5 ms·

Yes absolutely. There’s definitely a bit of a cult of open source. Just because I can look at your code does not inherently, magically make it more secure. Esp

Yes absolutely. There’s definitely a bit of a cult of open source. Just because I can look at your code does not inherently, magically make it more secure. Especially in a world where the black market pays better than bug bounty programs. Not necessarily advocating for closed source approaches, but it’s something to bear in mind.

echelon 5y ago
> Especially in a world where the black market pays better than bug bounty programs. In crypto/DeFi/croins/crokens/whatever, the bug bounty can be the entire holdings. And there are no legal ramifications or manners of recourse/restitution.
- lmm 5y ago
  The whole point of the game is that the tokens belong to whoever got the code to run to transfer them to them, isn't it? Complaining that someone "stole" your tokens is like complaining that someone "stole" your gold in an MMORPG.
- jjnoakes 5y ago
  > And there are no legal ramifications or manners of recourse/restitution. I'd appreciate a source on that... Both seem unlikely to me. More difficult perhaps, but impossible you say?
  - VTimofeenko 5y ago
    Well in crypto there does seem to exist a somewhat widespread notion of "code is law". If the existing business logic is used to do something undesirable (transfer all money to another person) - in such axiom set that action would be considered in line with the " law".
    - 3np 5y ago
      This notion is only used in context of smart contracts and on-chain virtual machine code. This is in contrast to wallet implementations.
    - SEJeff 5y ago
      "code is law" has yet to be tested in courts. It is highly suspect that actual humans in a jury would all agree this is the case.
      - pcthrowaway 5y ago
        We'll have an answer (applicable to the U.S. at least) soon enough: https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-this-teen-hacker-seems-intent-on-testing-code-is-law-in-the-courts/ https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-...
        echelon 5y ago
        Time to write code that indebts the user to you forever, then get FAMAGMA to use it. Code is law.
    - jbkiv 5y ago
      Code law? You must be kidding. It is OK to chat about "Code Law" among like minded individuals always on the lookout to crack open the pirate's chest. It is a different story to explain to a judge: "sir, the bank had left the vault open during the fire alarm. I just helped myself with few $M. It is the bank's fault". Good luck.
      - lottin 5y ago
        If the smart contract is not the contract, then where is the actual contract? I imagine the judge would like to know that. If there's no contract, they'll have a hard time convincing anyone that there was a breach of contract.
  - NicoJuicy 5y ago
    Https://rekt.news - plenty of references
    - jjnoakes 5y ago
      A list of compromises or exploits isn't a source for the claim that there aren't legal repercussions or avenues of recourse that could be pursued.
      - iostream23 5y ago
        Wait, are you saying that there is recourse for reversing blockchain transactions?
        jjnoakes 5y ago
        See the DAO hack for precedent.
        NicoJuicy 5y ago
        There's no result in court. So what's the recourse now at this moment ? Additionally, they were lucky they could find the 16 yr old kid, otherwise they wouldn't known in which jurisdiction to sue :) Welcome to the decentralized world!
        jjnoakes 5y ago
        Sorry, not following. The recourse I was referring to was a fork and modification of the transactions in question.
        NicoJuicy 5y ago
        Okay, part of the subject was "legal repercussions" and i thought it was related to that.
      - NicoJuicy 5y ago
xyzzy123 5y ago
It's not like this stuff is hard to reverse but those skills are a bit more scarce and it requires more effort. My opinion is that you'll get relatively more blackhat "eyes" on your code and fewer whitehat "eyes" if you go closed source. Personally, I don't know anyone who would reverse a closed-source wallet to report bugs "out of the goodness of their hearts", but I do know a bunch of people who would report bugs in good faith to open-source projects.
- deleted 5y ago
  [deleted]
e40 5y ago
There’s definitely a bit of a cult of open source. Just because I can look at your code does not inherently, magically make it more secure. Especially in a world where the black market pays better than bug bounty programs. And open source projects likely pay nothing! I've certainly never heard of a paid bug bounty for any open source project, which doesn't mean they don't exist, it just means it's not that common.
- SEJeff 5y ago
  There definitely are a few, kubernetes actually has a dedicated one that hacker one runs. Here are a few examples: https://www.hackerone.com/internet-bug-bounty https://www.hackerone.com/internet-bug-bounty https://huntr.dev/ https://huntr.dev/ https://securitylab.github.com/bounties/ https://securitylab.github.com/bounties/ https://www.mozilla.org/en-US/security/bug-bounty/ https://www.mozilla.org/en-US/security/bug-bounty/
- mikeodds 5y ago
  There are some but for of the projects I’ve looked at, you are almost certainly getting a better payout by selling the vulnerability (monetarily not karma wise) to zerodium et al.
  - deleted 5y ago
    [deleted]
AshamedCaptain 5y ago
Wait a second. The biggest problem here with a crypto system that is not open is not that "it may have not passed through a lot of eyes", it's that it may have not passed through EVEN A SINGLE EYE. The closed system could very well be "we xor this with ILUVPUPPIES repeated ad infinitum" and very few people would the wiser. An open system at least means _you_ can have a quick look into it. Every other advantage is not guaranteed, but with the amount of pure snake oil out there this one guaranteed advantage is friggin important.
- fragmede 5y ago
  Hopefully (blind coders aside), the code's passed through, at the very least, one set of eyes. GPT-3's not that good at writing code yet!

