5 ms·

The issue in my opinion is that the Ethereum maintainers actively helped create a hard fork to steal Ether from the so-called "hacker". This crosses a line. S

The issue in my opinion is that the Ethereum maintainers actively helped create a hard fork to steal Ether from the so-called "hacker". This crosses a line. Sadly, the DAO had major bugs and the time to do something about them was before it launched. It's not the end of the world, though it does place Ethereum in the category of "easily corruptible human organizations" which makes it largely ineffective for the sorts of things that made it most exciting. Ethereum may become more distributed which would make this sort of consensus more difficult to achieve, or it may be replaced by something that has a more corruption-resistant governance structure. The basic idea underlying the holocaust, the Iraq war, and pretty much any human atrocity is that the ends justify the means. This is exactly the argument that hard forkers made. But, much like the Iraq war, the president should not have ever had the sole discretion to launch a war, nor should such a small number of interested people have the ability to launch a hard fork. Apologies for the hyperbole, but I think it's helpful to illustrate the core issue.

lawnchair_larry 10y ago
The problem with that hyperbole is that it begs the question of whether or not this was even an atrocity at all. The ends don't justify an atrocity as the means, but that isn't the same thing as the ends never justifying the means. Ends justifies the means is just a fancy way of saying that the cost/benefit analysis is favorable to the decider. That is a sane decision making framework. Presumably, you just disagree with the assesment of the cost.
- grandalf 10y ago
  > Ends justifies the means is just a fancy way of saying that the cost/benefit analysis is favorable to the decider. I think it's more accurately defined as the decider acknowledging that the costs are not something he/she would typically approve of, but the desired or touted ends are so worthwhile for everyone (as determined by the decider on behalf of everone) that it's worth doing. In other words, an un-democratic greater good argument. It turns out that there was majority consensus among ETH miners to do a hard fork, but only after the Ethereum maintainers signaled their bias by researching and writing the hard fork code.
zem 10y ago
the hacker actively exploited a flaw in the ethereum system to steal money from unwi{tt,ll}ing users. saying that that was okay because the platonic nature of smart contracts allowed it is saying that the means justified the ends, which does not work either.
- grandalf 10y ago
  > the hacker actively exploited a flaw in the ethereum system This is not the case. There was not a bug in the Ethereum "system", it was a bug in the Slock.it smart contract code ONLY. The smart contract code behaved exactly as written. There is nothing to interpret. Those who invested in that smart contract invested in it as written, and failed to have it properly vetted. Think of the fraud that is possible with poorly vetted contracts... It's absurd to think that rewinding the tape is any sort of legitimate remedy for code bugs in smart contracts.
  - will_brown 10y ago
    >There is nothing to interpret. Those who invested in that smart contract invested in it as written, and failed to have it properly vetted. What about the plain language of the marketing materials soliciting investment that was completely inconsistent with the code of the DAO. It happens all the time in the world outside of smart contracts, where people rely on marketing materials (say marketing a car loan for 4%, but the contract provides for a substantially higher interest rate). You can make the same argument in those cases, that the individual should have read an understood the actual contract and not relied on the marketing material, in fact, the marketing material might even include a disclaimer, but that doesn't change the fact that the individual is likely to prevail in a court of law based on causes of action including, but not limited to: fraud, fraud in the inducement, unfair trade practices, unjust enrichment, breach of contract, etc... What makes smart contracts so special that people can falsely market them to the public and not be liable?
    - jessaustin 10y ago
      Do you contend here that the "hackers" and the "marketers" are the same people? If that could be demonstrated, it would be an extraordinary revelation!
pavel_lishin 10y ago
> Sadly, the DAO had major bugs and the time to do something about them was before it launched. It boggles the fucking mind that they didn't run a small-scale test, with enough money to make it worthwhile for people to test the contract, but not so much that it would have created all of this drama. Spending $10,000 to test a project that I've heard is worth $150 million seems like a no-brainer decision.
- grandalf 10y ago
  > It boggles the fucking mind that they didn't run a small-scale test The issue was a semantic bug in the code, which was exploited by an unanticipated usage pattern. It is hard to catch this kind of error with testing, since the programmer is usually the one writing the test. It is also (often) hard to catch subtle semantic bugs in code review too, unless the reviewer is looking for a known pattern of semantic bug. There are some interesting things happening as a result -- formal verification, etc., but I am hoping that we end up seeing the emergence of an insurance market on smart contract behavior...
  - pavel_lishin 10y ago
    I didn't mean unit tests; I meant more along the lines of a bug bounty - which is why I said $10k. "Here's a box, it has $10,000 in it. If you break it, you get $10,000 worth of Ethereum."
    - grandalf 10y ago
      > I meant more along the lines of a bug bounty Ahh. Yes, that would have been an excellent thing to do. Even a binary future on "will the DAO be hacked" would have quickly revealed (via its price) the true risk, well before the dollar figure got so high.
    - pYQAJ6Zm 10y ago
      I think that poses an interesting dilemma. Say somebody finds a flaw: would they really want to disclose it? If they doesn’t, and nobody else has found that flaw or any other of similar importance, they stands to benefit more by hacking the system when it goes into production.

