9 ms·

PeopleDAO “exploited” by Google Docs edit

122 points by rideontime 4y ago

sokoloff 4y ago
Is clicking on a link really “hacking”? > The accounting lead mistakenly shared a link with edit access in a public channel in discord. The hacker gained edit role via the link.
- rwalle 4y ago
  One way or another, the bad guys are getting their money. Talk to anyone and they'll tell you this is hacking. Many incidents that are more technical and involves exploiting vulnerability also begin with social engineering.
- johndough 4y ago
  > After gaining the access, the hacker inserted a 76 ETH payment to himself in the sheet, and set it invisible It might not be a real hack in the traditional sense, but hiding critical information so a human makes an incorrect choice is good enough to be considered social engineering for me.
  - fuckingmorons 4y ago
    [dead]
- NoZebra120vClip 4y ago
  Imagine the number of people who have ownership of business-critical documents in the cloud. Now imagine a venn diagram with the number of people who don't realize that granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity.
  - TheDong 4y ago
    > granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity. That's like saying passwords are "security through obscurity" because they're also "obscure" random strings, just like URLs. To try and make my point more clear: Basic auth password url: https://username:randomSecurePassword@webpage.com https://username:randomSecurePassword@webpage.com Google docs edit url: https://docs.google.com/randomLongString/edit https://docs.google.com/randomLongString/edit How are those two things different, other than one is a password which might be short and insecure, and the other has plenty of entropy? Will you also argue that all shared secrets are security by obscurity?
    - BobbyJo 4y ago
      > How are those two things different How they're used? I mean, we can argue that pizzas are wheels because they're circles, but, until you throw one on a car and get where you're going, no one will take it seriously. URLs get shared, passed around, posted in chats, etc. Passwords don't, or at least everyone knows they're doing something wrong if they do. In the case of the this doc, if it was privately shared, I don't think anyone would have mistakenly posted their Google password the same way.
      - shkkmo 4y ago
        Then it sounds like both passwords and gdoc authorization links depend on security through obscurity, but people are less aware of that fact for the links. There is a point here that the difference between access level grants is not clear enough and the urls should have a clearer demarcation of the level granted, (e.g. sheets.google.com/danger-allows-editing/{secureToken} or sheets.google.com/allows-viewing/{secureToken}.)
        BobbyJo 4y ago
        If you're going to classify passwords as security through obscurity, then how would you accomplish security through any other means? All forms of digital security require information asymmetry (IE someone holding information not known to others). The only other security I can think of is physical, and most of that is designed around information asymmetry as well (key cards, door codes). STO to me generally indicates there is some backward engineering process, or some vital related knowledge, that can break it, which is specifically not the case here. Secrets are specifically designed to have common forms and functions, you only keep the value itself, or values they were derived from, secret. Obscurity and secrecy have slightly different meanings.
  - ceejayoz 4y ago
    If the super long string on a Google doc is “security through obscurity”, so are passwords, 2FA codes, and ssh keys.
    - Nextgrid 4y ago
      One persists in your browser history and is easy to copy/paste into the wrong place, the other is not (good luck copying a password field without technical workarounds such as changing the field type in the developer tools).
    - NoZebra120vClip 4y ago
      A Google Doc ID (or Drive/Sheets/Slides) is a single identifier which denotes a resource in the cloud. It is a name; it is not intended as a secret. "Anyone with the Link" really means anyone. In fact, I would say that "Anyone with the Link" access modes are a hack and a workaround for people who do not have Google accounts. If you rely on privacy, use Google accounts. So if you created a secret, clandestine, world-readable, anyone-comments, blog post with the slug "http://example.com/correct-horse-battery-staple/ http://example.com/correct-horse-battery-staple/" would you really complain when someone brute-force or outright guessed your blog post? YouTube has "unlisted" videos which are unsearchable and unreachable unless you've been shared a link, but do people freak out when someone stumbles across this shared by others? Just because a Google Workspaces ID is a long, jumbled-up, base-64 string doesn't mean it is a password or a cryptographically secure secret. It's quite different. It's meant to be well-known by anyone who is intended to have access. The "Anyone with the Link" access simply relies on a circle of friends/colleagues keeping the URL to themselves.
- gus_massa 4y ago
