Have a friend who lost more than $12k in the process of buying a house. Scammers sent the wiring instructions a few hours before the legit closing attorney sent the real instructions. The email looked exactly right except for a minor change to the domain name from address.
After one hour, wire transfers sent in error are no more recoverable than crypto.
How the thieves knew so much about the process and timing is supposedly being investigated, but no one is holding out much hope. And the attorneys have a strong incentive to cover up any evidence of intrusion on their side, assuming it was their infrastructure infiltrated.
I wanted it to be convenient and electronic transfer but my lawyer said I’m simply not allowed to. I had to get cheques from my banks and hand deliver them to the lawyer’s office.
I’m not sure I fully understand, in retrospect, the desire to shave off inconvenient corners for large life events you do so rarely. I think there’s real wisdom in some of these things being so slow and old school.
This reasoning also (especially?) applies to voting. Trying to make voting "efficient" is not worth it when we do it rarely and we have not had a problem just getting people to count ballots manually.
> Making it easier to vote has a big affect on how many people vote.
I think OP meant "efficient" as in "efficient for the people doing the counting." In this case, efficient is not the same as easy. It's efficient to count a bunch of ballots by having people enter their choices directly into a bunch of counting computers that are networked to a central counting computer.
It's easy to vote by getting a ballot (by mail or in person), marking it, and dropping it into a box. But counting those votes is not efficient, or at least not fast.
> This reasoning also (especially?) applies to voting. Trying to make voting "efficient" is not worth it when we do it rarely and we have not had a problem just getting people to count ballots manually.
THat's a very rose-colored view on voting, one that conflicts with amount of recounts and outright election fraud that has taken place just in my lifetime. Not to mention the outright denial of some to candidates to attend or speak at conventions and caucuses or having heir delegates ignored entirely.
Ethereum was recently, and succinctly described to be the following by Udi Wertheimer:
“I think that Ethereum is a convoluted mess and I don’t know what it’s good for but fine; other people like it. Good for them.”
That pretty much sums up my perception, at first it was supposed to be a global computer, which made no sense to me... then it was THE Blockchain upon which smart contracts could be created, entirely ignoring Bitcoin's could do that multi-sig txs or nLock. But would facilaite things like smart-contracts for hotels and car rentals, then that faded into obscurity when they knew it was not practical at all given its limitations. Then when Crypto Kitties fad came on I stopped attending the local meetups entirely as I couldn't take them serious anymore.
I was always the 'Bitcoin maximalist' at those events, and while I was using their meetups as a way to grasp why Ethereum even mattered as I was at IBM's Blockchain division where they were openly pushing for ETH based solutions and using an equally complicated things as Solidity was when they mandated everything be done in Hyperledger Fabric.
Ultimately, I realized it was complexity for complexity's sake driven by people who really don't understand this technology at all, and did so with no real reason to justify it other than it fit with the 'it isn't Bitcoin, its this other thing' narrative. IBM really dropped the ball on their advantage to capitalize on the use of this tech to many of its multinational customers, many who seemed eager to explore the possibilities, as a result of this.
I still have some screen caps from the internal study material from the exams and other internal material on a phone somewhere that just focused on how Bitcoin was nothing more than digital currency for criminals online. And how Ripple and Ethereum were some how immune to that with no real explanation to anyone who actually understood the technology [1].
To this day I'm still baffled how anything but greed explains how Vitalik, a former member of Unsystem, was the guy behind this and the subsequent clusterfuck that is ETH/Classic/DAO whatever it wants to call itself.
I kind of wished it had all been a big prank to transfer funds from stupid investors and Putin who were mesmerized by empty claims and buzzwords to fund Unsystem's loftier goals for privacy on Bitcoin but after the DAO I was pretty convinced it was never going to happen. Crypto Kitties made me realize that even they had no idea what they were really building.
Not sure if it’s general but here in the UK our lawyer made us come in to collect the bank account number and were very explicit about never using other details because of this scam.
I saw a variation of it first hand at a company I once worked at. The scammers gained access to the lobby of the building, removed the post and replaced it with invoices with different bank account details on.
Interestingly, property is the slowest and old-schoolest of all the branches of law. Some systems of deeds and recorders have existed for hundreds of years.
As an attorney I used to look at a lot of boilerplate skeptically but is a RE attorney told me I had to sign in the presence of a clergy, my mother and law, and three local stray dogs I'm marching my butt to a pet store and making some calls without a question.
As an attorney, you should know to read your contracts more carefully :) nothing in a pet store should qualify as a "stray dog," so is the whole thing null and void now?
> I’m not sure I fully understand, in retrospect, the desire to shave off inconvenient corners for large life events you do so rarely.
Same. I’ve seen people but one car over another just because it was available nearby instead of a half hour bus ride away. How many times in your life do you buy a car that an extra half hour is significant?
For this, I think it also matters how people view the car, the class of car, and the cost of waiting or goi g somewhere else.
If you're buying a cheap car to get you from point a to point b and you don't care about amenities, what does it matter? Will that civic the next town over make you much happier than the corolla in front of you (or vice versa, or whatever)? Some people just don't care about cars, or at least not for the type of car they are buying for that use at that point in their life.
Nobody can care about everything all the time, and sometimes people just decide not to sweat the things other people think are vitally important because they have other stuff they care more about.
I was so picky and spent months looking for my car. To the point the dealers were getting a bit irritated. When I finally picked I was asked what colour. “Don’t care. What do you have on the lot?”
True, if you really don't care at all then just buy the closest one. But in my (limited) experience with buying cars, once you figure out what will meet your needs, there's usually a significant value difference between the available vehicles and it seems silly to give up several thousand dollars worth of vehicle for the sake of one slightly longer journey.
Sometimes. For middle-of-the road needs and reliability, it's hard to go wrong with Honda or Toyota, and at the lowest level of vehicle that only leaves you a couple choices. If I was in that position and didn't know a lot about cars, I might just go to whichever dealership was closest that had one, test drive what they had, and if nothing really negative jumped out, buy it.
The more money you're willing to spend the more good choices there are at that level though, so this becomes harder to do when not operating at the lowest cost tier of cars.
This does change a did if people are willing to consider less traditional choices, like smart cars.
What's so inconvinent about that? I assume you have to go into the lawyer's office anyways. A cheque is just a signed document telling your bank to transfer the money-if you're buying a house then a cheque is the least of the things you're going to have to sign. Was it just a normal cheque? (Not a certified cheque or money order, or anything special) if so many people will already have them on hand.
Fellow Canadian here, I did not have this experience.
The certified cheque was done in 20 minutes. All that was required was two pieces of photo id, producing the debit card and entering my pin to access the account.
This wasn't even my "home" branch, zero prior relationship with this branch and I walked into a random one on my way to work.
I'm guessing there are hoops to jump through if you're clearing out your entire bank account because it could be grounds of suspicious activity by the branch manager.
This is an artifact of insecure communications systems and poor operational security. Making people shuffle physical paper around, especially considering things like pandemics and climate change, is a temporary workaround, not a long-term
solution.
I think the most important point is that it's slow, it involves many people, and leaves a physical trail. These are all advantages for any kind of ability to prevent or recover from fraud or simple mistakes.
Perhaps you can build a similar electronic system, but if one of the purposes is to make it slow and make it involve lots of manual confirmations, is there really a purpose to it? It's going to be much more complex than the paper system (replacing physical properties like uniqueness with brittle/complex cryptographic versions). Complexity always begets bugs.
> Here’s how these scams usually go down: A thief hacks into a real estate or title company’s computer system and then studies the transactions, from the language used to the format of the wiring instructions. When the scammer strikes, he or she will often pose as someone from the real estate or titling company to instruct the buyer to wire funds to them.
You aren't (usually) wiring the money to the property owner. It goes to the title or escrow company processing the transaction. They get the money, execute the paperwork, and then transfer the money to the owner after everything is squared away.
What is the incentive to use an escrow instead of dealing with the owner directly? How do I know the escrow won't run away like a crow with my money and the house?
The escrow company is supposed to be more reputable than the owner. They also handle this type of transaction, and know how to get it done properly, how to check the seller actually owns the house etc.
Not all the money goes to the home owner. Typically some goes to the bank for the mortgage, some to the buyers agent, some to the seller's agent, some to taxes/fees, and so on. The escrow/title company calculates all of this and ensures everyone gets their money.
The scam here relies on someone having compromised the network of the company sending the instructions. In that situation, wouldn't you have to assume the intruder found the secret key?
I'm not saying that cryptography wouldn't help in general, or that it's not incredibly stupid that we're not using it. What I'm saying is you can't just slap crypto on this particular scam to make it go away. These people have insider access to the machines that would likely be used to sign the email. If that is the threat model, it's a mistake to trust anything not delivered in person, signed or not.
In the US at least, you typically don’t even meet the owner. (Never mind that it’s not easy to make sure you’re paying the real owner without the aid of the various intermediaries. Nolo Press has good books about buying and selling homes and all the potential pitfalls involved.)
