6 ms·

I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build thei

I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build their own custom, one of a kind UI with no way to limit what the user thinks the button does for you to sign such a transaction, it's got to be the biggest, most massive security hole I've ever seen brushed off. You want me to put the title to my house on it? You want code to be law? This shit isn't ready for the mainstream, and some of these architectural decisions are indicative of engineers who are in over their heads (but that's almost all code nowadays, even mine). They build a mechanism that enables me, at the click of a button, to give away control of my fortune, and they designed the system so that anyone can design whatever interface they like to get you to sign any transaction they like. It's laughable. I'm in disbelief. And this is web3? No thanks, I think I'll stick with bitcoin or whatever, keep it simple. At least I can tell what a bitcoin transaction does without having to learn a programming language.

orasis 5y ago
When it comes to code, we’re all in over our heads. I can reason about significantly more complexity than most developers I know and it’s still laughable how little complexity I can manage.
ikt 5y ago
Think of all the scams happening over TCP/IP every day! They built this thing where anyone can pretend to be a bank website? No checks or security? It's laughable. I'm in disbelief. And this is the web?
- betwixthewires 5y ago
  I never said I expect ethereum or web3 or whatever to be entirely scam free. I said that having the ability to send anyone any transaction and to their eyes have it look like any other sort of interaction they like unless they can read solidity and audit the code themselves is a very very large security hole.
- markstos 5y ago
  There are checks in place to make difficult to buy an SSL certificate for the official domain of a bank. At least Chrome tracks malicious websites. By comparison, there seem to be no checks in place to prevent writing an ethereym contract that drains a victim’s wallet.
  - doopy1 5y ago
    Actually most web3 wallets have their own version of "safe browsing" and track malicious/phishing web3 websites.
    - Rastonbury 5y ago
      There isn't much point if domains and contracts are being setup for the sole purpose of spearfishing a handful of whales.
      - doopy1 5y ago
        Alright, then same goes for the parent comment within the context of spear phishing...
  - Osiris 5y ago
    There a number of services that provide blacklisted addresses to help people avoid scams or to prevent stolen funds from being laundered.
  - aaaaaaaaata 5y ago
  - aaaaaaaaata 5y ago
    The ACH banking protocol doesn't have these either. This isn't Ethereum's job. It's an L2's job. Whichever ones you choose to engage with. But, they'll all be interoperable.
    - fragmede 5y ago
deleted 5y ago
[deleted]
unityByFreedom 5y ago
Haha, I was never on board with crypto and this is far worse. It's like fast tracking the usual crypto scam. Also this guy seems rather green in term of internet scams, > Scammers are getting smarter. Before now, the best scam I've really encountered is basically "hi this is tech support please share your private key so we can help"
PragmaticPulp 5y ago
> it's got to be the biggest, most massive security hole I've ever seen brushed off. Well said. This goes hand-in-hand with the victim blaming that goes on in cryptocurrency circles. Any time a story like this appears, defenders come out of the woodwork to insist that it's the victim's fault for doing something or not doing something else. Even the linked Twitter thread is full of replies from people suggesting that the author was "asking for it". Crypto seems to appeal to people who like to think that they are smarter than the average person and therefore will succeed by self-managing their finances right down to the private keys. Adding smart contracts to the mix basically opens up a can of worms that makes it unrealistic to actually control every detail of your money unless you strictly limit each contract to a separate wallet and only transfer funds into that wallet before activating the contract. That's honestly a good strategy if you're sitting on $100mm+ in cryptocurrency and the transaction fees are negligible (as was the case with the Twitter user). However, when transaction fees are $10/each or more, the average crypto user isn't actually doing anything of the sort. They're clicking the buttons and hoping for the best.
- phone8675309 5y ago
  > Crypto seems to appeal to people who like to think that they are smarter than the average person and therefore will succeed by self-managing their finances right down to the private keys. I've been calling them Dunning Krugerrands for this reason, and I suggest others do as well.
  - schrectacular 5y ago
    I hereby award you five internet points. As part of your prize you Al's get to name this currency.
DoctorOW 5y ago
When I heard about Ethereum this was my exact fear. Programmable money sounds like a terrible idea from the perspective of business owner. Does this mean I have to check every transaction I enter to run arbitrary code with full access to my wallet? That is of course assuming the code isn't able to break out of any other protections there might be and pay for the ETH I'm getting with my data.
- akersten 5y ago
  No, no, of course you don't have to check every contract you engage with. At least, not with the help of my conveniently-IPO'ing DAO wETH unwrapper leaser startup. We'll take care of the heavy lifting, you sit back, relax, and pay us no mind (really, please, do not look behind the curtain). We're a Series F company filling the totally coincidental grift-shaped hole where Ethereum left off - contact our sales team on Discord if you're interested!
  - sizzle 5y ago
    Shut up and take my liquidity in your farming pools!!!
- phone8675309 5y ago
  It boggles the mind that someone looked at money and thought "you know what, this is too simple, let's shoehorn in a Turing complete programming language - that'll fix it!"
  - randomhodler84 5y ago
    It boggles the mind that someone is so lacking imagination that they couldn’t imagine a use for such technology. Ignorance is unbecoming.
    - crocwrestler 5y ago
      Can you share some uses? Genuinely interested.
dcolkitt 5y ago
This isn’t how it works. With ERC20 you “approve” tokens. That allows the specific contract you approve to spend up to a specific tokens at that specific address. Things that a random smart contract cannot do: 1) Spend more tokens than the amount you approved. 2) Spend any other tokens besides the specific type that you approved. (E.g. can’t steal your NFT or USDC) 3) Spend tokens at any other wallet address even if you own those other addresses (and creating a new address for a specific purpose is trivially easy) In addition the only approve() technology is already being replaced with the modern EIP-2612 standard. (USDC already implements it.) In this workflow instead of pre-approving a contract, you sign a specific transaction-specific message. With EIP-2612 you know exactly how much you’re spending on each transaction and there’s zero after the fact risk.
- betwixthewires 5y ago
  I'm very much aware of how ERC20 contracts work, I've written them. I'm glad the standard for approval of control of wallets is being deprecated for one with more granularity and security, and I hope it solves this problem. But that is how it works. The idea that I have a wallet as an extension in my web browser, and people can deliver me any transaction they like, with a "yes" button decorated however they like in the form of a web app, it absolutely does mean that I need to know how to read solidity to be safe and that I must audit every transaction I'm interested in signing. And an engineer would take that for granted, but if that's the standard UX, again, this isn't ready for grandma, not even close. What ethereum should've done was be a little more slow moving with adding features and maintain mist so that a standard UI feature set could be expected by users.
- pests 5y ago
  Thank you, I was going to explain this. I have seen contracts approve your entire supply though without mentioning it. That would allow the contract to come back at any time, with no user action, to take more coins out. Just be wary of "Approving" contracts before using them on DeFi apps. That first approval confirmation is the most important as you're basically handing them that much coin and trusting them to give it all back.
rkagerer 5y ago
Yeah. And to take it one level further, a language that let's you lock up / burn a coin in any fashion other than a very explicit Burn() command is equally reckless. The platform needs to provide guardrails for developers too.