  I'm not sure if something like this also happened here, but I have sometimes a document shared with a few coworkers. While discussing it by email, I have to send them (again) the link because otherwise they can't find it. Each time, gmail says that "John" will not be able to see the document and offers to make it readable/editable for anyone with a link. It appears in a modal window that blocks sending the message. I must read carefully the modal window to click the correct button. "John" can see the doc because he has a google account, but I'm sending the message to his yahoo email because it's his preferred email. Anyway, I only have a draft of a math midterm for next week. If a hundred of thousands of dollars were in the line, I'd be very nervous.
weego 4y ago
I know this is a low value way of saying this, so, apologies up front but: Fucking lol at their bookkeeping and payout system just being a spreadsheet with no other comparison of truth before submission. We're on course for DAOs to rediscover the basic principles of our existing financial system within the decade.
- mstipetic 4y ago
  And if you take the process to its conclusion people will say we’re tired of doing all this accounting all the time, let’s hire a specialized person to do that - and you’ll end up with a company accountant. After that they’ll say he we should standardize the accounting process over different organizations and end up where we are now
  - andruby 4y ago
    And then add an organization to double check the accounting numbers to validate if they are correct.
- Waterluvian 4y ago
  This feels like the financial version of, “front end feels too complicated. Let’s make it simple.” And then they re-discover all the hard fought lessons one by one until their framework is complicated too.
  - mtlmtlmtlmtl 4y ago
    Exactly. Or young people coming out of college having this adorably naïve, idealistic world view where everything fits nearly into their world view. Then they live some, experience things that don't fit so neatly, and begin to acknowledge the complexity of the world, becoming more pragmatist politically. At least that was my experience of 20->30. I can't even think of a long sentence that encapsulates my world view anymore, let alone a single word like "conservative", "anarchist" or whatever. When I was 20 I could have easily done so.
    - 4y ago
draw_down 4y ago
[dead]
jhoechtl 4y ago
Reading 1/10 on twitter is usability wise a nightmare.
- AlexandrB 4y ago
  I thought you could post much longer tweets now? Or did that get rolled back?
  - bdcravens 4y ago
    You have to be a Twitter Blue subscriber.
jalapenos 4y ago
Inability to spell is still an amazing tell.
rwalle 4y ago
I don't really feel sorry for them, their access control and accounting are a completely mess. It only takes one mistake to lose tons of money, like in this case.
kwhitefoot 4y ago
What's a DAO?
- orbz 4y ago
  https://en.wikipedia.org/wiki/Decentralized_autonomous_organization https://en.wikipedia.org/wiki/Decentralized_autonomous_organ...
- deleted 4y ago
  [deleted]
- bannedbybros 4y ago
  [dead]
- matt_langston 4y ago
  The PeopleDAO is not a DAO, even though they claim themselves to be a DAO, because a DAO can't own title to property, and therefore can't own Ethereum that can be robbed. The PeopleDAO is a well-meaning club, not a DAO, that has a confusing and misleading name that owns title to property that is centralized, and therefore that property can be seized, and that property was seized. An example of an actual DAO was last year's Genesis fractal experimental apparatus (links below). The PeopleDAO used an old-school spreadsheet accounting system (i.e. a Google spreadsheet), and there is nothing wrong with that. The Genesis fractal also used an old-school spreadsheet accounting system. The same type of "theft" could have also happened to the Genesis fractal, i.e. stealing a password and editing an accounting spreadsheet. However, there was no Genesis property to steal. The Genesis fractal only had pure information stored in their spreadsheets and not title to property. The "theft error" would have been discovered eventually, just like the PeopleDAO discovered their "theft", but the Genesis fractal would simply need to re-edit their spreadsheet and not pursue the thief for the return of any property. This is a fundamental principle and feature of a DAO. The PeopleDAO's fatal flaw was not understanding the principles of a DAO, meaning they did not understand the concept of decentralization and title to property. The "PeopleDAO theft" is a wonderful case study for the benefits of a DAO and for the need for educational fractals like Genesis. Dan Larimer invented the concept of Decentralized Autonomous Organization and the word DAO, but it is poorly understood which is why we see heartbreaking theft stories like "the PeopleDAO theft" and the catastrophe surrounding Ethereum's "The DAO" (which was also not a DAO and suffered a similar fate as PeopleDAO). Ethereum's "The DAO" was a smart contract deployed to a "real" blockchain (i.e. it did not use a Google spreadsheet for accounting) but it still fell victim to an entirely predictable fate just like PeopleDAO - it held title to property. The acid test of whether something is a DAO is determining whether the organization holds title to property. If the organization holds title to property, then it is not a DAO. There are many ways for an organization to use real property involving title (e.g. domain names, physical equipment like servers, land and equipment and anything other tangible, etc.) If you know someone in the PeopleDAO, it would be well worth their while to read the following blog posts from Team fractally and to reach out to anyone on the Genesis fractal's leader board: "What is a DAO?", February 20, 2022 https://fractally.com/blog/what-is-a-dao https://fractally.com/blog/what-is-a-dao "What is the Legal Standing of a DAO?", June 28, 2022 https://fractally.com/blog/what-is-the-legal-standing-of-a-dao https://fractally.com/blog/what-is-the-legal-standing-of-a-d... "Genesis Fractal Dashboard" https://share.streamlit.io/matt-langston/fractal_governance/main/fractal_governance/streamlit/genesis_fractal.py https://share.streamlit.io/matt-langston/fractal_governance/...
karulont 4y ago
So people want to be progressive and use cryptocurrency that is not tied to a government. But when things go wrong they run to the FBI and FTC both run by the government.
- im3w1l 4y ago
  If you use google sheets and discord to run your org then it's pretty clear you are not in it for the decentralization. Is it money? Or is it the cool mystique of these emerging technologies? I don't know.
  - UncleMeat 4y ago
    It’s for the people! It says so right in the name!
- JasonFruit 4y ago
  People want their eggs and milk privately, but when the shopkeeper steals their money and runs away, they want the police and the courts. That's not really inconsistent.
  - pornel 4y ago
    But these are "don't tax my eggs and milk!" people, and "my shop is police-proof and sale receipts are the law" shopkeepers.
- plagiarist 4y ago
  Taking your statement independently of this particular situation: if they're paying taxes on their crypto gains, I don't see a conflict in wanting that? There are plenty of people doing forex who would (IMO correctly) expect the government to do something if their foreign currency is stolen by fraud or deception.
UncleMeat 4y ago
Hilarious. DAO stands for "decentralized autonomous organization." This thing appears to collect transactions via a centralized google form and then complete those transactions if 5 of 9 people vote to perform them. Neither decentralized nor autonomous. You go through all this effort to establish something fancy using whatever hot defi thing exists but situate it on top of a google form and a spreadsheet just owned by some guy. Also, I can't believe that the form uses scientific notation for amounts. How unbelievably error prone to miss that one row has a "+" instead of a "-". The lessons learned should be "holy fuck don't run everything on a google sheet" not "be more careful with how you share links and make sure the signers are uber careful to review 80 rows of boring transactions for single-character swaps." Unreal: https://twitter.com/The_PeopleDAO/status/1634524761744367616?s=20 https://twitter.com/The_PeopleDAO/status/1634524761744367616... "Most DAOs do use spread sheet for collecting information and accounting. What tools do you suggest to use instead?"
- michaelbuckbee 4y ago
  I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number. I did not realize that was actually how this operated.
  - Karunamon 4y ago
    Let people buy multiple cells and arbitrarily set the formatting and you basically have reinvented the million dollar homepage. https://en.wikipedia.org/wiki/The_Million_Dollar_Homepage https://en.wikipedia.org/wiki/The_Million_Dollar_Homepage Actually that would be a pretty neat NFT project. With each pixel having its RGB value and a link stored on chain, the entire image could be reconstructed without having to be hosted anywhere in specific.
    - ryanschneider 4y ago
      You’re a couple years late on that idea: https://steemit.com/advertising/@shazow/the-million-dollar-homepage-as-an-ethereum-dapp-the-thousand-ether-homepage https://steemit.com/advertising/@shazow/the-million-dollar-h...
tarotuser 4y ago
I don't see an exploit. I see a negotiation and a successful agreement of 6 of 9 parties. The analog to this in the real world is 2 pages stuck together, and the signer(s) didn't do their due diligence. After all, wasn't the saying with shitcoin was that "The code is the contract, and the contract is the code"? You make your bed, and lie in it.
paradite 4y ago
Yes it's ironic. I have seen DAOs collecting information or doing event sign ups with Google Docs. It's as if they didn't know what DAO stands for. I stay away from people who don't practice what they preach.
bryancoxwell 4y ago
Love that one of the conclusions is “we need a better UI”. Because of course it was their technology that failed them, not their people.
- lightbendover 4y ago
  "Why did this happen?" "Our UI was bad." "Why?" "No, that's the root cause."
say_it_as_it_is 4y ago
The minimum viable product burned to ash
wood_spirit 4y ago
