13 ms·

I haven't seen any evidence there was in fact a hack at all. A digital contract was used in a way that complied with the contract that the bonehead writers of t

I haven't seen any evidence there was in fact a hack at all. A digital contract was used in a way that complied with the contract that the bonehead writers of that contract did not intend. That's it. If bad contract writers get to cry "hack" and beg for their money back there is no point to digital contracts at all. If someone had physically or electronically broken into systems and illicitly copied private keys that would be a different story. Here someone executed permissible actions on chain that people didn't like, wah wah. You have to be an absolute tool to use the poly network for anything serious ever again.

rebuilder 5y ago
I have to agree. I was going to counterargue that technically all hacking is executing permissible actions in the sense that the system you're hacking into ends up allowing you to do what you want. That leads to why we have laws around unauthorized access etc., and that leads to digital contracts that need to be interpreted by a human with some ability to enforce their interpretation. So yes. As the main point of digital contracts seems to be that they are self-enforcing, then it seems to follow that there can be no complaining about the results of using them.
- ALittleLight 5y ago
  I've wondered about things like this with video games. I played RuneScape a while back and one of the things my brother and I would do is lure unsuspecting players into the wilderness to kill them and take their stuff. That stuff, RuneScape gold, weapons, and armor, has some real world value. We took it from other people, often by lying to them (e.g. "follow me into the wilderness, I'll show you something cool"). Could this somehow be construed as a crime? And if not, because everything we did was permissable actions in the game, how could any computer hacking be a crime?
  - Crazyontap 5y ago
    Such interesting food for thought. You are deceiving people for your own gains but then you're not breaking any rules (i guess since i don't know much about runescape), and it would really matter if it was an NPC who did that to them.
    - ALittleLight 5y ago
      Bringing NPCs into it makes it really interesting. You could imagine an NPC lying to the player in such a way that incautious players might lose game items that are worth real world money. That NPC, in a large MMO, could scam large numbers of people out of a large amount of value. Is that wrong? Is it part of the game? Obviously there would be something wrong if you sold people your digital tokens and then took them away from players - you agreed to give them digital tokens and then took them away. But if an in-game character is making false representations as part of the game, that seems different.
  - hnick 5y ago
    In games we usually separate between exploits and hacks. Exploits are vague but typically things allowed by the game, but not intended (or have for more impact than expected). I believe if you lied in the game that would constitute a written/verbal contract and what you did is fraud. Some games enforce written agreements, others say it's the wild west so too bad, this is role playing by a character, not the person. I'm not sure if either has ever been tested in court. For the hacking thing I don't really agree that all hacking is 'allowed', phishing is of course a type of fraud, your access is unauthorised even with the correct credentials - authority to enter a building does not derive from stealing a key from someone. Likewise a buffer overflow is 'allowed' much the same way a window allows itself to be broken by a brick.
    - birdyrooster 5y ago
      https://www.pcworld.com/article/152673/virtual_theft.html https://www.pcworld.com/article/152673/virtual_theft.html
      - deleted 5y ago
        [deleted]
      - djrogers 5y ago
        That involved a physical beating in the real world, which is clearly a different thing.
        birdyrooster 5y ago
        Yeah true, but the civil lawsuit was specifically over the theft.
    - DonHopkins 5y ago
      >... this is role playing by a character, not the person. I'm not sure if either has ever been tested in court. Actually... https://www.gwern.net/docs/rotten.com/library/bio/crime/criminals/patrick-naughton/index.html https://www.gwern.net/docs/rotten.com/library/bio/crime/crim... >Patrick had an interesting mating ritual: Apparently the task of convincing a girl to meet you involves sending her a digital photograph of your wang, as Naughton did on several occasions. He described his flights of fantasy as role-playing as himself, pretending to be a successful, rich executive with everything going his way. When he bragged about running a company and owning a boat in chat sessions, he was telling the truth, unlike so many chatters before him. [...] >If Mickey cried a little that night then certainly Michael Eisner had a bad day after learning that his young Vice-President in charge of E-mail and Chat Rooms had been arrested for, well, very un-Disneylike behavior. [...] >Despite all of the evidence and the decades of prison time hanging over him, Naughton would eventually walk free. The jury in his trial deadlocked over the more serious charge and to avoid a retrial, he plead out to lesser charges. https://www.latimes.com/archives/la-xpm-1999-dec-10-fi-42422-story.html https://www.latimes.com/archives/la-xpm-1999-dec-10-fi-42422... Former Internet Exec Says Online Pursuit of Girl Was Role-Playing DEC. 10, 1999 12 AM PT >Taking the stand in his own defense, former Internet executive Patrick Naughton testified Thursday that he never intended to have sex with a minor and that his steamy online encounters with an undercover FBI agent posing as a teenage girl were part of a fantasy