4 ms·

> The contract developer releasing the code is the problem, not verifying that is what is running. In a trustless environment like defi, why would anyone other

> The contract developer releasing the code is the problem, not verifying that is what is running. In a trustless environment like defi, why would anyone other than the most gullible put their money in any smart contract that doesn't have open sourced code? > When a company open sources some code, we assume and trust they are not keeping a separate, evil branch running in production unbeknownst to us. We assume and trust because we have to. With crypto, you can trust and verify, as the Russians say.

shagie 5y ago
> In a trustless environment like defi, why would anyone other than the most gullible put their money in any smart contract that doesn't have open sourced code? So... this is a thing for techies only? The rest of the world that can't read the code will have to trust the techies that say "this is good". As a not-JavaScript-devleoper, open sourced optimal written JavaScript is only slightly less inscrutable than minified or compiled JavaScript. So, would I be gullible to put my money into a smart contract written in JavaScript? Most of the world can't verify the code and will need to trust someone. I hope that isn't the password verification commission that calls grandmothers offering to help check out their bank account security.
- selestify 5y ago
  > Most of the world can't verify the code and will need to trust someone. I haven't scrutinized the code for major flagship apps like Uniswap either. But plenty of others have, including paid auditors. With open-sourced code, you can actually do this. You can actually get semi-reliable signals that others have scrutinized the code and found it to be fine. Not completely reliable, because sometimes auditors also miss subtle exploits. But you know, everyone's risk tolerance is different. Decide for yourself what degree of trust you're comfortable with, and put or don't put your money in accordingly. This isn't specific to crypto, this is true for open source in general. > So... this is a thing for techies only? The rest of the world that can't read the code will have to trust the techies that say "this is good". But yes, as of now pretty much. The average Joe who cannot remember their own passwords should not be using crypto, IMO. With freedom comes the freedom to shoot yourself in the foot, and unless you understand basic digital safety procedures, you are best off not shooting yourself in the foot.

shagie 5y ago

> In a trustless environment like defi, why would anyone other than the most gullible put their money in any smart contract that doesn't have open sourced code? So... this is a thing for techies only? The rest of the world that can't read the code will have to trust the techies that say "this is good". As a not-JavaScript-devleoper, open sourced optimal written JavaScript is only slightly less inscrutable than minified or compiled JavaScript. So, would I be gullible to put my money into a smart contract written in JavaScript? Most of the world can't verify the code and will need to trust someone. I hope that isn't the password verification commission that calls grandmothers offering to help check out their bank account security.

selestify 5y ago
> Most of the world can't verify the code and will need to trust someone. I haven't scrutinized the code for major flagship apps like Uniswap either. But plenty of others have, including paid auditors. With open-sourced code, you can actually do this. You can actually get semi-reliable signals that others have scrutinized the code and found it to be fine. Not completely reliable, because sometimes auditors also miss subtle exploits. But you know, everyone's risk tolerance is different. Decide for yourself what degree of trust you're comfortable with, and put or don't put your money in accordingly. This isn't specific to crypto, this is true for open source in general. > So... this is a thing for techies only? The rest of the world that can't read the code will have to trust the techies that say "this is good". But yes, as of now pretty much. The average Joe who cannot remember their own passwords should not be using crypto, IMO. With freedom comes the freedom to shoot yourself in the foot, and unless you understand basic digital safety procedures, you are best off not shooting yourself in the foot.