I don’t browse much Twitter so maybe I’m just sheltered, but this is the first time I’ve scrolled down and seen extremely explicit pics (presumably spam to make people click). Is this normal or have twitters filters started to fail?
- phaker 4y ago
  There was a very noticeable uptick in spam (and also false positives like news Russia wouldn't like suddenly being marked as nsfw) starting after Elon laid off everyone he could. So i guess the human half of moderation disappeared.
- gk1 4y ago
  The first “recommended tweet” under the thread was some porn that I don’t even think is legal (hint: there was a dog involved). Posted 11 hours ago. I wonder what’s left of the content moderation team at Twitter.
  - flangola7 4y ago
    This is what I miss out on for running uBlock origin
Pxtl 4y ago
I've said it before, I'll say it again: Crypto currency is about tearing down the old rules and institutions of banking and finding out one failure at a time why each rule and institution exists.
- AlexandrB 4y ago
  A lot of people with libertarian tendencies involved in crypto think that post secondary education is a waste of resources. So perhaps crypto is like a finishing school in economics for these types. Seems more expensive than traditional universities though.
ivoras 4y ago
This is a beautiful example of the biggest current problem with DAOs and all (and I do mean ALL) crypto projects which aim to interface with the real world (i.e. all projects not doing with purely abstract stuff like DeFi-like tokens, and closed systems like "metaverses"): THEY CAN'T. They really cannot interface with the Real World, without leaking real-world problems into the "perfect" smart contract-driven crypto systems. They can't interface with the real-world financial systems (with stablecoins) and expect it to be always stable (see USDC), they can't interface with people doing real-world chores/tasks and have it reflected in blockchain brownie points aka tokens (like socially-useful DAOs like the one in the article), they can't interface with logistics where people and machines do actual work and fail unpredictable (like blockchain tracking of the supply chain), they can't authenticate artwork purely on blockchain (without paying actual people to guard the artwork), etc. They just can't. All projects claiming they can are pure scams (of course, I'd be very happy to be proven wrong). The nearest we can get to having perfect digital systems like cyptoanarhysts and cryptobros (sometimes there isn't any difference) advocate is to give up on the physical world and actually move everything into the metaverse where it doesn't depend on real world messyness, but then a) people will still find ways to mess things up and b) this Matrix-like system still needs electricity. Just... embrace the messiness. You can't really escape it. Crypto is not special. Blockchains are useful tools, but so far, systems based on them they have not been proven to be strictily better than real-world messyness. The best use cases for blockchains are those which don't really earn a lot of money for the operators, such as tracking publically visible official data - like university degrees, corporate tax returns and financial statements, fighting fake news, etc. - so they are avoided like the plague.
- turtleyacht 4y ago
  Hey, wait a minute.. those sound like really useful use cases for public transparency. So we just need folks to tag and shuttle these things into a blockchain, and present some kind of API to allow (data) mining it?
  - ivoras 4y ago
    Yes, it's interesting. This has been known and ocassionally touted for AGES. I've attempted to start a couple of such projects and have been following the progress of other projects with similar ideas. There has been near ZERO interest for them, because there's no currently viable business case for such projects, except "let the government pay for it." Data mining isn't THAT useful if there's no data in there - who would force entities like companies, universities or the SEC to push the data into the blockchain? I'd be very happy if could find funding for https://github.com/WOTvision/wot1 https://github.com/WOTvision/wot1 and I can see a business case for it as a potential platform for legal, paid distribution of news between creators/reporters and distributors like news portals. But even so, no takers.
cloudking 4y ago
So they used Google sheets instead of a smart contract to manage payments? Ok..
gabereiser 4y ago
Lesion number one, don’t run accounting for crypto on a Google doc.
whoknew1122 4y ago
Apparently a 'hacker' used 'social engineering' to pull this off. All they did was know how to spreadsheet. So I guess I should just add 'knows speadsheets' to my resume instead of studying and sitting for yet another overpriced exam. Today I learned.
ricktdotorg 4y ago
just to be clear, the default permissions on Google Forms do not allow anyone to edit the form just by adding /edit to the URL. the owner of the form has to either (1) specifically add individuals via email address, or (2) change "general access" from 'Restricted' to 'Anyone with the link'. that is the only reason the "hacker" was able to edit the form. TL;dr the owner of the form changed the permissions to be literally wide open. you reap what you sow.

