4 ms·

I am against smart contracts because we do not know how to write software in that way. I like how they sparked a formal verification Renaissance of sorts but th

I am against smart contracts because we do not know how to write software in that way. I like how they sparked a formal verification Renaissance of sorts but that did not help much either unfortunately (if the premise is wrong, no amount of proof will save you anyway). However, if you let all parties review the smart contract (the source is on the chain, you can check it) and agree with it's workings and sign a 'human' contract saying you do agree and then it goes wrong, I think it should be an out. We do not have proper ways to sue for misbehaving software (it happens all the time but MSFT is climbing higher and higher): this is easier to verify but we are adults here: if you agree to put money in smart contracts, you should have verified the code. And if you think the code is flawed, do not put money: otherwise do not complain afterwards. It is not that hard.

Daishiman 5y ago
> but we are adults here: if you agree to put money in smart contracts, you should have verified the code. And if you think the code is flawed, do not put money: otherwise do not complain afterwards. It is not that hard. That's not how it works. Courts generally operate by ambiguous standard of what reasonable people and reasonable experts can actually do given the state of technology. No reasonable software engineer can tell you that a piece of code is flawless. I don't think courts will agree on a system that has been shown through evidence to be highly flawed.
- tluyben2 5y ago
  Sure, that will depend on the courts and specific case, as it seems it works exactly like this mostly. But if you inspected the code yourself and you put your money in anyway and it is gone, you might find that the court will not do anything at all. And who can you shout at then, the moon? I am saying that smart contracts are a special case: they are small pieces of code, if they have a bug, it usually causes major damage and, if they run on the eth chain etc and no one took public responsibility for deploying it, there is no one to sue. We have no way to write this type of bombs without flaws as you rightly say and because of the irrevocable damage and the lack of defendant in most cases, these contracts should not be used at all. There are already (many) cases like this, but if I write some software and put it in github, someone else deploys it and people die; that is simply not my fault: it is the deploying person. In normal situations, this is easy to find the defendant here: but on the chain, you won't be able to: anyone can deploy anything and you won't know who it was. So unless you to end open source software, you have no case against anyone.
- mimixco 5y ago
  This reminds me of the Toyota Prius (and other models') un-commanded acceleration problem. Should car buyers examine Toyota's code, or should they assume that the gas and brake pedals work as expected? It's not reasonable to expect software users (even other developer users) to understand or audit code in order to be able to use software -- for anything.
  - tluyben2 5y ago
    Yes, but not in case of smart contracts is the point. Prius it's source is not open and cannot be audited and is, definitely installed by Toyota. So Toyota is responsible. Smart contracts have none of this. They are open source by definition and no one knows, by definition, who deployed them. It is a very different case.
    - mimixco 5y ago
      The author of the code and/or its publisher are always responsible for software quality, not the users. The fact that other people could audit the software does not absolve the original authors of the fact that they didn't.
      - tluyben2 5y ago
        Sigh. If this were the case, all open source is doomed. You are responsible if you deploy/offer it, not if you only wrote it. And the point is, in smart contracts, you will not normally know who deployed it. If you put on github Return x>0; And I deploy this in a production environment that kills people with heart rate over 0, do you have any responsibility? No of course not. I do. You have none. In short: if you put money into something as smart contracts, the only thing you have, and that is literally the intention of the pundits, is that you check the contracts and trust or not trust them. I do not know how this crosses over to other software that has different properties in this thread. That is not relevant. There is no one to sue or say they did a bad job here: you will not know. That is baked in.
        5y ago

Daishiman 5y ago

> but we are adults here: if you agree to put money in smart contracts, you should have verified the code. And if you think the code is flawed, do not put money: otherwise do not complain afterwards. It is not that hard. That's not how it works. Courts generally operate by ambiguous standard of what reasonable people and reasonable experts can actually do given the state of technology. No reasonable software engineer can tell you that a piece of code is flawless. I don't think courts will agree on a system that has been shown through evidence to be highly flawed.

tluyben2 5y ago
Sure, that will depend on the courts and specific case, as it seems it works exactly like this mostly. But if you inspected the code yourself and you put your money in anyway and it is gone, you might find that the court will not do anything at all. And who can you shout at then, the moon? I am saying that smart contracts are a special case: they are small pieces of code, if they have a bug, it usually causes major damage and, if they run on the eth chain etc and no one took public responsibility for deploying it, there is no one to sue. We have no way to write this type of bombs without flaws as you rightly say and because of the irrevocable damage and the lack of defendant in most cases, these contracts should not be used at all. There are already (many) cases like this, but if I write some software and put it in github, someone else deploys it and people die; that is simply not my fault: it is the deploying person. In normal situations, this is easy to find the defendant here: but on the chain, you won't be able to: anyone can deploy anything and you won't know who it was. So unless you to end open source software, you have no case against anyone.
mimixco 5y ago
This reminds me of the Toyota Prius (and other models') un-commanded acceleration problem. Should car buyers examine Toyota's code, or should they assume that the gas and brake pedals work as expected? It's not reasonable to expect software users (even other developer users) to understand or audit code in order to be able to use software -- for anything.
- tluyben2 5y ago
  Yes, but not in case of smart contracts is the point. Prius it's source is not open and cannot be audited and is, definitely installed by Toyota. So Toyota is responsible. Smart contracts have none of this. They are open source by definition and no one knows, by definition, who deployed them. It is a very different case.
  - mimixco 5y ago
    The author of the code and/or its publisher are always responsible for software quality, not the users. The fact that other people could audit the software does not absolve the original authors of the fact that they didn't.
    - tluyben2 5y ago
      Sigh. If this were the case, all open source is doomed. You are responsible if you deploy/offer it, not if you only wrote it. And the point is, in smart contracts, you will not normally know who deployed it. If you put on github Return x>0; And I deploy this in a production environment that kills people with heart rate over 0, do you have any responsibility? No of course not. I do. You have none. In short: if you put money into something as smart contracts, the only thing you have, and that is literally the intention of the pundits, is that you check the contracts and trust or not trust them. I do not know how this crosses over to other software that has different properties in this thread. That is not relevant. There is no one to sue or say they did a bad job here: you will not know. That is baked in.
      - 5y ago