11 ms·
Can someone explain to me how on earth Ethereum is still a thing? People have lost hundreds of millions of dollars in the Ethereum ecosystem, many due to basic
by MrBingley 9y ago
Can someone explain to me how on earth Ethereum is still a thing? People have lost hundreds of millions of dollars in the Ethereum ecosystem, many due to basic flaws in the "Solidity" language. For example, last November $280 million was frozen in Parity wallets because function visibility defaults to external rather than internal (see the previous HN discussion here[0]). Just for fun, I was looking through the Security Considerations[1] in the Ethereum docs, and here are two so-called "minor details":
- In `for (var i = 0; i < arrayName.length; i++) { ... }`, the type of `i` will be `uint8`, because this is the smallest type that is required to hold the value `0`. If the array has more than 255 elements, the loop will not terminate.
- The `constant` keyword for functions is currently not enforced by the compiler. Furthermore, it is not enforced by the EVM, so a contract function that "claims" to be constant might still cause changes to the state.
WTF?! Trivial loops won't terminate to due (unchecked) integer overflow, and the `constant` keyword does nothing? It's a complete gong show. I'm not touching anything to do with this language with a 100 foot pool. Is the hype bubble just that big?
[0] https://news.ycombinator.com/item?id=14807779 https://news.ycombinator.com/item?id=14807779
[1] https://solidity.readthedocs.io/en/develop/security-considerations.html https://solidity.readthedocs.io/en/develop/security-consider...
Edit: Oops, it looks like I'm mixing up my multi-million dollar screw-ups. First in July $30 million was stolen due to the "public is default" debacle, and then the fix for that problem introduced another bug (the developers forget to call the `initWallet` function), which lead to the $280 million being frozen in November[2]. Holy crap.
[2] https://news.ycombinator.com/item?id=15642856 https://news.ycombinator.com/item?id=15642856
- Bromskloss 9y agoDoes Ethereum's existence hinge on Solidity? Isn't Solidity just a language that one can compile to the lower-level language actually built into Ethereum?
- twic 9y agoSomeone told me recently that there's an idea to replace EVM (the lower-level language actually built into Ethereum) with WASM. That would allow people to target it with a variety of existing programming languages, some of which are not clown shoes. If that's possible, it sounds sensible.
- mhluongo 9y agoThe EVM is the runtime, not the language. WASM would be great though. A couple new projects are using it (eg Dfinity)
- masklinn 9y agoSolidity is the official language, part of the ethereum project, and pretty much all you get when you look for how to develop eth contracts, unless you specifically exclude mentions of solidity. Then you get Ivy (prototype & for bitcoin not eth) and Pyramid Scheme. So I'd say yeah, technically not but practically it is.
- Pxtl 9y agoWait, there's a scheme variant for Eth called Pyramid Scheme? That is the best programming language name ever.
- weavie 9y agohttp://www.michaelburge.us/2017/11/28/write-your-next-ethereum-contract-in-pyramid-scheme.html http://www.michaelburge.us/2017/11/28/write-your-next-ethere... "Pyramid Scheme is implemented using the appropriately-named Racket."
- cat199 9y agocould have used larceny as well.. http://www.larcenists.org/ http://www.larcenists.org/
- blunte 9y agoThe promise of Ethereum was to be a global, decentralize, virtual computer. Without smart contracts, it's just another electronic value exchange platform.
- ve55 9y agoYou could have other languages that compile code into EVM-executable opcodes, but Solidity is currently the language used by all major players in the Ethereum ecosystem for writing smart contracts. Although there's other options (or new options could be made), it's very unlikely that Solidity will be replaced by any of them any time soon.
- mhluongo 9y agoYep, anyone interested in taking a crack can write a language that compiles down to the Low-level Lisp-like Language (LLL) intermediate lang. There are a couple projects working on it (eg Viper), though many seems to prefer starting a new blockchain. Edit: s/Serpent/Viper/
- mannykannot 9y agoIsn't Serpent an earlier effort that was abandoned in favor of Solidity? There was also the short-lived Mutan, V[iy]per (apparently a work-in-progress) and something called Slang.