122 points by rideontime 4y ago

Is clicking on a link really “hacking”? > The accounting lead mistakenly shared a link with edit access in a public channel in discord. The hacker gained edit role via the link.

rwalle 4y ago
One way or another, the bad guys are getting their money. Talk to anyone and they'll tell you this is hacking. Many incidents that are more technical and involves exploiting vulnerability also begin with social engineering.
johndough 4y ago
> After gaining the access, the hacker inserted a 76 ETH payment to himself in the sheet, and set it invisible It might not be a real hack in the traditional sense, but hiding critical information so a human makes an incorrect choice is good enough to be considered social engineering for me.
- fuckingmorons 4y ago
  [dead]
NoZebra120vClip 4y ago
Imagine the number of people who have ownership of business-critical documents in the cloud. Now imagine a venn diagram with the number of people who don't realize that granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity.
- TheDong 4y ago
  > granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity. That's like saying passwords are "security through obscurity" because they're also "obscure" random strings, just like URLs. To try and make my point more clear: Basic auth password url: https://username:randomSecurePassword@webpage.com https://username:randomSecurePassword@webpage.com Google docs edit url: https://docs.google.com/randomLongString/edit https://docs.google.com/randomLongString/edit How are those two things different, other than one is a password which might be short and insecure, and the other has plenty of entropy? Will you also argue that all shared secrets are security by obscurity?
  - BobbyJo 4y ago
    > How are those two things different How they're used? I mean, we can argue that pizzas are wheels because they're circles, but, until you throw one on a car and get where you're going, no one will take it seriously. URLs get shared, passed around, posted in chats, etc. Passwords don't, or at least everyone knows they're doing something wrong if they do. In the case of the this doc, if it was privately shared, I don't think anyone would have mistakenly posted their Google password the same way.
    - shkkmo 4y ago
      Then it sounds like both passwords and gdoc authorization links depend on security through obscurity, but people are less aware of that fact for the links. There is a point here that the difference between access level grants is not clear enough and the urls should have a clearer demarcation of the level granted, (e.g. sheets.google.com/danger-allows-editing/{secureToken} or sheets.google.com/allows-viewing/{secureToken}.)
      - BobbyJo 4y ago
        If you're going to classify passwords as security through obscurity, then how would you accomplish security through any other means? All forms of digital security require information asymmetry (IE someone holding information not known to others). The only other security I can think of is physical, and most of that is designed around information asymmetry as well (key cards, door codes). STO to me generally indicates there is some backward engineering process, or some vital related knowledge, that can break it, which is specifically not the case here. Secrets are specifically designed to have common forms and functions, you only keep the value itself, or values they were derived from, secret. Obscurity and secrecy have slightly different meanings.
- ceejayoz 4y ago
  If the super long string on a Google doc is “security through obscurity”, so are passwords, 2FA codes, and ssh keys.
  - Nextgrid 4y ago
    One persists in your browser history and is easy to copy/paste into the wrong place, the other is not (good luck copying a password field without technical workarounds such as changing the field type in the developer tools).
  - NoZebra120vClip 4y ago
    A Google Doc ID (or Drive/Sheets/Slides) is a single identifier which denotes a resource in the cloud. It is a name; it is not intended as a secret. "Anyone with the Link" really means anyone. In fact, I would say that "Anyone with the Link" access modes are a hack and a workaround for people who do not have Google accounts. If you rely on privacy, use Google accounts. So if you created a secret, clandestine, world-readable, anyone-comments, blog post with the slug "http://example.com/correct-horse-battery-staple/ http://example.com/correct-horse-battery-staple/" would you really complain when someone brute-force or outright guessed your blog post? YouTube has "unlisted" videos which are unsearchable and unreachable unless you've been shared a link, but do people freak out when someone stumbles across this shared by others? Just because a Google Workspaces ID is a long, jumbled-up, base-64 string doesn't mean it is a password or a cryptographically secure secret. It's quite different. It's meant to be well-known by anyone who is intended to have access. The "Anyone with the Link" access simply relies on a circle of friends/colleagues keeping the URL to themselves.
gus_massa 4y ago
I'm not sure if something like this also happened here, but I have sometimes a document shared with a few coworkers. While discussing it by email, I have to send them (again) the link because otherwise they can't find it. Each time, gmail says that "John" will not be able to see the document and offers to make it readable/editable for anyone with a link. It appears in a modal window that blocks sending the message. I must read carefully the modal window to click the correct button. "John" can see the doc because he has a google account, but I'm sending the message to his yahoo email because it's his preferred email. Anyway, I only have a draft of a math midterm for next week. If a hundred of thousands of dollars were in the line, I'd be very nervous.

