4 ms·

> Know this: Krypton is more than just a blockchain or another cryptocurrency. We will survive these attacks, even if it means staying on the POS chain, in orde

by gamache 10y ago

> Know this: Krypton is more than just a blockchain or another cryptocurrency. We will survive these attacks, even if it means staying on the POS chain, in order to protect KR investments, until we do the complete rewrite of our client platform in a more secure language, like C. What could possibly go wrong?

mehh 10y ago
Funny, was literally about to post the same thing!
andrewvijay 10y ago
Same thought. But then may be Krypton Dev is wise enough to sort out his stuff.
- gamache 10y ago
  A great hacker could maybe do it in C -- maybe even in a one-night coding spree -- but a wise hacker in 2016 wouldn't try.
beberlei 10y ago
I was scared by the mention of migrating all code from etherum to bitcoin blockchain in just one night.
tremon 10y ago
Any chance this was meant as sarcasm? As in, they're suggesting that even C is more secure than what Ethereum has developed?
- heliumcraft 10y ago
  It has nothing to do with Ethereum. This Krypton chain has a very minuscule hashpower so it's susceptible to attacks. It would happen with any Proof of Work chain. She is moving to a Proof of Stake which requires +- 51% of the ownership total coins to execute an attack like this.
smitherfield 10y ago
C can be secure if you follow best practices (yes, big if). Are BSD, Linux and Postgres secure?
- kl4m 10y ago
  Maybe
- zenlikethat 10y ago
  Which BSD? Postgres "maybe", Linux hell no. Constant kernel exploits
- geofft 10y ago
  Postgres isn't written in standard C. It's written in a derivative of C where signed integer overflow is defined as two's-complement and the strict aliasing rule is removed. Most standard C compilers also support this variant language with the compile options -fwrapv -fno-strict-aliasing. https://www.postgresql.org/message-id/1689.1134422394@sss.pgh.pa.us https://www.postgresql.org/message-id/1689.1134422394@sss.pg... If you're going to use Postgres as an example of writing secure code in a language, that's fine, but make sure you're advocating for this C variant and not for standard C. Standard C, where signed integer overflow is undefined and the strict aliasing rule exists, is extremely hard to write secure code in. http://blog.regehr.org/archives/1307 http://blog.regehr.org/archives/1307 (There's also the separate issue that most of the input paths into Postgres are trusted in some way: you don't expect malformed database files, and you often don't expect hostile queries. It's primarily the auth code that needs to be rock-solid, which is a relatively small piece of the software.)
  - anarazel 10y ago
    Yea, postgres certainly assumes a lot more than the standard guarantees. Besides the above, if you look at it formally, it's pretty much impossible to have a multi-process program, connected over shared memory, that's actually fully standard compliant. Especially not when using a pre C11 environment (postgres requires C89). I think we really should have "official" variants of C that are a bit more predictable. But I guess that's not happening.

by gamache 10y ago

mehh 10y ago

Funny, was literally about to post the same thing!

andrewvijay 10y ago

Same thought. But then may be Krypton Dev is wise enough to sort out his stuff.

gamache 10y ago
A great hacker could maybe do it in C -- maybe even in a one-night coding spree -- but a wise hacker in 2016 wouldn't try.

beberlei 10y ago

I was scared by the mention of migrating all code from etherum to bitcoin blockchain in just one night.

tremon 10y ago

Any chance this was meant as sarcasm? As in, they're suggesting that even C is more secure than what Ethereum has developed?

heliumcraft 10y ago
It has nothing to do with Ethereum. This Krypton chain has a very minuscule hashpower so it's susceptible to attacks. It would happen with any Proof of Work chain. She is moving to a Proof of Stake which requires +- 51% of the ownership total coins to execute an attack like this.

smitherfield 10y ago

C can be secure if you follow best practices (yes, big if). Are BSD, Linux and Postgres secure?

kl4m 10y ago
Maybe
zenlikethat 10y ago
Which BSD? Postgres "maybe", Linux hell no. Constant kernel exploits
geofft 10y ago
Postgres isn't written in standard C. It's written in a derivative of C where signed integer overflow is defined as two's-complement and the strict aliasing rule is removed. Most standard C compilers also support this variant language with the compile options -fwrapv -fno-strict-aliasing. https://www.postgresql.org/message-id/1689.1134422394@sss.pgh.pa.us https://www.postgresql.org/message-id/1689.1134422394@sss.pg... If you're going to use Postgres as an example of writing secure code in a language, that's fine, but make sure you're advocating for this C variant and not for standard C. Standard C, where signed integer overflow is undefined and the strict aliasing rule exists, is extremely hard to write secure code in. http://blog.regehr.org/archives/1307 http://blog.regehr.org/archives/1307 (There's also the separate issue that most of the input paths into Postgres are trusted in some way: you don't expect malformed database files, and you often don't expect hostile queries. It's primarily the auth code that needs to be rock-solid, which is a relatively small piece of the software.)
- anarazel 10y ago
  Yea, postgres certainly assumes a lot more than the standard guarantees. Besides the above, if you look at it formally, it's pretty much impossible to have a multi-process program, connected over shared memory, that's actually fully standard compliant. Especially not when using a pre C11 environment (postgres requires C89). I think we really should have "official" variants of C that are a bit more predictable. But I guess that's not happening.