life he pursued to escape emotional problems and mounting pressures at work. [...] >Naughton’s unexpected appearance represented a bold move by a defense team that is pursuing what many consider a risky and unprecedented legal strategy. Their central argument is that Naughton’s statements online and subsequent actions aren’t incriminating because they were grounded in an online fantasy world. [...] >While claiming that role-playing is rampant online, Naughton admitted that he always provided accurate information about himself during online chats, even pointing his supposed 13-year-old correspondent--actually an agent--to one Web site that had a news article about him and another that had a picture of his exposed genitals. >Asked why he furnished such information if fantasy was his real objective, Naughton replied: “The role I was playing was a character of me. If you ask my psychiatrist, I have a lot of self-image and ego problems. I was looking for approval.” https://en.wikipedia.org/wiki/Patrick_Naughton#Novel_defense https://en.wikipedia.org/wiki/Patrick_Naughton#Novel_defense >His line of defense was that he claimed he was persuaded to participate online in a ritualized sexual role-playing exercise, dealing with a mature woman acting as a girl.[14] His then-novel defense, became known as the fantasy defense for pedophiles.[2] https://en.wikipedia.org/wiki/Fantasy_defense https://en.wikipedia.org/wiki/Fantasy_defense >The fantasy defense is where a defendant accused of attempting a crime (enticing minors into sexual activity, for example) claims that they never intended to complete the crime. Instead, they claim they were engaged in a fantasy and, in the case of luring a minor, believed they were dealing with an adult.[1] >The fantasy defense was developed by Donald B. Marks, the attorney for Patrick Naughton,[2] the Disney executive who eventually pleaded guilty to traveling in interstate commerce with the intent to have sex with a minor, in violation of 18 U.S.C. § 2423(b).[3][4][5] The "fantasy defense" used in the Naughton case was novel; however, since the closely watched Naughton fantasy defense was successful, defense lawyers were expected to use it to help other clients.[4] https://digitalcommons.law.scu.edu/lawreview/vol41/iss2/6/ https://digitalcommons.law.scu.edu/lawreview/vol41/iss2/6/ >Donald S. Yamagami, Comment, Prosecuting Cyber-Pedophiles: How Can Intent Be Shown in a Virtual World in Light of the Fantasy Defense?, 41 Santa Clara L. Rev. 547 (2000).
  - unionpivo 5y ago
    Another game where that happens regularly is Eve online.
    - gego 5y ago
      In EVE it is explicitly allowed
  - brey 5y ago
    The laws of physics permit (physically allow) me to punch someone in the face. The laws of my country say if I do that, there will be consequences. This is all about the level of abstraction The ‘laws of physics’ in a game may allow you to do unintended things, it’s a complex system. Doesn’t mean that it’s OK at a higher abstraction.
  - jereees 5y ago
    We used to do this in Habbo Hotel. I don’t know how RuneScape worked back then but in Habbo you could buy virtual furniture dropping their valuables into one of our rooms and then kicking them out and making the room private. So, it is different from your example in that “killing” was by-design meant to take stuff from other people, whereas what we did was closer to “fraud” (good luck regulating that in 2006) as other comment said.
  - mdiesel 5y ago
    Lures still exist and apparently work in osrs, but they've gotten far more complicated. Unsurprising as osrs gold still has a real world value. Really its the equivalent of the Nigerian Prince email scam and its ilk. KempQ on YouTube does a lot of videos on modern luring methods. There's also a guy on YouTube called Hermano, a former Venezuelan gold farmer, who has some interesting insights into the real world value of osrs gold and why Venezuelans do it.
  - Kevin_S 5y ago
    So I scammed at the duel arena for a few years. Made quite a lot of gp, then RWT it all. I know what we did constituted a violation of terms of service, and we were subject to bans at any time. However, I was reasonably confident there was little Jagex could do to pursue legal action against us. Generally, we were relatively small fish compared to things like the Mod Jed scandal. I am not sure the courts would find this to be in any way illegal. But I find it very interesting.
puchatek 5y ago
So this is like the ETH DAO thing except the "attacker" messed up?
mlazos 5y ago
It’s so funny to me when everyone touts crypto + smart contracts as revolutionary™ then when you follow a system implemented with them to its logical conclusions you have analogs to everything that already exists. Lawyers to audit the contracts for bugs (and yes there can be bugs in a formally verified spec as well), courts to arbitrate disagreements, and an authority to enforce rules when someone finds a security hole. Hmm maybe the entire federal bureaucracy is not entirely redundant, and there were reasons that it grew to what it is today. Maybe we should understand the existing system before advocating complete disruption.
- pmorici 5y ago
  Just because there are similar mechanisms doesn’t mean they haven’t been improved on in some way. Lawyers and courts are notoriously inefficient if this implementation achieves efficiencies, even if the mechanisms are analogous, seems like progress.
  - RVuRnvbM2e 5y ago
    > It’s important to remember that when you start from scratch there is absolutely no reason to believe that you are going to do a better job than you did the first time. First of all, you probably don’t even have the same programming team that worked on version one, so you don’t actually have “more experience”. You’re just going to make most of the old mistakes again, and introduce some new problems that weren’t in the original version. https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...