weego 4y ago

I know this is a low value way of saying this, so, apologies up front but: Fucking lol at their bookkeeping and payout system just being a spreadsheet with no other comparison of truth before submission. We're on course for DAOs to rediscover the basic principles of our existing financial system within the decade.

mstipetic 4y ago
And if you take the process to its conclusion people will say we’re tired of doing all this accounting all the time, let’s hire a specialized person to do that - and you’ll end up with a company accountant. After that they’ll say he we should standardize the accounting process over different organizations and end up where we are now
- andruby 4y ago
  And then add an organization to double check the accounting numbers to validate if they are correct.
Waterluvian 4y ago
This feels like the financial version of, “front end feels too complicated. Let’s make it simple.” And then they re-discover all the hard fought lessons one by one until their framework is complicated too.
- mtlmtlmtlmtl 4y ago
  Exactly. Or young people coming out of college having this adorably naïve, idealistic world view where everything fits nearly into their world view. Then they live some, experience things that don't fit so neatly, and begin to acknowledge the complexity of the world, becoming more pragmatist politically. At least that was my experience of 20->30. I can't even think of a long sentence that encapsulates my world view anymore, let alone a single word like "conservative", "anarchist" or whatever. When I was 20 I could have easily done so.
  - 4y ago

draw_down 4y ago

[dead]

jhoechtl 4y ago

Reading 1/10 on twitter is usability wise a nightmare.

AlexandrB 4y ago
I thought you could post much longer tweets now? Or did that get rolled back?
- bdcravens 4y ago
  You have to be a Twitter Blue subscriber.

jalapenos 4y ago

Inability to spell is still an amazing tell.

rwalle 4y ago

I don't really feel sorry for them, their access control and accounting are a completely mess. It only takes one mistake to lose tons of money, like in this case.

kwhitefoot 4y ago

What's a DAO?

orbz 4y ago
https://en.wikipedia.org/wiki/Decentralized_autonomous_organization https://en.wikipedia.org/wiki/Decentralized_autonomous_organ...
deleted 4y ago
[deleted]
bannedbybros 4y ago
[dead]
matt_langston 4y ago
The PeopleDAO is not a DAO, even though they claim themselves to be a DAO, because a DAO can't own title to property, and therefore can't own Ethereum that can be robbed. The PeopleDAO is a well-meaning club, not a DAO, that has a confusing and misleading name that owns title to property that is centralized, and therefore that property can be seized, and that property was seized. An example of an actual DAO was last year's Genesis fractal experimental apparatus (links below). The PeopleDAO used an old-school spreadsheet accounting system (i.e. a Google spreadsheet), and there is nothing wrong with that. The Genesis fractal also used an old-school spreadsheet accounting system. The same type of "theft" could have also happened to the Genesis fractal, i.e. stealing a password and editing an accounting spreadsheet. However, there was no Genesis property to steal. The Genesis fractal only had pure information stored in their spreadsheets and not title to property. The "theft error" would have been discovered eventually, just like the PeopleDAO discovered their "theft", but the Genesis fractal would simply need to re-edit their spreadsheet and not pursue the thief for the return of any property. This is a fundamental principle and feature of a DAO. The PeopleDAO's fatal flaw was not understanding the principles of a DAO, meaning they did not understand the concept of decentralization and title to property. The "PeopleDAO theft" is a wonderful case study for the benefits of a DAO and for the need for educational fractals like Genesis. Dan Larimer invented the concept of Decentralized Autonomous Organization and the word DAO, but it is poorly understood which is why we see heartbreaking theft stories like "the PeopleDAO theft" and the catastrophe surrounding Ethereum's "The DAO" (which was also not a DAO and suffered a similar fate as PeopleDAO). Ethereum's "The DAO" was a smart contract deployed to a "real" blockchain (i.e. it did not use a Google spreadsheet for accounting) but it still fell victim to an entirely predictable fate just like PeopleDAO - it held title to property. The acid test of whether something is a DAO is determining whether the organization holds title to property. If the organization holds title to property, then it is not a DAO. There are many ways for an organization to use real property involving title (e.g. domain names, physical equipment like servers, land and equipment and anything other tangible, etc.) If you know someone in the PeopleDAO, it would be well worth their while to read the following blog posts from Team fractally and to reach out to anyone on the Genesis fractal's leader board: "What is a DAO?", February 20, 2022 https://fractally.com/blog/what-is-a-dao https://fractally.com/blog/what-is-a-dao "What is the Legal Standing of a DAO?", June 28, 2022 https://fractally.com/blog/what-is-the-legal-standing-of-a-dao https://fractally.com/blog/what-is-the-legal-standing-of-a-d... "Genesis Fractal Dashboard" https://share.streamlit.io/matt-langston/fractal_governance/main/fractal_governance/streamlit/genesis_fractal.py https://share.streamlit.io/matt-langston/fractal_governance/...

