6 ms·

The international obfuscated c contest has taught me that programmers can make small mistakes on purpose and its almost impossible to identify legit mistakes fr

The international obfuscated c contest has taught me that programmers can make small mistakes on purpose and its almost impossible to identify legit mistakes from malfeasance. If we have a situation where: * Its hard to tell, after the fact, 'a mistake' was a bad actor. * The programmers are, by and large, anonymous. * The benefit of making 'a mistake' could be hundreds of millions of dollars that are not easily traced. This situation seems rife for abuse and bad actors. Not saying it happened in this case. . . but how would you know?

nubb 4y ago
if you enjoy obfuscated c, we have this https://underhanded.soliditylang.org/ https://underhanded.soliditylang.org/
- OrangeMonkey 4y ago
  I am 98% anti-crypto, but this is awesome. Thank you man!
  - nubb 4y ago
    i can totally get why a lot of folks are anti crypto but from a dev perspective it is REALLY a fun place. It is possible to have fun and make money AND not be a piece of shit in crypto dev.
    - OrangeMonkey 4y ago
      I don't like the industry and I believe that, in general, its existence currently is a net negative for humanity. Currently, I believe that most 'web3' and 'crypto applications' exist to drive fear of missing out leading to monetary investments in crypto by people who don't understand the risks leading to the story here (150 million lost or stolen). I think of my grandmother or uncle investing in crypto and losing their retirement savings. I personally know family members who have lost low 5 digits. Why? Because they wanted to invest because it was the future, web 3, fomo. I actually believe the world is a worst place because of crypto. Can that change in the future? 100% Does this mean that you and people who work in the industry are bad? Not at all. I've worked in industries when I was younger that - now - I think were a net negative for the world. I'd be a hypocrite to throw stones at people just trying to live... Maybe governmental regulations of this will change my view.
      - nubb 4y ago
        totally understand your POV. I am pro crypto because I think banks and VC and hedge funds and market makers and all of these shadow/mystery shits that go down in the real markets are scammy and evil. while its possible to obfuscate things on a chain ledger, its impossible to really hide. blockchain tech puts everything in the open which i think would prevent a lot of crime that exists today and goes completely unchecked. i prob didnt say all that super well but i hope you get the spirit of my argument. i totally respect your opinion here though because you are not wrong :)
        Closi 4y ago
        > I am pro crypto because I think banks and VC and hedge funds [...] are scammy Liking Crypto because you think hedge funds are scammy is kind of like enjoying swimming because rain makes you wet. Today's crypto is much more rife with scams and Ponzi schemes than hedge funds currently are (because of actual legislation).
        asenna 4y ago
        Problem with arguments like these is you put all of crypto/web3 into one category. Yes there are scams out there. Lot more than other fields. But just take 2 or 3 solid examples - Uniswap, DyDx, etc -> These are much more open and decentralized and transparent than their TradFi counterparts. If you think Uniswap is a scam, you haven't looked into it yet. Yes the tokens that get listed on it can be scams but that's up to to the buyer to assume the risk. As a tool, it's so much more transparent than anything that existed before it.
        Closi 4y ago
