5 ms·

How is the number being random a problem?

planetpluta 3y ago
Agreed — isn’t the problem that nothing was actually being set aside for the insurance fund, not that the amount being set aside was based on a random number?
teraflop 3y ago
When you tell your customers that a particular number corresponds to something real (e.g. the amount of money in the insurance fund that protects their assets) but you know the number was actually chosen randomly with no connection to that allegedly real thing, that's called "lying", or in the business world "fraud", and you can go to jail for it.
- playingalong 3y ago
  I could imagine they could possibly choose the amount randomly and truly deposit such amount to the fund.
  - JumpCrisscross 3y ago
    > could imagine they could possibly choose the amount randomly and truly deposit such amount to the fund This would be bad risk management. The random number makes it clear that not creating the fund wasn't an oversight, it was a willful deception.
    - londons_explore 3y ago
      It wouldn't be terrible risk management. The value chosen (after many days) is going to converge to being awfully close to the trading volume × 0.0075
      - maxbond 3y ago
        If that's the level the fund should be at than that's how they should have written it (as a constant multiple). This implementation makes it possible for the "insurance" fund to be reduced by an unbounded amount on a day of record high trading volume (indeed, the higher the trading volume, the more likely it is you'll withdraw a large sum from the fund). Creating the possibility that some rotten luck could wreck you when you're most vulnerable is bad risk management. It's thumbing your nose in the face of Murphy's Law.
  - svnt 3y ago
    Oh of course, but then it would be breach of fiduciary duty or maybe just gross negligence.
  - tomku 3y ago
    If you were doing that, don't you think it'd be handy to have a record of the amount to deposit? The random amount that's generated isn't even stored anywhere, it's just added directly to the total and written back to the database. What are you going to do, have another daily task that tops off the actual insurance fund to whatever the website says the total should be? Why would you treat a display value meant for the website as the source of truth about the correct value of an actual account? The only reason to do it this way is if there's no intent for the number to correspond to reality at all.
    - maxbond 3y ago
      To be fair I do think they do that on line 27. They have a table of deltas which they then materialize manually in a different table (which presumably only has one row?). And amusingly link them with foreign keys. ORMs make for some weird schemas, this looks like how I might do it MongoDB. But to your point; if this code is written honestly, it's pretty weird that we don't see any code to post a transaction to the blockchain, or to verify that the funds are available to be allocated to the insurance funds. You would think that would happen before you wrote the new total to the database.
      - tomku 3y ago
        You're right, misread that because of the indentation and diff formatting, good catch!
kgermino 3y ago
Strictly speaking the problem isn’t that it’s random, the problem is that it’s a lie. The fact it’s random proves that the number isn’t real. The RNG is used to give some variance to the number without accidentally making a pattern (which humans making up numbers tend to do). Literally using a RNG in code that’s meant to produce a value based on real world data is blatant and hard to defend if true.
- Ylpertnodi 3y ago
  >accidentally making a pattern (which humans making up numbers tend to do) ...and if you are stealing, repeat a few digits occasionally: lack of repetition has caught several-a-tea leaf.
- wolverine876 3y ago
  It shows intent.
arlcode 3y ago
If you claim it's a fund to mitigate risk you probably should actually put money into said fund and not just pull some number out of your code. So technically it's not the randomness that's the issue, and a constant or manually updated fake amount would be as bad, but to me as a layman but it seems like they use a random number to imply a sophisticated risk management system.
svnt 3y ago
The problem is that the reason it is random is to mislead. If it were a static number then it would be obvious it was faked. The value is designed to look like it is pulled from a fund whose balance is determined by market conditions. But viewing the code, there is no fund to get the balance from, only a call out to random(). It’s like putting pillows under your blanket so someone thinks you’re in bed. Once they find the pillows you aren’t going to get away with “oh I thought I was allowed to be out all night.”
danpalmer 3y ago
...and this is how this code gets written. When a software engineer writes code because the code makes sense or solves the problem, without interrogating the problem or how it applies to the real world, there can be real and significant consequences. We trust far too much of our lives to tech to ignore these issues when we're on the side of writing the code.
- wolverine876 3y ago
  > without interrogating the problem or how it applies to the real world, there can be real and significant consequences. We trust far too much of our lives to tech to ignore these issues Seriously, that part is a humanities problem, and many engineers have little education in or understanding of humanitities (to the point of disdaining it).
  - danpalmer 3y ago
    I think you've hit the nail on the head with the disdain. I have no real humanities education, did exclusively STEM/languages after the age of 16, but I learnt quickly at university and in my first job that STEM is nothing special, that all disciplines have something to contribute, and that ignoring them is just going to lead to ignorance on my part. If you study to do software engineering from the earliest age you can, do CS at university, don't join any clubs with others from non-STEM backgrounds, or even go to a STEM only university, then join a tech company big enough that you don't have to talk to non software engineers, you've just spent your life in a bubble. Sadly I think this is too easy to do.

