8 ms·

I know I'm this situation the dev made a simple mistake, but I wonder if Ethereum is safe as a system assuming developers will make many mistakes, and those mis

by lowpro 9y ago

I know I'm this situation the dev made a simple mistake, but I wonder if Ethereum is safe as a system assuming developers will make many mistakes, and those mistakes will happen more often as more complicated contracts are written. At some point I wonder if the idea of smart contracts is better than a traditional system, since they seem prone to developer error due to complexity.

icelancer 9y ago
>At some point I wonder if the idea of smart contracts is better than a traditional system, since they seem prone to developer error due to complexity. The idea is incredible. Groundbreaking. Honestly super interesting to me. The execution of them as law is... well, going about as expected. This is why the law doesn't actually work this way.
hn_throwaway_99 9y ago
> I know I'm this situation the dev made a simple mistake, but I wonder if Ethereum is safe as a system assuming developers will make many mistakes, and those mistakes will happen more often as more complicated contracts are written. This will probably come off as being assholish, but I honestly don't mean it to be: you should read the rest of the article. It actually covers this topic in depth and has good thoughts on this fundamental issue with smart contracts.
- lowpro 9y ago
  Honestly I read the comments first, I enjoy and learn from HN comments often more than the original article. Thanks for pointing out I was missing context.
- bastawhiz 9y ago
  The rest of the article amounts to a few points: - Humans make mistakes, the tools should have been better - The technology to make Ethereum safe doesn't really exist - We should work to make that technology exist - We should be happy this happened since it raises awareness about the problem > In the end, attacks like this are good for the community. They call you to your senses and force you to keep your eyes open. What?! Listen, just because Valgrind exists doesn't mean you can't accidentally write a C program with memory errors. Just because Rust protects against race conditions doesn't mean you can't have bugs in your threading code. We're not even close to a world where tools can offer amazing protection. > The developer here was Gavin Wood, one of the co-creators of Ethereum, and the inventor of Solidity, the smart contract programming language. The code was also reviewed by other Parity contributors. This is basically the highest standard of programming that exists in the Ethereum ecosystem. This was an error made by the best of the best, reviewed by the best of the best. The tools that will save us from this madness don't exist. What does this mean for Joe Developer? It means he's not going to build something that he keeps anything of value on. The author's cheery "we'll be stronger for this!" attitude completely neglects the obvious chilling effect that this is having. If the guy that invented the damn thing can't protect his $31 million dollars, why would I even try to build something that could manage even hundreds of dollars? And to that end, is it really better than a traditional system?
  - deleted 9y ago
    [deleted]
  - xfer 9y ago
    > We're not even close to a world where tools can offer amazing protection. I wonder how do you ride your plane then? > The tools that will save us from this madness don't exist. These tools do exist(not with ethereum ofc). They are harder to work with, which should be a non-issue for writing contracts.
    - sdenton4 9y ago
      The planes I ride in are not designed to survive most forms of adversarial engagement...
    - nemothekid 9y ago
      >I wonder how do you ride your plane then? I don't understand this comparison. The underlying concepts involved in flying a plane is way more understood, tested, and regulated than writing software is. If the choice was between dying in a plane crash, and dying due to a software bug/exploit, I'd choose the plane every time.
    - noobermin 9y ago
      >I wonder how do you ride your plane then? When I was in physics undergrad, I remember talking to engineering students taking statics. In general physics, we were allowed to make simple numerical errors, the emphasis then was on figuring out the solution and understanding the physics. My friends on the other hand complained how they, after acing gen. physics, would get mercilessly docked off points for minor arithmetic errors and calculation errors in statics. They'd complain to the professor and he'd reply, "that mistake you made means your bridge will collapse! It doesn't matter if it's minor!" The point is to become an certified engineer, there is a certain level of rigor you need to have because of the gravity of what you deal with, and if that fails, engineers have been held legally liable. The article said it itself, and I really couldn't believe how blantant it was: >Most of the programmers who are getting into this space, myself included, come from a web development background, and the blockchain toolchain is designed to be familiar for web developers.[...]The problem is, blockchain programming is fundamentally different from web development. My mouth was wide open reading this here, people who have the discipline of web developers are the ones developing Ethereum? And this is the promised land that one day will be the future and I'm supposed to believe it? Sorry, for some aspects of life, brightness and having a great community are not enough, especially when you want to do something that you could lead to risk of loss of life or limb.
davidgerard 9y ago
I think Solidity, and hence Ethereum as a smart contracts platform, really took off because Solidity is easy to get started with. More formal languages make it harder to shoot yourself in the foot, but ... devs don't use them. The trouble with appealing to the middling devs, of course, is that you end up with middling code, and middling smart contract code is how to shoot yourself in the foot. https://davidgerard.co.uk/blockchain/ethereum-smart-contracts-in-practice/ https://davidgerard.co.uk/blockchain/ethereum-smart-contract...

