7 ms·

Isn't that the whole security / obscurity point? That true security only comes by being exposed to active, intelligent, informed adversaries for a sufficient am

by ethbro 6y ago

Isn't that the whole security / obscurity point? That true security only comes by being exposed to active, intelligent, informed adversaries for a sufficient amount of time? Or, another way: each exploit and oops only improves the system, rather than being a signal of its failure. And let's be honest, the competition is still "Oops, I accidentally sent $900M to the wrong party." [1] [1] https://news.ycombinator.com/item?id=24222045 https://news.ycombinator.com/item?id=24222045

Analemma_ 6y ago
> And let's be honest, the competition is still "Oops, I accidentally sent $900M to the wrong party." [1] The counterargument there is that Citibank is currently pursuing a resolution in the courts to that issue, and if they win they will get their $900M back. If you flub a DeFi transaction, you're shit outta luck.
- alkonaut 6y ago
  Exactly. There is no way I'd ever want to anything remotely important, or remotely high value, on a system that isn't run by humans and with transactions reversible in courts. Who is it that uses these smart contracts, and for what? Is it mostly a gadget for research and speculation (still)?
  - iSnow 6y ago
    I work in old industry and the supply chain guys as well as finance is having a boner from the idea of moving their crufty systems to blockchain. The whole paper trail around a bill of lading isn't a joke if you are shipping from say China to South America. But - like the internet - it's just a fad that will soon pass.
    - RhodesianHunter 6y ago
      It'll never happen on the supply chain because of all of the entities in the middle with zero desire to participate.
      - rglullis 6y ago
        If they don't, they will be put out of business. Do you think if Walmart says "I will only buy from you if I am able to audit you and prove that your shrinkage is less than X%" they are just going to say "Opposite, sorry we can't do that."? Or if Amazon ever starts a blockchain-based certification system to crack down on counterfeit products, the legit distributors are not going to push down on all their suppliers? Of course they will.
        RhodesianHunter 6y ago
        This thinking belies a very simplistic view of a very complex supply chain. Brands like Nike often don't touch their products after they produce the design. Manufacturing, distribution, shipping, warehousing, sales are all handled by a massive web of smaller entities with long term contracts. Most of these businesses use very very old tech, and will actively resist change. Its a chicken or egg problem too, since having half of your products on a blockchain is pretty much worthless, it's an all-or-nothing problem which makes it that much more of a massive undertaking. I've studied this pretty extensively and honestly don't think it'll ever happen. At least unless the current paradigm of supply changes massively.
        rglullis 6y ago
        > I've studied this pretty extensively and honestly don't think it'll ever happen. At least unless the current paradigm of supply changes massively. "I don't think we will see any changes in the industry, unless the industry changes." Kind of tautological, no? > Most of these businesses use very very old tech, and will actively resist change. I don't think we are disagreeing. Maybe we are just thinking in different timescales. I don't doubt current business will resist change. What I am saying is that there will be a point where adopting the technology will be such an obvious advantage for the large players that the existing business will either be forced to adopt or be disrupted by some new business.
        RhodesianHunter 6y ago
  - rglullis 6y ago
    For all the scams, ponzi schemes and outright theft that has happened in the blockchain space, I can bet a good amount of money that we as a society lose more every year to corrupt officials, subverted institutions and petty theft than we will ever lose on a system that is not run by humans.
    - ivalm 6y ago
      In total? Yes. As a fraction of total volume? Debatable.
      - rglullis 6y ago