    - andy_ppp 5y ago
      I think this a lot about our politics now, we seem to want to tear down all the institutions and values that got us here.
      - mschuster91 5y ago
        > we seem to want to tear down all the institutions and values that got us here. Strike a "we", replace by "rich elites". "Small government" means in practice that most of what governments are doing now with taxpayer money at no-profit will be done by private for-profit companies, at a worse service level, or that regulations/regulatory agencies will be torn down. For the first, just look at private prisons - make a lot of profit for their owners, while the level of care for the prisoners (access to healthcare, drug withdrawal treatment or education is often spotty, human rights abuse claims the norm). For the second, look at how e.g. environment regulations were "relaxed" during the 45th. It's all about the grifting opportunities.
zadler 5y ago
Of course they are going to cry foul but they don’t have a legal right to get their money back so there very much is a point.
namdnay 5y ago
> You have to be an absolute tool to use the poly network for anything serious ever again agreed > A digital contract was used in a way that complied with the contract that the bonehead writers of that contract did not intend. That's it I kind of disagree in philosophy here. If there's a bug in a bank API that lets me transfer funds to my account, I'm still "hacking", even if I'm doing exactly what the API lets me do, because I know very well that I'm not supposed to. Then again, as you say, the whole spiel of digital contracts is that theyre far too clever to need silly courts and judges and common sense and all that, so... meh
- blowfish721 5y ago
  Isn’t that the point though, when you access a bank api you have signed a contract in order to access it that states what is allowed and what’s not, the api code is not the contract but a way to access what you are allowed. With smart contracts the code is that contract so if the code allows it then it should be allowed.
  - spyder 5y ago
    You don't have to sign a contract to find vulnerabilities in an API. The thing that you have to obey is the law. Just because we call it smart contracts it isn't above the laws.
- pcthrowaway 5y ago
  Something that seems to be missed here, is that the bank has their physical servers owned by an institution, which you are exploiting. There is no physical server for Ethereum, the Smart Contracts don't exist anywhere. You are likely also violating the terms of usage of the API and various other legally enforceable contracts by breaching the API. If a smart contract included a terms of use however, it would be interesting to see whether this could be considered enforceable.
  - wizzwizz4 5y ago
    > There is no physical server for Ethereum, the Smart Contracts don't exist anywhere. There is no one physical server. I think this is misleading.
nl 5y ago
It's a hack because public statements about how the contract was supposed to behave describe the expected behaviour. Anything outside the that was exploiting bad implementations and therefore a hack. Some here might think the the code is a contract because that's the name. But that had never really been the case: public human statements supercede code.
ourcat 5y ago
To me, it boils down to incompetent auditing of the contract code. Arguably things like this should make the future a bit more secure, from what gets learnt. In the same way other code industries learn from found bugs or exploits.
- scotty79 5y ago
  The code has now been competently audited and it costed them less than 600 mil. I'd say it was a bargain when the thing audited is multi-chain crypto financial smart contract.
bouncycastle 5y ago
It looks like you are debating whenever the hack was moral or not. From a moral standpoint, it's like, if you accidentally leave behind your wallet with cash on a park bench with a lot of passer-by, then it's your fault for leaving it there and whoever finds it deserves to keep it. I'm sure you're familiar with the "finders keepers, losers weepers" saying... After all, it's in public, similar to how public blockchains work, right? However, different people may come to different conclusions about this. In some countries in the world, the overwhelming consensus would be to return the wallet to the owner, even if it's found in public. I guess it's because it doesn't matter if you had to break through the window, or simply reach out and grab it from the bench; the property does not belong to you.
- ramraj07 5y ago
  Which country would it be? Questions of morality are slippery slopes since one could argue the entire crypto system is immoral and who cares about the moral rules in a pirate village? As Jack Sparrow says famously, there are only two types of things out there: the things you CAN do, and the things you CANT. Crypto is the libertarians wet dream and to come and argue you should be a Good Samaritan from the opposite end of the spectrum because someone proved libertarianism is bulls*t suggests these people are just immature at best.
- spywaregorilla 5y ago
  More like a big sign says "A man named Jack may take this wallet", and you're named Jack, so you take the wallet, even though it wasn't meant for you. The smart contract is explicitly defined and on a public ledger. A lost wallet is accidentally left there. The context of it being available to be taken by anyone is not intended. There is no declaration of rules by which you may take it by the owner.
  - wizzwizz4 5y ago
    More like a big sign says “Jack may take this wallet, because it belongs to Jack”, and you happen to also be called Jack, even though you're not the Jack the sign was written about, but the sign enforcer only checks that your ID is valid and that you are named Jack.
