4 ms·

Solidity needs to get rid of features like library and inheritance. If you write an unstoppable contract that is responsible for holding hundreds of millions of

Solidity needs to get rid of features like library and inheritance. If you write an unstoppable contract that is responsible for holding hundreds of millions of dollars, you alone should be responsible for it, and not some library you used. Better yet, people who have the mindset that it's ok to have these hipster "modular" features that spread out the responsibility (for whose benefit?) should really not be working on such fundamental pieces of technology. If you write software that holds people's money and you fuck up, you and only you are responsible for it. This is a recurring theme with the Ethereum community where people complain about how there was a bug in the system which resulted in a huge hack and people losing tons of money, and developers say "hey don't blame me I just used some library, it's the library's fault".

root_axis 9y ago
Certainly each person rolling their own is going to end up worse than the use of modules that are improved over time.
- MichaelBurge 9y ago
  Most of the trouble is on the module boundary, so improving the modules themselves probably isn't worth as much as you'd think.
mifeng 9y ago
Since contracts are immutable, you need modularity to be able to fix bugs like what happened with Parity. The problem is that Solidity libraries are also immutable, which means you can't fix them. The solution is easy: just use contract modules, not libraries.
- cocktailpeanuts 9y ago
  No you don't. That's a myth. Having modularity in these things only amplifies the damage when something DOES happen. I'm not saying it is bad to have a centralized auditing of contracts, but I am saying it's not a good thing to simply import libraries and inherit some other abstract contract you don't fully understand when it comes to irreversible contracts. This is a new type of problem we as a humanity have never faced before, so we need a different type of solution.
  - Procrastes 9y ago
    > This is a new type of problem we as a humanity have never faced before, so we need a different type of solution. Could you elaborate on that? How is it a new problem? I would think it's similar to problems with hardware components or FPGA libraries, but maybe I'm missing something?
    - cocktailpeanuts 9y ago
      Crypto used to be a purely technological problem, which means if you have a secure cryptographic lock in your bank account and someone steals it from the bank, the bank is responsible to get it back to you. But with cryptocurrencies, it's not just about technology but ties into other issues that normally have been tackled on a social level. So in this case there is no "bank" you can complain to or no one to sue. Of course, you could say Ethereum as a whole can do a hard fork just for this, but that's another discussion altogether.
- DennisP 9y ago
  Parity actually used a contract module in this case.
cslarson 9y ago
> hey don't blame me I just used some library, it's the library's fault Who really says that?
- tomca32 9y ago
  Equifax: https://www.infosecurity-magazine.com/news/equifax-blame-breach-apache/ https://www.infosecurity-magazine.com/news/equifax-blame-bre...
- cocktailpeanuts 9y ago
  When people blamed Ethereum for being the cause of the DAO, the devs said it's not Ethereum's fault but the ones who wrote the DAO, which is technically true, which is why I'm making this point. It's not about technology, it's about responsibility. Also, a while ago some guy complained about how he lost his money using myetherwallet, and the problem was NOT because of myetherwallet but a library they used. So the guy from myetherwallet told reddit that it's not their fault, which is again technically true, but again fits into what I'm talking about. Dependency spreads out responsibility, which works out fine for traditional finance because everything is reversible, but not in this new economy.
  - AgentME 9y ago
    The whole point of Ethereum is for people to be able to use custom contracts. People would be using Bitcoin if they only wanted to be able to use contracts by the Ethereum -- er, cryptocurrency developers.
vkou 9y ago
Contracts in the real world are written with the understanding that they rest on the shoulders of millions of pages of legislature and legal precedents. For the most part, they work just fine.
- cocktailpeanuts 9y ago
  That's because contracts in the real world are reversible.
  - vkou 9y ago
    Given the DAO fork, and the upcoming fix to Eth, so are Eth contracts.
    - cocktailpeanuts 9y ago
      Not sure if you're arguing for the sake of arguing.
      - mlvljr 9y ago
        He isn't :)
DennisP 9y ago
In this case the library was also written by Parity. They were trying to minimize the gas cost of deploying a new wallet, which imho doesn't seem like the best thing to worry about optimizing, for a contract that may hold millions of dollars.
- snissn 9y ago
  Yeah - they saved what 50$ in gas?

root_axis 9y ago

Certainly each person rolling their own is going to end up worse than the use of modules that are improved over time.

MichaelBurge 9y ago
Most of the trouble is on the module boundary, so improving the modules themselves probably isn't worth as much as you'd think.

mifeng 9y ago

Since contracts are immutable, you need modularity to be able to fix bugs like what happened with Parity. The problem is that Solidity libraries are also immutable, which means you can't fix them. The solution is easy: just use contract modules, not libraries.

cocktailpeanuts 9y ago
No you don't. That's a myth. Having modularity in these things only amplifies the damage when something DOES happen. I'm not saying it is bad to have a centralized auditing of contracts, but I am saying it's not a good thing to simply import libraries and inherit some other abstract contract you don't fully understand when it comes to irreversible contracts. This is a new type of problem we as a humanity have never faced before, so we need a different type of solution.
- Procrastes 9y ago
  > This is a new type of problem we as a humanity have never faced before, so we need a different type of solution. Could you elaborate on that? How is it a new problem? I would think it's similar to problems with hardware components or FPGA libraries, but maybe I'm missing something?
  - cocktailpeanuts 9y ago
    Crypto used to be a purely technological problem, which means if you have a secure cryptographic lock in your bank account and someone steals it from the bank, the bank is responsible to get it back to you. But with cryptocurrencies, it's not just about technology but ties into other issues that normally have been tackled on a social level. So in this case there is no "bank" you can complain to or no one to sue. Of course, you could say Ethereum as a whole can do a hard fork just for this, but that's another discussion altogether.
DennisP 9y ago
Parity actually used a contract module in this case.

cslarson 9y ago

> hey don't blame me I just used some library, it's the library's fault Who really says that?

tomca32 9y ago
Equifax: https://www.infosecurity-magazine.com/news/equifax-blame-breach-apache/ https://www.infosecurity-magazine.com/news/equifax-blame-bre...
cocktailpeanuts 9y ago
When people blamed Ethereum for being the cause of the DAO, the devs said it's not Ethereum's fault but the ones who wrote the DAO, which is technically true, which is why I'm making this point. It's not about technology, it's about responsibility. Also, a while ago some guy complained about how he lost his money using myetherwallet, and the problem was NOT because of myetherwallet but a library they used. So the guy from myetherwallet told reddit that it's not their fault, which is again technically true, but again fits into what I'm talking about. Dependency spreads out responsibility, which works out fine for traditional finance because everything is reversible, but not in this new economy.
- AgentME 9y ago
  The whole point of Ethereum is for people to be able to use custom contracts. People would be using Bitcoin if they only wanted to be able to use contracts by the Ethereum -- er, cryptocurrency developers.

vkou 9y ago

Contracts in the real world are written with the understanding that they rest on the shoulders of millions of pages of legislature and legal precedents. For the most part, they work just fine.

cocktailpeanuts 9y ago
That's because contracts in the real world are reversible.
- vkou 9y ago
  Given the DAO fork, and the upcoming fix to Eth, so are Eth contracts.
  - cocktailpeanuts 9y ago
    Not sure if you're arguing for the sake of arguing.
    - mlvljr 9y ago
      He isn't :)

DennisP 9y ago

In this case the library was also written by Parity. They were trying to minimize the gas cost of deploying a new wallet, which imho doesn't seem like the best thing to worry about optimizing, for a contract that may hold millions of dollars.

snissn 9y ago
Yeah - they saved what 50$ in gas?