3 ms·

> We're not even close to a world where tools can offer amazing protection. I wonder how do you ride your plane then? > The tools that will save us from this

by xfer 9y ago

> We're not even close to a world where tools can offer amazing protection. I wonder how do you ride your plane then? > The tools that will save us from this madness don't exist. These tools do exist(not with ethereum ofc). They are harder to work with, which should be a non-issue for writing contracts.

sdenton4 9y ago
The planes I ride in are not designed to survive most forms of adversarial engagement...
nemothekid 9y ago
>I wonder how do you ride your plane then? I don't understand this comparison. The underlying concepts involved in flying a plane is way more understood, tested, and regulated than writing software is. If the choice was between dying in a plane crash, and dying due to a software bug/exploit, I'd choose the plane every time.
noobermin 9y ago
>I wonder how do you ride your plane then? When I was in physics undergrad, I remember talking to engineering students taking statics. In general physics, we were allowed to make simple numerical errors, the emphasis then was on figuring out the solution and understanding the physics. My friends on the other hand complained how they, after acing gen. physics, would get mercilessly docked off points for minor arithmetic errors and calculation errors in statics. They'd complain to the professor and he'd reply, "that mistake you made means your bridge will collapse! It doesn't matter if it's minor!" The point is to become an certified engineer, there is a certain level of rigor you need to have because of the gravity of what you deal with, and if that fails, engineers have been held legally liable. The article said it itself, and I really couldn't believe how blantant it was: >Most of the programmers who are getting into this space, myself included, come from a web development background, and the blockchain toolchain is designed to be familiar for web developers.[...]The problem is, blockchain programming is fundamentally different from web development. My mouth was wide open reading this here, people who have the discipline of web developers are the ones developing Ethereum? And this is the promised land that one day will be the future and I'm supposed to believe it? Sorry, for some aspects of life, brightness and having a great community are not enough, especially when you want to do something that you could lead to risk of loss of life or limb.
- mbrock 9y ago
  That means there is an entrepreneurial prospect for you to enter the space with a team that has a more serious background, right? Eventually people will generally understand that contracts require serious correct engineering, and you'll be able to capitalize on expertise. Smart contracts have only been generally available for like a couple of years. Most people are clueless about how to do them properly. That means it's an interesting thing to work on! And hopefully we'll steer the ship towards safety, correctness, and simplicity.
  - icelancer 9y ago
    >Eventually people will generally understand that contracts require serious correct engineering, and you'll be able to capitalize on expertise. No one gets paid for exploiting a minor hole in a bridge, causing it to collapse. They will by finding holes in smart contracts, as evidenced. Bug bounty programs do not exist to provide alternative means of financial remuneration for black hat hackers. They exist to provide white/grey hat hackers an opportunity to get paid for doing the right thing. And yet black hat hackers still sell zero-days to rogue governments and operatives. Why do you think this bug bounty model of securing smart contracts will be any different? Capitalizing on expertise against smart contracts has its own reward with a shorter feedback cycle than selling zero-days: You directly profit from finding security breaches and stealing money.
    - mbrock 9y ago
      I think we'll be able to just prove the correctness of our contracts and then use them safely. Of course you can't do that with Microsoft Windows because it's too complicated, but you can do it with small contract bytecodes.
  - lmm 9y ago
    The kind of person who's risk-averse enough that they'd pay extra for a better contract engineer is probably not the kind of person who's using smart contracts at all. And buying contracts is lemon market, which is only really solvable via regulation - but its biggest fans are regulation-averse people.
icelancer 9y ago
>I wonder how do you ride your plane then? I don't fly air superiority missions, so I don't generally consider it. Your point is probably valid for Air Force and Navy pilots, I guess.

by xfer 9y ago

sdenton4 9y ago

The planes I ride in are not designed to survive most forms of adversarial engagement...

nemothekid 9y ago

>I wonder how do you ride your plane then? I don't understand this comparison. The underlying concepts involved in flying a plane is way more understood, tested, and regulated than writing software is. If the choice was between dying in a plane crash, and dying due to a software bug/exploit, I'd choose the plane every time.

noobermin 9y ago

>I wonder how do you ride your plane then? When I was in physics undergrad, I remember talking to engineering students taking statics. In general physics, we were allowed to make simple numerical errors, the emphasis then was on figuring out the solution and understanding the physics. My friends on the other hand complained how they, after acing gen. physics, would get mercilessly docked off points for minor arithmetic errors and calculation errors in statics. They'd complain to the professor and he'd reply, "that mistake you made means your bridge will collapse! It doesn't matter if it's minor!" The point is to become an certified engineer, there is a certain level of rigor you need to have because of the gravity of what you deal with, and if that fails, engineers have been held legally liable. The article said it itself, and I really couldn't believe how blantant it was: >Most of the programmers who are getting into this space, myself included, come from a web development background, and the blockchain toolchain is designed to be familiar for web developers.[...]The problem is, blockchain programming is fundamentally different from web development. My mouth was wide open reading this here, people who have the discipline of web developers are the ones developing Ethereum? And this is the promised land that one day will be the future and I'm supposed to believe it? Sorry, for some aspects of life, brightness and having a great community are not enough, especially when you want to do something that you could lead to risk of loss of life or limb.

mbrock 9y ago
That means there is an entrepreneurial prospect for you to enter the space with a team that has a more serious background, right? Eventually people will generally understand that contracts require serious correct engineering, and you'll be able to capitalize on expertise. Smart contracts have only been generally available for like a couple of years. Most people are clueless about how to do them properly. That means it's an interesting thing to work on! And hopefully we'll steer the ship towards safety, correctness, and simplicity.
- icelancer 9y ago
  >Eventually people will generally understand that contracts require serious correct engineering, and you'll be able to capitalize on expertise. No one gets paid for exploiting a minor hole in a bridge, causing it to collapse. They will by finding holes in smart contracts, as evidenced. Bug bounty programs do not exist to provide alternative means of financial remuneration for black hat hackers. They exist to provide white/grey hat hackers an opportunity to get paid for doing the right thing. And yet black hat hackers still sell zero-days to rogue governments and operatives. Why do you think this bug bounty model of securing smart contracts will be any different? Capitalizing on expertise against smart contracts has its own reward with a shorter feedback cycle than selling zero-days: You directly profit from finding security breaches and stealing money.
  - mbrock 9y ago
    I think we'll be able to just prove the correctness of our contracts and then use them safely. Of course you can't do that with Microsoft Windows because it's too complicated, but you can do it with small contract bytecodes.
- lmm 9y ago
  The kind of person who's risk-averse enough that they'd pay extra for a better contract engineer is probably not the kind of person who's using smart contracts at all. And buying contracts is lemon market, which is only really solvable via regulation - but its biggest fans are regulation-averse people.

icelancer 9y ago

>I wonder how do you ride your plane then? I don't fly air superiority missions, so I don't generally consider it. Your point is probably valid for Air Force and Navy pilots, I guess.