It's avoided by the companies involved taking 5 minutes to talk to each other when comuniticating instructions, and then holding the funds in escrow for a day before disbursing them.
But they don't care and they are not computer literate.
You would think, but in all scammer cases that I heard, they are able to get their money out.
I really don't get it, because I have to provide my ID every year or so for verification. I really don't get how these scammer can get away with that, but obviously every time.
Its easy to get fake ids that look very real (ask a local 20 year old).
Also you often do not even need to take a picture of an ID to open an account online, just have the info of an identity that you steal.
After that, you get an atm card, wear a covid mask, shades and hat, call to raise the limit and take it out asap.
Fidelity Investments brokerage and cash management accounts have a limit of $1000 a day, and I have four of them, so I can get $4000.
I recently learned that some Chase Bank ATMs inside branches used with Chase ATM cards can get $3000 in one transaction. I did it the first time a few days ago.
Good to know, thanks. Fidelity is actually my example #1. I've been told multiple times on the phone it can't be changed from $500, but that was years ago. Will try again.
Back to the topic, we're up to $3-4k now which is more than I thought, but still not enough to pull off this $12k scam.
Fidelity outsources their debit card servicing. A Fidelity rep told me that the cap is set per customer, and the withdrawal limit is set depending on the account balance and history with that customer. They told me that I could request a higher withdrawal limit if I wished to do so, and they may or may not approve it.
I travel a lot, and sometimes often to "emerging economies". Cash is always king, especially when your American bank puts yet another suspected fraud alert on your card...
It costs you more to do the work to recover your money than you get back. The government's contribution is only the general deterrence, which has no effect to attackers from hostile nations.
Is it just me or is there fantastically more fraud these days than a decade or two ago? Any transaction feels like walking around in northern Canada during black fly season.
I receive several cold scam calls per day and I’ve known people who have done things like purchase a home and been inundated by fake calls from “the underwriter” and other scams.
Is there no mail and telemarketing fraud enforcement any more?
We're definitely getting more of the Chinese robocalls and other SMS spam here in Australia too. I think there are two sides to it: scammers like everyone else are feeling the pinch from reduced economic activity, and desperate people are easier to scam.
A lot of scams do feel like low hanging fruit that would be easy to track down. I think there is a lack of will and capability for resolving "small" scams of up to a few thousand dollars which can be crippling for individuals.
When we bought our house last year, the packet came with a big, bright red page (as well as a verbal warning from our loan officer) to look out for these scams.
Same for me a year ago, and they called early in the morning on the day of closing to repeat the warning. It wasn't even mentioned when I closed on a house seven years ago.
I tend to phone people I'm making transfers to, where they've emailed or otherwise electronically sent the sort code and account number, to verify. Adds a couple of minutes, but could save tens of thousands.
Similar, my old and jaded real estate agent said "don't trust this computer shit, call me or call the loan people on anything involving money or signing something"
> Scammers sent the wiring instructions a few hours before the legit closing attorney sent the real instructions.
In my view, this mess is temporary. It's caused by a partial transition from an old system (manual via solicitors, cheques, and bank managers) to a new one. The old one was pretty reliable, but involved a lot of expensive people. The new one is like operating in the matrix. When communications happens electronically, the checks built into the old system break down and it's near impossible for a human to know if a electronic message is real.
It is not near impossible for a computer to know of course. A computer validate a series of cryptographic assertions anchored at the titles office relaying what bank to credit, and it can do with far greater accuracy than the old "human relationship" system, and it can do it in factions of second. But right now we use the new system to communicate because it self evidently more efficient to do so, and still use the checks from the old system to validate those communications.
You see this all the time. Phishing fraud, where accounts are sent fake invoices from what appears to be a valid supplier is essentially the same thing - humans using eyeballs to verify an electronic document is valid (which is essentially impossible), as opposed the supplier just signing it and the bank account details it contains.
It's almost comically bad. I was asked by the accounting section of one of the top computer contracting organisations to verify I controlled another bank account. They demanded a bank statement to prove it. Problem: the details on the bank statement were inaccurate. I raised a ticket with the bank to get it fixed, but as seems to happen depressingly often the bank screwed it up. So in the I downloaded PDF, edited it, rendered it to TIFF, added noise, and sent it. It was accepted of course.
Right now most organisations are wide to being exploited because they are communicating electronically, and using eyeballs to validate the result. They seem oblivious to the idea The Matrix wasn't just a move, it was a prophecy. And now the future it prophecised has arrived.
It will change, but only after quite a few companies have been ripped a new one.
That scam relies on the purchaser sending the full payment almost as soon as the bank transfer details have been sent to them, otherwise they’ll see the legit details too.
When I’ve bought residential property in the past, there have always been various fees to pay in advance, using the same bank details. So when it comes to the final big payment, I’ll have already had the bank details for weeks, and have already used them to send previous payments. Double checking the payment instructions by phone just before making the payment helps too, as that allows confirming the account and the final amount.
I am closing on a house, and this is quite terrifying. How in the world did the scammers know all the exact details of the house? I am guessing the $12k was good faith money? In my case, I was able to write a plain old check for my good faith money.
It was the down payment on the house in this case. And was actually a lot more than $12k. It has to be a wire transfer since checks take so long to clear and the title can't transfer with that uncertainty.
My advice to anyone buying or selling is to get the attorney's phone number from a known good source in advance, and call them to verify the wiring instructions before submitting. Also compare the bank account name down to the character with the real one (although I don't know how hard it is fake this). Your bank should read off the bank account info you're sending to before you give the confirmation to proceed.
Checks can be uncleared long after they clear (another common scam, since checks have no security model), so nobody sane accepts checks from stranges for large numbers.
My title company gave us all of the relevant information and account numbers in person on paper and made us sign documents agreeing that we were warned not to trust any information sent via email, web, or phone. You should expect the same.
Last time I had to wire a large amount of money I used paypal's verification trick - first sent a small amount of money and then phoned the person on the other side of the transaction and asked them to tell me how much money I'd sent them, and only once they'd confirmed that trusted the information to send the balance.
I could imagine a MiTM scam where the scammer relists the owner's property, and provides the mark with the scammer's email, phone number, mailing address etc.
Depending on how sophisticated the scammer is, the MiTM between communication can be transparent to the victim.
No need to be terrified, lots of ways to confirm the wire instructions are legit. Calling a known good phone number or going to the title company in person.
Well, I'm not sure why transfers are not checked against the name, especially for high value ones
This is fraud. It might not be recoverable immediately but it merits a police report. And maybe with that report you can have the receiving bank take action
I really think that all of this DeFi stuff is playing with fire. If these tools scale large enough, it's easy to imagine breaking the right link in the system at the right time to cause catastrophic failures.
Remember that all complex systems operate in a degraded state. If there's ever a way that only part of a complicated swap executes correctly the trade can get really far out of position. People in Ethereum land will say things like "the smart contracts can't possibly execute if all of these conditions aren't met!", but I can assure you that lots of extremely fault-tolerant systems built by very smart people (like electronic stock exchanges) have failed in very surprising ways.
Weakly collateralized flash loans are just faster leveraged tools with all of the tradeoffs that entails.
YMMV, there's definitely a lot of money to be made.
This DeFi stuff is playing with fire because the products being released have significantly outpaced the state of the art in building safe smart contracts.
To make an analogy, imagine that instead of DeFi, we were talking about skyscrapers. Imagine that thousands of engineers funded by millions of people who believed in them were building 25 kilometer tall towers using technology that they discovered in Isaac Arthur videos. And they were doing it today, before any of the technologies like active support structures had been properly matured. That's what's happening here. It's not that building towers is bad or unsafe, and it's not that the technology behind 25 km towers is fundamentally unworkable, but it IS the case that you shouldn't be doing it just yet given our current engineering knowledge.
Defi is insanely cool, insanely powerful, and it will dramatically change the landscape of society. But given the state of today's technology, if your product is anything fancier than Uniswap (sorry Maker, sorry Curve, sorry YAMs, sorry Augur, etc), it's not safe and it's ahead of its time. A lot of these projects are repeats of things like pets.com. Great idea, but it was too early (Amazon eventually fulfilled the vision though).
I don’t disagree with your claim here, but aren’t existing systems even worse? The conventional electronic payments system is in many ways permissionless. Even if crypto doesn’t live up to all the promises it makes, it may still add value.
If crypto is building poorly-engineered space elevators to get out payments to and from the sky, maybe the current system is throwing them in artillery and parachutes and hoping they land where you aim.
I stayed with Bitcoin not because I don't see how cool Ethereum contracts are, but because it's all about getting at least 1 thing right, which is digital scarce money. Even that itself is an incredibly hard problem. Getting smart contracts to be secure will take much more time, so I'm staying an outside observer.
> Defi is insanely cool, insanely powerful, and it will dramatically change the landscape of society.
