4 ms·

Wait... Couldn't the same argument be used simply to move coins? "My keys, my coins. If I fuck up by holding my keys on an insecure computer, I deserve my coi

Wait... Couldn't the same argument be used simply to move coins? "My keys, my coins. If I fuck up by holding my keys on an insecure computer, I deserve my coins to be stolen.". Yet there are HSM / hardware wallet so that it becomes way harder to "fuck up". There's a difference between a nefarious actor having its own ETH slashed and a nefarious actor finding a way to have an honest actor's ETH slashed. Isn't it possible to imagine secure hardware device to stake ETHs instead of having to run validation code on general, insecure, purpose computers which gets owned all the time? I literally mean that: the same as hardware wallet to stake/validate instead of sign transactions. I think you got my critique right: I find it's folly to stake on general purpose computers.

bhaak 4y ago
> Wait... Couldn't the same argument be used simply to move coins? "My keys, my coins. If I fuck up by holding my keys on an insecure computer, I deserve my coins to be stolen.". Yes. The blame of coins getting stolen is often laid 100% on the victim. Who would have thought that being a bank is hard? /s > There's a difference between a nefarious actor having its own ETH slashed and a nefarious actor finding a way to have an honest actor's ETH slashed. Only for the owner of those ETH. For the network, they don't look different. Because of the decentral nature I don't think the network can even have a different view. > I think you got my critique right: I find it's folly to stake on general purpose computers. The part about general purpose computers wasn't clear from your original post. I too read it as "staking is inherently unsafe in general".
capableweb 4y ago
> I think you got my critique right: I find it's folly to stake on general purpose computers. Validators are not supposed to run on general purpose computers you use for other things, they are supposed to be extra hardened against attacks, as they WILL be targeted. A validator won't be running on the same machine someone does general web development on, where you download random packages over npm for example. If someone does run a validator on a machine where they are randomly trust 3rd party code from a public registry, they have zero sense of security. If you run them in a hosted server environment, you better trust that environment to be really secure. If you run it at home, you really need to know what you're doing in regards to software, hardware, networking and physical access. Just like you're not supposed to run production banking infrastructure on home computers, validators are not supposed to run in that environment either.

bhaak 4y ago

> Wait... Couldn't the same argument be used simply to move coins? "My keys, my coins. If I fuck up by holding my keys on an insecure computer, I deserve my coins to be stolen.". Yes. The blame of coins getting stolen is often laid 100% on the victim. Who would have thought that being a bank is hard? /s > There's a difference between a nefarious actor having its own ETH slashed and a nefarious actor finding a way to have an honest actor's ETH slashed. Only for the owner of those ETH. For the network, they don't look different. Because of the decentral nature I don't think the network can even have a different view. > I think you got my critique right: I find it's folly to stake on general purpose computers. The part about general purpose computers wasn't clear from your original post. I too read it as "staking is inherently unsafe in general".

capableweb 4y ago

> I think you got my critique right: I find it's folly to stake on general purpose computers. Validators are not supposed to run on general purpose computers you use for other things, they are supposed to be extra hardened against attacks, as they WILL be targeted. A validator won't be running on the same machine someone does general web development on, where you download random packages over npm for example. If someone does run a validator on a machine where they are randomly trust 3rd party code from a public registry, they have zero sense of security. If you run them in a hosted server environment, you better trust that environment to be really secure. If you run it at home, you really need to know what you're doing in regards to software, hardware, networking and physical access. Just like you're not supposed to run production banking infrastructure on home computers, validators are not supposed to run in that environment either.