        Yes, but the parent comment also put all banks and hedge funds into a single category. > If you think Uniswap is a scam, you haven't looked into it yet. Yes the tokens that get listed on it can be scams but that's up to to the buyer to assume the risk. I never said anything about Uniswap personally, but using a company that can list scams as an example about how non-scammy crypto can be is a little strange to me.
    - mod 4y ago
      Can you help with some fun jumping off points? I'm a dev interested in learning more.
      - nubb 4y ago
        when i wanted to learn Solidity, at the time, I was really into yield farming. I forked the sushiswap masterchef contract and just played around with tweaking it. you can do this for (basically) free on a chain like BSC or Arbitrum or you can play around with forking a network using Ganache or hardhat (or Foundry if you are a Rust nerd). Crypto Zombies is a very good interactive intro to Solidity, despite being REALLY outdated at this point (last i checked it was using Sol 0.5 or 0.4). my best advice is find some popular crypto concept you vibe with and just start messing around. Vyper is also growing in popularity so that might be worth checking out too!
    - deleted 4y ago
      [deleted]
- tgv 4y ago
  I've always enjoyed the underhanded C contest, but I don't think it's active anymore. Thanks for this. The 2022 entry that I saw was very much in the same spirit.
- nyanpasu64 4y ago
  Reading https://blog.soliditylang.org/2022/04/09/announcing-the-underhanded-contest-winners-2022/#-first-place-tynan-richards https://blog.soliditylang.org/2022/04/09/announcing-the-unde...: > In Solidity, the order of evaluation of sub-expressions is unspecified. This means that in f(g(), h()), g() might get evaluated before h() or h() might get evaluated before g(). Practically, this order is predictable, but Solidity code shouldn’t depend on that behavior between compiler versions. In most circumstances g() is evaluated before h() (left-to-right order), which is also the behavior that most languages specify in their standards. However, in the case of emitting an event with indexed arguments, the arguments are evaluated right-to-left. I feel that order-of-evaluation dependence is a special case of the general conflict between expression-oriented (functional-style) programming, and impure operations requiring sequential reasoning. Another case of this conflict is temporary values (expressions) with side-effectful destructors (sequential reasoning), for example https://fasterthanli.me/articles/a-rust-match-made-in-hell#what-the-fuck-is-happening https://fasterthanli.me/articles/a-rust-match-made-in-hell#w.... At this point, is it good practice to avoid using side-effectful procedure calls as parameters to other expressions (especially those with multiple inputs), but instead first assign to a temporary value to make order of operations explicit?
jpmonette 4y ago
Isn't the same thing for oss contributions, npm packages, etc.?
- cmeacham98 4y ago
  Slipping an exploit into an npm package doesn't let you easily run away with tens/hundreds of millions of dollars in the same way web3 projects do. That said, I personally doubt this happens much if at all, because if you want to scam on web3 you can just do a good old-fashioned pump&dump and nobody seems to be receiving any legal/criminal consequences as of yet.
Destiner 4y ago
"Never attribute to malice that which is adequately explained by stupidity"
rmbyrro 4y ago
> hundreds of millions of dollars that are not easily traced If they keep it in blockchains only, it's hard to connect to a real identity. But if they cross the line (which is everybody's goal eventually) to the real world, they can get caught as easy or even easier than in traditional financial system.
chernevik 4y ago
This. I don't how anyone would commit anything more than pocket change to a scheme where an insider could deliberately introduce a weakness and then exploit that weakness to walk off with all the funds committed.