As a person who has been around this tech since 2011, can you explain what exactly it is you find so fascinating about this other than the seemingly absurd amounts of money some people have made so far?
This all just seems like a reshased version of the DAO to me and I have ignored it entirely.
We're told this is a global economy, and yet think about things that are still overly complicated and expensive nowadays with financial operations. Things like wiring money to people abroad, buy securities in other countries, and all other operations in the hands of a few large financial institutions. Now we throw much of that bureaucracy away.
>I really think that all of this DeFi stuff is playing with fire. If these tools scale large enough, it's easy to imagine breaking the right link in the system at the right time to cause catastrophic failures.
Substitute "software" for DeFi. Every single day we're playing with fire through low quality code and bad security practices. DeFi just exposes the real financial costs and consequences of terrible software development. How many countless dollars and hours and data have been lost through bad code?
Good point but it won’t stop DeFi’s growth. In my opinion, such risks shouldn’t stop DeFi’s growth neither. Similar risks have been present in conventional finance and economy too. Relevant: https://youtu.be/ed2FWNWwE3I
Instead of fearing from the risks we should quantify and analyze them.
Oh great, so we'll solve the problem of insurmountable complexity by putting another layer of complexity on top that is supposed to understand the first layer of complexity for us.
Isn't that the whole security / obscurity point? That true security only comes by being exposed to active, intelligent, informed adversaries for a sufficient amount of time?
Or, another way: each exploit and oops only improves the system, rather than being a signal of its failure.
And let's be honest, the competition is still "Oops, I accidentally sent $900M to the wrong party." [1]
> And let's be honest, the competition is still "Oops, I accidentally sent $900M to the wrong party." [1]
The counterargument there is that Citibank is currently pursuing a resolution in the courts to that issue, and if they win they will get their $900M back. If you flub a DeFi transaction, you're shit outta luck.
And of course, if cryptocurrencies ever become anything more than Internet play money (and environmental disaster), the legal systems of countries worldwide will make sure the same protections apply. So yes, your newest cryptoanarchist token may have totally irreversible transactions (cross my heart, here's the math proof!), but the court can still order the thief to send back the money they stole in a separate transaction, under threat of prison time. The judge will not care that the relevant "smart contract" prohibits such behavior.
Because that's what real-world security ultimately boils down to: men with guns, ready to drag you where the law tells them to. It's not perfect, but it achieves 99% of the effect at the fraction of a cost of a "trustless" proof-of-work system.
By definition, if it can be regulated, it's no longer decentralized. And if it's not longer decentralized, blockchains have no benefits over regular databases.
Blockchains solve a very specific problem - decentralized transactions. Unfortunately solving that problem for the world's organized criminals brought a massive amount of heretofore hidden financial activity to light. Consequently, people, most of which don't actually understand blockchains, are trying to replicate this 'bonanza', like moths chasing a light bulb.
There many other use cases for decentralized transactions. But, with so much perceived opportunity at stake, industrial -strength pretzel logic is being applied to the problem, along with eye-popping amounts of venture and FOMO money.
TLS issuance is decentralized too, yet Certificate Transparency provides accountability, and inclusion into Mozilla's trusted CA list is basically the vetting process that binds CAs to legal entities.
In theory in crypto currency world "staking" is this process.
TLS is not decentralised, it's hierarchical. There are a fairly small number of root CAs, and an even smaller number of browser makers who define their trusted lists.
And you can install your trust root if you want, for example I can't find any Russian ones in that list, so probably the Russian government uses internal ones. (Their tax authority interestingly uses Sectigo a CA from the UK.)
> Because that's what real-world security ultimately boils down to: men with guns, ready to drag you where the law tells them to.
But that's assuming the judge knows who the thief is. One of the main characteristics of cryptocurrency is that you can hold it without giving anyone your social security number.
In that respect it's much the same as cash -- if you get away with it you keep the money, but if you get arrested, they can order you to return it, and seize your house/car/wages/etc. if you don't.
The issue, which creates the demand for cryptocurrency, is that we don't have a digital equivalent of cash that isn't based on proof of work. But the regulatory system could create one quite easily.
> But that's assuming the judge knows who the thief is. One of the main characteristics of cryptocurrency is that you can hold it without giving anyone your social security number.
You can, but AFAIK it's harder to do that when you're trying to cash out your cryptocoins in fiat (though arguably, this becomes less of a problem for criminals with the growing numbers of goods and services you can pay for with crypto). Still, I think if governments ever allow for a mainstream, sanctioned adoption of digital currency, they won't let it keep this level of anonymity.
> You can, but AFAIK it's harder to do that when you're trying to cash out your cryptocoins in fiat (though arguably, this becomes less of a problem for criminals with the growing numbers of goods and services you can pay for with crypto).
It also becomes less of a problem if any of the things you can buy for cryptocurrency can then be resold for fiat, which is already the case.
> Still, I think if governments ever allow for a mainstream, sanctioned adoption of digital currency, they won't let it keep this level of anonymity.
But that's the problem. If you can get it from cryptocurrency then it's available, so the only consideration is whether it's available from the system that isn't built on environmental destruction, thereby removing the demand from the system that is. It would be better if we'd admit that and get on with it.
I am not so sure that people were talking about having PoS already used in 2020. What has been planned was to have the first phase of a PoS on testnets, and this milestone has been hit.
In any case, Ethereum still has a lot of characteristics of a research project. If you follow closely, you start seeing that ideas are explored, some approaches are validated, some are proven impractical, etc. Some delays and hiccups are inevitable. As long as the Ethereum Foundation keeps its transparency and does not overpromise I am fine with it.
It will ultimately have to be handled the same way these problems are handled with fiat: through international treaties and multinationals subject to several jurisdictions simultaneously.
We are talking about a scenario where cryptocurrency become prominent enough that people would be trading with it. Governments and financial institutions can only control the on- and off-ramps from fiat to crypto. So now the US can claim to a quarter billion USD from North Korea [0], but what about a scenario where your assets are just numbers in a ledger that no one can control and these fiat ramps simply are irrelevant?
You want to talk about Governments trying to make it illegal? That is debatable, but a better argument. You want to make the argument that States and Institutions will create their own blockchains with backdoors so that they can override it? That is possible (or actually implemented if you look at Ripple), but that will be no real disruption of the existing global financial system.
I fail to see how "Governments will allow it as it is, but control it" is a possibility, though.
> I fail to see how "Governments will allow it as it is, but control it" is a possibility, though.
I do not claim that. I believe governments will allow it iff it's in a shape and form they can control. If some features prevent effective oversight, these features will have to be removed for the cryptocurrency to be officially sanctioned.
So you are talking about the "blockchain with backdoors" scenario (which absolutely defeats the principle and the purpose of any major existing system) AND making the existing leading chains illegal.
That is certainly is a possibility and a valid view, but to me a very short-sighted one. It assumes social-political systems are static. It makes us take for granted that global top-down Governments (hopefully democratic) will be the only legitimate form of power for a long period of time.
Blockchain or not, that leaves me with a very grim outlook of our future.
This may be my lack of imagination, but I can't see it ever being any other way. Hierarchical governance seems natural to us, pretty much written into fabric of social reality.
Once a group reaches more than couple dozen members, interpersonal pressures crumble as two random people don't really know each other or depend on one another - and you need to create a level of governance in order for the group to grow and stay coordinated. Rinse repeat, and you end up with hierarchical governance we know from every single society throughout history.
I know that "blockchain with backdoors" (or, "blockchain with anarcho-capitalist guarantees removed") goes entirely against the vision on which leading chains are built. But then, I disagree with that vision and consider it naive. I may be wrong about this, though. Time will tell.
This could be a good long conversation to have. Not sure if HN is the best place and format for it, so I will keep it short.
> Hierarchical governance seems natural to us, pretty much written into fabric of social reality.
Hierarchies have existed for basically forever and it's almost always the natural state of organizations not just for humans. I wouldn't argue the opposite. What has changed and almost certainly will keep changing is the nature of these different hierarchies. Moreover, we have more than one single type of hierarchy co-existing. Just compare Switzerland to China in present time, or compare the independence of Hellenic city-states with the growing centralization of the EU and you will know what I mean.
The one thing that is recent (and IMO misguided and/or totalitarian) is the idea that we can organize ourselves into one single global hierarchy, an all-encompassing entity that would be able to subject all different countries into one unified set of rules. Some look at Europe and the EU as a way to show that would be a good thing, but completely ignore the fact that the EU it is not an unanimous organization. Libertarians think that all-out globalization and absolute free-flow of commerce will smooth out every international issue and will completely ignore the fact that this only works if every one is on similar level of individual freedom and economic development. Communists refuse to accept past failed attempts because in their view Communism can only work if the whole world adopts it.
Every Utopian project that requires every one to conform to one single set of rules has failed and will always fail due to the impossibility of satisfying the needs, values and wants of everyone at a global scale. I hope we can agree on that.