echelon 5y ago

> Especially in a world where the black market pays better than bug bounty programs. In crypto/DeFi/croins/crokens/whatever, the bug bounty can be the entire holdings. And there are no legal ramifications or manners of recourse/restitution.

lmm 5y ago
The whole point of the game is that the tokens belong to whoever got the code to run to transfer them to them, isn't it? Complaining that someone "stole" your tokens is like complaining that someone "stole" your gold in an MMORPG.
jjnoakes 5y ago
> And there are no legal ramifications or manners of recourse/restitution. I'd appreciate a source on that... Both seem unlikely to me. More difficult perhaps, but impossible you say?
- VTimofeenko 5y ago
  Well in crypto there does seem to exist a somewhat widespread notion of "code is law". If the existing business logic is used to do something undesirable (transfer all money to another person) - in such axiom set that action would be considered in line with the " law".
  - 3np 5y ago
    This notion is only used in context of smart contracts and on-chain virtual machine code. This is in contrast to wallet implementations.
  - SEJeff 5y ago
    "code is law" has yet to be tested in courts. It is highly suspect that actual humans in a jury would all agree this is the case.
    - pcthrowaway 5y ago
      We'll have an answer (applicable to the U.S. at least) soon enough: https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-this-teen-hacker-seems-intent-on-testing-code-is-law-in-the-courts/ https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-...
      - echelon 5y ago
        Time to write code that indebts the user to you forever, then get FAMAGMA to use it. Code is law.
  - jbkiv 5y ago
    Code law? You must be kidding. It is OK to chat about "Code Law" among like minded individuals always on the lookout to crack open the pirate's chest. It is a different story to explain to a judge: "sir, the bank had left the vault open during the fire alarm. I just helped myself with few $M. It is the bank's fault". Good luck.
    - lottin 5y ago
      If the smart contract is not the contract, then where is the actual contract? I imagine the judge would like to know that. If there's no contract, they'll have a hard time convincing anyone that there was a breach of contract.
- NicoJuicy 5y ago
  Https://rekt.news - plenty of references
  - jjnoakes 5y ago
    A list of compromises or exploits isn't a source for the claim that there aren't legal repercussions or avenues of recourse that could be pursued.
    - iostream23 5y ago
      Wait, are you saying that there is recourse for reversing blockchain transactions?
      - jjnoakes 5y ago
        See the DAO hack for precedent.
        NicoJuicy 5y ago
        There's no result in court. So what's the recourse now at this moment ? Additionally, they were lucky they could find the 16 yr old kid, otherwise they wouldn't known in which jurisdiction to sue :) Welcome to the decentralized world!
        jjnoakes 5y ago
        Sorry, not following. The recourse I was referring to was a fork and modification of the transactions in question.
        NicoJuicy 5y ago
        Okay, part of the subject was "legal repercussions" and i thought it was related to that.
    - NicoJuicy 5y ago

xyzzy123 5y ago

It's not like this stuff is hard to reverse but those skills are a bit more scarce and it requires more effort. My opinion is that you'll get relatively more blackhat "eyes" on your code and fewer whitehat "eyes" if you go closed source. Personally, I don't know anyone who would reverse a closed-source wallet to report bugs "out of the goodness of their hearts", but I do know a bunch of people who would report bugs in good faith to open-source projects.

deleted 5y ago
[deleted]

e40 5y ago

There’s definitely a bit of a cult of open source. Just because I can look at your code does not inherently, magically make it more secure. Especially in a world where the black market pays better than bug bounty programs. And open source projects likely pay nothing! I've certainly never heard of a paid bug bounty for any open source project, which doesn't mean they don't exist, it just means it's not that common.

SEJeff 5y ago
There definitely are a few, kubernetes actually has a dedicated one that hacker one runs. Here are a few examples: https://www.hackerone.com/internet-bug-bounty https://www.hackerone.com/internet-bug-bounty https://huntr.dev/ https://huntr.dev/ https://securitylab.github.com/bounties/ https://securitylab.github.com/bounties/ https://www.mozilla.org/en-US/security/bug-bounty/ https://www.mozilla.org/en-US/security/bug-bounty/
mikeodds 5y ago
There are some but for of the projects I’ve looked at, you are almost certainly getting a better payout by selling the vulnerability (monetarily not karma wise) to zerodium et al.
- deleted 5y ago
  [deleted]

AshamedCaptain 5y ago

Wait a second. The biggest problem here with a crypto system that is not open is not that "it may have not passed through a lot of eyes", it's that it may have not passed through EVEN A SINGLE EYE. The closed system could very well be "we xor this with ILUVPUPPIES repeated ad infinitum" and very few people would the wiser. An open system at least means _you_ can have a quick look into it. Every other advantage is not guaranteed, but with the amount of pure snake oil out there this one guaranteed advantage is friggin important.

fragmede 5y ago
Hopefully (blind coders aside), the code's passed through, at the very least, one set of eyes. GPT-3's not that good at writing code yet!