6 ms·

There doesn’t appear to be any details on the site besides the recipient: certik Anybody familiar with that name is probably chuckling right now.

by koolba 2y ago

mtmail 2y ago
I'm not familiar. What am I missing?
- koolba 2y ago
  They perform audits of crypto projects. The idea is that you’re certifying that the code is not going to immediately steal people’s money. Quite a few of their clients have gone on to do that with relatively simple vulnerabilities. To the point where “certik audit” is a meme about not providing any actual assurances (and thus implying they are incompetent). There also was the story a month or two ago where they actually took funds from a bug bounty target and eventually did give it back: https://blockworks.co/news/krakens-cso-confirms-certik-returned-funds-with-a-small-amount-lost-to-fees https://blockworks.co/news/krakens-cso-confirms-certik-retur...
  - gnfargbl 2y ago
    That's just the classic attack/defence asymmetry though, no? When playing defence you have to find every reachable vulnerability. When playing attack, you have to find one.
    - londons_explore 2y ago
      It highlights the fact that even experts can't find every bug in code, and therefore you probably shouldn't be using code as the only security for a monetary system.
  - user90131313 2y ago
    They are %100 corrupted people and stealers.That story a month ago is mind blowing. Black hat type
  - oersted 2y ago
    I know this is rather obvious and has been repeated to death but: There's just absolutely no point to crypto if you end up having to trust institutions that are fundamentally less trustworthy than mainstream financial institutions and regulators, even if they have plenty of issues too.
    - npoc 2y ago
      Absolutely correct regarding cRypTo. But there's also bitcoin, which people wrongly group with it. They are two completely different things, once you dig a bit deeper. One is going to improve the world immeasurably - in fact one of mankind's most important (maybe greatest) inventions, and the other is a snake pit. If what I say sounds crazy, it won't after you've studied the topic for 5000 hours.
    - netsharc 2y ago
      It's so funny when crypto banks get robbed and they turn to the FBI to ask them to get the robbers...
      - kybernetikos 2y ago
        I see no problem with this. Crime doesn't stop being crime just because its happening to virtual assets. Maybe some crypto folks want to disconnect from the rest of society, but I don't think that's very many of them.
        FireBeyond 2y ago
        Many folks said the Silk Road had made drug dealing "harmless". What they really meant was "harmless to me". Because it does nothing for anyone else in the chain to make it safer. There's also a non-zero sum of crypto proponents that think a large swathe of things that are illegal "IRL", should be non-criminal because ... "online".
        jenadine 2y ago
        There are people who think some things that are illegal shouldn't be illegal. (Online or IRL doesn't matter)
- montenegrohugo 2y ago
  Certik has a terrible rep in the crypto ecosystem They're ostensibly an audit/security firm, but miss many vulns Most egregiously recently they tried to blackmail Kraken, a big exchange, for $2m
  - frankjr 2y ago
    Well, "certik" does translate to "little devil"...
    - user90131313 2y ago
      oh so the founders already had the idea. so no surprise at all
    - oersted 2y ago
      Yes I believe the direct translation is simply "imp".
- qqqult 2y ago
  Crypto security audit company that used to be decent & somewhat respected then scaled out and hired many more security auditors with questionable skills and morals (such as exploiting bugs in projects they're paid to review & help). The running joke is that protocols with no security audits are safer than protocols with security audits done by CertiK.
1023bytes 2y ago
Conspiracy theory - they bought it from someone else for PR
forty 2y ago
What should we understand? It looks like the H1 account is the actual company, at least they link to their website. Is the company doing bug bounty? Or is this a creative way to pay for an audit?
danielvf 2y ago
For those looking for context: https://news.ycombinator.com/item?id=41128441 https://news.ycombinator.com/item?id=41128441

There doesn’t appear to be any details on the site besides the recipient: certik Anybody familiar with that name is probably chuckling right now.

by koolba 2y ago

There doesn’t appear to be any details on the site besides the recipient: certik Anybody familiar with that name is probably chuckling right now.

mtmail 2y ago

I'm not familiar. What am I missing?

koolba 2y ago
They perform audits of crypto projects. The idea is that you’re certifying that the code is not going to immediately steal people’s money. Quite a few of their clients have gone on to do that with relatively simple vulnerabilities. To the point where “certik audit” is a meme about not providing any actual assurances (and thus implying they are incompetent). There also was the story a month or two ago where they actually took funds from a bug bounty target and eventually did give it back: https://blockworks.co/news/krakens-cso-confirms-certik-returned-funds-with-a-small-amount-lost-to-fees https://blockworks.co/news/krakens-cso-confirms-certik-retur...
- gnfargbl 2y ago
  That's just the classic attack/defence asymmetry though, no? When playing defence you have to find every reachable vulnerability. When playing attack, you have to find one.
  - londons_explore 2y ago
    It highlights the fact that even experts can't find every bug in code, and therefore you probably shouldn't be using code as the only security for a monetary system.
- user90131313 2y ago
  They are %100 corrupted people and stealers.That story a month ago is mind blowing. Black hat type
- oersted 2y ago
  I know this is rather obvious and has been repeated to death but: There's just absolutely no point to crypto if you end up having to trust institutions that are fundamentally less trustworthy than mainstream financial institutions and regulators, even if they have plenty of issues too.
  - npoc 2y ago
    Absolutely correct regarding cRypTo. But there's also bitcoin, which people wrongly group with it. They are two completely different things, once you dig a bit deeper. One is going to improve the world immeasurably - in fact one of mankind's most important (maybe greatest) inventions, and the other is a snake pit. If what I say sounds crazy, it won't after you've studied the topic for 5000 hours.
  - netsharc 2y ago
    It's so funny when crypto banks get robbed and they turn to the FBI to ask them to get the robbers...
    - kybernetikos 2y ago
      I see no problem with this. Crime doesn't stop being crime just because its happening to virtual assets. Maybe some crypto folks want to disconnect from the rest of society, but I don't think that's very many of them.
      - FireBeyond 2y ago
        Many folks said the Silk Road had made drug dealing "harmless". What they really meant was "harmless to me". Because it does nothing for anyone else in the chain to make it safer. There's also a non-zero sum of crypto proponents that think a large swathe of things that are illegal "IRL", should be non-criminal because ... "online".
        jenadine 2y ago
        There are people who think some things that are illegal shouldn't be illegal. (Online or IRL doesn't matter)
montenegrohugo 2y ago
Certik has a terrible rep in the crypto ecosystem They're ostensibly an audit/security firm, but miss many vulns Most egregiously recently they tried to blackmail Kraken, a big exchange, for $2m
- frankjr 2y ago
  Well, "certik" does translate to "little devil"...
  - user90131313 2y ago
    oh so the founders already had the idea. so no surprise at all
  - oersted 2y ago
    Yes I believe the direct translation is simply "imp".
qqqult 2y ago
Crypto security audit company that used to be decent & somewhat respected then scaled out and hired many more security auditors with questionable skills and morals (such as exploiting bugs in projects they're paid to review & help). The running joke is that protocols with no security audits are safer than protocols with security audits done by CertiK.

1023bytes 2y ago

Conspiracy theory - they bought it from someone else for PR

forty 2y ago

What should we understand? It looks like the H1 account is the actual company, at least they link to their website. Is the company doing bug bounty? Or is this a creative way to pay for an audit?

danielvf 2y ago

For those looking for context: https://news.ycombinator.com/item?id=41128441 https://news.ycombinator.com/item?id=41128441