        Some quick Google searches: - World GDP: 142 trillion USD. - Global cost of corruption: At least 5% of World's GDP according to WEF. [0] - Cost of violence: estimated to be 11% of GDP in 2012 [1] We are already at 16% and we are not even counting resources and parts of the world economy under the control of authoritarian regimes. [0]: https://www.un.org/press/en/2018/sc13493.doc.htm https://www.un.org/press/en/2018/sc13493.doc.htm [1]https://www.researchgate.net/publication/261037678_Estimating_the_Global_Costs_of_Violence https://www.researchgate.net/publication/261037678_Estimatin...
        deleted 6y ago
        [deleted]
        ivalm 6y ago
        Then for crypto you need to count what fraction of value is used for illicit activity. Here is a paper estimating its about 46% of transactions [0]. If you look at transactions that cause real economic activity (as opposed to speculation) I bet the fraction would be in the 90%+. [0] https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3102645 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3102645
        rglullis 6y ago
        You are moving the goal posts. The point initially was to show that the current socio-political institutions are no better than "Wild-West" blockchain systems to avoid fraud and misappropriation of assets. You are now talking about how much of a "real economy" blockchain can handle, which is a different matter and a totally unfair comparison. Let's talk about a "real economy" when people are allowed to enter a work agreement and have a contract specifying a salary in crypto.
- TeMPOraL 6y ago
  And of course, if cryptocurrencies ever become anything more than Internet play money (and environmental disaster), the legal systems of countries worldwide will make sure the same protections apply. So yes, your newest cryptoanarchist token may have totally irreversible transactions (cross my heart, here's the math proof!), but the court can still order the thief to send back the money they stole in a separate transaction, under threat of prison time. The judge will not care that the relevant "smart contract" prohibits such behavior. Because that's what real-world security ultimately boils down to: men with guns, ready to drag you where the law tells them to. It's not perfect, but it achieves 99% of the effect at the fraction of a cost of a "trustless" proof-of-work system.
  - svachalek 6y ago
    Citibank is in an argument with other institutions that operate in broad daylight. Crypto nets allow anyone, anywhere to jump into the transaction as a feature. These guys don’t care about New York City police. I don’t think regulators will have any control without having a controlling stake in the ledgers.
  - AnthonyMouse 6y ago
    > Because that's what real-world security ultimately boils down to: men with guns, ready to drag you where the law tells them to. But that's assuming the judge knows who the thief is. One of the main characteristics of cryptocurrency is that you can hold it without giving anyone your social security number. In that respect it's much the same as cash -- if you get away with it you keep the money, but if you get arrested, they can order you to return it, and seize your house/car/wages/etc. if you don't. The issue, which creates the demand for cryptocurrency, is that we don't have a digital equivalent of cash that isn't based on proof of work. But the regulatory system could create one quite easily.
    - TeMPOraL 6y ago
      > But that's assuming the judge knows who the thief is. One of the main characteristics of cryptocurrency is that you can hold it without giving anyone your social security number. You can, but AFAIK it's harder to do that when you're trying to cash out your cryptocoins in fiat (though arguably, this becomes less of a problem for criminals with the growing numbers of goods and services you can pay for with crypto). Still, I think if governments ever allow for a mainstream, sanctioned adoption of digital currency, they won't let it keep this level of anonymity.
cryptica 6y ago
>> each exploit and oops only improves the system This is not necessarily true. If the system architecture is highly complex and poorly designed, each exploit will result in a patch which will only make the system more complex and more brittle. IMO this is exactly what is happening with Ethereum.

