Hacker News Reader

Comment by saagarjha | Hacker News Reader

I’m glad you seem to be happy with your payout, but can we talk for a moment about how much you got? For an exploit like this, especially given how much effort was put into it and how much the market rate of a security engineer like this would be, plus given how much this could be worth on the exploit market, $2 million is literally pennies. This could’ve easily been a bug worth hundreds of millions of dollars. I guess Optimism is lucky that people like you are willing to do “the right thing” even if you’re not being compensated fairly for it, but exploits like these are going to keep happening (and we’ve seen a bunch in this space already) unless bounties go up to match their true value.

View on HN

If we choose to value everything we touch by way of "the next highest bidder might have paid $X for this" while fully ignoring their intentions (and so allowing black market sales to be in scope for the implied auction), I think you won't actually enjoy the society you end up with :(. Like, as a security researcher yourself, it might feel interesting to posit the exact addition of value we protect per incident, but I think the ramifications on how other work gets valued as well as what adverse side effects result from this mental model are scary.

It is thereby really only "required" (for the world to function) that there is sufficient monetary motivation for people who don't want to spend the rest of their life feeling either the guilt or stress (even if merely due to the ramifications of people finding out) of having done something "wrong" (which I put in quotes as I feel the "code is law" argument that can result at this point isn't actually that useful in a discussion of morality) to bother to then go out of their way to help (as opposed to not searching hard in the first place, looking the other way instead of reporting, or merely hoarding the bug as a parlor trick).

And so like, while I totally see how this bug could easily be worth at least tens of millions of dollars to someone, it isn't clear to me that finding and reporting this bug should imply that I would need to be paid (and "by who?" is a then a hard question to answer even if we think this, one which might bleed into "and how?" a bit as the first answer is probably awkwardly decentralized in scope) the tens (or even hundreds) of millions of dollars that that hypothetical black hat might have figured out how to extract (which I make a bit theoretical as profiting from crypto hacks is harder than people often assume, something I touch on in my article; I think you might have to go for extortion, and even that didn't work for the Wormhole hacker)... most people simply aren't of the moral constitution to be black hats (which is probably a good thing).

(In this case, the main lingering ethics question related to this bounty that I come back to occasionally is that there are projects--such as Metis--that forked Optimism and now compete with it using Optimism's own code and vision... projects that (in the case of Metis) are actually of similar size to it (based on "total value locked", which is imprecise but probably the best measure here for potential impact: Defi Llama lists Optimism at $344M and Metis at $347M) which are still relying on Optimism to motivate the security efforts for their platform... it feels at least awkward to me that they should get a "free pass" here simply because their listed bounties were lower than Optimism's? Like, even if you don't think I should get money from them, maybe they should be helping compensate Optimism?)

Really exceptional response. A surprising number of people aren't aware of moral constitution, practically, even though this was a core topic for at least the last few hundred years. Interesting times we live in.

This post openly advocates being an accessory to fraud to maximize profit.

The true value of exploits is NOT the cost of the damage they could do, because that externalizes various costs to the perpetrator: evade law enforcement for the rest of your life, lose access to friends and family, become a high-value target for traditional organized crime, etc. For many people that is a net negative, even for a 9-figure payout. And that is a good thing, I think.

Morals aside, which seems to be popular in sec communities,

Do you not understand the immense amount of effort they would have needed to expend to hide, not to mention the ongoing stress involved afterward?

Surely someone with the skills to find bugs like these would be an expert in cashing out on those bugs?

Those skills are unrelated.

Yeah... and as the person in question who found and exploited this particular bug ;P, I can definitely state that I would not feel comfortable betting the rest of my life on my ability to safely launder a giant pile of crypto back through to fiat (and then, further, keep that secret for the rest of my life, which shouldn't be downplayed).

I am much happier being able to get a bunch of clean money and then be able to give talks on the subject at conferences and get a lot of "street cred" in the tech community for my effort than spending the rest of my life wondering if there's someone from a real-world mob out there trying to hunt me down to recover the $100M I "owe them".