- mhluongo 9y agoDuh, Viper is what I meant- thanks :)
- 52-6F-62 9y agoNot explicitly. Currently, it's the most widest used language for interacting with the VM, but it's not the end development goal. I don't think the entire thing hinges on Solidity, though it's probably the most immediately accessible language. The hype driving the price up seems a bit premature, though. There are a couple of other languages in development that might improve the ecosystem: * Vyper https://github.com/ethereum/vyper https://github.com/ethereum/vyper * Serpent https://github.com/ethereum/serpent https://github.com/ethereum/serpent
- mannykannot 9y agoI think one can say that these issues of miner 'optimization' and some of the issues raised in the LeastAuthority audit [1] are architectural, rather than Solidity-specific, and which can only be addressed through defensive transaction design. [1] https://github.com/LeastAuthority/ethereum-analyses/blob/master/GasEcon.md https://github.com/LeastAuthority/ethereum-analyses/blob/mas...
- UncleMeat 9y agoEven EVM has complex semantics surrounding critical features like time, dispatch, and exceptions. The whole ecosystem is amateur.
- robert_davidson 9y agoIt is. This will improve but it's a lower priority than scaling.
- jancsika 9y agoWell, they start with an assumption that the halting problem is addressed simply by "running out of gas." I could easily see a dev assessing the infinite loop potential and glibly thinking, "well, that would just run out of gas, too." That doesn't explain the lack of guarantee on "constant". What is the technical detail which prevents such a guarantee?
- falsprofet 9y agoI don't know, but constant as a function return value signature does not make much sense at all.
- ve55 9y agoSolidity has a lot of potential pitfalls that need to be avoided, just like similar languages. Some of these are due to poor or unintuitive language design, although a lot of improvements have been made over time. The wallet bug involving Parity's multisig wallets was due to an error that Parity made, even if it's an error that may have been easy to make, it should have been caught in testing or code reviews due to how critical that library was. As far as the loop goes, you cannot have a loop that runs forever due to gas limits involved in transactions (a contract can only execute so many opcodes before it hits the gas limit and execution halts, with state reverted back), so it isn't a potential issue that it would never terminate. With that said Solidity still has some pitfalls that should be fixed, and many of them already have been fixed. It's not perfect, but it's quite usable compared to other smart contract systems, few of which are even as developed. Most of the largest headlines involving loss of funds in the Ethereum network have been due to programmer or user error. Keep in mind that Ethereum is still in its "experimental" phase - it isn't "supposed" to have billions of dollars put into it just yet, but the market doesn't care about this as long as the prices are going up. Ethereum could be much worse than it is, but that wouldn't mean its value would go to zero, or even do down. Plenty of top coins by market capitalization have been orders of magnitude worse, or just outright scams. Remember "The market can stay irrational for longer than you can remain solvent". It's still a very new area of technology despite the amount of money that pours into it. There's innovation, but it can be difficult to see it in the midst of the hype.
- mtgx 9y ago> Most of the largest headlines involving loss of funds in the Ethereum network have been due to programmer or user error. Well, that's reassuring. Should we expect that there will be no more programmer errors in the future on the Ethereum network then? Isn't Ethereum's job to minimize those errors?
- jstarks 9y agoIt’s well established that humans will make programming errors, and that good language design can reduce the rate of such errors (and eliminate certain classes of errors altogether). I’m surprised you are willing to place so much blame on Solidity’s users for their mistakes when these mistakes would have be avoided with simple improvements to the language design.
- spookthesunset 9y agoWho cares about the language when the very premise of the project "code is law" was proven wrong. When the DAO was "hacked" by a "thief", rather than tell people "whelp, code is law and the code executed perfect" the mob (more accurately, those at the top of the etherium pyramid) decided to change history and roll back the blockchain. Even the language designed to describe the "hack" was garbage. It wasn't a "hack", if code is law, all bugs are code and therefore part of law. There was no "thief" that "stole" anything either. Code is law. Somebody followed the contract down to the letter and made a trade to their benefited. Code is law. If the central tenant of "code is law" cannot even be held and real meatspace-based humans can modify history at will.... what value does ethereum add at all besides pissing away an unimaginable amount of energy turning non-renewable fossil fuels into heat? If anybody can modify history.... just use AWS. It's cheaper.