karulont 4y ago

So people want to be progressive and use cryptocurrency that is not tied to a government. But when things go wrong they run to the FBI and FTC both run by the government.

im3w1l 4y ago
If you use google sheets and discord to run your org then it's pretty clear you are not in it for the decentralization. Is it money? Or is it the cool mystique of these emerging technologies? I don't know.
- UncleMeat 4y ago
  It’s for the people! It says so right in the name!
JasonFruit 4y ago
People want their eggs and milk privately, but when the shopkeeper steals their money and runs away, they want the police and the courts. That's not really inconsistent.
- pornel 4y ago
  But these are "don't tax my eggs and milk!" people, and "my shop is police-proof and sale receipts are the law" shopkeepers.
plagiarist 4y ago
Taking your statement independently of this particular situation: if they're paying taxes on their crypto gains, I don't see a conflict in wanting that? There are plenty of people doing forex who would (IMO correctly) expect the government to do something if their foreign currency is stolen by fraud or deception.

UncleMeat 4y ago

Hilarious. DAO stands for "decentralized autonomous organization." This thing appears to collect transactions via a centralized google form and then complete those transactions if 5 of 9 people vote to perform them. Neither decentralized nor autonomous. You go through all this effort to establish something fancy using whatever hot defi thing exists but situate it on top of a google form and a spreadsheet just owned by some guy. Also, I can't believe that the form uses scientific notation for amounts. How unbelievably error prone to miss that one row has a "+" instead of a "-". The lessons learned should be "holy fuck don't run everything on a google sheet" not "be more careful with how you share links and make sure the signers are uber careful to review 80 rows of boring transactions for single-character swaps." Unreal: https://twitter.com/The_PeopleDAO/status/1634524761744367616?s=20 https://twitter.com/The_PeopleDAO/status/1634524761744367616... "Most DAOs do use spread sheet for collecting information and accounting. What tools do you suggest to use instead?"

michaelbuckbee 4y ago
I used to joke about how I was going to make my own shitcoin that was literally just that you could paypal me $10 and I'd add your name to a publicly viewable Google Sheet with your "coin" being that you'd own the row number. I did not realize that was actually how this operated.
- Karunamon 4y ago
  Let people buy multiple cells and arbitrarily set the formatting and you basically have reinvented the million dollar homepage. https://en.wikipedia.org/wiki/The_Million_Dollar_Homepage https://en.wikipedia.org/wiki/The_Million_Dollar_Homepage Actually that would be a pretty neat NFT project. With each pixel having its RGB value and a link stored on chain, the entire image could be reconstructed without having to be hosted anywhere in specific.
  - ryanschneider 4y ago
    You’re a couple years late on that idea: https://steemit.com/advertising/@shazow/the-million-dollar-homepage-as-an-ethereum-dapp-the-thousand-ether-homepage https://steemit.com/advertising/@shazow/the-million-dollar-h...

tarotuser 4y ago

I don't see an exploit. I see a negotiation and a successful agreement of 6 of 9 parties. The analog to this in the real world is 2 pages stuck together, and the signer(s) didn't do their due diligence. After all, wasn't the saying with shitcoin was that "The code is the contract, and the contract is the code"? You make your bed, and lie in it.

paradite 4y ago

Yes it's ironic. I have seen DAOs collecting information or doing event sign ups with Google Docs. It's as if they didn't know what DAO stands for. I stay away from people who don't practice what they preach.

bryancoxwell 4y ago

Love that one of the conclusions is “we need a better UI”. Because of course it was their technology that failed them, not their people.

lightbendover 4y ago
"Why did this happen?" "Our UI was bad." "Why?" "No, that's the root cause."

