4 ms·

> Given that you can deploy smart contracts as binaries (without source) and you can design the contracts to be upgradeable if needed You can do all that, but

> Given that you can deploy smart contracts as binaries (without source) and you can design the contracts to be upgradeable if needed You can do all that, but then who but the most gullible will use your smart contracts?

uncomputation 5y ago
The point I am making is every smart contract is Schrodinger’s contract where the user has no idea what is inside and no way to know. Say you have a game called, I don’t know, Crypto Run. To purchase in game assets, the developers of Crypto Run deployed a smart contract that lets players do this. You have to use the smart contract from the developers and even if alternatives exist, people want to use the official contract from the development team. There is nothing stopping the Crypto Run team from sneaking in some telemetry code and we have to trust that they don’t. So we’re back to a trust-dependent system.
- selestify 5y ago
  > The point I am making is every smart contract is Schrodinger’s contract where the user has no idea what is inside and no way to know. I literally explained a few comments ago how that's not the case. Did you forget what you read already? https://news.ycombinator.com/item?id=29588550 https://news.ycombinator.com/item?id=29588550
  - uncomputation 5y ago
    The contract developer releasing the code is the problem, not verifying that is what is running. When a company open sources some code, we assume and trust they are not keeping a separate, evil branch running in production unbeknownst to us. If Facebook “open-sourced” their entire platform and infrastructure tomorrow, the hard part is not verifying that this code is what is running. The hard part would be getting Facebook to do this in the first place. Your use case (of the developer open sourcing their code already) is not the hard part.
    - deleted 5y ago
      [deleted]
    - selestify 5y ago
      > The contract developer releasing the code is the problem, not verifying that is what is running. In a trustless environment like defi, why would anyone other than the most gullible put their money in any smart contract that doesn't have open sourced code? > When a company open sources some code, we assume and trust they are not keeping a separate, evil branch running in production unbeknownst to us. We assume and trust because we have to. With crypto, you can trust and verify, as the Russians say.
      - shagie 5y ago
        > In a trustless environment like defi, why would anyone other than the most gullible put their money in any smart contract that doesn't have open sourced code? So... this is a thing for techies only? The rest of the world that can't read the code will have to trust the techies that say "this is good". As a not-JavaScript-devleoper, open sourced optimal written JavaScript is only slightly less inscrutable than minified or compiled JavaScript. So, would I be gullible to put my money into a smart contract written in JavaScript? Most of the world can't verify the code and will need to trust someone. I hope that isn't the password verification commission that calls grandmothers offering to help check out their bank account security.
        selestify 5y ago
        > Most of the world can't verify the code and will need to trust someone. I haven't scrutinized the code for major flagship apps like Uniswap either. But plenty of others have, including paid auditors. With open-sourced code, you can actually do this. You can actually get semi-reliable signals that others have scrutinized the code and found it to be fine. Not completely reliable, because sometimes auditors also miss subtle exploits. But you know, everyone's risk tolerance is different. Decide for yourself what degree of trust you're comfortable with, and put or don't put your money in accordingly. This isn't specific to crypto, this is true for open source in general. > So... this is a thing for techies only? The rest of the world that can't read the code will have to trust the techies that say "this is good". But yes, as of now pretty much. The average Joe who cannot remember their own passwords should not be using crypto, IMO. With freedom comes the freedom to shoot yourself in the foot, and unless you understand basic digital safety procedures, you are best off not shooting yourself in the foot.

uncomputation 5y ago

The point I am making is every smart contract is Schrodinger’s contract where the user has no idea what is inside and no way to know. Say you have a game called, I don’t know, Crypto Run. To purchase in game assets, the developers of Crypto Run deployed a smart contract that lets players do this. You have to use the smart contract from the developers and even if alternatives exist, people want to use the official contract from the development team. There is nothing stopping the Crypto Run team from sneaking in some telemetry code and we have to trust that they don’t. So we’re back to a trust-dependent system.

selestify 5y ago
> The point I am making is every smart contract is Schrodinger’s contract where the user has no idea what is inside and no way to know. I literally explained a few comments ago how that's not the case. Did you forget what you read already? https://news.ycombinator.com/item?id=29588550 https://news.ycombinator.com/item?id=29588550
- uncomputation 5y ago
  The contract developer releasing the code is the problem, not verifying that is what is running. When a company open sources some code, we assume and trust they are not keeping a separate, evil branch running in production unbeknownst to us. If Facebook “open-sourced” their entire platform and infrastructure tomorrow, the hard part is not verifying that this code is what is running. The hard part would be getting Facebook to do this in the first place. Your use case (of the developer open sourcing their code already) is not the hard part.
  - deleted 5y ago
    [deleted]
  - selestify 5y ago
    > The contract developer releasing the code is the problem, not verifying that is what is running. In a trustless environment like defi, why would anyone other than the most gullible put their money in any smart contract that doesn't have open sourced code? > When a company open sources some code, we assume and trust they are not keeping a separate, evil branch running in production unbeknownst to us. We assume and trust because we have to. With crypto, you can trust and verify, as the Russians say.
    - shagie 5y ago
      > In a trustless environment like defi, why would anyone other than the most gullible put their money in any smart contract that doesn't have open sourced code? So... this is a thing for techies only? The rest of the world that can't read the code will have to trust the techies that say "this is good". As a not-JavaScript-devleoper, open sourced optimal written JavaScript is only slightly less inscrutable than minified or compiled JavaScript. So, would I be gullible to put my money into a smart contract written in JavaScript? Most of the world can't verify the code and will need to trust someone. I hope that isn't the password verification commission that calls grandmothers offering to help check out their bank account security.
      - selestify 5y ago
        > Most of the world can't verify the code and will need to trust someone. I haven't scrutinized the code for major flagship apps like Uniswap either. But plenty of others have, including paid auditors. With open-sourced code, you can actually do this. You can actually get semi-reliable signals that others have scrutinized the code and found it to be fine. Not completely reliable, because sometimes auditors also miss subtle exploits. But you know, everyone's risk tolerance is different. Decide for yourself what degree of trust you're comfortable with, and put or don't put your money in accordingly. This isn't specific to crypto, this is true for open source in general. > So... this is a thing for techies only? The rest of the world that can't read the code will have to trust the techies that say "this is good". But yes, as of now pretty much. The average Joe who cannot remember their own passwords should not be using crypto, IMO. With freedom comes the freedom to shoot yourself in the foot, and unless you understand basic digital safety procedures, you are best off not shooting yourself in the foot.