> Once a group reaches more than couple dozen members (...) you need to create a level of governance in order for the group to grow and stay coordinated.
Right, and the beauty of blockchain is precisely that it solves the Byzantine Generals Problem. You can have any number of people that don't know and don't trust each other able to coordinate without any central authority.
Granted, this is not a perfect solution. It's not like that just because we can have a computer network telling us "who controls X and who should have access to Y" that people will blindly follow it. You will still have groups trying to control things by force, abuse the system and so on. Societies will still have to have their military forces.
The key difference is that now these disparate people and societies no longer requires nation-states to organize themselves. People won't be forced to swear allegiance with to one tribe or another just because of the place they were born, etc.
Citibank is in an argument with other institutions that operate in broad daylight. Crypto nets allow anyone, anywhere to jump into the transaction as a feature. These guys don’t care about New York City police. I don’t think regulators will have any control without having a controlling stake in the ledgers.
Exactly. There is no way I'd ever want to anything remotely important, or remotely high value, on a system that isn't run by humans and with transactions reversible in courts.
Who is it that uses these smart contracts, and for what? Is it mostly a gadget for research and speculation (still)?
I work in old industry and the supply chain guys as well as finance is having a boner from the idea of moving their crufty systems to blockchain. The whole paper trail around a bill of lading isn't a joke if you are shipping from say China to South America.
But - like the internet - it's just a fad that will soon pass.
If they don't, they will be put out of business. Do you think if Walmart says "I will only buy from you if I am able to audit you and prove that your shrinkage is less than X%" they are just going to say "Opposite, sorry we can't do that."?
Or if Amazon ever starts a blockchain-based certification system to crack down on counterfeit products, the legit distributors are not going to push down on all their suppliers? Of course they will.
This thinking belies a very simplistic view of a very complex supply chain.
Brands like Nike often don't touch their products after they produce the design.
Manufacturing, distribution, shipping, warehousing, sales are all handled by a massive web of smaller entities with long term contracts. Most of these businesses use very very old tech, and will actively resist change.
Its a chicken or egg problem too, since having half of your products on a blockchain is pretty much worthless, it's an all-or-nothing problem which makes it that much more of a massive undertaking.
I've studied this pretty extensively and honestly don't think it'll ever happen. At least unless the current paradigm of supply changes massively.
> I've studied this pretty extensively and honestly don't think it'll ever happen. At least unless the current paradigm of supply changes massively.
"I don't think we will see any changes in the industry, unless the industry changes." Kind of tautological, no?
> Most of these businesses use very very old tech, and will actively resist change.
I don't think we are disagreeing. Maybe we are just thinking in different timescales.
I don't doubt current business will resist change. What I am saying is that there will be a point where adopting the technology will be such an obvious advantage for the large players that the existing business will either be forced to adopt or be disrupted by some new business.
> "I don't think we will see any changes in the industry, unless the industry changes." Kind of tautological, no?
Kind of not-at-all what I said no? Change is inevitable, blockchain is not the right tool for this job.
>adopting the technology will be such an obvious advantage for the large players
A centralized solution from a trusted third party has all of the benefits of blockchain with just about none of the downsides. Many institutions could fill this role from technology companies to major law firms in the supply chain space.
> A centralized solution from a trusted third party has all of the benefits of blockchain with just about none of the downsides.
So why hasn't it happened yet?
Also, who in their right mind would rely so much on a "trusted third party" to coordinate global supply chains?
What would be cost to have an organization that is able to maintain this level of trust?
What about the politics of it? Even if the entity were to be trusted, how can we be sure that there would be no countries forcing their political/economical might to bend this entity to do what they want? As an example, after the global pandemic, do you trust WHO more or less? Do you still believe that they are completely independent?
You are never going to hear from me that blockchain is a perfect solution for all problems, but a "centralized solution with a trusted third-party" is quite a spherical cow in comparison.
As I said in my previous comment, it is happening in a major way across industries. There just aren't any clear market leaders because as previously discussed, different brands have different ideas on who a trusted third party is.
> different brands have different ideas on who a trusted third party is
If different entities do not all trust the same centralized party, then it is not happening. You are pulling a spherical cow again as an answer. What is so hard to understand about that?
Because it's not a matter of the industry that I am talking about, it is the general principle.
To make an analogy: I don't need to know all of the details of foreign trade and banking regulations around the world to know that people can use blockchain-backed cryptocurrency to send money all around the world in a way that is faster and cheaper that any banking or remittance company ever will be able to.
As blockchain tech matures and gets easier to be adopted by the masses, it will not matter if currently we have a gazillion different banks and if companies each are using their own ad-hoc method for managing world-wide transfers and FX: the moment that consumers are able to say "I want to use my crypto to pay for this", companies that are not on-board with that will simply lose business.
---
To sum up: you are arguing that the status quo is the only way to make things and that the only way to have any change is when they are of interest to the status quo. I am arguing that the status quo will not matter the moment that blockchain technology gets more accessible and makes more economical sense as a way to verify and coordinate work among entities that do not trust each other.
What matters in the end (to quote from the OP that started our discussion) is "The whole paper trail around a bill of lading isn't a joke if you are shipping from say China to South America". This is something that blockchain is basically designed to solve. It doesn't matter if the companies now don't want to use it, when the people holding the purses start asking for a solution that only blockchain can solve efficiently, the companies that don't adopt will lose business and fade away.
So you're extrapolating a general principle that has yet to be proven anywhere into an industry you know nothing about. Great. This sort of attitude is part of why folks generally sneer at BlockChain enthusiasts.
> you are arguing that the status quo is the only way to make things and that the only way to have any change is when they are of interest to the status quo
You keep building a strawman of my argument that's easy for you to tear down. Are you aware that there are more choices than "status quo" and BlockChain?
> when the people holding the purses start asking for a solution
That's the thing, consumers DGIF, and have proven this for generations by purchasing based on cost and quality alone.
If it is a general principle, it doesn't matter the specific application. That's the whole point of abstract thinking. But you don't seem to care about that. So, let's go back at the comment from OP:
I work in old industry and the supply chain guys as well as finance is having a boner from the idea of moving their crufty systems to blockchain.
They are the ones holding the purses. Not "consumers who DGIF". It's not retail that is going to drive the adoption of better tech in the industry, it's the large purchasers who will make everything possible to increase their margins.
> This sort of attitude is part of why folks generally sneer at BlockChain enthusiasts.
Again, I will borrow the words from OP:
But (Blockchain) - like the internet - it's just a fad that will soon pass.
My google-fu has failed me now, but I'd love to find a link to a story about a MS executive who thought that the idea that "internet search was stupid. People will just bookmark the sites they use more often and start navigating from there."
I will say this in the nicest way possible: your head is so stuck inside the box of the status quo and their current issues that you are not even able to contemplate a thought outside of it. You are dismissing something that can disrupt entire industries because the current implementation is not good enough. The moment that you stop thinking in a static way, perhaps you won't calling everyone "naive enthusiasts".
> Are you aware that there are more choices than "status quo" and BlockChain?
Sure there are! Yet none of the things you present as choices actually (a) solve the problem of coordinating work and attesting validity of information in a global scenario with competing actors and (b) have the potential to be automated/scaled to eliminate a lot of human intervention in the way that blockchain does. You are talking about big firms, big contracts, CYA agreements and certifications whose costs can not reduce with scale. How do you want me to believe that this is going to compete with technology that will be exponentially cheaper and simpler to operate and deploy?
For all the scams, ponzi schemes and outright theft that has happened in the blockchain space, I can bet a good amount of money that we as a society lose more every year to corrupt officials, subverted institutions and petty theft than we will ever lose on a system that is not run by humans.
Then for crypto you need to count what fraction of value is used for illicit activity. Here is a paper estimating its about 46% of transactions [0]. If you look at transactions that cause real economic activity (as opposed to speculation) I bet the fraction would be in the 90%+.
You are moving the goal posts. The point initially was to show that the current socio-political institutions are no better than "Wild-West" blockchain systems to avoid fraud and misappropriation of assets.
You are now talking about how much of a "real economy" blockchain can handle, which is a different matter and a totally unfair comparison. Let's talk about a "real economy" when people are allowed to enter a work agreement and have a contract specifying a salary in crypto.
It is still unrelated to the point of comparing the percentage of funds taken from its owners or misappropriated in the blockchain vs fiat. The activity may be illegal, so what? They were still desired by both participants. Bringing that to the story is still goal-post moving.
Depending on the jurisdiction, a lot of non-violent activities are considered illegal and happen on black markets anyway: gambling/sports betting, recreational drugs, contraband goods, prostitution... A lot of the "violence" that you are trying to prescribe to this comes from the fact that these activities are pushed to the underground, not due to the activity itself.
You are grasping at straws and you know it. Right now all your argument is based on your preconceptions against blockchain, but you are misattributing a whole lot of things to it.
