Comment by darawk | Hacker News Reader

Comment by darawk | Hacker News Reader

Parent Full thread

As an investor in the DAO and believer in smart contracts and Ethereum, I agree with this article.

I think we all got over-excited and took this way too fast. But I do think it would be a mistake to be too rash in throwing out the entire concept because of this one mistake. Will there be mistakes like this in the future? Definitely. But it is my hope that the entire cryptocurrency community will be chastened by this experience into taking things a little more slowly in the future.

IMO those of us who invested in the DAO should lose our investment. We fucked up and we deserve the loss, and if people see that real money was lost, perhaps they will be more judicious in the future with their investment decisions. I certainly will be.

But I don't think it makes sense to let the thief get away with the money either. I know in some sense there is a philosophical problem that the 'code is the contract' and the 'contract is the law' and therefore the code is the law, for better or worse. But IMO allowing this to happen would just be counter productive. There's no benefit to letting he (or she!) take the money and run, and quite a bit of harm to the ecosystem and probably lots of people who just held some ether and didn't invest in the DAO.

I'd like this event to be seen as a learning experience. People were overzealous and they got burned. In the future, let's be more careful, but let's keep exploring the possibilities of this technology.

The reason to let the attackers get away with the money is that it would show Ethereum is what they say it is: a secure way to execute smart contracts. If you don't allow it to happen, then it's just another boring human organization with a few powerful people calling the shots, and everyone who uses it as a platform for smart contracts will wonder if theirs is the one that crosses the invisible line and gets rolled back.

We like to pretend Ethereum and Bitcoin are controlled by the code, but they're not. They're controlled by their communities, which decide what code to run. That's how it's always been.

Indeed this is the elephant in the room with the more ardent libertarian niche; the community as a whole has beliefs of many shapes and shades. Once the mob, for lack of a better term, decides to move it is very difficult to steer. And the mob is a mighty powerful force that has a tendency to sweep all before it, rational or otherwise.

People are not just rational beings, neither is the community. The 51% is dead, long live the 51%.

I agree, and I had money invested in The DAO. Admittedly not a lot of money, but still enough to miss. I'd rather never see that money again than have the ethereum network compromise its principles to revert the theft. I'll happily invest in the next version of The DAO, and other DAOs - once they have gone through extensive code review, of course.

Except that it isn't powerful people calling the shots. It's powerful people making suggestions, and then the shots being called by the network participants. There is nothing happening here that is contrary to the ethos of smart contracts or decentralized governance. If any sort of fork is accepted it will be because a majority of miners thought it was a good idea, not because Vitalik said so.

That just means that a majority of miners can be swayed into breaking the whole thing by a few people at the top.

That's what power looks like. A few people decide and many people willingly make it happen.

I disagree. The miners are the network. It has always been the case that the ability to influence the miners is equivalent to the ability to manipulate the network however you please. This isn't a new property of the system.

The miners choosing to do this or not to do this changes nothing about the fundamental security assumptions of Ethereum. Even if they choose not to fork, that doesn't mean that they couldn't choose to do so in the future for some other case. So i'm not really sure what it is that's being lost if they choose to do so now.

There's an assumption with these systems that the miners value the integrity of the system, whether out of idealism or just because they're invested in it, so you'll never have most of them try to subvert it.

If they roll this back, that will show that this assumption is wrong. They are not sufficiently invested or sufficiently idealistic to preserve the system. At least half of them value expediency instead.

Technologically it changes nothing, but it totally alters the human element.

Idealists will get wiped if they don't agree with majority consensus. It was always a human system and "the code is the network" is just ideology.

It is ultimately a human system, but human systems can include an element of rule based order. Humans can decide to have one process for making the rules and different one for enforcing/honoring the rules.

So the best way to proceed, in my view, is to honor the current version of the contract (which equals the current version of the code including the "exploit") and then change the rules/code so that the same thing cannot happen again in the future.

The miners are not the network; the expectation of market reaction is the network and the miners make their choice just like everyone else. Miners don't want to be on the wrong chain.

What does the mining situation look like for Eth? Is it like Bitcoin where it's less than a dozen guys in China? Or is it more spread out.

Three pools (dwarfpool, ethpool/ethermine, and f2pool) control around 64 % of the hashrate currently.[1] I don’t know how many people are behind these organizations, but their vote, if coordinated, would be decisive in whether any kind of fork takes place.

[1] https://etherchain.org/statistics/miners

Correction: ethermine, much to my delight, has enabled individual voting. (I don’t know about the others.)

Where did you get the idea that Bitcoin is mined by less than a dozen guys in China. This is absolutely false. There are major miners in the US, Georgia and elsewhere.

Around 70% of the hashrate is controlled by 5 Chinese-controlled mining pools.

the hashrate chart.... ? the recently mined blocks perhaps?

what they wrote was only BARELY hyperbole, barely.

It's much worse.

That may be even worse. This would basically be a "majority robs minority" attack. Not necessarily a great thing...