The whole assumption that your ethics have a pricetag attached is faulty, it's not as if the choices were 'commit crime / get bounty'.

Everyone’s ethics have a price tag. It’s better not to pretend otherwise, since it clarifies a lot of human behavior.

I strongly disagree with that. You really can't claim to speak for everybody.

If you don’t play ball in certain parts of the world, you end up in a river. The price tag is just different.

Yours would likely be family or close relatives.

I think you’d take money to do something untoward if that was the alternative. Almost everybody would. And there’s nothing wrong with admitting that.

My 'goalposts moved' detector just twitched.

If you say so. It’s the same thing, even if it’s more comfortable to believe it’s not.

It helps to frame it this way, because once you accept that you’d do that, you’re more likely to accept you would do something unethical for a billion dollars if it had no consequences to you. And from there, it’s a binary search to determine exactly what your price is.

Would you be able to say you wouldn’t lie to your wife if it meant you’d walk away with a billion dollars? Certainly this is contrived, but all examples in this territory are contrived.

Yes, but that's not what we're discussing, because then I can counter with:

"Would you sell your mother or your children at any price?"

And I hope - admittedly, that's speculation - I know what the answer to that would be.

So this is now an absurd discussion, whereas it started off from a rational point of view: there exist such people whose ethics can not be corrupted. The fact that you believe this is not the case says nothing about people in general.

People did in fact sell their children when faced with hard times, by the way. The 1920’s era was rough. https://www.ranker.com/list/story-behind-photo-of-children-f...

You are asking what I would personally do. But it’s better to think of limit cases that everyone would do — such as lie to their wife for a billion dollars. Since it’s guaranteed you fall into the bucket of “everybody”, that means you can locate your ethical price tag.

It’s helpful for people to do this mental exercise. At least, I find it comforting knowing my own price tags in advance.

You are still moving the goalposts.

My statement is pretty simple: ethical people exist.

You countered with "Everyone’s ethics have a price tag. It’s better not to pretend otherwise, since it clarifies a lot of human behavior."

And have been moving the goalposts ever since. The fact that unethical people exist was never up for debate.

I had to scroll up and re-read to make sure we were on the same page.

Since you’re misquoting yourself, it sounds like you don’t want to have this debate, or you may not have realized what you said. But “The whole assumption that ethics have a price tag attached is faulty” is not at all the same thing as “ethical people exist.” It’s not a pedantic distinction; one is debating whether people will take compensation for acting unethically, even if they feel they’re the most ethical person on the planet — I think the answer is “yes” — whereas “ethical people exist” is a point no one could disagree with.

It’s a bit unexpected for you to omit your “price tag” words and then continue with my argument.

But we’re past the point that readers are having a nice time reading this. If you’d like to continue, I’m happy to do so, but we need to restrict ourselves to a high caliber of debate, if only for HN’s sake.

The distinction is pedantic because you are making it so.

Whereas in fact it is anything but pedantic.

"The whole assumption that ethics have a price tag attached is faulty"

For everyone.

> But we’re past the point that readers are having a nice time reading this.

You seem to be in a habit of projecting your own feelings onto everybody else.

> If you’d like to continue, I’m happy to do so, but we need to restrict ourselves to a high caliber of debate, if only for HN’s sake.

Suit yourself.

I'm saddened that a repeat of our debate from seven years ago won't be forthcoming today. https://news.ycombinator.com/item?id=8901682 I was looking forward to it.

If you ever do want to probe deeper into the question of ethics vs cost, I think it would be interesting. But since you keep talking about me rather than the idea, the interest feels one-sided.

Three different people have now made the same point in three different ways and you simply ignore it, consider the possibility that you are simply wrong about something.

Ethics problems typically do not lend themselves to be translated into a caricature of the market economy. The habit of assigning price tags to stuff can help if the original problem is cost related, but it tends to be a crutch when things of a more principal nature are discussed, which would have a valid meaning absent such things as money or physical rewards. As long as you keep framing it like that you won't get further.

If you believe everyone has a price shouldn't your goal be to not find your own?

(Like, work to avoid creating the situation where you have to compromise, if possible)

That’s a very interesting question. Thanks for that.

