9 ms·

> but we are adults here: if you agree to put money in smart contracts, you should have verified the code. And if you think the code is flawed, do not put money

> but we are adults here: if you agree to put money in smart contracts, you should have verified the code. And if you think the code is flawed, do not put money: otherwise do not complain afterwards. It is not that hard. That's not how it works. Courts generally operate by ambiguous standard of what reasonable people and reasonable experts can actually do given the state of technology. No reasonable software engineer can tell you that a piece of code is flawless. I don't think courts will agree on a system that has been shown through evidence to be highly flawed.

tluyben2 5y ago
Sure, that will depend on the courts and specific case, as it seems it works exactly like this mostly. But if you inspected the code yourself and you put your money in anyway and it is gone, you might find that the court will not do anything at all. And who can you shout at then, the moon? I am saying that smart contracts are a special case: they are small pieces of code, if they have a bug, it usually causes major damage and, if they run on the eth chain etc and no one took public responsibility for deploying it, there is no one to sue. We have no way to write this type of bombs without flaws as you rightly say and because of the irrevocable damage and the lack of defendant in most cases, these contracts should not be used at all. There are already (many) cases like this, but if I write some software and put it in github, someone else deploys it and people die; that is simply not my fault: it is the deploying person. In normal situations, this is easy to find the defendant here: but on the chain, you won't be able to: anyone can deploy anything and you won't know who it was. So unless you to end open source software, you have no case against anyone.
mimixco 5y ago
This reminds me of the Toyota Prius (and other models') un-commanded acceleration problem. Should car buyers examine Toyota's code, or should they assume that the gas and brake pedals work as expected? It's not reasonable to expect software users (even other developer users) to understand or audit code in order to be able to use software -- for anything.
- tluyben2 5y ago
  Yes, but not in case of smart contracts is the point. Prius it's source is not open and cannot be audited and is, definitely installed by Toyota. So Toyota is responsible. Smart contracts have none of this. They are open source by definition and no one knows, by definition, who deployed them. It is a very different case.
  - mimixco 5y ago
    The author of the code and/or its publisher are always responsible for software quality, not the users. The fact that other people could audit the software does not absolve the original authors of the fact that they didn't.
    - tluyben2 5y ago
      Sigh. If this were the case, all open source is doomed. You are responsible if you deploy/offer it, not if you only wrote it. And the point is, in smart contracts, you will not normally know who deployed it. If you put on github Return x>0; And I deploy this in a production environment that kills people with heart rate over 0, do you have any responsibility? No of course not. I do. You have none. In short: if you put money into something as smart contracts, the only thing you have, and that is literally the intention of the pundits, is that you check the contracts and trust or not trust them. I do not know how this crosses over to other software that has different properties in this thread. That is not relevant. There is no one to sue or say they did a bad job here: you will not know. That is baked in.
      - mimixco 5y ago
        As a career developer of more than 30 years, I still take the viewpoint that the person who wrote the code and/or approved it (both = developers) are 100% responsible for all bugs. As I mentioned earlier in this thread, there is no such thing as bug-free software (even for devices that kill people, as you point out), because bug-free software is categorically impossible within comp sci. Knowing this comes with great responsibility, even more so when dealing with life... or finances. The developers of this software, as is the case with Solidity and smart contracts in general, have foregone this responsibility. Another egregious failing of all crypto schemes which I'm compelled to point out is that they fail to use any of their enormous profits to actually fix bugs. When I was mainframe developer at IBM, the company spent millions of dollars (taken from clients, of course) to find and fix bugs. They paid people good money, including yours truly, for that work. Today's crypto companies have no such ethics. They (Mr. Buterin, I'm looking at you) have no compunctions after profiting windfalls from their software inventions to actually invest in debugging or fix distribution (or even real error reporting) for the customers. Likewise, they ignore all the UI aspects (and problems) that their inventions have birthed. This is not responsible software development. It leads to problems like IRON and others in the crypto space. As I said, it is the exact opposite of how, historically, important enterprise software development is done. It's only for selfish reasons (= money hoarding) that crypto projects don't hire the best auditors and coders in the world to fix their code. They can certainly afford them.

tluyben2 5y ago

Sure, that will depend on the courts and specific case, as it seems it works exactly like this mostly. But if you inspected the code yourself and you put your money in anyway and it is gone, you might find that the court will not do anything at all. And who can you shout at then, the moon? I am saying that smart contracts are a special case: they are small pieces of code, if they have a bug, it usually causes major damage and, if they run on the eth chain etc and no one took public responsibility for deploying it, there is no one to sue. We have no way to write this type of bombs without flaws as you rightly say and because of the irrevocable damage and the lack of defendant in most cases, these contracts should not be used at all. There are already (many) cases like this, but if I write some software and put it in github, someone else deploys it and people die; that is simply not my fault: it is the deploying person. In normal situations, this is easy to find the defendant here: but on the chain, you won't be able to: anyone can deploy anything and you won't know who it was. So unless you to end open source software, you have no case against anyone.

mimixco 5y ago

This reminds me of the Toyota Prius (and other models') un-commanded acceleration problem. Should car buyers examine Toyota's code, or should they assume that the gas and brake pedals work as expected? It's not reasonable to expect software users (even other developer users) to understand or audit code in order to be able to use software -- for anything.

tluyben2 5y ago
Yes, but not in case of smart contracts is the point. Prius it's source is not open and cannot be audited and is, definitely installed by Toyota. So Toyota is responsible. Smart contracts have none of this. They are open source by definition and no one knows, by definition, who deployed them. It is a very different case.
- mimixco 5y ago
  The author of the code and/or its publisher are always responsible for software quality, not the users. The fact that other people could audit the software does not absolve the original authors of the fact that they didn't.
  - tluyben2 5y ago
    Sigh. If this were the case, all open source is doomed. You are responsible if you deploy/offer it, not if you only wrote it. And the point is, in smart contracts, you will not normally know who deployed it. If you put on github Return x>0; And I deploy this in a production environment that kills people with heart rate over 0, do you have any responsibility? No of course not. I do. You have none. In short: if you put money into something as smart contracts, the only thing you have, and that is literally the intention of the pundits, is that you check the contracts and trust or not trust them. I do not know how this crosses over to other software that has different properties in this thread. That is not relevant. There is no one to sue or say they did a bad job here: you will not know. That is baked in.
    - mimixco 5y ago
      As a career developer of more than 30 years, I still take the viewpoint that the person who wrote the code and/or approved it (both = developers) are 100% responsible for all bugs. As I mentioned earlier in this thread, there is no such thing as bug-free software (even for devices that kill people, as you point out), because bug-free software is categorically impossible within comp sci. Knowing this comes with great responsibility, even more so when dealing with life... or finances. The developers of this software, as is the case with Solidity and smart contracts in general, have foregone this responsibility. Another egregious failing of all crypto schemes which I'm compelled to point out is that they fail to use any of their enormous profits to actually fix bugs. When I was mainframe developer at IBM, the company spent millions of dollars (taken from clients, of course) to find and fix bugs. They paid people good money, including yours truly, for that work. Today's crypto companies have no such ethics. They (Mr. Buterin, I'm looking at you) have no compunctions after profiting windfalls from their software inventions to actually invest in debugging or fix distribution (or even real error reporting) for the customers. Likewise, they ignore all the UI aspects (and problems) that their inventions have birthed. This is not responsible software development. It leads to problems like IRON and others in the crypto space. As I said, it is the exact opposite of how, historically, important enterprise software development is done. It's only for selfish reasons (= money hoarding) that crypto projects don't hire the best auditors and coders in the world to fix their code. They can certainly afford them.