ralfd 5y ago
But "breaking" electronically into a system also only executes (erronous) permissible actions? Where do you draw the line? Reading this a hash collision was exploited: https://rekt.news/polynetwork-rekt/ https://rekt.news/polynetwork-rekt/ > Well... here's the actual sighash of the target function: > http://ethers.utils.id http://ethers.utils.id ('putCurEpochConPubKeyBytes(bytes)').slice(0, 10) > '0x41973cd9' > And the sighash that the attacker crafted... > http://ethers.utils.id http://ethers.utils.id ('f1121318093(bytes,bytes,uint64)').slice(0, 10) > '0x41973cd9' > Fantastic. No private key compromise required! Just craft the right data and boom... the contract will just hack itself!
r00f 5y ago
If developer didn't put size check in his software then it's not bug with RCE exploit, it's just doing what author has intended. Where do we put a border?
- ethanbond 5y ago
  Around the entire system saying, “this system’s behavior is not strictly/formally verified to mirror my exact intentions and behaviors can be defined as malignant or disallowed post-facto.” But that’s antithetical to the value prop of smart contracts.
syzygyhack 5y ago
> You have to be an absolute tool to use the poly network for anything serious ever again. Such a weak take. I guess we are also tools for using Ethereum after The DAO. An error like this in the contract stack should have been caught by the auditor, Certik. It's not a fundamental flaw in PolyNet's system, just a very unfortunate oversight.
- bob33212 5y ago
  It does show why you shouldn't use "Smart Contracts". Unlike legal contracts they do not have phrases like "REASONABLE INTENT" and "FOR INTENDED PURPOSE" meaning that any loophole can be abused.
baobabKoodaa 5y ago
This is a disingenuous argument not written in good faith. You know very well that the contract writers did not intend for this to happen, and yet you are pretending otherwise just to make a provocative argument.
- thewarrior 5y ago
  Who decides what was intended in a decentralized system where code is law ?
  - baq 5y ago
    side question: what does decentralized have to do with the issue?
    - 8note 5y ago
      No common jurisdiction to go to an actual court to get it sorted
      - baq 5y ago
        i mean, if code is law, a centralized system will have the exact same issue.
- spywaregorilla 5y ago
  If you go bowling, and remove the gutter rails, you have to accept that you can now throw a gutter ball.
  - baobabKoodaa 5y ago
    Yes, but if you try to aim for the bowling pins, and you miss, don't make a disingenuous claim that you intended to miss in the first place.
- bart_spoon 5y ago
  I don't think its disingenuous. The entire purpose of a contract is because neither party can trust the other to go along with what each other "intends" and therefore has to be written out explicitly in a legally binding document. I think its an important point to be made.
leppr 5y ago
Using smart contracts doesn't mean you completely forgo human intervention. Blockchains themselves have standardized discretionary escape hatches in the form of hard forks. Nobody except straw-man'ing detractors claim current cryptocurrency systems work perfectly. Previous relevant comment of mine on the matter of "Code is law": https://news.ycombinator.com/item?id=28132994 https://news.ycombinator.com/item?id=28132994
- jdkfglkjh34 5y ago
  It begs mentioning that the ETH/ETC hardfork was a consequence of a theft just like this one. https://en.wikipedia.org/wiki/The_DAO_(organization) https://en.wikipedia.org/wiki/The_DAO_(organization) >In June 2016, users exploited a vulnerability in The DAO code to enable them to siphon off one-third of The DAO's funds to a subsidiary account. On 20 July 2016 01:20:40 PM +UTC at Block 1920000, the Ethereum community decided to hard-fork the Ethereum blockchain to restore virtually all funds to the original contract.[10] This was controversial, and led to a fork in Ethereum, where the original unforked blockchain was maintained as Ethereum Classic, thus splitting the Ethereum blockchain into two branches, each with its own cryptocurrency.
tomc1985 5y ago
I know, like how many times has this happened and people keep jerking each other off about smart contracts
carom 5y ago
Isn't any hack using a system in the way it was written and not the way it was intended?
- dnautics 5y ago
  "hacker news" is mostly, after all, not about security penetration.
paulpauper 5y ago
AFIK no detials have been relseased about how it was done
spullara 5y ago
If you find a software bug in an ATM that gives you all the money from the machine it absolutely would be considered theft. A bad lock on a door (or even no lock) doesn't give you the right to steal things behind that door. IMHO this is how the law would look at it and not care a wit about whether or not there was a flaw in the software. IANAL but have seen this kind of argument play out ever since computer bugs were exploited by unauthorized individuals.
- kinghajj 5y ago
  ATM machines aren't marketed that "their code is law," whereas that's an explicitly espoused property of smart contracts.
- joe_the_user 5y ago
  The thing about that is smart contracts are intended to not operate this way. The aim of a smart contract is that whatever happens is the ultimate rule - the contract enforces itself. Such an intention doesn't cause laws and courts to stop existing or make things so courts won't interpret certain actions as theft. But it complicates things.
ahallock 5y ago
That's like saying if a website allowed SQL injection because they made a mistake in their code, you're complying with their contract by waltzing on over to the browser and dropping all their tables. Just because something is allowed via code doesn't make that the intent. Use common sense.