orasis 5y ago

When it comes to code, we’re all in over our heads. I can reason about significantly more complexity than most developers I know and it’s still laughable how little complexity I can manage.

ikt 5y ago

Think of all the scams happening over TCP/IP every day! They built this thing where anyone can pretend to be a bank website? No checks or security? It's laughable. I'm in disbelief. And this is the web?

betwixthewires 5y ago
I never said I expect ethereum or web3 or whatever to be entirely scam free. I said that having the ability to send anyone any transaction and to their eyes have it look like any other sort of interaction they like unless they can read solidity and audit the code themselves is a very very large security hole.
markstos 5y ago
There are checks in place to make difficult to buy an SSL certificate for the official domain of a bank. At least Chrome tracks malicious websites. By comparison, there seem to be no checks in place to prevent writing an ethereym contract that drains a victim’s wallet.
- doopy1 5y ago
  Actually most web3 wallets have their own version of "safe browsing" and track malicious/phishing web3 websites.
  - Rastonbury 5y ago
    There isn't much point if domains and contracts are being setup for the sole purpose of spearfishing a handful of whales.
    - doopy1 5y ago
      Alright, then same goes for the parent comment within the context of spear phishing...
- Osiris 5y ago
  There a number of services that provide blacklisted addresses to help people avoid scams or to prevent stolen funds from being laundered.
- aaaaaaaaata 5y ago
- aaaaaaaaata 5y ago
  The ACH banking protocol doesn't have these either. This isn't Ethereum's job. It's an L2's job. Whichever ones you choose to engage with. But, they'll all be interoperable.
  - fragmede 5y ago

deleted 5y ago

[deleted]

unityByFreedom 5y ago

Haha, I was never on board with crypto and this is far worse. It's like fast tracking the usual crypto scam. Also this guy seems rather green in term of internet scams, > Scammers are getting smarter. Before now, the best scam I've really encountered is basically "hi this is tech support please share your private key so we can help"

