Hacker News Reader

Comment by MattDemers | Hacker News Reader

It sucks, because there ARE crypto projects that have interesting applications, but the entire conversations about them online are about how much money the community can be making, or the disappointment that they aren't making as much as they'd like to.

You can't actually talk about the project, because once it gets too big it's just a farm for speculators. The devs don't give a shit because their project getting buzz boosts their coin's value, but it also means the project itself stops mattering.

View on HN

> there ARE crypto projects that have interesting applications

Name some. Some that can't be better done with an sqlite database running on a Raspberry Pi.

- Ethereum's PKI allowed an e2ee messenger app to be built w/o a phone number https://twitter.com/dwr/status/1575248197454135296

Why do you need cryptocurrency for that? Just make a p2p app and trade public keys. The only reason Signal uses phone numbers is convenience in locating people and restoring accounts.

the pki does make life easy - ethereum address as a global unique id + seed phrase around for recovery + integrate this thing with the rest of the ethereum ecosystem (e.g. other apps can require ownership of an account on this app by looking for a signed message on chain)

Do you trust a single Rasperry Pi over a secured blockchain? If so, I think we can agree to disagree.

A lot of crypto projects require trust in the governing body, who are very often pseudonymous and untrustworthy

In which case it doesn't matter if it's on a Blockchain or a raspberry pi because the consensus layer being trusted is secondary

"A secured blockchain" is hilarious in concept to me. Looking at cryptographic constructions in general, 'secure' tends to mean "some multiple of the current total computing power of the world, running for hundreds of thousands to billions of years, might be able break the system".

With blockchains we have "a subset of the current compute power on the planet could start subverting it immediately".

I’m flabbergasted by how often HN commentators who should know better keep refusing to acknowledge the trade-offs in the technical implementations of crypto. What SQLite database running on raspberry pi is immune from seizure by relevant government authorities for helping with criminal transactions? Compare and contrast with Tornado Cash, which still works fine despite being OFAC sanctioned.

Now, you may not care for law evasion, and that’s fine. But it’s asinine to pretend that crypto tech is not better for such purposes than “an SQLite database running on a raspberry pi.”

TC works just fine, if your definition of fine is 'I want to send my money into a black hole'.

> What SQLite database running on raspberry pi is immune from seizure by relevant government authorities

What cryptocurrency is? The answer is none, because there are several weak points to any cryptocurrency and if state agencies choose to take them seriously they can easily shut them down.

> keep refusing to acknowledge the trade-offs in the technical implementations of crypto.

No, we don't. The thing is, every time a "good application of crypto" comes up the next question is "show these to us". And invariably those "good applications" have no idea what they are doing, require centralized trusted entities to function, and can be run from a Raspberry Pi.

The only real use-case of crypto is value transfer that is immune to government interference - I don't think anyone is denying that.

But for the vast majority of businesses which interact with the real world, it doesn't matter whether the actual logic is on a bulletproof, uncensorable VM if the government can just go after the few input/output points where the system interacts with the real world.

Therefore, it's no better than just running SQLite and much worse because crypto makes significant tradeoffs (to be resistant to adversary interference) that aren't actually useful here.

Bitcoin. Ethereum. Etc.

They don't go down if you turn off your Raspberry Pi.

I also can be 99.9999% sure that they run correctly and Ethereum itself is pretty unhackable, as proven by the multi-billion bug-bounties.

The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable, i'm sure no malicious person/business can hack or change it, and if they do it has an auditable backlog.

> The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable, i'm sure no malicious person/business can hack or change it

And equally sure that any bug in there (and there will be bugs in there) is unfixable and any funds stolen through it unretrievable.

"smart contracts" are neither.

> Bitcoin. Ethereum. Etc.

This is tech. Not its applications.

> The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable,

Ah, to once again have a child's wonder and belief in magic. Just add th incantation "blockchain ethereum smart contracts", and all is right with the world.

Meanwhile reality [1] just in the past ten days:

--- start quote ---

Insufficient validation on an OHM smart contract at Bond Protocol allowed an attacker to drain 30,437 OHM (~$300,000) from the Olympus DAO defi protocol.

Olympus DAO wrote in an announcement that "This bug was not found by 3 auditors, nor by our internal code review, nor reported via our Immunefi bug bounty."

---

On October 14, Ethereum reached a milestone that alarms many who have pushed for blockchains as "censorship-proof" technology. More than 51% of blocks produced in the preceding 24 hours were processed by relays that filtered out transactions involving Tornado Cash

---

The defi project Earning.Farm lost 748 ETH (~$971,000) to a hacker using a flash loan attack. The project contract was missing a check that a flash loan was initiated by the protocol, so the attacker was able to instruct the project to withdraw large amounts of funds

---

Rabby Swap, a feature of the Rabby crypto wallet, was exploited a month after it was first rolled out. An attacker discovered an apparent vulnerability in the Rabby Swap smart contract that enabled them to arbitrarily transfer other users' funds.

--- end quote ---

[1] https://web3isgoinggreat.com/

> i'm sure no malicious person/business can hack or change it

Words that precede every DeFi hack with a ridiculous nominal dollar value.

Wrong conclusion. The hacks never targeted the underlying platforms and security. It was always the bugs on the smart contract level. The same way you can't blame Java/Ruby/Python being insecure because of SQL injection attacks.

What useful thing do those smart contracts achieve in practice? The only place they have authority over is their respective blockchain. They are powerless in the real world, always relying on some centralized entity to sync real-world state with blockchain state, but doing so inherently throws away all the benefits of running on a blockchain, so you may as well just let the centralized entity run a good old database and call it a day.

Reply on news.ycombinator.com