you had a elderly parent who was on their death bed and I told your parent the Will makes you the sole beneficiary but it really made me the sole beneficiary, would you have a moral obligation to allow the Will/contract to stand that overrides your complaint about unfair representations? At the end of the day, people signed up for the DAO, but the DAO as executed was not what they signed up for, no matter how much people say that is the entire point of the DAO. If it were me I would feel no moral obligation to accept my losses as if it were losses based on a legitimate investment opportunity that simply didn't perform. I think people must determine for themselves what is moral, and while keeping ones word and fulfilling contractual obligations is a moral issue, it applies to all parties (the solicitor and investor), and that is why the law doesn't permit fraud, deceptive and unfair trade practices, contracts with minors, contracts with people who lack capacity to understand them, unjust enrichment, etc...

by rsync 10y ago

ahelwer 10y ago

This argument also rests on an assumption over and above the function of the system: that the result of executing a contract is immutable and thus beyond reproach. As was demonstrated, the result is subject to ratification by miners. To miners on the new chain, the DAO hacker is a hacker. Certainly it was the case that ethereum contacts were advertised as immutable and beyond reproach, but if you bought into that, well... you'd be making the same error you see in your ideological opponents! It is a separate question whether ethereum contacts ought to be immutable, but that requires a different type of argument.

grandalf 10y ago
The issue in my opinion is that the Ethereum maintainers actively helped create a hard fork to steal Ether from the so-called "hacker". This crosses a line. Sadly, the DAO had major bugs and the time to do something about them was before it launched. It's not the end of the world, though it does place Ethereum in the category of "easily corruptible human organizations" which makes it largely ineffective for the sorts of things that made it most exciting. Ethereum may become more distributed which would make this sort of consensus more difficult to achieve, or it may be replaced by something that has a more corruption-resistant governance structure. The basic idea underlying the holocaust, the Iraq war, and pretty much any human atrocity is that the ends justify the means. This is exactly the argument that hard forkers made. But, much like the Iraq war, the president should not have ever had the sole discretion to launch a war, nor should such a small number of interested people have the ability to launch a hard fork. Apologies for the hyperbole, but I think it's helpful to illustrate the core issue.
- lawnchair_larry 10y ago
  The problem with that hyperbole is that it begs the question of whether or not this was even an atrocity at all. The ends don't justify an atrocity as the means, but that isn't the same thing as the ends never justifying the means. Ends justifies the means is just a fancy way of saying that the cost/benefit analysis is favorable to the decider. That is a sane decision making framework. Presumably, you just disagree with the assesment of the cost.
  - grandalf 10y ago
    > Ends justifies the means is just a fancy way of saying that the cost/benefit analysis is favorable to the decider. I think it's more accurately defined as the decider acknowledging that the costs are not something he/she would typically approve of, but the desired or touted ends are so worthwhile for everyone (as determined by the decider on behalf of everone) that it's worth doing. In other words, an un-democratic greater good argument. It turns out that there was majority consensus among ETH miners to do a hard fork, but only after the Ethereum maintainers signaled their bias by researching and writing the hard fork code.
- zem 10y ago
  the hacker actively exploited a flaw in the ethereum system to steal money from unwi{tt,ll}ing users. saying that that was okay because the platonic nature of smart contracts allowed it is saying that the means justified the ends, which does not work either.
  - grandalf 10y ago
    > the hacker actively exploited a flaw in the ethereum system This is not the case. There was not a bug in the Ethereum "system", it was a bug in the Slock.it smart contract code ONLY. The smart contract code behaved exactly as written. There is nothing to interpret. Those who invested in that smart contract invested in it as written, and failed to have it properly vetted. Think of the fraud that is possible with poorly vetted contracts... It's absurd to think that rewinding the tape is any sort of legitimate remedy for code bugs in smart contracts.
matt_morgan 10y ago
Smart points but rsync's comment stands--this article takes a very one-sided tone. It doesn't even attempt to state why so many of the people involved don't think that punishing the "attacker" (their term!) is a priority. So it's also kind of half-baked, actually.

draw_down 10y ago

Nobody involved wants to admit that's the case. It's pretty ridiculous.

ryan-c 10y ago

How is using features and functions in an unexpected way not hacking?

EdHominem 10y ago
This is why computer security is a dog's breakfast and always will be as long as we can run crying to a judge. Your mistakes are your failures, not my hacks. Even calling an SQL injection or buffer-overflow with malware payload a hack misses the point. This is just an extreme example because there weren't invalid inputs, etc. Everything was used as intended but the intentions weren't very well thought through.

will_brown 10y ago

>The DAO contract was neither hacked nor broken. Broken, is an interesting choice of words, because by your very definition the DAO could never be broken it simply is whatever the code says it is, thus could never be broken. However, as much as some people want to claim the DAO as executed is exactly what investors contracted for, it is not. The creators of the DOA solicited investment based on marketing material in plain language that was entirely inconsistent with the code of the DAO. Under the law one can't market and solicit investment based on representations that are untrue...that is fraud and but for the false representations many/if not all investors would not have invested. Moreover, it is generally not enough to include a little disclaimer at the end of the marketing material acknowledging the marketing may not be accurate and that the investors are investing at their own risk and in the DAO "as-is".

pavel_lishin 10y ago
While I recognize that the law almost certainly disagrees, isn't ETH's "The Code is the Contract" ethos morally override any complaints people could make about unfair marketing? If you're using Ethereum, you're implicitly buying into the "the code is the contract" philosophy; it's 100% 'caveat emptor'.
- will_brown 10y ago
  >isn't ETH's "The Code is the Contract" ethos morally override any complaints people could make about unfair marketing? I am no moral authority, though I certainly have my opinions. I think the moral question breaks down to the following: 1. Do I have a moral obligation to perform a contract that I entered only as a result of fraud? Let me ask you, what if you and I enter a contract where I will pay you $10 to pull a string of my choice and you agree. After you enter the contract I show you the string and it is tied off to a trigger on a gun pointed to someones head, does the contract ethos morally override my unfair disclosure? That is obviously an extreme, but how about if you had a elderly parent who was on their death bed and I told your parent the Will makes you the sole beneficiary but it really made me the sole beneficiary, would you have a moral obligation to allow the Will/contract to stand that overrides your complaint about unfair representations? At the end of the day, people signed up for the DAO, but the DAO as executed was not what they signed up for, no matter how much people say that is the entire point of the DAO. If it were me I would feel no moral obligation to accept my losses as if it were losses based on a legitimate investment opportunity that simply didn't perform. I think people must determine for themselves what is moral, and while keeping ones word and fulfilling contractual obligations is a moral issue, it applies to all parties (the solicitor and investor), and that is why the law doesn't permit fraud, deceptive and unfair trade practices, contracts with minors, contracts with people who lack capacity to understand them, unjust enrichment, etc...