Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Thursday July 20 2017, @05:25PM   Printer-friendly
from the ephemeral-ethereal-wealth dept.

Some time ago, I wrote that I had given up on Ethereum. While the problems coming from the DAO hack are now in the past Ethereum has had a few other problems.

Granted, these problems have nothing to do with Ethereum itself. They are all exploits in the surrounding ecosystem. Hacking the CoinDash website to replace their public wallet address was particularly cheeky. This all reminds me of tales of the Wild West, when money was transferred between banks by stagecoach or by train. The technology simply didn't exist to provide the necessary security way the heck out on the prairie.

Seems like that's where we are now. The necessary technology does not exist, to provide the security that currencies like Ethereum and Bitcoin really require. Website hacks are a dime a dozen, and when a hack can be worth $millions... The same for software: When professional programmers still write code vulnerable to SQL injection - when our platforms even allow this as a possibility - then we simply do not have the technology to secure the stagecoach.

Previously:
$30 Million Below Parity: Ethereum Wallet Bug Fingered in Mass Heist
Hacker Allegedly Steals $7.4 Million in Ethereum During ICO
Used GPUs Flood the Market as Ethereum's Price Crashes Below $150
Ethereum Mining Craze Leads to GPU Shortages
Ethereum Unusable, DAO Refunds Possible


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by rigrig on Thursday July 20 2017, @07:48PM

    by rigrig (5129) <soylentnews@tubul.net> on Thursday July 20 2017, @07:48PM (#542040) Homepage

    You can expect this to happen again and again until the developer of the smart contract is held liable for any losses incurred due to a flaw in that contract's code. That will be the only way to insure that these contracts get the scrutiny they truly need and companies can rely on them to do business on the Ethereum (or any similar) platform.

    It isn't like people gave the developer a bunch of smartcoins and told him to write a secure contract: the contract was there first, so everybody could(and should) have had a look at it themselves before storing their money in it.
    And if you can't properly verify a contract (or know someone who you trust who can), maybe don't trust it with your savings?

    As this tweet [twitter.com] about the pull request that introduced the bug [github.com] points out:

    2000+ line changeset containing critical code merged w/out security review or formal signoff, 1 person commenting. Maybe not best practices

    --
    No one remembers the singer.
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2