by ethbro 6y ago

Analemma_ 6y ago

> And let's be honest, the competition is still "Oops, I accidentally sent $900M to the wrong party." [1] The counterargument there is that Citibank is currently pursuing a resolution in the courts to that issue, and if they win they will get their $900M back. If you flub a DeFi transaction, you're shit outta luck.

alkonaut 6y ago
Exactly. There is no way I'd ever want to anything remotely important, or remotely high value, on a system that isn't run by humans and with transactions reversible in courts. Who is it that uses these smart contracts, and for what? Is it mostly a gadget for research and speculation (still)?
- iSnow 6y ago
  I work in old industry and the supply chain guys as well as finance is having a boner from the idea of moving their crufty systems to blockchain. The whole paper trail around a bill of lading isn't a joke if you are shipping from say China to South America. But - like the internet - it's just a fad that will soon pass.
  - RhodesianHunter 6y ago
    It'll never happen on the supply chain because of all of the entities in the middle with zero desire to participate.
    - rglullis 6y ago
      If they don't, they will be put out of business. Do you think if Walmart says "I will only buy from you if I am able to audit you and prove that your shrinkage is less than X%" they are just going to say "Opposite, sorry we can't do that."? Or if Amazon ever starts a blockchain-based certification system to crack down on counterfeit products, the legit distributors are not going to push down on all their suppliers? Of course they will.
      - RhodesianHunter 6y ago
        This thinking belies a very simplistic view of a very complex supply chain. Brands like Nike often don't touch their products after they produce the design. Manufacturing, distribution, shipping, warehousing, sales are all handled by a massive web of smaller entities with long term contracts. Most of these businesses use very very old tech, and will actively resist change. Its a chicken or egg problem too, since having half of your products on a blockchain is pretty much worthless, it's an all-or-nothing problem which makes it that much more of a massive undertaking. I've studied this pretty extensively and honestly don't think it'll ever happen. At least unless the current paradigm of supply changes massively.
        rglullis 6y ago
        > I've studied this pretty extensively and honestly don't think it'll ever happen. At least unless the current paradigm of supply changes massively. "I don't think we will see any changes in the industry, unless the industry changes." Kind of tautological, no? > Most of these businesses use very very old tech, and will actively resist change. I don't think we are disagreeing. Maybe we are just thinking in different timescales. I don't doubt current business will resist change. What I am saying is that there will be a point where adopting the technology will be such an obvious advantage for the large players that the existing business will either be forced to adopt or be disrupted by some new business.
        RhodesianHunter 6y ago
- rglullis 6y ago
  For all the scams, ponzi schemes and outright theft that has happened in the blockchain space, I can bet a good amount of money that we as a society lose more every year to corrupt officials, subverted institutions and petty theft than we will ever lose on a system that is not run by humans.
  - ivalm 6y ago
    In total? Yes. As a fraction of total volume? Debatable.
    - rglullis 6y ago
      Some quick Google searches: - World GDP: 142 trillion USD. - Global cost of corruption: At least 5% of World's GDP according to WEF. [0] - Cost of violence: estimated to be 11% of GDP in 2012 [1] We are already at 16% and we are not even counting resources and parts of the world economy under the control of authoritarian regimes. [0]: https://www.un.org/press/en/2018/sc13493.doc.htm https://www.un.org/press/en/2018/sc13493.doc.htm [1]https://www.researchgate.net/publication/261037678_Estimating_the_Global_Costs_of_Violence https://www.researchgate.net/publication/261037678_Estimatin...
      - deleted 6y ago
        [deleted]
      - ivalm 6y ago
        Then for crypto you need to count what fraction of value is used for illicit activity. Here is a paper estimating its about 46% of transactions [0]. If you look at transactions that cause real economic activity (as opposed to speculation) I bet the fraction would be in the 90%+. [0] https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3102645 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3102645
        rglullis 6y ago
        You are moving the goal posts. The point initially was to show that the current socio-political institutions are no better than "Wild-West" blockchain systems to avoid fraud and misappropriation of assets. You are now talking about how much of a "real economy" blockchain can handle, which is a different matter and a totally unfair comparison. Let's talk about a "real economy" when people are allowed to enter a work agreement and have a contract specifying a salary in crypto.
TeMPOraL 6y ago
And of course, if cryptocurrencies ever become anything more than Internet play money (and environmental disaster), the legal systems of countries worldwide will make sure the same protections apply. So yes, your newest cryptoanarchist token may have totally irreversible transactions (cross my heart, here's the math proof!), but the court can still order the thief to send back the money they stole in a separate transaction, under threat of prison time. The judge will not care that the relevant "smart contract" prohibits such behavior. Because that's what real-world security ultimately boils down to: men with guns, ready to drag you where the law tells them to. It's not perfect, but it achieves 99% of the effect at the fraction of a cost of a "trustless" proof-of-work system.
- svachalek 6y ago
  Citibank is in an argument with other institutions that operate in broad daylight. Crypto nets allow anyone, anywhere to jump into the transaction as a feature. These guys don’t care about New York City police. I don’t think regulators will have any control without having a controlling stake in the ledgers.
- AnthonyMouse 6y ago
  > Because that's what real-world security ultimately boils down to: men with guns, ready to drag you where the law tells them to. But that's assuming the judge knows who the thief is. One of the main characteristics of cryptocurrency is that you can hold it without giving anyone your social security number. In that respect it's much the same as cash -- if you get away with it you keep the money, but if you get arrested, they can order you to return it, and seize your house/car/wages/etc. if you don't. The issue, which creates the demand for cryptocurrency, is that we don't have a digital equivalent of cash that isn't based on proof of work. But the regulatory system could create one quite easily.
  - TeMPOraL 6y ago
    > But that's assuming the judge knows who the thief is. One of the main characteristics of cryptocurrency is that you can hold it without giving anyone your social security number. You can, but AFAIK it's harder to do that when you're trying to cash out your cryptocoins in fiat (though arguably, this becomes less of a problem for criminals with the growing numbers of goods and services you can pay for with crypto). Still, I think if governments ever allow for a mainstream, sanctioned adoption of digital currency, they won't let it keep this level of anonymity.

cryptica 6y ago

>> each exploit and oops only improves the system This is not necessarily true. If the system architecture is highly complex and poorly designed, each exploit will result in a patch which will only make the system more complex and more brittle. IMO this is exactly what is happening with Ethereum.