rebuilder 5y ago

I have to agree. I was going to counterargue that technically all hacking is executing permissible actions in the sense that the system you're hacking into ends up allowing you to do what you want. That leads to why we have laws around unauthorized access etc., and that leads to digital contracts that need to be interpreted by a human with some ability to enforce their interpretation. So yes. As the main point of digital contracts seems to be that they are self-enforcing, then it seems to follow that there can be no complaining about the results of using them.

ALittleLight 5y ago
I've wondered about things like this with video games. I played RuneScape a while back and one of the things my brother and I would do is lure unsuspecting players into the wilderness to kill them and take their stuff. That stuff, RuneScape gold, weapons, and armor, has some real world value. We took it from other people, often by lying to them (e.g. "follow me into the wilderness, I'll show you something cool"). Could this somehow be construed as a crime? And if not, because everything we did was permissable actions in the game, how could any computer hacking be a crime?
- Crazyontap 5y ago
  Such interesting food for thought. You are deceiving people for your own gains but then you're not breaking any rules (i guess since i don't know much about runescape), and it would really matter if it was an NPC who did that to them.
  - ALittleLight 5y ago
    Bringing NPCs into it makes it really interesting. You could imagine an NPC lying to the player in such a way that incautious players might lose game items that are worth real world money. That NPC, in a large MMO, could scam large numbers of people out of a large amount of value. Is that wrong? Is it part of the game? Obviously there would be something wrong if you sold people your digital tokens and then took them away from players - you agreed to give them digital tokens and then took them away. But if an in-game character is making false representations as part of the game, that seems different.
- hnick 5y ago
  In games we usually separate between exploits and hacks. Exploits are vague but typically things allowed by the game, but not intended (or have for more impact than expected). I believe if you lied in the game that would constitute a written/verbal contract and what you did is fraud. Some games enforce written agreements, others say it's the wild west so too bad, this is role playing by a character, not the person. I'm not sure if either has ever been tested in court. For the hacking thing I don't really agree that all hacking is 'allowed', phishing is of course a type of fraud, your access is unauthorised even with the correct credentials - authority to enter a building does not derive from stealing a key from someone. Likewise a buffer overflow is 'allowed' much the same way a window allows itself to be broken by a brick.
  - birdyrooster 5y ago
    https://www.pcworld.com/article/152673/virtual_theft.html https://www.pcworld.com/article/152673/virtual_theft.html
    - deleted 5y ago
      [deleted]
    - djrogers 5y ago
      That involved a physical beating in the real world, which is clearly a different thing.
      - birdyrooster 5y ago
        Yeah true, but the civil lawsuit was specifically over the theft.
  - DonHopkins 5y ago
    >... this is role playing by a character, not the person. I'm not sure if either has ever been tested in court. Actually... https://www.gwern.net/docs/rotten.com/library/bio/crime/criminals/patrick-naughton/index.html https://www.gwern.net/docs/rotten.com/library/bio/crime/crim... >Patrick had an interesting mating ritual: Apparently the task of convincing a girl to meet you involves sending her a digital photograph of your wang, as Naughton did on several occasions. He described his flights of fantasy as role-playing as himself, pretending to be a successful, rich executive with everything going his way. When he bragged about running a company and owning a boat in chat sessions, he was telling the truth, unlike so many chatters before him. [...] >If Mickey cried a little that night then certainly Michael Eisner had a bad day after learning that his young Vice-President in charge of E-mail and Chat Rooms had been arrested for, well, very un-Disneylike behavior. [...] >Despite all of the evidence and the decades of prison time hanging over him, Naughton would eventually walk free. The jury in his trial deadlocked over the more serious charge and to avoid a retrial, he plead out to lesser charges. https://www.latimes.com/archives/la-xpm-1999-dec-10-fi-42422-story.html https://www.latimes.com/archives/la-xpm-1999-dec-10-fi-42422... Former Internet Exec Says Online Pursuit