That's every cryptocurrency ever though.

Even if they let the attacker get away with it this time, it would only be showing that Ethereum community used their discretion and chose not to in this case.

I'm not sure it matters whether or not they do it; having people realize that they can is pretty damning in itself.

It would also be an incredibly valuable, long-lasting learning experience for the entire community, especially the ~23,000 who put money into TheDAO. Bitcoin had this in its early years and resulted in a highly critical, street-smart community. Ethereum community has been more on the risk-taking experimental side b/c until recently they had no real money at stake. Now that they've crossed that boundary, the ethos and attitude needs to catch up to the reality.

I mean, stopping the attacker is certainly doing justice, but a soft fork of the underlying Ethereum software that targets a specific account feels like it undermines the idea of Ethereum itself. Ethereum should be a platform, and any technology platform should be simple and reliable- add in an authority's ability to push out updates that muck around with contracts directly (even if they must then be consciously accepted by end users) takes away enough simplicity and reliability that it threatens the practicality of contracts worth millions of dollars.

A more principled response would be to simply shrug and say "contracts are hard, lets be extra careful in the future" and move on. An unscrupulous hacker would get rich, but if that's the worst that happens during Ethereum's bootstrap phase its an unequivocal win. Sooner or later the lesson will have to be learned, if anything like Ethereum becomes widely used.

Ya the big problem with it is that not only would a bad actor get rich (not so bad), but he'd likely flood the markets with eth, tanking the price which would hurt people that didn't even invest in the DAO. And secondly, it'd make switching to proof of stake in the future a more dubious proposition, knowing that a known malicious actor controlled 10% or more of all the ether in existence.

Those IMO are the big reasons to soft fork, not to prevent the enrichment of the thief. IMO really, the guy deserves something for finding the flaw. If it were up to me, i'd give him some of the money - just not enough to cause problems for the network.

You can't have the same actor both flood the markets to temporarily drive down the price and control a major stake of Ether - it's an either or proposition. In the first case, assuming the move was purely malicious rather than self-interested, the price dip would likely not be fatal to Ethereum, but it would suck for a bit. The more likely move is sell-offs in chunks at price highs, as this would maximize profit which would seem to be the motive here so far. In the second case, the actor still doesn't control a majority, Ethereum's disinflationary nature erodes at that percentage stake at regular intervals, and they are incentivized to act positively wrt the Ethereum network to protect the value of their sizable assets.

I think it comes down to a matter of time preference. People who want their money back now or justice for the wronged aren't acting in a way that is seemingly interested in the longterm health of Ethereum. They just want what's best for them whether money or the gratification of revenge, and they want it now. The best longterm thing for Ethereum is for the investors to eat their losses, and for the appropriate amount of risk aversion to enter the ecosystem. This will create massive, positive incentives to create ways of reliably building and vetting future contracts. IMO that is better long term for Ethereum than the short term gains of a hard or soft fork.

> a known malicious actor

Isn't the entire idea of trustless systems that everyone is assumed malicious?

If you think an asset is worth $x and it drops below that amount for a while. That's a benefit isn't it? You get to invest more at a lower price. When the asset returns to its true value you now have more of it.

Perhaps an equally principled response would be to fix all known bugs across all contracts at once.

Or, you know, to encode the contracts in an unambiguous, verifiable language.

Nevermind, let's just use JavaScript because it has the biggest available developer base.

Maybe another good option is to restrict our commenting to things we have knowledge of.

> IMO those of us who invested in the DAO should lose our investment. We fucked up and we deserve the loss, and if people see that real money was lost, perhaps they will be more judicious in the future with their investment decisions. I certainly will be.

This raises an interesting question. Bitcoin is (IMO correctly) fairly widely considered to be a commodity by regulators. So what's DAO? In my mind, it sounds a lot like a security. This is all speculation on my part, but, if DAO is a security, then in the US, shouldn't securities law, including Reg D, apply? Securities law is, in large part, about protecting unsophisticated investors.

I know even less about German law, but, if I were slock.it, I'd be nervous.

(Securities law isn't the only thing I can imagine causing problems. What if DAO ended up being regulated under ERISA?)

Disclaimer: I am not a lawyer. I also am not giving legal or investment advice of any sort.

> I don't think it makes sense to let the thief get away with the money either. I know in some sense there is a philosophical problem that the 'code is the contract' and the 'contract is the law' and therefore the code is the law, for better or worse.

You haven't explained how you solve the contradiction.

Primarily in the fact that in the same sense that 'the code is the law', the code also is known to have this property that it is vulnerable to collective human intervention. You can argue that that is in inseparable property of the code itself.

I like your standpoint.

Who has the most to lose if there is no hardfork? Is it those that seem to have the largest voice in the community? Is it Vitalik Buterin that begged the exchanges to stop? https://www.reddit.com/r/ethereum/comments/4oif2x/dao_attack...

Reply on news.ycombinator.com