lawnchair_larry 10y ago

The problem with that hyperbole is that it begs the question of whether or not this was even an atrocity at all. The ends don't justify an atrocity as the means, but that isn't the same thing as the ends never justifying the means. Ends justifies the means is just a fancy way of saying that the cost/benefit analysis is favorable to the decider. That is a sane decision making framework. Presumably, you just disagree with the assesment of the cost.

grandalf 10y ago
> Ends justifies the means is just a fancy way of saying that the cost/benefit analysis is favorable to the decider. I think it's more accurately defined as the decider acknowledging that the costs are not something he/she would typically approve of, but the desired or touted ends are so worthwhile for everyone (as determined by the decider on behalf of everone) that it's worth doing. In other words, an un-democratic greater good argument. It turns out that there was majority consensus among ETH miners to do a hard fork, but only after the Ethereum maintainers signaled their bias by researching and writing the hard fork code.

zem 10y ago

the hacker actively exploited a flaw in the ethereum system to steal money from unwi{tt,ll}ing users. saying that that was okay because the platonic nature of smart contracts allowed it is saying that the means justified the ends, which does not work either.

grandalf 10y ago
> the hacker actively exploited a flaw in the ethereum system This is not the case. There was not a bug in the Ethereum "system", it was a bug in the Slock.it smart contract code ONLY. The smart contract code behaved exactly as written. There is nothing to interpret. Those who invested in that smart contract invested in it as written, and failed to have it properly vetted. Think of the fraud that is possible with poorly vetted contracts... It's absurd to think that rewinding the tape is any sort of legitimate remedy for code bugs in smart contracts.
- will_brown 10y ago
  >There is nothing to interpret. Those who invested in that smart contract invested in it as written, and failed to have it properly vetted. What about the plain language of the marketing materials soliciting investment that was completely inconsistent with the code of the DAO. It happens all the time in the world outside of smart contracts, where people rely on marketing materials (say marketing a car loan for 4%, but the contract provides for a substantially higher interest rate). You can make the same argument in those cases, that the individual should have read an understood the actual contract and not relied on the marketing material, in fact, the marketing material might even include a disclaimer, but that doesn't change the fact that the individual is likely to prevail in a court of law based on causes of action including, but not limited to: fraud, fraud in the inducement, unfair trade practices, unjust enrichment, breach of contract, etc... What makes smart contracts so special that people can falsely market them to the public and not be liable?
  - jessaustin 10y ago
    Do you contend here that the "hackers" and the "marketers" are the same people? If that could be demonstrated, it would be an extraordinary revelation!

pavel_lishin 10y ago

> Sadly, the DAO had major bugs and the time to do something about them was before it launched. It boggles the fucking mind that they didn't run a small-scale test, with enough money to make it worthwhile for people to test the contract, but not so much that it would have created all of this drama. Spending $10,000 to test a project that I've heard is worth $150 million seems like a no-brainer decision.

grandalf 10y ago
> It boggles the fucking mind that they didn't run a small-scale test The issue was a semantic bug in the code, which was exploited by an unanticipated usage pattern. It is hard to catch this kind of error with testing, since the programmer is usually the one writing the test. It is also (often) hard to catch subtle semantic bugs in code review too, unless the reviewer is looking for a known pattern of semantic bug. There are some interesting things happening as a result -- formal verification, etc., but I am hoping that we end up seeing the emergence of an insurance market on smart contract behavior...
- pavel_lishin 10y ago
  I didn't mean unit tests; I meant more along the lines of a bug bounty - which is why I said $10k. "Here's a box, it has $10,000 in it. If you break it, you get $10,000 worth of Ethereum."
  - grandalf 10y ago
    > I meant more along the lines of a bug bounty Ahh. Yes, that would have been an excellent thing to do. Even a binary future on "will the DAO be hacked" would have quickly revealed (via its price) the true risk, well before the dollar figure got so high.
  - pYQAJ6Zm 10y ago
    I think that poses an interesting dilemma. Say somebody finds a flaw: would they really want to disclose it? If they doesn’t, and nobody else has found that flaw or any other of similar importance, they stands to benefit more by hacking the system when it goes into production.