of Girl Was Role-Playing DEC. 10, 1999 12 AM PT >Taking the stand in his own defense, former Internet executive Patrick Naughton testified Thursday that he never intended to have sex with a minor and that his steamy online encounters with an undercover FBI agent posing as a teenage girl were part of a fantasy life he pursued to escape emotional problems and mounting pressures at work. [...] >Naughton’s unexpected appearance represented a bold move by a defense team that is pursuing what many consider a risky and unprecedented legal strategy. Their central argument is that Naughton’s statements online and subsequent actions aren’t incriminating because they were grounded in an online fantasy world. [...] >While claiming that role-playing is rampant online, Naughton admitted that he always provided accurate information about himself during online chats, even pointing his supposed 13-year-old correspondent--actually an agent--to one Web site that had a news article about him and another that had a picture of his exposed genitals. >Asked why he furnished such information if fantasy was his real objective, Naughton replied: “The role I was playing was a character of me. If you ask my psychiatrist, I have a lot of self-image and ego problems. I was looking for approval.” https://en.wikipedia.org/wiki/Patrick_Naughton#Novel_defense https://en.wikipedia.org/wiki/Patrick_Naughton#Novel_defense >His line of defense was that he claimed he was persuaded to participate online in a ritualized sexual role-playing exercise, dealing with a mature woman acting as a girl.[14] His then-novel defense, became known as the fantasy defense for pedophiles.[2] https://en.wikipedia.org/wiki/Fantasy_defense https://en.wikipedia.org/wiki/Fantasy_defense >The fantasy defense is where a defendant accused of attempting a crime (enticing minors into sexual activity, for example) claims that they never intended to complete the crime. Instead, they claim they were engaged in a fantasy and, in the case of luring a minor, believed they were dealing with an adult.[1] >The fantasy defense was developed by Donald B. Marks, the attorney for Patrick Naughton,[2] the Disney executive who eventually pleaded guilty to traveling in interstate commerce with the intent to have sex with a minor, in violation of 18 U.S.C. § 2423(b).[3][4][5] The "fantasy defense" used in the Naughton case was novel; however, since the closely watched Naughton fantasy defense was successful, defense lawyers were expected to use it to help other clients.[4] https://digitalcommons.law.scu.edu/lawreview/vol41/iss2/6/ https://digitalcommons.law.scu.edu/lawreview/vol41/iss2/6/ >Donald S. Yamagami, Comment, Prosecuting Cyber-Pedophiles: How Can Intent Be Shown in a Virtual World in Light of the Fantasy Defense?, 41 Santa Clara L. Rev. 547 (2000).
- unionpivo 5y ago
  Another game where that happens regularly is Eve online.
  - gego 5y ago
    In EVE it is explicitly allowed
- brey 5y ago
  The laws of physics permit (physically allow) me to punch someone in the face. The laws of my country say if I do that, there will be consequences. This is all about the level of abstraction The ‘laws of physics’ in a game may allow you to do unintended things, it’s a complex system. Doesn’t mean that it’s OK at a higher abstraction.
- jereees 5y ago
  We used to do this in Habbo Hotel. I don’t know how RuneScape worked back then but in Habbo you could buy virtual furniture dropping their valuables into one of our rooms and then kicking them out and making the room private. So, it is different from your example in that “killing” was by-design meant to take stuff from other people, whereas what we did was closer to “fraud” (good luck regulating that in 2006) as other comment said.
- mdiesel 5y ago
  Lures still exist and apparently work in osrs, but they've gotten far more complicated. Unsurprising as osrs gold still has a real world value. Really its the equivalent of the Nigerian Prince email scam and its ilk. KempQ on YouTube does a lot of videos on modern luring methods. There's also a guy on YouTube called Hermano, a former Venezuelan gold farmer, who has some interesting insights into the real world value of osrs gold and why Venezuelans do it.
- Kevin_S 5y ago
  So I scammed at the duel arena for a few years. Made quite a lot of gp, then RWT it all. I know what we did constituted a violation of terms of service, and we were subject to bans at any time. However, I was reasonably confident there was little Jagex could do to pursue legal action against us. Generally, we were relatively small fish compared to things like the Mod Jed scandal. I am not sure the courts would find this to be in any way illegal. But I find it very interesting.