say_it_as_it_is 4y ago

The minimum viable product burned to ash

wood_spirit 4y ago

I don’t browse much Twitter so maybe I’m just sheltered, but this is the first time I’ve scrolled down and seen extremely explicit pics (presumably spam to make people click). Is this normal or have twitters filters started to fail?

phaker 4y ago
There was a very noticeable uptick in spam (and also false positives like news Russia wouldn't like suddenly being marked as nsfw) starting after Elon laid off everyone he could. So i guess the human half of moderation disappeared.
gk1 4y ago
The first “recommended tweet” under the thread was some porn that I don’t even think is legal (hint: there was a dog involved). Posted 11 hours ago. I wonder what’s left of the content moderation team at Twitter.
- flangola7 4y ago
  This is what I miss out on for running uBlock origin

Pxtl 4y ago

I've said it before, I'll say it again: Crypto currency is about tearing down the old rules and institutions of banking and finding out one failure at a time why each rule and institution exists.

AlexandrB 4y ago
A lot of people with libertarian tendencies involved in crypto think that post secondary education is a waste of resources. So perhaps crypto is like a finishing school in economics for these types. Seems more expensive than traditional universities though.

ivoras 4y ago

This is a beautiful example of the biggest current problem with DAOs and all (and I do mean ALL) crypto projects which aim to interface with the real world (i.e. all projects not doing with purely abstract stuff like DeFi-like tokens, and closed systems like "metaverses"): THEY CAN'T. They really cannot interface with the Real World, without leaking real-world problems into the "perfect" smart contract-driven crypto systems. They can't interface with the real-world financial systems (with stablecoins) and expect it to be always stable (see USDC), they can't interface with people doing real-world chores/tasks and have it reflected in blockchain brownie points aka tokens (like socially-useful DAOs like the one in the article), they can't interface with logistics where people and machines do actual work and fail unpredictable (like blockchain tracking of the supply chain), they can't authenticate artwork purely on blockchain (without paying actual people to guard the artwork), etc. They just can't. All projects claiming they can are pure scams (of course, I'd be very happy to be proven wrong). The nearest we can get to having perfect digital systems like cyptoanarhysts and cryptobros (sometimes there isn't any difference) advocate is to give up on the physical world and actually move everything into the metaverse where it doesn't depend on real world messyness, but then a) people will still find ways to mess things up and b) this Matrix-like system still needs electricity. Just... embrace the messiness. You can't really escape it. Crypto is not special. Blockchains are useful tools, but so far, systems based on them they have not been proven to be strictily better than real-world messyness. The best use cases for blockchains are those which don't really earn a lot of money for the operators, such as tracking publically visible official data - like university degrees, corporate tax returns and financial statements, fighting fake news, etc. - so they are avoided like the plague.

turtleyacht 4y ago
Hey, wait a minute.. those sound like really useful use cases for public transparency. So we just need folks to tag and shuttle these things into a blockchain, and present some kind of API to allow (data) mining it?
- ivoras 4y ago
  Yes, it's interesting. This has been known and ocassionally touted for AGES. I've attempted to start a couple of such projects and have been following the progress of other projects with similar ideas. There has been near ZERO interest for them, because there's no currently viable business case for such projects, except "let the government pay for it." Data mining isn't THAT useful if there's no data in there - who would force entities like companies, universities or the SEC to push the data into the blockchain? I'd be very happy if could find funding for https://github.com/WOTvision/wot1 https://github.com/WOTvision/wot1 and I can see a business case for it as a potential platform for legal, paid distribution of news between creators/reporters and distributors like news portals. But even so, no takers.

cloudking 4y ago

So they used Google sheets instead of a smart contract to manage payments? Ok..

gabereiser 4y ago

Lesion number one, don’t run accounting for crypto on a Google doc.

whoknew1122 4y ago

Apparently a 'hacker' used 'social engineering' to pull this off. All they did was know how to spreadsheet. So I guess I should just add 'knows speadsheets' to my resume instead of studying and sitting for yet another overpriced exam. Today I learned.

ricktdotorg 4y ago

just to be clear, the default permissions on Google Forms do not allow anyone to edit the form just by adding /edit to the URL. the owner of the form has to either (1) specifically add individuals via email address, or (2) change "general access" from 'Restricted' to 'Anyone with the link'. that is the only reason the "hacker" was able to edit the form. TL;dr the owner of the form changed the permissions to be literally wide open. you reap what you sow.