5 ms·

The way I recall it, they didn’t void past transactions; they added “irregular state changes” that would “return” the “stolen” funds to their “legitimate“ owner

The way I recall it, they didn’t void past transactions; they added “irregular state changes” that would “return” the “stolen” funds to their “legitimate“ owners. Nor were they forced to fork; it was a voluntary decision of a group of people with enough social power over the platform. Now this is more a matter of dispute, but I wouldn’t say the hacker stole the funds. They simply followed the DAO contract (not the “smart-contract”, mind you, but the one put forward by the Slock.it team on their page), according to which everything that went on the blockchain according to the DAO code was legitimate.

mannykannot 10y ago
>Now this is more a matter of dispute, but I wouldn’t say the hacker stole the funds... Verification is Ethereum's Achille's heel. Everyone seems to trust that someone else will verify that the contracts they participate in will work securely as intended, and the DAO showed how well that works. If Ethereum ever gets used as its proponents imagine, with multiple interacting contracts in progress at any given time, rolling back an error will not be nearly as easy as it was in the DAO case (and that was not particularly easy.)
- aminok 10y ago
  That's every system's Achille's Heel. It's a human fault.
  - mannykannot 10y ago
    The point is that in Ethereum's case, the extent of the problem is vastly underestimated by almost all of the participants. In most other cases, it is a risk that can be mitigated or accepted, but in Ethereum's case, it undermines the fundamental premise ('trustless' contracts.)
    - aminok 10y ago
      It's something that will change with experience.
      - mannykannot 10y ago
        It certainly will - people will realize that the fanciful dreams are not feasible.
        aminok 10y ago
        And others will realise the possibilities opened up by Turing Complete contracting.
        mannykannot 10y ago
        Unless Ethereum can solve its verification problem, its biggest opportunities will be for scammers.
        aminok 10y ago
        I think it's unlikely that scamming will be the biggest opportunity in the long run, given how unsustainable it is. Mutually beneficial uses will predominate over time because that's the only way to get repeat users.
        mannykannot 10y ago
        Unless an effective defense is developed, scamming can be continued as long as attempts at legitimate use are being made. Whenever activity ticks up, scammers will be attracted by it.
        aminok 10y ago
        Scammers are fighting a losing battle against better security technology. They can only capitalize on insecurity. They cannot prevent people from developing and adopting more secure products/services/technologies.
    - mbrock 10y ago
      I think Ethereum users will mostly converge on a limited set of useful cookie cutter contracts and simple combinations thereof. New types of contracts will hopefully be received with skepticism, as "The DAO" should have been. So the premise isn't really undermined. It's just that the focus on writing custom contracts in a programming language will diminish as the basic framework matures.
      - mannykannot 10y ago
        That is not the vision Ethereum was sold on.
        mbrock 10y ago
        There was always a pretty limited range of basic use cases for smart contracts: crowdsales, auctions, debt registries, currency tokens, multisig wallets, etc. As people begin to use Ethereum for real-world organizations, they will of course prefer to use popular, tested, verified implementations of these basic contract types. I'm not sure what vision you refer to, but anyway, original visions aren't binding!
        mannykannot 10y ago
        >they will of course prefer to use popular, tested, verified implementations of these basic contract types. That worked out so well with the DAO. There was, of course, at least one person who did take the trouble to do his own investigation of its security ;-) Perhaps you could point us to some verified implementations of these basic contract types (together with the arguments for their veracity, of course.)

mannykannot 10y ago

>Now this is more a matter of dispute, but I wouldn’t say the hacker stole the funds... Verification is Ethereum's Achille's heel. Everyone seems to trust that someone else will verify that the contracts they participate in will work securely as intended, and the DAO showed how well that works. If Ethereum ever gets used as its proponents imagine, with multiple interacting contracts in progress at any given time, rolling back an error will not be nearly as easy as it was in the DAO case (and that was not particularly easy.)

aminok 10y ago
That's every system's Achille's Heel. It's a human fault.
- mannykannot 10y ago
  The point is that in Ethereum's case, the extent of the problem is vastly underestimated by almost all of the participants. In most other cases, it is a risk that can be mitigated or accepted, but in Ethereum's case, it undermines the fundamental premise ('trustless' contracts.)
  - aminok 10y ago
    It's something that will change with experience.
    - mannykannot 10y ago
      It certainly will - people will realize that the fanciful dreams are not feasible.
      - aminok 10y ago
        And others will realise the possibilities opened up by Turing Complete contracting.
        mannykannot 10y ago
        Unless Ethereum can solve its verification problem, its biggest opportunities will be for scammers.
        aminok 10y ago
        I think it's unlikely that scamming will be the biggest opportunity in the long run, given how unsustainable it is. Mutually beneficial uses will predominate over time because that's the only way to get repeat users.
        mannykannot 10y ago
        Unless an effective defense is developed, scamming can be continued as long as attempts at legitimate use are being made. Whenever activity ticks up, scammers will be attracted by it.
        aminok 10y ago
        Scammers are fighting a losing battle against better security technology. They can only capitalize on insecurity. They cannot prevent people from developing and adopting more secure products/services/technologies.
  - mbrock 10y ago
    I think Ethereum users will mostly converge on a limited set of useful cookie cutter contracts and simple combinations thereof. New types of contracts will hopefully be received with skepticism, as "The DAO" should have been. So the premise isn't really undermined. It's just that the focus on writing custom contracts in a programming language will diminish as the basic framework matures.
    - mannykannot 10y ago
      That is not the vision Ethereum was sold on.
      - mbrock 10y ago
        There was always a pretty limited range of basic use cases for smart contracts: crowdsales, auctions, debt registries, currency tokens, multisig wallets, etc. As people begin to use Ethereum for real-world organizations, they will of course prefer to use popular, tested, verified implementations of these basic contract types. I'm not sure what vision you refer to, but anyway, original visions aren't binding!
        mannykannot 10y ago
        >they will of course prefer to use popular, tested, verified implementations of these basic contract types. That worked out so well with the DAO. There was, of course, at least one person who did take the trouble to do his own investigation of its security ;-) Perhaps you could point us to some verified implementations of these basic contract types (together with the arguments for their veracity, of course.)