Come back when you have a significant number of cases of people being attacked in order to get their bitcoin wallets stolen, banks being robbed for private keys in paper wallets or corrupt officials locking people up and demanding crypto for payment. Then I will start listening to you in regards to "violence that is caused by the nature of cryptocurrency and blockchain"
This is not necessarily true. If the system architecture is highly complex and poorly designed, each exploit will result in a patch which will only make the system more complex and more brittle.
IMO this is exactly what is happening with Ethereum.
Of course DeFi is playing with fire. And of course a lot of people are going to get badly burnt.
But the analogy is closer than you think. People still get badly burnt by real fire every day. Without coal fired power stations, blast furnaces and internal combustion engines we would not have modern society. If currently thinking is correct, without cooking food on fire there would be no intelligent hairless apes contemplating a future when DeFi actually does something useful.
PS: As the article says, transaction fees are of the order of $10..$20 per trade. DeFi trades derivatives in crypto currencies that have found no useful niche whatsoever (bitcoin being an exception, if you regard being the currency of choice for illegal activities as useful). In that environment, the only people who are reliably making money are getting those fees.
> I really think that all of this DeFi stuff is playing with fire. If these tools scale large enough, it's easy to imagine breaking the right link in the system at the right time to cause catastrophic failures.
We've already been through this with algorithmic trading in stocks: the flash crashes of 2010-12. Some were way bigger in terms of damage than the entire crypto market.
So yes "there will be blood" but you'll see all of the DEXs and other mechanisms eventually implement the same techniques that NASD and the stock market implemented to fight it: limits on price movement, kill switches (probably automated), market pauses etc.
possibly when you are depending on transactions being verified on two different chains but one can do child pays for parent or can be overwritten on a smaller blockchain you could end up with a "blockchain race condition"
As an elaborate real-money PVP system, Etherum is amazing. As a means of doing relatively normal business, being sniped, frontrun, or exploited is hugely off-putting.
True, but the article was about a situation in which they were retrieving money that was inadvertently available to anyone. That's not normal.
Any well-written smart contract has protections against front-running. For about a year I audited them for a living, and front-running opportunities are definitely something we looked for.
We never guaranteed there were no vulnerabilities. My point is just that there are simple ways to defend against front-running in particular, and it's common practice to do those things.
In order for money to be both real and useful it should be secured by unencumbered interest in durable real property.
The simplest way to circulate commercial paper for daily transactions is the Benjamin Franklin paper money system which involves appointing public loan officers throughout a nation to issue equity loans to anyone in possession of unencumbered interest in durable real property which they are willing to pledge as collateral which the public can auction in the event of non-payment.
This way money is placed in circulation so that the interest paid for the first use of legal tender is publicly collected and immediately spent back into the economy and so that the total quantity of money expands dynamically in proportion to the aggregate quantity of physical durable capital.
Competing theories say that the main value of monetary tokens comes from the government's monopoly on violence. What I mean is that governments ask taxes to be paid in tokens that they issue (pounds, dollars etc) and they threaten you with jail / physical violence if you don't pay. Governments then issue these tokens and pay people in order to employ them. Under this model, money is devoid from the value of the asset backing it (in the case of fiat money, no such asset actually exists).
Because allowing new public legal tender to be created on security of fictitious capital such as speculative land values and deposits of credit created by other banks is accounting fraud, transfers wealth from the poor to the rich, creates speculative bubbles in financial asset markets, promotes disinvestment in the real economy, decreases demand for labor, inflates the price of land relative to wages for unsupervised labor, and worsens inequality.
The only reason inflated valuations based on speculative hype, i.e. your 'fictitious capital', are able to redistribute wealth from the productive economy to rent-seeking interests is that parties taking irresponsible risks are bailed out by government programs that socialize losses. These programs are sold to the public as making the market safer for consumers:
This is primarily an issue for contract writers[1], of which there are relatively few. You get similar kinds of automatic exploitation on exchanges of all kinds too (stock, currency, futures, etc), though I think it's fair to say Ethereum makes it (quite a bit) more complex and more automate-able on average.
[1]: transitively it affects users too, but it's a bit different either way.
I thought Ethereum's primary aim was to be an unstoppable world computer that runs any code where the fas fee was paid, not money. Bitcoin aims to be peer-to-peer censorship-resistant electronic cash---and at this point its protocol has far higher levels of tested security.
Many of these transactions are not using ETH the currency, just Ethereum the network. Ethereum has many tokens such as stablecoins (USD pegged tokens), governance tokens (capital assets), synthetic assets, even wrapped versions of Bitcoin.
Ethereum is still a "world computer", but it's a world computer for high-value transactions, which are generally financial.
Transactions on ethereum get processed from the mempool in order of who wants to pay the most gas to have their stuff processed.
And yes, ethereum has more potential for problems, it's a much more complicated system than bitcoin. Their current goals are proof of stake (getting away from energy wasting mining) and scalability. Bitcoin is great for what it's great for, being digital gold, but it's pretty far from replacing Visa, ethereum actually has a shot at that.
I can't imagine running (or investing) in a software-based company here without also having an automatic model checking layer for verifying all runs + 24/7 monitoring for disabling any live contract. If you're going to put $10M+, years of your life, and who knows how much customer money into this, why not spend $500K of it so you're running with the blockchain equiv of CI testing? You'd be able to deploy faster, with more confidence and less stress, and fewer of these weird midnight Europe phone calls.
Viable model checkers for basic software contracts existed since the 80's, and the modern incarnations are insanely powerful (Z3, ...) + quite approachable (Rosette, ...). They're used to tackle software verification problems magnitudes harder than "money can only go from here to there in this tiny software contract": race detection in distributed file systems, bugs in hardware circuits, security holes in big javascript libraries, etc. I think of these same not-very-secret tools every time I see one of these articles, and yet the engineering fails keep happening.
A few teams deploy tech here, including built on the above, but it seems like most do not. I'd say mind-blowing, but at this point... mind-numbing?
I do appreciate the author being frank about how bad the status quo is.
EDIT: To give a sense of this -- the same people will talk about meticulous cold storage key exchanges with someone always being there to watch, driving into the desert for bootstrapping secrets, and then for their actual operations, deploy unverified contracts.
I hate to be that guy but you are vastly underestimating the challenge of formally verifying these software systems. Blockchains are highly adversarial, open source, and doing a lot of innovation. Innovation which means that nobody has ever tried to verify that type of system before.
Model checkers can tell you thinks like 'there are no underflows' and 'these two pieces of code are identical', but if you want to know whether there is no arbitrage or front-running, you're well past the capabilities of the state of the art. It's not merely a matter of spending $500k on CI and auditing.
And then you've got a separate issue, which is that the space is super competitive and moves extremely fast. If you spend 6 weeks getting your new contract audited, you may well miss the window where people will care about the project you launched. I don't think this is a healthy culture, but it is one that many teams are trying to compete in. And therefore they ARE willing to bet millions of dollars without taking any time to audit, because the expected value of deploying faster is higher than the expected value of deploying more safely.
For projects that are comfortable moving more slowly, formal verification IS a big focus, and the cryptocurrency industry has been a material driving force in many security related technologies such as reproducible builds (Gitian), reproducible bootstrapping (Guix), and software verification methodologies.
For background, I've built verifiers for harder languages, reviewed papers for crypto systems, seen the inside of crypto operations & crypto security startups, and help build software for adversarial, investigative, & high performance scenarios. I'm not an expert in blockchain stuff, but I'm also not unfamiliar with the software challenges.
* I would agree that paying consultants to audit contracts is prohibitively expensive. It's the equivalent of paying pen testers to do your unit testing & security engineering - that's a costly way to do your basics
* I disagree that model checkers can't check for stuff like front-running. It's not textbook, but close: the first papers on model checkers were specifically temporal logic for stuff like ordering issues. That was ~35 years ago! Contracts are similar in size, and both computers + solvers have gotten exponentially better. For my day job, we do TLFOPS for $0.20/hr, in Python.
* Reproducible builds, bootstrapping, etc. are real... but the 20%, and skipping the 80% I'm talking about. Verifiable VM IRs + verifiable contract lang subsets + contracts verified against them. Yes, we've seen sw supplychain attacks against some projects. More than that? Buggy contracts, buggy contract libs, & buggy blockchains.
I get that crypto startup people don't know this stuff, but you can hire 1-2 devs (= $500K) that can. Even if verifying against full abstraction is likely out of reach due to the security mess that is the ETH VM & friends, chiseling out subsets and running the model checking equiv of fuzzers isn't hard. The status quo of not doing it makes it look like an industry of folks not running unit tests before pushing to prod. (See: article.) It's not that hard. As more money gets into any company here, my expectations go higher, even if that industry's haven't.