PragmaticPulp 5y ago

> it's got to be the biggest, most massive security hole I've ever seen brushed off. Well said. This goes hand-in-hand with the victim blaming that goes on in cryptocurrency circles. Any time a story like this appears, defenders come out of the woodwork to insist that it's the victim's fault for doing something or not doing something else. Even the linked Twitter thread is full of replies from people suggesting that the author was "asking for it". Crypto seems to appeal to people who like to think that they are smarter than the average person and therefore will succeed by self-managing their finances right down to the private keys. Adding smart contracts to the mix basically opens up a can of worms that makes it unrealistic to actually control every detail of your money unless you strictly limit each contract to a separate wallet and only transfer funds into that wallet before activating the contract. That's honestly a good strategy if you're sitting on $100mm+ in cryptocurrency and the transaction fees are negligible (as was the case with the Twitter user). However, when transaction fees are $10/each or more, the average crypto user isn't actually doing anything of the sort. They're clicking the buttons and hoping for the best.

phone8675309 5y ago
> Crypto seems to appeal to people who like to think that they are smarter than the average person and therefore will succeed by self-managing their finances right down to the private keys. I've been calling them Dunning Krugerrands for this reason, and I suggest others do as well.
- schrectacular 5y ago
  I hereby award you five internet points. As part of your prize you Al's get to name this currency.

DoctorOW 5y ago

When I heard about Ethereum this was my exact fear. Programmable money sounds like a terrible idea from the perspective of business owner. Does this mean I have to check every transaction I enter to run arbitrary code with full access to my wallet? That is of course assuming the code isn't able to break out of any other protections there might be and pay for the ETH I'm getting with my data.

akersten 5y ago
No, no, of course you don't have to check every contract you engage with. At least, not with the help of my conveniently-IPO'ing DAO wETH unwrapper leaser startup. We'll take care of the heavy lifting, you sit back, relax, and pay us no mind (really, please, do not look behind the curtain). We're a Series F company filling the totally coincidental grift-shaped hole where Ethereum left off - contact our sales team on Discord if you're interested!
- sizzle 5y ago
  Shut up and take my liquidity in your farming pools!!!
phone8675309 5y ago
It boggles the mind that someone looked at money and thought "you know what, this is too simple, let's shoehorn in a Turing complete programming language - that'll fix it!"
- randomhodler84 5y ago
  It boggles the mind that someone is so lacking imagination that they couldn’t imagine a use for such technology. Ignorance is unbecoming.
  - crocwrestler 5y ago
    Can you share some uses? Genuinely interested.

dcolkitt 5y ago

This isn’t how it works. With ERC20 you “approve” tokens. That allows the specific contract you approve to spend up to a specific tokens at that specific address. Things that a random smart contract cannot do: 1) Spend more tokens than the amount you approved. 2) Spend any other tokens besides the specific type that you approved. (E.g. can’t steal your NFT or USDC) 3) Spend tokens at any other wallet address even if you own those other addresses (and creating a new address for a specific purpose is trivially easy) In addition the only approve() technology is already being replaced with the modern EIP-2612 standard. (USDC already implements it.) In this workflow instead of pre-approving a contract, you sign a specific transaction-specific message. With EIP-2612 you know exactly how much you’re spending on each transaction and there’s zero after the fact risk.

betwixthewires 5y ago
I'm very much aware of how ERC20 contracts work, I've written them. I'm glad the standard for approval of control of wallets is being deprecated for one with more granularity and security, and I hope it solves this problem. But that is how it works. The idea that I have a wallet as an extension in my web browser, and people can deliver me any transaction they like, with a "yes" button decorated however they like in the form of a web app, it absolutely does mean that I need to know how to read solidity to be safe and that I must audit every transaction I'm interested in signing. And an engineer would take that for granted, but if that's the standard UX, again, this isn't ready for grandma, not even close. What ethereum should've done was be a little more slow moving with adding features and maintain mist so that a standard UI feature set could be expected by users.
pests 5y ago
Thank you, I was going to explain this. I have seen contracts approve your entire supply though without mentioning it. That would allow the contract to come back at any time, with no user action, to take more coins out. Just be wary of "Approving" contracts before using them on DeFi apps. That first approval confirmation is the most important as you're basically handing them that much coin and trusting them to give it all back.

rkagerer 5y ago

Yeah. And to take it one level further, a language that let's you lock up / burn a coin in any fashion other than a very explicit Burn() command is equally reckless. The platform needs to provide guardrails for developers too.