The way I view it is that it’s important to seek out yours ahead of time -— to game out different scenarios, and to consider whether you would do X or Y if forced to choose. That way, when you’re in a situation where you feel like compromising, you’ll remember your limits.

In other words, I was less tempted to act unethically in the moment than I would have been if I’d been surprised by the opportunity.

This is especially important in scientific circles. It’s often trivial to falsify data, and the rewards for doing so are generally high. It’s also not always an active, conscious decision; it’s easy to make small mistakes that have favorable outcomes for yourself.

The exercise has helped me steer far away from any of those. I’ve watched peers fall into a trap that I’d label “scientific hype,” i.e. claim that you’re doing something impressive when in reality you’re nowhere close. This is a very easy mistake to make, and if I hadn’t mentally found my boundaries ahead of time then I’d have been vulnerable to making the same error. Or I may have stayed silent when my peers were doing something naughty.

Positive and negative consequences are not the same thing in ethics.

Compare “kill this person to save your son’s life” with “kill this person to earn $1 million.” They’re not equivalent, even if both might be metaphorically referred to as a price.

On the contrary — the decisions you have to make to avoid negative consequences are often the best test of your ethics. Consider how many people would’ve been punished for speaking out against what plantation owners were doing in the 1800’s, for example.

The illusion that they feel different is extremely powerful. It’s worth resisting. It helps uncover all kinds of ways that we contribute to unethical behavior, if only through inaction.

The concept of having a price attached to your ethics is essential. Without it, people fool themselves into believing they’re above temptation. In my experience those same people tend to be the most vulnerable to it.

> If you don’t play ball in certain parts of the world, you end up in a river. The price tag is just different.

Aside from the problems of this statement being a completely vague and unspecific and extreme hypothetical, isn’t there a problem with switching from talking about incentives to talking about threats? Being threatened with death isn’t the same as being offered money, and this ground has been well covered by philosophers who point out that there are things wrong with “admitting that” as you call it. Calling it a price tag seems misleading at best. There’s further a massive problem with suggesting a person’s ethics might be based on what someone threatening them with death wants them to do, no? If the action isn’t something you are choosing to do, and isn’t something you would do if not threatened, for any amount of money, then why would you consider it your actions or part of your ethics?

> If you don’t play ball in certain parts of the world, you end up in a river.

OP branched here: "it's not as if the choices were 'commit crime / get bounty'."

Any example relevant to OP's branch cannot end with the subject in a river. The very fact that you are discussing it proves we've jumped to the other branch of the conditional-- the one where the choice is exclusively between `commit crime / get bounty` (by threat of death in your example)

tldr; goto considered harmful on HN

People choose the river regularly.

Many people's ethics have a price tag.

Don't bleed all over us!, or let others bleed on us.

Yeah: I definitely agree with this, and I think it is an endemic problem to discussion of ethics in technology: we tend to focus on "but I could"--which sometimes ignores the law but even when it doesn't tends to then get bogged down arguing the exact boundaries of the law--without instead trying to judge people on whether they "should" (maybe based on the ramifications it has on other people) or "would".

I just think it is also worth noting that, even if we do accept the false dichotomy, I would not be an effective criminal... which seems to continually disappoint some people ;P. (I'm sorry to be such a let down! lol)

Indeed, not everything that is permitted is ethical.

When you sell your car, and someone is paying more than usual. Should you keep looking for someone who might pay ten times that amount?

That person is there, maybe not today, maybe not within 10km. By wait a few years, or drive a few thousand KM or both.

Does that make the first, already above-average offer 'pennies'?

Off course not.

This is $2 mil of clean money.

> This could’ve easily been a bug worth hundreds of millions of dollars

That doesn't mean that you could find someone to give you $100 mil, clean or unclean.

We have atomic swaps to monero now, cleaning your stolen eth is easier than ever.

How are you going to turn that into actual goods and services though? You'll still need to go through an exchange with KYC and AML and the IRS will still be asking questions.

IRS doesn’t care as long as you pay taxes on the money.