puchatek 5y ago

So this is like the ETH DAO thing except the "attacker" messed up?

mlazos 5y ago

It’s so funny to me when everyone touts crypto + smart contracts as revolutionary™ then when you follow a system implemented with them to its logical conclusions you have analogs to everything that already exists. Lawyers to audit the contracts for bugs (and yes there can be bugs in a formally verified spec as well), courts to arbitrate disagreements, and an authority to enforce rules when someone finds a security hole. Hmm maybe the entire federal bureaucracy is not entirely redundant, and there were reasons that it grew to what it is today. Maybe we should understand the existing system before advocating complete disruption.

pmorici 5y ago
Just because there are similar mechanisms doesn’t mean they haven’t been improved on in some way. Lawyers and courts are notoriously inefficient if this implementation achieves efficiencies, even if the mechanisms are analogous, seems like progress.
- RVuRnvbM2e 5y ago
  > It’s important to remember that when you start from scratch there is absolutely no reason to believe that you are going to do a better job than you did the first time. First of all, you probably don’t even have the same programming team that worked on version one, so you don’t actually have “more experience”. You’re just going to make most of the old mistakes again, and introduce some new problems that weren’t in the original version. https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...
  - andy_ppp 5y ago
    I think this a lot about our politics now, we seem to want to tear down all the institutions and values that got us here.
    - mschuster91 5y ago
      > we seem to want to tear down all the institutions and values that got us here. Strike a "we", replace by "rich elites". "Small government" means in practice that most of what governments are doing now with taxpayer money at no-profit will be done by private for-profit companies, at a worse service level, or that regulations/regulatory agencies will be torn down. For the first, just look at private prisons - make a lot of profit for their owners, while the level of care for the prisoners (access to healthcare, drug withdrawal treatment or education is often spotty, human rights abuse claims the norm). For the second, look at how e.g. environment regulations were "relaxed" during the 45th. It's all about the grifting opportunities.

zadler 5y ago

Of course they are going to cry foul but they don’t have a legal right to get their money back so there very much is a point.

namdnay 5y ago

> You have to be an absolute tool to use the poly network for anything serious ever again agreed > A digital contract was used in a way that complied with the contract that the bonehead writers of that contract did not intend. That's it I kind of disagree in philosophy here. If there's a bug in a bank API that lets me transfer funds to my account, I'm still "hacking", even if I'm doing exactly what the API lets me do, because I know very well that I'm not supposed to. Then again, as you say, the whole spiel of digital contracts is that theyre far too clever to need silly courts and judges and common sense and all that, so... meh

blowfish721 5y ago
Isn’t that the point though, when you access a bank api you have signed a contract in order to access it that states what is allowed and what’s not, the api code is not the contract but a way to access what you are allowed. With smart contracts the code is that contract so if the code allows it then it should be allowed.
- spyder 5y ago
  You don't have to sign a contract to find vulnerabilities in an API. The thing that you have to obey is the law. Just because we call it smart contracts it isn't above the laws.
pcthrowaway 5y ago
Something that seems to be missed here, is that the bank has their physical servers owned by an institution, which you are exploiting. There is no physical server for Ethereum, the Smart Contracts don't exist anywhere. You are likely also violating the terms of usage of the API and various other legally enforceable contracts by breaching the API. If a smart contract included a terms of use however, it would be interesting to see whether this could be considered enforceable.
- wizzwizz4 5y ago
  > There is no physical server for Ethereum, the Smart Contracts don't exist anywhere. There is no one physical server. I think this is misleading.

nl 5y ago

It's a hack because public statements about how the contract was supposed to behave describe the expected behaviour. Anything outside the that was exploiting bad implementations and therefore a hack. Some here might think the the code is a contract because that's the name. But that had never really been the case: public human statements supercede code.

ourcat 5y ago

To me, it boils down to incompetent auditing of the contract code. Arguably things like this should make the future a bit more secure, from what gets learnt. In the same way other code industries learn from found bugs or exploits.

scotty79 5y ago
The code has now been competently audited and it costed them less than 600 mil. I'd say it was a bargain when the thing audited is multi-chain crypto financial smart contract.

bouncycastle 5y ago

It looks like you are debating whenever the hack was moral or not. From a moral standpoint, it's like, if you accidentally leave behind your wallet with cash on a park bench with a lot of passer-by, then it's your fault for leaving it there and whoever finds it deserves to keep it. I'm sure you're familiar with the "finders keepers, losers weepers" saying... After all, it's in public, similar to how public blockchains work, right? However, different people may come to different conclusions about this. In some countries in the world, the overwhelming consensus would be to return the wallet to the owner, even if it's found in public. I guess it's because it doesn't matter if you had to break through the window, or simply reach out and grab it from the bench; the property does not belong to you.

ramraj07 5y ago
Which country would it be? Questions of morality are slippery slopes since one could argue the entire crypto system is immoral and who cares about the moral rules in a pirate village? As Jack Sparrow says famously, there are only two types of things out there: the things you CAN do, and the things you CANT. Crypto is the libertarians wet dream and to come and argue you should be a Good Samaritan from the opposite end of the spectrum because someone proved libertarianism is bulls*t suggests these people are just immature at best.
spywaregorilla 5y ago
More like a big sign says "A man named Jack may take this wallet", and you're named Jack, so you take the wallet, even though it wasn't meant for you. The smart contract is explicitly defined and on a public ledger. A lost wallet is accidentally left there. The context of it being available to be taken by anyone is not intended. There is no declaration of rules by which you may take it by the owner.
- wizzwizz4 5y ago
  More like a big sign says “Jack may take this wallet, because it belongs to Jack”, and you happen to also be called Jack, even though you're not the Jack the sign was written about, but the sign enforcer only checks that your ID is valid and that you are named Jack.

