5 ms·

Generally we've described this sort of research as "review resistant", rather than being secure in some classical sense. How Ethereum and other cryptocurrencies

Generally we've described this sort of research as "review resistant", rather than being secure in some classical sense. How Ethereum and other cryptocurrencies actually work is often eagerly explained but completely unfathomable on closer inspection. Concerns raised are fixed with additional complexity repeatedly until the reviewer grows weary of attempting to piece it together. Consequently there's sufficient conflicting descriptions that I don't think anybody has any hope of successfully understanding the system as a whole, much less being able to come to conclusions about its security.

whatisweb3 4y ago
The spec is open and documented pretty clearly.[1] [1] https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc
- capableweb 4y ago
  Considering that Eth2 also have about 7 clients that work today (with more being worked on), the specification is clearly understandable by at least 7 different entities, further eroding the argument that Eth2 specification is so complicated no one actually understands it.
  - ben-schaaf 4y ago
    Most of the linked spec is pseudocode - actually it looks like valid python code. So to be fair I highly doubt you'd need any understanding of what it's actually doing to successfully implement that spec. Just like I still have no clue how Quaternions work, yet I've implemented them multiple times.
    - freemint 4y ago
      How much would one need to pay you to test your hypothesis? That is you try to implement a standard complaint new Eth2 implementation from scratch ( and possible record yourself while doing so.
- YetAnotherNick 4y ago
  That's just a random function description. The main thing here is how is seed calculated and analysis of whether it seed is safe from network partition, DDoS, malicious attack, nodes being offline, forks etc.
  - whatisweb3 4y ago
    Also clearly documented and open to researchers to examine. The full code for the various Eth2 clients is open source. [1] https://eth2book.info/altair/part2/building_blocks/randomness https://eth2book.info/altair/part2/building_blocks/randomnes... [2] https://eth2.incessant.ink/book/06__building-blocks/02__randomness.html https://eth2.incessant.ink/book/06__building-blocks/02__rand...
capableweb 4y ago
That's a gross misrepresentation of how it works in the real-world. Do you believe the same about cryptography? Since you can't understand it, and few really understand the full system, algorithms and functions, it must be "review resistant" rather than actually safe to use?
- josh2600 4y ago
  Cryptography has mathematical proofs of the underlying math that are rigorous. There are constraints such as breaking if a proof of an attack against the discrete log were to emerge or other constraints related to p=np. The implementations are also very close to formally verified if not fully formally verified. Nothing is perfect but cryptographic code has to be pretty bulletproof or a lot of systems would get owned. The descriptions of how to verify cryptographic systems are academically and professionally rigorous especially compared to eth. Caveat: sometimes the underlying systems that cryptographic implementations utilize change degrading their guarantees. There have been times where the compiler will get updated and cause what was a branchless process to branch which could lead to information leaks against a dedicated attacker. Thankfully such examples are rare in the literature.
  - capableweb 4y ago
    > The implementations are also very close to formally verified if not fully formally verified. So is Eth2, see "Formal Verification of the Ethereum 2.0 Beacon Chain" by Franck Cassez, Joanne Fuller, Aditya Asgaonkar, paper (https://arxiv.org/abs/2110.12909 https://arxiv.org/abs/2110.12909) and source code (https://github.com/ConsenSys/eth2.0-dafny https://github.com/ConsenSys/eth2.0-dafny). More efforts to formally verify Eth2 is ongoing as well, by different entities. > Nothing is perfect but cryptographic code has to be pretty bulletproof or a lot of systems would get owned Same with Ethereum. The chance of having a major impact with a vulnerability is even higher I'd argue, as you can easily extract currency you can trade for USD, and the entire network is inter-connected, so finding targets to exploit becomes even easier. Point still stands that cryptography goes over a lot of peoples head, but you don't hear those people complaining that because they don't understand it, no one does.
bowsamic 4y ago
"I don't get it so it must be false" that's what you sound like right now
douglaswlance 4y ago
All popular Ethereum clients are open-source. If you really want to know how it works, go read the code.
pa7x1 4y ago
How can this argument be made in good faith? The spec is open source, all the clients are open source. Furthermore, it's implemented and running. You could argue that someone in particular has made a poor or incomplete explanation of how it works but not that they way it works is unfathomable or being patched as your speak. It's already implemented, go look at the code if you don't want to believe what anyone says.
- jayd16 4y ago
  If the spec is open source, how can you say all the clients are open source? Or do you simply mean there are open source clients one can inspect and use?
  - pa7x1 4y ago
    There is a specification of the protocol, which is open source: https://github.com/ethereum/consensus-specs https://github.com/ethereum/consensus-specs And there are over 5 interoperable, independent and open source implementations of said specification: - https://github.com/sigp/lighthouse/ https://github.com/sigp/lighthouse/ - https://github.com/ChainSafe/lodestar https://github.com/ChainSafe/lodestar - https://github.com/status-im/nimbus-eth2 https://github.com/status-im/nimbus-eth2 - https://github.com/prysmaticlabs/prysm https://github.com/prysmaticlabs/prysm - https://github.com/ConsenSys/teku https://github.com/ConsenSys/teku - https://github.com/sifraitech/grandine https://github.com/sifraitech/grandine ...
    - deleted 4y ago
      [deleted]
Humdeee 4y ago
But isn't that a great description of our current banking system as it is today? Not everyone knows everything, somehow it works, complex, etc. However, still so woefully insecure.
aaaaaaaaata 4y ago
Spoken like somebody who doesn't read Buterin.