KYC and AML? Just lie that you mined the monero on a now defunct pool. I have a plenty of coins that I genuinely acquired in such manner and haven’t had issues selling them. The bank only cares about hearing a vaguely consistent story, they aren’t cops.

The KYC stuff will only become a problem if you get caught via some other means, because lying to the bank is a crime.

A reminder not to take legal advice from HN.

> IRS doesn’t care as long as you pay taxes on the money.

Lol, you never actually handled the sums the submission is about right? The IRS will definitely ask questions about where the money you spend come from, if you end up on their radar. And if the answer is not satisfactory, they will grill you on it.

Yeah these subthreads always remind me of the Money Laundering subplot in Office Space.

IRS isn’t going to do a deep dive into your purported monero mining activities unless you go out of your way to give them cause to do so.

And even if you did, there’s no way for them to ever prove where your monero came from unless you fucked up during either the hack or the swap to monero.

Even if the IRS suspected that you’re lying to them, how could they prove it?

Again, depends on the amount of money. Sure, there is not gonna be a lot of action from the IRS or any other government entities for $2 million. But when we're talking about $100 million, you start to ruffle some bushes. So they will start to dig where it comes from. If you describe that you got $100 million from mining Monero, you're gonna have to show proof that you have the equipment to actually get that, over the timeframe you're claiming you have mined. If it doesn't match up, they'll dig deeper.

But yeah, I'm not claiming it's impossible to clean stolen ETH. The only claim I did was that the IRS will definitely start asking questions if you go from a declared income around average in the US to a declared income around $100 million from one year to another. To believe that they are just gonna accept "I mined it lol" is a grand delusion.

Yeah, you probably don’t want to cash out $100 million at a time. That is obviously going to draw attention.

But $10 million a year? Perhaps much more if split over a couple of jurisdictions? No problem.

In the end this was about stolen $100 million being worth more than totally legit $2 million. I firmly believe that it would be downright easy to safely cash out $2 million a year from the stolen $100 million.

> To believe that they are just gonna accept "I mined it lol" is a grand delusion.

Unless you keep evidence of your crimes sitting around, at some point they’ll have to.

Assuming you use monero correctly, no amount of forensic analysis will be able to go back from your funds to the original crime.

And besides, the “early miner” story is hardly incredible. Many people have recovered huge sums of money from old hard drives.

> If you describe that you got $100 million from mining Monero, you're gonna have to show proof that you have the equipment to actually get that, over the timeframe you're claiming you have mined

This isn’t really a problem as long as you claim to have started mining early enough, fairly basic hardware would probably suffice.

Or, the criminal could buy goods and services with the monero directly.

The IRS will ask questions of those people, but not the black hat "security researcher".

I want a mansion. How do I buy that with monero?

You could fly to Dubai.

Land will be harder (though not impossible) to purchase with crypto. next, find a construction company ready to accept payment in crypto. Mansion attained. Perhaps, buy said mansion in Keene, New Hampshire where more crypto users live.

Swap to monero, buy an NFT from yourself, convert to fiat, pay taxes. Now your money is clean, taxed, and you have an explanation for where it came from.

No, money laundering is never this easy...I see people on internet forums always suggesting stuff like this; Swap to monero >> NFT (or whatever else) >> clean money...Sounds good in theory but in execution, you'll likely make a mistake along the way and get caught

The mistake has to be in the early stages, it should be impossible to get caught in the “cash out monero” stage.

Even if the government figures out that you have unexplained assets, that isn’t the same as getting caught. Having unexplained assets is generally not a crime, and monero can make it impossible for the government to figure out where you got that money from.

In past threads I’ve heard about exploit brokers and how their rates are typically much higher than bug bounties. If Hacker News commenters know about these avenues I’m sure bug hunters can find ways to cash out for more money. Calling it unclean is stupid anyways, since the company clearly isn’t paying enough for bugs in their own service…this is the same kind of thinking that leads to “responsible disclosure” and all that junk.

gtfo with that. it's a generous payout.

Full disclosure: https://twitter.com/_saagarjha/status/1493021803802890242

Reply on news.ycombinator.com