4 ms·

Meh. As an outsider, you're not going to be able to reliably audit some incomprehensible smart contracts, either. You'll have to trust somebody: either Deloitte

Meh. As an outsider, you're not going to be able to reliably audit some incomprehensible smart contracts, either. You'll have to trust somebody: either Deloitte, or @ShibaMuskMoonSecure.eth Evidence: https://old.reddit.com/r/Buttcoin/comments/we8514/nomad_hack_smart_contract_auditors_outlined_the/ https://old.reddit.com/r/Buttcoin/comments/we8514/nomad_hack...

siftrics 4y ago
You can easily audit total assets though. Just look at one number on the chain.
- ForHackernews 4y ago
  I assume you have to install software to do that? Software written by some author(s) that you have to trust? That you have to download and install from trusted sources? It's not like I can verify "one number on the chain" with my own human eyes and no third parties involved. There's always trust somewhere in the system, you're just making that trust relationship more obscure and opaque.
  - siftrics 4y ago
    You're acting in bad faith and you know it. This clearly reduces trust dramatically.
    - ForHackernews 4y ago
      It absolutely does not. As a developer who has worked to secure software systems, I fundamentally reject your assertion that "just trust the code" is a better security policy than "employ trustworthy people".
      - siftrics 4y ago
        Unbelievable ignorance. We just witnessed one of the largest frauds in all of human history. It would have been nearly impossible to trick every client that exists that can examine the chain. You are so wrong it is unfathomable that you are being honest right now.
        ForHackernews 4y ago
        The is the point I am making that you refuse to understand: You don't have to trick the clients, you have to trick the people; one way you might trick the people is with bogus software.[0] Consider that Tether is obviously a scam but continues unabated to this day. Better tooling is not going to fix the problems you think it will, because the incentives are all stacked toward dishonesty and fraud. [0] - https://insidebitcoins.com/news/scammers-are-using-fake-wallet-apps-to-stealing-crypto-funds-from-chinese https://insidebitcoins.com/news/scammers-are-using-fake-wall...
        siftrics 4y ago
        First, the greater community that would "accept" such an audit that is simply proof of on-chain funds is not dumb enough to download some random "Bitcoin wallet" that shows fake numbers for one single company. Second, the fraud you're alleging Tether is doing is off chain! It's in the fiat world! It's not happening on-chain. Stop blaming a system that literally mathematically precludes fraud (within the system itself, of course).
birracerveza 4y ago
Your evidence is an audit company finding a vulnerability and the team refusing to fix it? How does that prove your point? Sure, while it's hard for users to verify that the code does what it says and has no bugs, there are companies that can do it for you (as you posted) and even automated tools that allow anyone to do so automatically, and as the EVM gets used and exploited, these tools and audits also gets more robust. More importantly, the code can be audited by multiple sources, as it being public means it can be audited by anyone. On the other hand, financial records are likely audited by a single "reputable" company, with all the information the customers have is a badge that says "the money is there, trust me bro" and nothing else. But hey, it's "reputable" source so it's ok to trust them, right? ...Until it turns out that whoops, the money wasn't actually there because someone got a fat paycheck to make a honest mistake, ahah...
- ForHackernews 4y ago
  > Until it turns out that whoops, the money wasn't actually there because someone got a fat paycheck to make a honest mistake, ahah... Do you have any examples of this happening with a reputable (read: top 5) auditing firm in the last decade? Because I can find a dozen examples of crypto frauds happening in the past week.
  - birracerveza 4y ago
    https://www.theguardian.com/business/2009/oct/25/auditors-role-financial-crisis https://www.theguardian.com/business/2009/oct/25/auditors-ro... lol Crypto is a tool to build a public financial system that minimizes the amount of trust needed. If you invest in DogeSpaceMarsElonCumMakeMeRichInu and lose money, it's not crypto's fault. You STILL have to do your due diligence and invest responsibly.
    - birracerveza 4y ago
      I just noticed, before you rag me on about "in the last decade", the article closes with: >In his book on the Equity Funding Corporation fraud – the Enron of the 1970s – Raymond Dirks wrote: "If routine auditing procedures cannot detect 64,000 phony insurance policies, $25m in counterfeit bonds and $100m in missing assets, what is the purpose of audits?" More than 30 years later, investors are asking themselves the same questions.
everfree 4y ago
Smart contracts only need to be audited once, traditional accounts need to be audited continuously. Amortized over enough time, that's a much lower surface area for error. Smart contracts can be audited by any member of the public with the technical know-how, so there are typically a lot of eyes on the most important cogs - similar in some ways to the OSS security model. Traditional accounts typically cannot be directly and reliably audited by members of the public.
- ForHackernews 4y ago
  > similar in some ways to the OSS security model The OSS security model is honestly poor. This very fundamental bug in Debian (one of the most popular Linux distros) sat unnoticed (and exploited?) for two years: https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... How many eyes are on Debian vs memecoin-smart-contract-22112?
  - everfree 4y ago
    > How many eyes are on Debian vs memecoin-smart-contract-22112? To be perfectly honest, the memecoin contract probably has more. A smart contract's code base is much, much smaller and changes less often, and a greater number of people are much more strongly financially incentivized to find bugs. Plus, they often do a thorough third-party code audit up-front at the time they publish the code, which would be impractical to do with OS code since it needs to be constantly updated due to its threat model. I would trust the Shiba Inu token code to have less critical bugs in it than the Debian code.

siftrics 4y ago

You can easily audit total assets though. Just look at one number on the chain.