whatisweb3 4y ago

The spec is open and documented pretty clearly.[1] [1] https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc

capableweb 4y ago
Considering that Eth2 also have about 7 clients that work today (with more being worked on), the specification is clearly understandable by at least 7 different entities, further eroding the argument that Eth2 specification is so complicated no one actually understands it.
- ben-schaaf 4y ago
  Most of the linked spec is pseudocode - actually it looks like valid python code. So to be fair I highly doubt you'd need any understanding of what it's actually doing to successfully implement that spec. Just like I still have no clue how Quaternions work, yet I've implemented them multiple times.
  - freemint 4y ago
    How much would one need to pay you to test your hypothesis? That is you try to implement a standard complaint new Eth2 implementation from scratch ( and possible record yourself while doing so.
YetAnotherNick 4y ago
That's just a random function description. The main thing here is how is seed calculated and analysis of whether it seed is safe from network partition, DDoS, malicious attack, nodes being offline, forks etc.
- whatisweb3 4y ago
  Also clearly documented and open to researchers to examine. The full code for the various Eth2 clients is open source. [1] https://eth2book.info/altair/part2/building_blocks/randomness https://eth2book.info/altair/part2/building_blocks/randomnes... [2] https://eth2.incessant.ink/book/06__building-blocks/02__randomness.html https://eth2.incessant.ink/book/06__building-blocks/02__rand...

capableweb 4y ago

That's a gross misrepresentation of how it works in the real-world. Do you believe the same about cryptography? Since you can't understand it, and few really understand the full system, algorithms and functions, it must be "review resistant" rather than actually safe to use?

josh2600 4y ago
Cryptography has mathematical proofs of the underlying math that are rigorous. There are constraints such as breaking if a proof of an attack against the discrete log were to emerge or other constraints related to p=np. The implementations are also very close to formally verified if not fully formally verified. Nothing is perfect but cryptographic code has to be pretty bulletproof or a lot of systems would get owned. The descriptions of how to verify cryptographic systems are academically and professionally rigorous especially compared to eth. Caveat: sometimes the underlying systems that cryptographic implementations utilize change degrading their guarantees. There have been times where the compiler will get updated and cause what was a branchless process to branch which could lead to information leaks against a dedicated attacker. Thankfully such examples are rare in the literature.
- capableweb 4y ago
  > The implementations are also very close to formally verified if not fully formally verified. So is Eth2, see "Formal Verification of the Ethereum 2.0 Beacon Chain" by Franck Cassez, Joanne Fuller, Aditya Asgaonkar, paper (https://arxiv.org/abs/2110.12909 https://arxiv.org/abs/2110.12909) and source code (https://github.com/ConsenSys/eth2.0-dafny https://github.com/ConsenSys/eth2.0-dafny). More efforts to formally verify Eth2 is ongoing as well, by different entities. > Nothing is perfect but cryptographic code has to be pretty bulletproof or a lot of systems would get owned Same with Ethereum. The chance of having a major impact with a vulnerability is even higher I'd argue, as you can easily extract currency you can trade for USD, and the entire network is inter-connected, so finding targets to exploit becomes even easier. Point still stands that cryptography goes over a lot of peoples head, but you don't hear those people complaining that because they don't understand it, no one does.

bowsamic 4y ago

"I don't get it so it must be false" that's what you sound like right now

douglaswlance 4y ago

All popular Ethereum clients are open-source. If you really want to know how it works, go read the code.

pa7x1 4y ago

How can this argument be made in good faith? The spec is open source, all the clients are open source. Furthermore, it's implemented and running. You could argue that someone in particular has made a poor or incomplete explanation of how it works but not that they way it works is unfathomable or being patched as your speak. It's already implemented, go look at the code if you don't want to believe what anyone says.

jayd16 4y ago
If the spec is open source, how can you say all the clients are open source? Or do you simply mean there are open source clients one can inspect and use?
- pa7x1 4y ago
  There is a specification of the protocol, which is open source: https://github.com/ethereum/consensus-specs https://github.com/ethereum/consensus-specs And there are over 5 interoperable, independent and open source implementations of said specification: - https://github.com/sigp/lighthouse/ https://github.com/sigp/lighthouse/ - https://github.com/ChainSafe/lodestar https://github.com/ChainSafe/lodestar - https://github.com/status-im/nimbus-eth2 https://github.com/status-im/nimbus-eth2 - https://github.com/prysmaticlabs/prysm https://github.com/prysmaticlabs/prysm - https://github.com/ConsenSys/teku https://github.com/ConsenSys/teku - https://github.com/sifraitech/grandine https://github.com/sifraitech/grandine ...
  - deleted 4y ago
    [deleted]

Humdeee 4y ago

But isn't that a great description of our current banking system as it is today? Not everyone knows everything, somehow it works, complex, etc. However, still so woefully insecure.

aaaaaaaaata 4y ago

Spoken like somebody who doesn't read Buterin.