-- Modeling: You start with basics like using the small universe assumption to bound checking to X transactions. I'd expect most front running to show up as small cycles here, so the typical case is a super small X. Later, you might get into a time cost semantics to better tune what you consider interesting, but almost no one in the crypto space is at the level of modeling maturity. I'd predict a team's time is way better spent building up a stdlib of contract checks, verified contract helpers, & whitebox attack heuristics/guides.
-- Modeling II: Also, in verification, it's way better (ex: realizes more of the ROI) to verify the program has the properties you want ("money goes from a->b without getting stuck"). You can dream up individual attacks and model those one by one ("front-running where ..."), but then you potentially miss some, or some aspect of one. That's basically the difference between verification and testing. You still do stuff like check sample scenarios & individual attacks, but that's more about testing the verification conditions & model fidelity.
-- Fixes: A good (while still cheap & easy) checker gives you summarized examples of attacks. Likewise, it makes it interactive, so you can tune what you consider in/out of scope. More R&D-level verifiers suggest patches (verification and synthesis are two sides of the same coin), but that's not necessary. If your idea sucks or the attack is unavoidable, the verifier isn't the problem, and if you decide to still proceed with the now proven-bad idea, you can at least now price the risk in.
In the article the attacker simply pays a higher fee to have their call executed first. How does verification help you in this case?
It sounds a bit like it would just tell you that your design sucks and you need to change it, but that's not really helpful if it does that for all designs you can come up with.
I'm not convinced you can spend 500k and make the problem go away. If it turns out the problem can only be fixed by changing the underlying platform, rather than your contracts, you will spend years talking to stakeholders and advocating for the necessary changes. Which you still have to come up with yourself. Unless your solver somehow finds the correct solution?
Another reason why that budget is suspect is that you'd have to develop most of that from scratch. There certainly isn't an existing set of mature tools like there might be for verifying properties of C++ code.
Unless you make the problem go away, you are not going to be better off hiring people. Front runners let one know there is a problem just as well as a verification consultant.
Proving that an attack is unavoidable might at least save some time. Proving that a specific solution doesn't work doesn't really help you find the correct one (?)
Nope! I actually hedged by ~10X :) In reality, I'd advocate building successively better verifiers as more & more money flows through, with the first solid prototype being $20K-$50K.
One good MS/PhD student in the verification community can build a decent toolkit over a summer (= $20-50K). The reason is that tools like those I mentioned earlier are intentionally language-agnostic and part of 15+ year movement of building out lightweight generic toolkits for this stuff.
Think of it like a CI system: you get most bang for the buck by building out basic unit tests early on, and as your system becomes worth more $, get into integration testing, and one day, chaos engineering. Same for different levels of verifiers.
* Some problems are inherent to all designs...yet you're better off hiring people? That doesn't make sense to me. What are the expensive per-contract outside people going to do if they can't fix the bug? That's worst of both worlds!
When a verifier flags the issue, if a team can't figure out a fix, at least now they can now mitigate the risk (e.g., shut it off, only put in so much money, get insurance, hedge/diversify, monitor for the exploit happening, ..).
My broader statement is verification tech is increasingly accessible and building out some of it for an org deploying contracts is similar to a utility co building out monitoring or a software shop building out CI. Not for the weekend coder, but should be basic engineering for a professional shop.
If you can't fix it maybe you shouldn't deploy it. It's like knowing you have a bug that will result in a 50/50 chance of losing customers money. It would be irresponsible to deploy code like that.
There should actually be a big market for formal verification tools: malicious users can use them to find and exploit buggy contracts.
I imagine this will happen after the low-hanging fruit (the front-runners described in this article) is gone.
Providing formal security proofs may be forever out of reach, but if the tools get expressive eventually it'll be a battle of who can throw the most CPU at the solver, to the point where no cost incentive remains.
Either way, it will spur developers to use these tools before their attackers do.
Runtime Verification (no affiliation, just know some people who have worked with or for them) are working on tools and providing services for things like this
> the same people will talk about meticulous cold storage key exchanges with someone always being there to watch, driving into the desert for bootstrapping secrets, and then for their actual operations, deploy unverified contracts
Although they, or their predecessors, didn't necessarily do the former in the first few years of Bitcoin. Lots of exchanges, including the very biggest, were compromised and robbed.
Maybe there's a cycle where particularly terrible outcomes help to create a new consensus on basic safety precautions.
You can validate your contract all you want, but if it matters in which order executions matter, you're still subject to the whims of the underlying blockchain.
That's something you can verify and fix, or decide to otherwise include in your risk calc.
But yep, after looking at the hoops verification folks are having to jump through to run safe contracts on insecure blockchain VMs, maybe doing something else with your $ can also make sense.
I know next to nothing of ethereum or how it works, so the whole thing read like a cyberpunk caper that I couldn't put down. I imagine the author on his Ono-Sendai deck.
They have nothing on the current financial system, like banks being able to block you because you sell adult sex toys or someone being able to pull money from your account whenever they want because you once gave them your card details to buy a $5 sandwich or having to find a merchant relationship just for people to send you money. These are nonstarters that would get laughed out of the room if pitched today.
You're just used to the stupidity, so it's easier to scrutinize the new things. But there are people out there who take those downsides seriously. And sure, you're always trading old problems for new, different problems, but it's nice to have the choice between those trade-offs for once.
As an outsider looking in, though, it seems that banks are getting better at this, while crypto is getting worse.
There's a bajillion fintechs helping the banks sort out their UI issues and make it friendlier/better.
Bitcoin is still basically unusable for everyday transactions, and the endless stream of wallet provider hacks is not convincing anyone that it's secure. As TFA says, the hazards for normal folks playing in this pool are getting worse. If the miners are frontrunning your transaction every time you want to get paid, what's the point?
The fundamental problem of ownership still isn't (and won't be) solved by the existing banking system. Money that you actually own, that you can do whatever you want with (for better or worse).
this isn't a fundamental problem for anyone who isn't caught up in this weird ideologically libertarian crypto cult.
Virtually nobody wants to 'actually own' money or do whatever they want with it, they want to buy groceries, pay rent, or put it in their bank account.
If people wanted to actually own stuff they'd buy pinephones instead of samsung galaxies.
Well until a few centuries ago nobody wanted to have electricity sent into their houses. The masses don't care until it becomes part of life. It's always the quirky pioneers that care first.
It's just a different approach with different tradeoffs. Credit cards push the fraud risk and fees on the merchant. Crypto can push it to the user (and in the process reduce the fees incurred).
I would be happy to have a way to pay merchants I trust online with and remove the ability to reverse the charge if I was financially incentivized to do this (with the money the merchant saves on fees).
The ability to reverse a charge isn't just about helping you if you are cheated by a merchant, though. It is also about if your credentials are compromised and used by someone else.
Sure, you might be happy to give up your ability to get a chargebacks against a particular merchant.... but what about against a thief?
The banking system deals with it by just reversing the transaction so the end user of the system, the consumer, doesn't care. This ends up screwing the merchant most of the time, causing the price to be paid by higher prices, but people don't seem to care.
And most people don't store value in currency long term, they typically store value in assets such as precious metals, securities, or real estate. Cash has a purpose of exchanging value in the modern economy, nothing more. It is manipulated by design to bring stability to the economy to allow for a more favorable business environment.
I think crypto has a place in the world... but it's not as a general purpose currency. Using anything but a fiat currency for commerce is way too unstable for long term sustainability.
There's finance stuff which is mostly large organization to large organization. Everything from escrow, loans invoices, to things like RFPs and supply chain management.
Then there's the NFT/Unique items section which is for gaming (God's Unchained/Magic the Gathering where each card is owned digitally and can be traded freely with others or used as collateral for a loan), media (You own a movie but can use it on any service), and art (Tokenized art is a big craze right now).
The big ones down the line are new methods of organizing and collaborating. DAOs allow for decentralized corporations and governments. There's a lot of cool stuff here.
There's more but payments are really just a tiny use case of crypto. The big stuff like decentralized applications which might replace Google and Facebook with privacy preserving neutral platforms built for everyone to use.
Most internet platforms used to be "neutral" - or significantly more so than today. The current discussion in society is about the problems that too much neutrality can cause.
However your stance may be on those topics, this very same discussion will extend to decentralised communication networks as well, should they ever go mainstream.
> The big ones down the line are new methods of organizing and collaborating. DAOs allow for decentralized corporations and governments.
Ok, dumb question: How would such a decentralised government keep itself from being overrun by, say, the Russia troll army, or any other actor with enough resources to take over a majority of it?
Identity is a huge topic itself with lots of projects doing fundamental research and experiments but essentially if it's a traditional physical government then it would work like it does today where you would use your government secured ID to vote. Not much would change. If it's a digital government then it would probably be using an identity based on built up history of actions and financial settlements and connections to other highly verified accounts. Ethereum has a project called POAP (Proof of Attendance Protocol) which is a way of identifying that a real person attended a specific event or performed some important action. These POAP badges can't be faked and are already being used for things like being able to vote on certain dev polls if you've attended a Devcon.