ForHackernews 4y ago
I assume you have to install software to do that? Software written by some author(s) that you have to trust? That you have to download and install from trusted sources? It's not like I can verify "one number on the chain" with my own human eyes and no third parties involved. There's always trust somewhere in the system, you're just making that trust relationship more obscure and opaque.
- siftrics 4y ago
  You're acting in bad faith and you know it. This clearly reduces trust dramatically.
  - ForHackernews 4y ago
    It absolutely does not. As a developer who has worked to secure software systems, I fundamentally reject your assertion that "just trust the code" is a better security policy than "employ trustworthy people".
    - siftrics 4y ago
      Unbelievable ignorance. We just witnessed one of the largest frauds in all of human history. It would have been nearly impossible to trick every client that exists that can examine the chain. You are so wrong it is unfathomable that you are being honest right now.
      - ForHackernews 4y ago
        The is the point I am making that you refuse to understand: You don't have to trick the clients, you have to trick the people; one way you might trick the people is with bogus software.[0] Consider that Tether is obviously a scam but continues unabated to this day. Better tooling is not going to fix the problems you think it will, because the incentives are all stacked toward dishonesty and fraud. [0] - https://insidebitcoins.com/news/scammers-are-using-fake-wallet-apps-to-stealing-crypto-funds-from-chinese https://insidebitcoins.com/news/scammers-are-using-fake-wall...
        siftrics 4y ago
        First, the greater community that would "accept" such an audit that is simply proof of on-chain funds is not dumb enough to download some random "Bitcoin wallet" that shows fake numbers for one single company. Second, the fraud you're alleging Tether is doing is off chain! It's in the fiat world! It's not happening on-chain. Stop blaming a system that literally mathematically precludes fraud (within the system itself, of course).

birracerveza 4y ago

Your evidence is an audit company finding a vulnerability and the team refusing to fix it? How does that prove your point? Sure, while it's hard for users to verify that the code does what it says and has no bugs, there are companies that can do it for you (as you posted) and even automated tools that allow anyone to do so automatically, and as the EVM gets used and exploited, these tools and audits also gets more robust. More importantly, the code can be audited by multiple sources, as it being public means it can be audited by anyone. On the other hand, financial records are likely audited by a single "reputable" company, with all the information the customers have is a badge that says "the money is there, trust me bro" and nothing else. But hey, it's "reputable" source so it's ok to trust them, right? ...Until it turns out that whoops, the money wasn't actually there because someone got a fat paycheck to make a honest mistake, ahah...

ForHackernews 4y ago
> Until it turns out that whoops, the money wasn't actually there because someone got a fat paycheck to make a honest mistake, ahah... Do you have any examples of this happening with a reputable (read: top 5) auditing firm in the last decade? Because I can find a dozen examples of crypto frauds happening in the past week.
- birracerveza 4y ago
  https://www.theguardian.com/business/2009/oct/25/auditors-role-financial-crisis https://www.theguardian.com/business/2009/oct/25/auditors-ro... lol Crypto is a tool to build a public financial system that minimizes the amount of trust needed. If you invest in DogeSpaceMarsElonCumMakeMeRichInu and lose money, it's not crypto's fault. You STILL have to do your due diligence and invest responsibly.
  - birracerveza 4y ago
    I just noticed, before you rag me on about "in the last decade", the article closes with: >In his book on the Equity Funding Corporation fraud – the Enron of the 1970s – Raymond Dirks wrote: "If routine auditing procedures cannot detect 64,000 phony insurance policies, $25m in counterfeit bonds and $100m in missing assets, what is the purpose of audits?" More than 30 years later, investors are asking themselves the same questions.

everfree 4y ago

Smart contracts only need to be audited once, traditional accounts need to be audited continuously. Amortized over enough time, that's a much lower surface area for error. Smart contracts can be audited by any member of the public with the technical know-how, so there are typically a lot of eyes on the most important cogs - similar in some ways to the OSS security model. Traditional accounts typically cannot be directly and reliably audited by members of the public.

ForHackernews 4y ago
> similar in some ways to the OSS security model The OSS security model is honestly poor. This very fundamental bug in Debian (one of the most popular Linux distros) sat unnoticed (and exploited?) for two years: https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... How many eyes are on Debian vs memecoin-smart-contract-22112?
- everfree 4y ago
  > How many eyes are on Debian vs memecoin-smart-contract-22112? To be perfectly honest, the memecoin contract probably has more. A smart contract's code base is much, much smaller and changes less often, and a greater number of people are much more strongly financially incentivized to find bugs. Plus, they often do a thorough third-party code audit up-front at the time they publish the code, which would be impractical to do with OS code since it needs to be constantly updated due to its threat model. I would trust the Shiba Inu token code to have less critical bugs in it than the Debian code.