Agreed — isn’t the problem that nothing was actually being set aside for the insurance fund, not that the amount being set aside was based on a random number?

teraflop 3y ago

When you tell your customers that a particular number corresponds to something real (e.g. the amount of money in the insurance fund that protects their assets) but you know the number was actually chosen randomly with no connection to that allegedly real thing, that's called "lying", or in the business world "fraud", and you can go to jail for it.

playingalong 3y ago
I could imagine they could possibly choose the amount randomly and truly deposit such amount to the fund.
- JumpCrisscross 3y ago
  > could imagine they could possibly choose the amount randomly and truly deposit such amount to the fund This would be bad risk management. The random number makes it clear that not creating the fund wasn't an oversight, it was a willful deception.
  - londons_explore 3y ago
    It wouldn't be terrible risk management. The value chosen (after many days) is going to converge to being awfully close to the trading volume × 0.0075
    - maxbond 3y ago
      If that's the level the fund should be at than that's how they should have written it (as a constant multiple). This implementation makes it possible for the "insurance" fund to be reduced by an unbounded amount on a day of record high trading volume (indeed, the higher the trading volume, the more likely it is you'll withdraw a large sum from the fund). Creating the possibility that some rotten luck could wreck you when you're most vulnerable is bad risk management. It's thumbing your nose in the face of Murphy's Law.
- svnt 3y ago
  Oh of course, but then it would be breach of fiduciary duty or maybe just gross negligence.
- tomku 3y ago
  If you were doing that, don't you think it'd be handy to have a record of the amount to deposit? The random amount that's generated isn't even stored anywhere, it's just added directly to the total and written back to the database. What are you going to do, have another daily task that tops off the actual insurance fund to whatever the website says the total should be? Why would you treat a display value meant for the website as the source of truth about the correct value of an actual account? The only reason to do it this way is if there's no intent for the number to correspond to reality at all.
  - maxbond 3y ago
    To be fair I do think they do that on line 27. They have a table of deltas which they then materialize manually in a different table (which presumably only has one row?). And amusingly link them with foreign keys. ORMs make for some weird schemas, this looks like how I might do it MongoDB. But to your point; if this code is written honestly, it's pretty weird that we don't see any code to post a transaction to the blockchain, or to verify that the funds are available to be allocated to the insurance funds. You would think that would happen before you wrote the new total to the database.
    - tomku 3y ago
      You're right, misread that because of the indentation and diff formatting, good catch!

kgermino 3y ago

Strictly speaking the problem isn’t that it’s random, the problem is that it’s a lie. The fact it’s random proves that the number isn’t real. The RNG is used to give some variance to the number without accidentally making a pattern (which humans making up numbers tend to do). Literally using a RNG in code that’s meant to produce a value based on real world data is blatant and hard to defend if true.

Ylpertnodi 3y ago
>accidentally making a pattern (which humans making up numbers tend to do) ...and if you are stealing, repeat a few digits occasionally: lack of repetition has caught several-a-tea leaf.
wolverine876 3y ago
It shows intent.

arlcode 3y ago

If you claim it's a fund to mitigate risk you probably should actually put money into said fund and not just pull some number out of your code. So technically it's not the randomness that's the issue, and a constant or manually updated fake amount would be as bad, but to me as a layman but it seems like they use a random number to imply a sophisticated risk management system.

svnt 3y ago

The problem is that the reason it is random is to mislead. If it were a static number then it would be obvious it was faked. The value is designed to look like it is pulled from a fund whose balance is determined by market conditions. But viewing the code, there is no fund to get the balance from, only a call out to random(). It’s like putting pillows under your blanket so someone thinks you’re in bed. Once they find the pillows you aren’t going to get away with “oh I thought I was allowed to be out all night.”

danpalmer 3y ago

...and this is how this code gets written. When a software engineer writes code because the code makes sense or solves the problem, without interrogating the problem or how it applies to the real world, there can be real and significant consequences. We trust far too much of our lives to tech to ignore these issues when we're on the side of writing the code.

wolverine876 3y ago
> without interrogating the problem or how it applies to the real world, there can be real and significant consequences. We trust far too much of our lives to tech to ignore these issues Seriously, that part is a humanities problem, and many engineers have little education in or understanding of humanitities (to the point of disdaining it).
- danpalmer 3y ago
  I think you've hit the nail on the head with the disdain. I have no real humanities education, did exclusively STEM/languages after the age of 16, but I learnt quickly at university and in my first job that STEM is nothing special, that all disciplines have something to contribute, and that ignoring them is just going to lead to ignorance on my part. If you study to do software engineering from the earliest age you can, do CS at university, don't join any clubs with others from non-STEM backgrounds, or even go to a STEM only university, then join a tech company big enough that you don't have to talk to non software engineers, you've just spent your life in a bubble. Sadly I think this is too easy to do.