ralfd 5y ago

But "breaking" electronically into a system also only executes (erronous) permissible actions? Where do you draw the line? Reading this a hash collision was exploited: https://rekt.news/polynetwork-rekt/ https://rekt.news/polynetwork-rekt/ > Well... here's the actual sighash of the target function: > http://ethers.utils.id http://ethers.utils.id ('putCurEpochConPubKeyBytes(bytes)').slice(0, 10) > '0x41973cd9' > And the sighash that the attacker crafted... > http://ethers.utils.id http://ethers.utils.id ('f1121318093(bytes,bytes,uint64)').slice(0, 10) > '0x41973cd9' > Fantastic. No private key compromise required! Just craft the right data and boom... the contract will just hack itself!

r00f 5y ago

If developer didn't put size check in his software then it's not bug with RCE exploit, it's just doing what author has intended. Where do we put a border?

ethanbond 5y ago
Around the entire system saying, “this system’s behavior is not strictly/formally verified to mirror my exact intentions and behaviors can be defined as malignant or disallowed post-facto.” But that’s antithetical to the value prop of smart contracts.

syzygyhack 5y ago

> You have to be an absolute tool to use the poly network for anything serious ever again. Such a weak take. I guess we are also tools for using Ethereum after The DAO. An error like this in the contract stack should have been caught by the auditor, Certik. It's not a fundamental flaw in PolyNet's system, just a very unfortunate oversight.

bob33212 5y ago
It does show why you shouldn't use "Smart Contracts". Unlike legal contracts they do not have phrases like "REASONABLE INTENT" and "FOR INTENDED PURPOSE" meaning that any loophole can be abused.

baobabKoodaa 5y ago

This is a disingenuous argument not written in good faith. You know very well that the contract writers did not intend for this to happen, and yet you are pretending otherwise just to make a provocative argument.

thewarrior 5y ago
Who decides what was intended in a decentralized system where code is law ?
- baq 5y ago
  side question: what does decentralized have to do with the issue?
  - 8note 5y ago
    No common jurisdiction to go to an actual court to get it sorted
    - baq 5y ago
      i mean, if code is law, a centralized system will have the exact same issue.
spywaregorilla 5y ago
If you go bowling, and remove the gutter rails, you have to accept that you can now throw a gutter ball.
- baobabKoodaa 5y ago
  Yes, but if you try to aim for the bowling pins, and you miss, don't make a disingenuous claim that you intended to miss in the first place.
bart_spoon 5y ago
I don't think its disingenuous. The entire purpose of a contract is because neither party can trust the other to go along with what each other "intends" and therefore has to be written out explicitly in a legally binding document. I think its an important point to be made.

leppr 5y ago

Using smart contracts doesn't mean you completely forgo human intervention. Blockchains themselves have standardized discretionary escape hatches in the form of hard forks. Nobody except straw-man'ing detractors claim current cryptocurrency systems work perfectly. Previous relevant comment of mine on the matter of "Code is law": https://news.ycombinator.com/item?id=28132994 https://news.ycombinator.com/item?id=28132994

jdkfglkjh34 5y ago
It begs mentioning that the ETH/ETC hardfork was a consequence of a theft just like this one. https://en.wikipedia.org/wiki/The_DAO_(organization) https://en.wikipedia.org/wiki/The_DAO_(organization) >In June 2016, users exploited a vulnerability in The DAO code to enable them to siphon off one-third of The DAO's funds to a subsidiary account. On 20 July 2016 01:20:40 PM +UTC at Block 1920000, the Ethereum community decided to hard-fork the Ethereum blockchain to restore virtually all funds to the original contract.[10] This was controversial, and led to a fork in Ethereum, where the original unforked blockchain was maintained as Ethereum Classic, thus splitting the Ethereum blockchain into two branches, each with its own cryptocurrency.

tomc1985 5y ago

I know, like how many times has this happened and people keep jerking each other off about smart contracts

carom 5y ago

Isn't any hack using a system in the way it was written and not the way it was intended?

dnautics 5y ago
"hacker news" is mostly, after all, not about security penetration.

paulpauper 5y ago

AFIK no detials have been relseased about how it was done

spullara 5y ago

If you find a software bug in an ATM that gives you all the money from the machine it absolutely would be considered theft. A bad lock on a door (or even no lock) doesn't give you the right to steal things behind that door. IMHO this is how the law would look at it and not care a wit about whether or not there was a flaw in the software. IANAL but have seen this kind of argument play out ever since computer bugs were exploited by unauthorized individuals.

kinghajj 5y ago
ATM machines aren't marketed that "their code is law," whereas that's an explicitly espoused property of smart contracts.
joe_the_user 5y ago
The thing about that is smart contracts are intended to not operate this way. The aim of a smart contract is that whatever happens is the ultimate rule - the contract enforces itself. Such an intention doesn't cause laws and courts to stop existing or make things so courts won't interpret certain actions as theft. But it complicates things.

ahallock 5y ago

That's like saying if a website allowed SQL injection because they made a mistake in their code, you're complying with their contract by waltzing on over to the browser and dropping all their tables. Just because something is allowed via code doesn't make that the intent. Use common sense.