> If it's a digital government then it would probably be using an identity based on built up history of actions and financial settlements and connections to other highly verified accounts.
Not sure if I understand this correctly. You mean, an account will be considered "genuine", if it had a long enough history of activity?
Sort of like a credit score matched with landlords who vouch that you rented from them before. The longer that history the harder it is to fake and also the harder it is to just be the same person with multiple accounts. These systems usually have some component of a social graph where people will interact with and vouch for other people and having more and higher quality connections (more verified, connected to someone you know personally is real) gives you a higher legitimacy rating. It's usually up to the organization to set the minimum bar of how verified someone is to be considered unique.
Blockchain addresses the fundamental societal concern of trust. It addresses accountability and transparency, removes middlemen, and maybe down the road will provide a currency use case. Yes, it can act as currency but that is the use case with the worst odds.
When it comes to currency, your coffee is not the target right now. Getting rid of entrenched monopolistic behavior is the best first step: wire transfer fees, Western Union, transfers that take days to process, objectionable government-defined illegality, banks freezing your funds, etc.
Have you ever used a browser wallet? I have yet to see a banking ui that is even close as fast and comfortable as metamask is. And i regularly try more modern banks.
> the endless stream of wallet provider hacks is not convincing anyone that it's secure
Does the endless theft of money through central banks' intentionally inflating the money supply increase your faith that government fiat is secure? Hacks against centralized wallet providers don't count as security weaknesses in decentralized protocols such as bitcoin.
Perhaps the current danger with Ethereum-based DeFi is that its far too centralized, and typically (but not necessarily) contracts deployed on it are also far to centralized in their design, governance, and security reviews before deployment.
You can as easily blame the previous generations of sex toy sellers for their shady practices as you can banks for responding to it by separating those industries for special treatment. Higher processing fees or outright blocking is just a response to risk.
It's not some moral pillar that crypto is taking a stand against at all, it's just removing all the processes that protect both sides of transactions and distributing those trust mechanisms to those parties instead.
Except that it's not "shady practices" that caused it. It's, man buys porn on credit card, wife questions the man about it, man denies it was him, wife has the charge reversed. Then the bank stops wanting to deal with anything related to the adult industry.
What you need is a payment system that can handle transactions where the seller is honest and the buyer is flaky when the existing one is built around the opposite assumption. And if the banks can't provide that (or the existing regulatory environment doesn't allow them to) then it's good when something else fills the gap.
Those examples you listed are at least an explainable, understandable flavor of stupid. "Hello, bank? I'm disputing this charge" or "Yes, I really bought that stuff".
It's no accident that TFA has Cthulhu in the header -- we're crossing into a malevolent and incomprehensible dimension of stupid. "Hello, void? Robot monsters ate my contract" and you hear nothing but echoes in your marrow.
"Better yet, if you happen to know a miner (we didn’t), you could have them include the transaction directly in a block, skipping the mempool—and the monsters—entirely."
ugh. It's not what you know, it's who you know
That said, this looks like a very interesting and rewarding system to hack. But it seems to serve little purpose. The other comments comparing it to Eve Online are spot on
"Better yet, if you happen to know a miner (we didn’t), you could have them include the transaction directly in a block, skipping the mempool—and the monsters—entirely."
In the bitcoin ecosystem, as far as I know, basically everyone can be a miner, right ? If you are running the bitcoin client you are mining and there is no particular barrier to entry to mining ... just run the client and mine.
How is the ethereum ecosystem different ? If they could avoid all of these complications by mining, why didn't they just fire up their miner ?
Its not different. The issue you run into in both systems is that unless you have a large amount of specialized hardware, you will not be able to mine a block in your lifetime.
The number of blocks being mined is constant for the entire mining ecosystem, so you are basically competing with all the other miners to create a new block.
I see - so the protection one could gain from being a miner that the article alluded to would come not just from being a miner, but from successfully mining blocks.
That distinction is needed since, no matter how slow and painfully inefficient I am, if I am running the miner I am, indeed, a miner on the network ...
If you just fire up the client and mine, it will do practically nothing. You will have essentially no compute power, so no chance to ever get the block with the transactions you want included
Its not just being the miner, its winning the block and including that transaction in the block without it first being included in the mempool and transmitted over the network.
I don't see how that would work. Wouldn't that miner have to win the race to find a block in order to help? Seems like this would greatly lengthen the amount of time for a transaction to commit. You'd have to tell your transaction to a bigger set of miners to increase your chances, but that would also increase the chance of your transaction leaking to a front-runner.
The environment described in this article is horrifying and definitely sounds worse than our current financial system. That person just lost $12k to fraud and has no recourse at all.
I agree with the other comments on here. Blockchain/crypto has always made me uncomfortable. I think it's a mix of the slimy get rich quick aspect of it that draws a lot of people and the cyberpunk/dystopian rhetoric around it.
I also think it's telling that even though Blockchain has been this hyped thing for 6+ years at this point, we haven't really seen it actually be used for anything outside of cryptocurrency, which in and of itself isn't used for much outside of speculation. On the other hand, machine learning is used in everything now and makes a lot of stuff better.
It definitely sounds like there's an additional major innovation that needs to happen with this stuff before it's really usable.
> I also think it's telling that even though Blockchain has been this hyped thing for 6+ years at this point, we haven't really seen it actually be used for anything outside of cryptocurrency, which in and of itself isn't used for much outside of speculation. On the other hand, machine learning is used in everything now and makes a lot of stuff better.
Did you know that the Neural Network has been around since 1958 [1]? Machine learning is not a technology that is just 6 years old. The latest AI trend is also not the first or second time that AI has been through a massive hype cycle.
The problem with the cryptocurrency space is that it's financial innovation. And just like financial innovation on Wall Street, this tends to draw out the slimiest people in society, because if you get someone to believe in your product they may well leverage their mortgage and throw their life savings at you. It's crushing to see people do this, especially because pretty much only the malicious projects get hyped up that much.
But that doesn't mean that there isn't any truly groundbreaking innovation out there. Cryptocurrency changes the fundamental scalability of society. A key bottleneck for human society is trust - at some point a system gets large and corrupt, and it becomes difficult to keep bad actors from imparting a large amount of negative influence. But cryptocurrency allows us to design systems that don't require any trust at all. They _cant'_ be corrupted, because a combination of incentives and cryptography keep everyone safe.
As this blog post shows, there are still a lot of rough edges out there, but the technology is innovating rapidly. I do think the hype is probably 5-10 years ahead of the technology, but in the grand scheme of technology (think of how long it too Arpanet to mature, or Neural Networks to mature) that is not much time at all!
which discusses economic limitations to the incentives for blockchain mining. (One part is that if a cryptocurrency gets too valuable, the value of a double-spend attack could exceed some models of the reward for honest mining. Another part is that if you have unregulated derivatives, you can own a negative amount of cryptocurrency, which means that your financial incentive can be to actively damage the cryptocurrency rather than helping it. Satoshi's paper seems to assume that you can only own a positive or zero amount of bitcoin rather than a negative amount, when arguing why miners are incentivized to be honest.)
(This is also true for the ability to short, or insure, any asset -- you can be financially incentivized to damage it -- but elsewhere this incentive is partly countered by law enforcement investigations of some trades and insurance claims where people profited significantly from accidents, disasters, or scandals. Smart contracts on blockchains let us build insurance and derivatives markets where you can bet against things without identifying yourself. In fact the whole underlying discussion here is about how the person who claimed this particular asset in Ethereum is anonymous and probably can't be punished for doing so, even if we believed that the claimant wasn't entitled to make this claim. That could be equally true if the person were collecting an insurance contract payout. That's potentially fine if contracts can't create new incentives to cause harm, but maybe not so awesome if they can.)
The paper is 2y old - which is a bit of time in blockchain space - and yet, no one has performed this attack successfully in the wild. So, either everyone is just loving Bitcoin and wouldn't harm it for profit, or it's not so easy (hint: you cannot short Bitcoin for hundreds of millions, it's not liquid enough).
Also, this is strictly about PoW, the ETH roadmap (and this is where we are coming from in this submission) is moving to PoS where attacks are potentially way more expensive.
> you cannot short Bitcoin for hundreds of millions, it's not liquid enough
That seems like a great explanation, but the paper's argument is definitely not that cryptocurrencies can't exist or can't work, just that they have a limited range of levels of adoption where the incentives will continue to point in the right direction. In the paper's model it seems that Bitcoin has just not reached that level, right? If you could double-spend or short enough value in it, the incentives would reverse.
> PoS where attacks are potentially way more expensive
I don't think Eric Budish agrees that PoS verification is categorically immune to this. The very last sentence of the paper mentions that it "will be interesting to watch [PoS] research develop, and see whether or not it constitutes a valid response to the critique in this paper".
This is a reasonable response - I definitely think blockchain is interesting but like I said, it's in need of some major additional refinement before it becomes practical.