by lowpro 9y ago

icelancer 9y ago

>At some point I wonder if the idea of smart contracts is better than a traditional system, since they seem prone to developer error due to complexity. The idea is incredible. Groundbreaking. Honestly super interesting to me. The execution of them as law is... well, going about as expected. This is why the law doesn't actually work this way.

hn_throwaway_99 9y ago

> I know I'm this situation the dev made a simple mistake, but I wonder if Ethereum is safe as a system assuming developers will make many mistakes, and those mistakes will happen more often as more complicated contracts are written. This will probably come off as being assholish, but I honestly don't mean it to be: you should read the rest of the article. It actually covers this topic in depth and has good thoughts on this fundamental issue with smart contracts.

lowpro 9y ago
Honestly I read the comments first, I enjoy and learn from HN comments often more than the original article. Thanks for pointing out I was missing context.
bastawhiz 9y ago
The rest of the article amounts to a few points: - Humans make mistakes, the tools should have been better - The technology to make Ethereum safe doesn't really exist - We should work to make that technology exist - We should be happy this happened since it raises awareness about the problem > In the end, attacks like this are good for the community. They call you to your senses and force you to keep your eyes open. What?! Listen, just because Valgrind exists doesn't mean you can't accidentally write a C program with memory errors. Just because Rust protects against race conditions doesn't mean you can't have bugs in your threading code. We're not even close to a world where tools can offer amazing protection. > The developer here was Gavin Wood, one of the co-creators of Ethereum, and the inventor of Solidity, the smart contract programming language. The code was also reviewed by other Parity contributors. This is basically the highest standard of programming that exists in the Ethereum ecosystem. This was an error made by the best of the best, reviewed by the best of the best. The tools that will save us from this madness don't exist. What does this mean for Joe Developer? It means he's not going to build something that he keeps anything of value on. The author's cheery "we'll be stronger for this!" attitude completely neglects the obvious chilling effect that this is having. If the guy that invented the damn thing can't protect his $31 million dollars, why would I even try to build something that could manage even hundreds of dollars? And to that end, is it really better than a traditional system?
- deleted 9y ago
  [deleted]
- xfer 9y ago
  > We're not even close to a world where tools can offer amazing protection. I wonder how do you ride your plane then? > The tools that will save us from this madness don't exist. These tools do exist(not with ethereum ofc). They are harder to work with, which should be a non-issue for writing contracts.
  - sdenton4 9y ago
    The planes I ride in are not designed to survive most forms of adversarial engagement...
  - nemothekid 9y ago
    >I wonder how do you ride your plane then? I don't understand this comparison. The underlying concepts involved in flying a plane is way more understood, tested, and regulated than writing software is. If the choice was between dying in a plane crash, and dying due to a software bug/exploit, I'd choose the plane every time.
  - noobermin 9y ago
    >I wonder how do you ride your plane then? When I was in physics undergrad, I remember talking to engineering students taking statics. In general physics, we were allowed to make simple numerical errors, the emphasis then was on figuring out the solution and understanding the physics. My friends on the other hand complained how they, after acing gen. physics, would get mercilessly docked off points for minor arithmetic errors and calculation errors in statics. They'd complain to the professor and he'd reply, "that mistake you made means your bridge will collapse! It doesn't matter if it's minor!" The point is to become an certified engineer, there is a certain level of rigor you need to have because of the gravity of what you deal with, and if that fails, engineers have been held legally liable. The article said it itself, and I really couldn't believe how blantant it was: >Most of the programmers who are getting into this space, myself included, come from a web development background, and the blockchain toolchain is designed to be familiar for web developers.[...]The problem is, blockchain programming is fundamentally different from web development. My mouth was wide open reading this here, people who have the discipline of web developers are the ones developing Ethereum? And this is the promised land that one day will be the future and I'm supposed to believe it? Sorry, for some aspects of life, brightness and having a great community are not enough, especially when you want to do something that you could lead to risk of loss of life or limb.

davidgerard 9y ago

I think Solidity, and hence Ethereum as a smart contracts platform, really took off because Solidity is easy to get started with. More formal languages make it harder to shoot yourself in the foot, but ... devs don't use them. The trouble with appealing to the middling devs, of course, is that you end up with middling code, and middling smart contract code is how to shoot yourself in the foot. https://davidgerard.co.uk/blockchain/ethereum-smart-contracts-in-practice/ https://davidgerard.co.uk/blockchain/ethereum-smart-contract...