- epistasis 9y agoIMHO, "code is law" is a silly thing to aim for, and by ignoring that saying for the DAO incident proves that Ethereum is more valuable than it would be otherwise. The "code is law" is just hype about how amazing and new and unprecedented this thing is, but it's a truly bad idea. The reversibility of bugs is a good thing. In human law, there are exceptions, and appeals, etc. Aiming for a completely mechanical system is the type of unnuanced thinking that leads me to be extremely skeptical of the entire cryptocurrency community, and in particular made me think that Ethereum was a total joke run by unserious people. Computer tools must adapt to human nature, not the other way around. Ethereum's hype train ignored that. Such temporary hype trains can help get the train moving, but it's always important to separate the hype and marketing from the reality. Especially in everything from post 2000 in the Silicon Valley, hype and marketing are what drives success much more than product itself. We need to remember to not get high on our own supply, and not believe the bullshit that gets peddled in order to drive platform adoption.
- dcow 9y agoI'm a little lost. What does ETH provide society if it's just another system for allowing 51% of people to screw over the 49% that dissent?
- elmar 9y ago"We have no idea what we are doing!" Karl Floersch - Ethereum Researcher https://youtu.be/ycF0WFHY5kc?t=991 https://youtu.be/ycF0WFHY5kc?t=991
- anonacct37 9y agoYou seem to think terrible design is a blocker to adoption. Are you acquainted with Javascript or windows?
- Mbioguy 9y agoSounds like 2 things are getting confused. Think of Ethereum as a very slow decentralized computer. People make mistakes building applications all the time, but this doesn't necessarily mean the underlying language, or for a better comparison, the compiler is at fault. Problems with the underlying language can cause problems with applications, obviously. Programmer error =/= language/compiler error, while both can occur. People have been talking about the Parity hack like it's Ethereum's fault. Imo that's as absurd as blaming C for your program crashing to your coding error. Your post, while you are confusing two types of errors, isn't completely off. Solidity does need improving. Any language has to pick tradeoffs, and evolves over time as it becomes apparent what the system's needs are. But Ethereum and Solidity aren't to blame for most of the ETH-based apps that rushed to market without an appropriate level of QA and review, cut corners, made mistakes, and caused catastrophic problems for their users like the Parity bug... this should be ringing bells, folks.
- keymone 9y agoI’m not sure who is more clueless - people that trust JavaScripty shit-language to manage their finances or people that built a cryptocurrency around javascripty shit-language. But I definitely assign some guilt and responsibility for all the money lost in solidity contracts to creators of ethereum.
- kevingadd 9y agoEthereum and Solidity absolutely bear some of the blame for bad software if the software is only bad because the tooling is garbage. You can't just kick the can down the road, runtime and compiler authors have a responsibility to actually do a good job. PHP cost people tons of time and money in the bad old days and again, you can't just blame people for using PHP. You have to fix it. At the end of the day of course, the biggest error was on the part of the app developer, #1 because they used a bad platform, #2 because they didn't QA enough to compensate for the platform being bad. But it still comes down to the fact that Ethereum and Solidity are low quality and the low quality results in more bugs and lost money than we'd see otherwise. It's just like the bad old days of Windows XP (and the modern days of Cryptolockers) except now money is directly vanishing into the ether because bad software is controlling it.
- Iv 9y agoMaybe because that is so fat the largest functioning cryptocurrency based on proof of stake instead of proof of work, and that bitcoin proved that energywise, a global cryptocurrency would not be sustainable?
- keymone 9y agoEthereum is not based on proof of stake. Bitcoin proved that global cryptocurrency is absolutely sustainable, it just can’t be cheap.