nubb 4y ago

if you enjoy obfuscated c, we have this https://underhanded.soliditylang.org/ https://underhanded.soliditylang.org/

OrangeMonkey 4y ago
I am 98% anti-crypto, but this is awesome. Thank you man!
- nubb 4y ago
  i can totally get why a lot of folks are anti crypto but from a dev perspective it is REALLY a fun place. It is possible to have fun and make money AND not be a piece of shit in crypto dev.
  - OrangeMonkey 4y ago
    I don't like the industry and I believe that, in general, its existence currently is a net negative for humanity. Currently, I believe that most 'web3' and 'crypto applications' exist to drive fear of missing out leading to monetary investments in crypto by people who don't understand the risks leading to the story here (150 million lost or stolen). I think of my grandmother or uncle investing in crypto and losing their retirement savings. I personally know family members who have lost low 5 digits. Why? Because they wanted to invest because it was the future, web 3, fomo. I actually believe the world is a worst place because of crypto. Can that change in the future? 100% Does this mean that you and people who work in the industry are bad? Not at all. I've worked in industries when I was younger that - now - I think were a net negative for the world. I'd be a hypocrite to throw stones at people just trying to live... Maybe governmental regulations of this will change my view.
    - nubb 4y ago
      totally understand your POV. I am pro crypto because I think banks and VC and hedge funds and market makers and all of these shadow/mystery shits that go down in the real markets are scammy and evil. while its possible to obfuscate things on a chain ledger, its impossible to really hide. blockchain tech puts everything in the open which i think would prevent a lot of crime that exists today and goes completely unchecked. i prob didnt say all that super well but i hope you get the spirit of my argument. i totally respect your opinion here though because you are not wrong :)
      - Closi 4y ago
        > I am pro crypto because I think banks and VC and hedge funds [...] are scammy Liking Crypto because you think hedge funds are scammy is kind of like enjoying swimming because rain makes you wet. Today's crypto is much more rife with scams and Ponzi schemes than hedge funds currently are (because of actual legislation).
        asenna 4y ago
        Problem with arguments like these is you put all of crypto/web3 into one category. Yes there are scams out there. Lot more than other fields. But just take 2 or 3 solid examples - Uniswap, DyDx, etc -> These are much more open and decentralized and transparent than their TradFi counterparts. If you think Uniswap is a scam, you haven't looked into it yet. Yes the tokens that get listed on it can be scams but that's up to to the buyer to assume the risk. As a tool, it's so much more transparent than anything that existed before it.
        Closi 4y ago
        Yes, but the parent comment also put all banks and hedge funds into a single category. > If you think Uniswap is a scam, you haven't looked into it yet. Yes the tokens that get listed on it can be scams but that's up to to the buyer to assume the risk. I never said anything about Uniswap personally, but using a company that can list scams as an example about how non-scammy crypto can be is a little strange to me.
  - mod 4y ago
    Can you help with some fun jumping off points? I'm a dev interested in learning more.
    - nubb 4y ago
      when i wanted to learn Solidity, at the time, I was really into yield farming. I forked the sushiswap masterchef contract and just played around with tweaking it. you can do this for (basically) free on a chain like BSC or Arbitrum or you can play around with forking a network using Ganache or hardhat (or Foundry if you are a Rust nerd). Crypto Zombies is a very good interactive intro to Solidity, despite being REALLY outdated at this point (last i checked it was using Sol 0.5 or 0.4). my best advice is find some popular crypto concept you vibe with and just start messing around. Vyper is also growing in popularity so that might be worth checking out too!
  - deleted 4y ago
    [deleted]
tgv 4y ago
I've always enjoyed the underhanded C contest, but I don't think it's active anymore. Thanks for this. The 2022 entry that I saw was very much in the same spirit.
nyanpasu64 4y ago
Reading https://blog.soliditylang.org/2022/04/09/announcing-the-underhanded-contest-winners-2022/#-first-place-tynan-richards https://blog.soliditylang.org/2022/04/09/announcing-the-unde...: > In Solidity, the order of evaluation of sub-expressions is unspecified. This means that in f(g(), h()), g() might get evaluated before h() or h() might get evaluated before g(). Practically, this order is predictable, but Solidity code shouldn’t depend on that behavior between compiler versions. In most circumstances g() is evaluated before h() (left-to-right order), which is also the behavior that most languages specify in their standards. However, in the case of emitting an event with indexed arguments, the arguments are evaluated right-to-left. I feel that order-of-evaluation dependence is a special case of the general conflict between expression-oriented (functional-style) programming, and impure operations requiring sequential reasoning. Another case of this conflict is temporary values (expressions) with side-effectful destructors (sequential reasoning), for example https://fasterthanli.me/articles/a-rust-match-made-in-hell#what-the-fuck-is-happening https://fasterthanli.me/articles/a-rust-match-made-in-hell#w.... At this point, is it good practice to avoid using side-effectful procedure calls as parameters to other expressions (especially those with multiple inputs), but instead first assign to a temporary value to make order of operations explicit?

jpmonette 4y ago

Isn't the same thing for oss contributions, npm packages, etc.?

cmeacham98 4y ago
Slipping an exploit into an npm package doesn't let you easily run away with tens/hundreds of millions of dollars in the same way web3 projects do. That said, I personally doubt this happens much if at all, because if you want to scam on web3 you can just do a good old-fashioned pump&dump and nobody seems to be receiving any legal/criminal consequences as of yet.

Destiner 4y ago

"Never attribute to malice that which is adequately explained by stupidity"

rmbyrro 4y ago

> hundreds of millions of dollars that are not easily traced If they keep it in blockchains only, it's hard to connect to a real identity. But if they cross the line (which is everybody's goal eventually) to the real world, they can get caught as easy or even easier than in traditional financial system.

chernevik 4y ago

This. I don't how anyone would commit anything more than pocket change to a scheme where an insider could deliberately introduce a weakness and then exploit that weakness to walk off with all the funds committed.