- Fnoord 9y ago> Bitcoin proved that global cryptocurrency is absolutely sustainable It has not. * Transactions don't scale: they're are expensive, and not instant. * There are practically no ways to spend Bitcoins in the physical world. * The electricity costs of mining are not sustainable by mankind. Although some people in China want you to believe otherwise.
- keymone 9y ago> Transactions don't scale: they're are expensive, and not instant blockchain has limited scalability, second layer doesn't. also blockchain transactions were never supposed to be instant. in fact nothing is instant, check this thing called physics. > practically no ways to spend Bitcoins in the physical world there are plenty > electricity costs of mining are not sustainable by mankind bitcoin is not even a blip in total world energy spending and less than that in total world energy production. also if you check the dictionary for word sustainable: > able to be maintained at a certain rate or level. miners are profitable at current difficulty at current price of bitcoin. if price goes down - less efficient miners will go out of business and difficulty will decrease until balance is achieved. bitcoin is sustainable by design.
- Fnoord 9y agoFirst of all, perhaps you want to use proper capitalization in your posts. It adds to the readability of your post. > blockchain has limited scalability, second layer doesn't. also blockchain transactions were never supposed to be instant. Of course it wasn't supposed to be instant. That's why its a shit system to use as currency just like gold bars are a shit currency cause one has to drag them from the mine to the bank to the store. This Bitcoin thing was meant to be a currency, right? I guess you're talking about Lightning Network though which Bitcoin evangelists appear to market as the Second Coming of Christ. Well, it isn't active yet, and it isn't part of Bitcoin ie. it isn't "Bitcoin". So... I was right. > there are plenty Not really. Many have been removed lately. There were Bitcoin debit cards. Well, they got revoked. Steam? Doesn't accept Bitcoins anymore due to high transaction costs. And those are just a few examples. > in fact nothing is instant, check this thing called physics. That's odd. I just put money on my debit card from my bank and it took like a minute. And I consider that slow! If I buy something from a store, which I did today, its instant enough that I can put my bank card in my wallet and move on. That's why I call it instant. The fact it isn't instant, is true, but it is nowhere near the latency of Bitcoin. And Bitcoin's latency is nowhere near my bank to debit card transaction. My statements regarding slow (and expensive) transactions were true. > bitcoin is not even a blip in total world energy spending and less than that in total world energy production. Yes, when it consumes more energy than my entire country, it is. Plus, when it is thin air we're discussing, it is. > also if you check the dictionary for word sustainable: How about you look up the word in your dictionary, called environment? > bitcoin is sustainable by design. Circulus in probando. Wake me up when I can pay BTC at the same places where I can pay with EUR. I'll even do a concession! Wake me up when a United States resident can pay BTC at the same places they can pay with USD.
- paulmd 9y ago> Can someone explain to me how on earth Ethereum is still a thing? Network effect and name recognition, the same reasons that Bitcoin hasn't been supplanted by Monero or Zcash or any of the other dozens of coins that do virtually everything better than Bitcoin. The really interesting thing is that the original plan for Bitcoin included many of the same programmable-money features as Ethereum. The instructions are still in the bytecode but I believe they were disabled in one of the patches, except for a handful of instructions that implement the basic "send money from A to B" type functionality. My impression is these were supposed to be enabled/used at some future date, but this is just one more thing that's gotten bogged down by the infighting and politics of the project. Much like blocksize - 1 MB was just a number picked to avoid transaction spamming blowing things up in the early days, not a divinely inspired number intended to be used for all time. But the project is so stagnant and calified that they can't handle even the smallest day-to-day tasks like this. God forbid we change one of Satoshi's sacred constants.
- Zpalmtree 9y agoWhile monero is very cool, it has the same scalibility issues as bitcoin i believe, but to a worse extent as the transactions are much larger due to how the ring signatures work. I know they're working on this but it's not a straight upgrade, and last time I checked monero fees were quite high compared to other alt-coins with similar use.
- woah 9y agoWhy are you wasting people’s time in the comments on a technical article with your strident political opinions? This comment has nothing to do with the article.