>But cryptocurrency allows us to design systems that don't require any trust at all. They _cant'_ be corrupted, because a combination of incentives and cryptography keep everyone safe.
This article definitely doesn't describe a system that lives up to that ideal at all. Which is why it's so scary - when you remove manual oversight you're essentially saying "Hey, if you can hack this, you win!"
>That person just lost $12k to fraud and has no recourse at all.
The original person lost $12k by a mistake of their own, namely sending it to the wrong place. I wouldn't call that fraud. That this money is then in a weird unintended limbo and can be picked up by anyone who noticed, and someone tried to whitehat get it and give it back, and they failed, does still not make it fraud IMO.
I used to think the same way about blockchain, but I then saw a presentation about self-sovereign identity and I think it could be blockchain’s killer app.
This is being spearheaded through the UN and the ID2020 alliance.
Sell shovels during a gold rush, just like I did for mobile apps a decade ago.
That turns into open source contributions in packages that affect far more than EVM.
And some truly lucrative knowledge and utility. Except people want to debate utility whereas nobody batted an eye at mobile even though people only use like 5 of the hundreds of apps they have. (People made fun of apps getting big checks but it was all in fun, or congratulated individuals developers making 5-6 figures from app stores, but mention a dapp on a blockchain and everyone looses their minds)
Makes me think of the book Accelerando, where sentient viral corporations and Economics 2.0 posthuman intelligences running amok in virtual space, trading uploaded human constructs as currency.
I wonder how these bots perform the shorting. Do they take the modified instruction and increase miner reward to make it more prioritized than the original transaction? Such a bot would be hard to counter as if you set some reward value, even if it's extremely high, it would take it and increase it by 1. Even if you saw that value yourself and increased it yourself, they could counter your counter by inceasing again, the process continuing until everything is eaten up by miner rewards.
If you have multiple such bots, would they fight over the loot, increasing the reward until it's all given to the miners?
Are there any logs of rejected transactions that existed in the mempool? Is there evidence of such fighting?
Well, gas prices are insane right now so no doubt bots are bidding them up. Gas prices hit 250 gwei or so 2 weeks ago. $150 fees for some of these contracts and arbitrage aren't abnormal.
Wish I were, but I am too old to work in a start-up, and I have family to feed so I won't work for $30k/y. I am just spending all my free time reading up on the stuff - to me, it's the most interesting tech revolution since the early web of the 1990's
So, with front-running on Ethereum, am I understanding correctly that what is happening here is that bots are being used to look at buy and sell orders on decentralized exchanges and then sending their own tokens with a slightly higher gas price to get in 'front' of the detected order?
Writing this sort of bot seems like a legitimately fun and interesting thing to work on, but somehow I have less than zero interest in actually doing it. There's just something intrinsically repulsive about the entire blockchain world to me where I just don't want to touch it.
I don't mean to offend people who do love blockchain tech, in many ways I don't blame you. But is this feeling I have somewhat common? I'm not even sure how to justify it.
I have it too. I'm not entirely sure where it comes from, but some significant factors are:
1) Proof-of-work systems are pure, unadulterated energy waste (and an ecological disaster as long as we depend on fossil fuels). They cannot, ever, be allowed to become significant in the economy, lest our future will be building a Dyson sphere around the Sun just to power everyone's ability to pay for a hot dog on their way to work.
2) There are a lot of naive ideas about how economy and society works surrounding major cryptocurrencies.
3) The main users of cryptocurrencies are (AFAIK) criminals and amateur financial speculators.
4) Statistically, you can expect any random startup in this space to be a scam.
It's a wild west. Trading unregulated money tends to disproportionately attract the worst kind of people.
I spend a lot of time on Ethereum and wanted to respond to your points.
1) Yes, proof of work is terrible long-term, mainly because its cost scales with the market cap of the cryptocurrencies it secures. Ethereum is switching to proof of stake, which uses a normal amount of electricity and forever solves this issue
3) It's true that there are many scams/crimes in crypto, and that many or most holders of cryptocurrencies are speculators. What makes crypto different from tulips is that many speculators believe that crypto will come to power large portions of the world's financial and economic infrastructure.
4) Whether a random crypto startup is likely to be a scam depends entirely on your filters and definition of "startup". If you limit your population to projects or tokens with some level of social validation, such as being top-ranked on coinmarketcap or backed by in-industry VCs, then there're hardly any scams at all. Ethereum now has hundreds of quality teams working on many different parts of the ecosystem. For example, the DEX space (decentralized exchanges, eg. https://uniswap.org/) is very different than the layer-2 scaling space (eg. https://optimism.io/)
5) [It's a wild west...] Respectfully, this is an unkind or perhaps bigoted statement. I have many friends in crypto who are thoughtful, kind people. They think deeply about the ethical implications of the systems we're building. The same is true of many leaders in the space.
> Ethereum is switching to proof of stake, which uses a normal amount of electricity and forever solves this issue
This has been said for a few years now. The originally deadline for this was January 2020. Suffice to say, it didn't happen. I'll believe it when I see it.
Ultimately, Blockchain seems to me to be a solution in search of a problem. There are a lot of issues with the current implementations, and a lot of words about how to solve them, but these are hard problems, and there's no guarantees they're going to be solved, and they are often problems that our current financial tech industry just doesn't have.
> This has been said for a few years now. The originally deadline for this was January 2020. Suffice to say, it didn't happen. I'll believe it when I see it.
Definitely not the first time a tech product has been delayed!
The beacon chain (first phase of the PoS transition) is on it's final testnet right now and operating well. The community is hoping for a mainnet launch in November.
> Definitely not the first time a tech product has been delayed!
True! But in this case, the issue for most part wasn't just a delay because work took longer - but the question of whether or not it can be mathematically proven to work was open (and if it can't be proven to be possible and working, there's no point in trying). My intuition told me the result will be "it's not possible; waste in PoW is fundamental to these kinds of structures". I'm relieved to see I was wrong.
Thank you for the thoughtful response. I'll preface with saying that I listed my points as a contributors to the source of feelings I have about the crypto space - they're observations subject to selection bias.
RE 1. I keep hearing this for years now; I'll believe in PoS when I see it actually working.
RE 2., I just tend to keep finding (or being approached with) really bad ones. Last time I got excited was with FileCoin, but that seems to be... not moving too fast at all. I'll look into the quadratic funding/voting thing; it looks interesting, but from the brief overview, it's not necessarily crypto-specific.
RE 3. That belief is what I consider naive - or just perhaps I strongly hope it's wrong, because of point 1.
RE 4. That's true. I just keep hitting the obviously scammy ones - but that's perhaps because I'm an outside observer. Honest people who are knee-deep in crypto are definitely able to separate the wheat from the chaff.
RE 5. I don't doubt your friends are thoughtful and have strong moral compasses. But in that last statement, I was talking about trading these currencies in general - which counts in scam coins, bullshit "crypto! AI!" startups, and various criminals using cryptocurrencies for illicit trade. I would think this point is self-evident - an unregulated space with features that give more utility to criminals than to law-abiding citizens will, by definition, attract disproportionately more of the former than the latter. Also, when I say "disproportionately more" I really mean it, it's not a code for "everyone is bad".
https://beaconcha.in/ - this is an explorer for the proof of stake testnet. The proof of stake chain is called the "beacon chain". If you want to believe in PoS when you see it actually working, this site is actually that! The public testnet launched in the last month or so. They are hoping to launch mainnet later this year.
It's not an explorer, but a way to keep tabs on your (and others') nodes when it's not handy to e.g. connect with ssh. Only a small number of node operators are currently reporting to eth2stats, but hopefully that number will grow over time.
If by trading you mean people trading these tokens on exchanges, they almost certainly don't give a crap about whether or not something is a scam and are not looking for scams. They simply look for the required correlation, volatility, etc.
Compared to stonks, crypto exchanges have APIs that you can use to access them directly without a broker and lower and simpler fees (i.e. no minimum fees per trade, so you can easily make a bot and test it with low amounts and whatnot). Some jurisdictions don't tax crypto trading profits or have a lower rate.
> such as being top-ranked on coinmarketcap or backed by in-industry VCs, then there're hardly any scams at all
I have to disagree there. Looking at the top 20, I see
3. XRP (Market cap hugely inflated, vaporware)
8. Bitcoin SV (This is textbook)
9. CRO (Not obvious today but time will tell)
11. EOS
15. TRON
19. NEO (Depending on your definition of "scam" and maybe it was well-intentioned initially, but having tried implementing for it, it's nowhere near living up to what they claim the current state is)
Then there's Tether/USDT, which I know is a contentious one given their history.
I'm very much a long-term believer (10y+ until ready for mainstream, and even today an important hedge to mainstream finance and national economies) but we shouldn't fool ourselves into thinking the majority of current volume is not what we'd like to believe it is. There's also the fact that you can have a big team of well-intentioned and intelligent people being orchestrated by a charismatic and convincing charlatan. There are multiple historical examples of this.
> 5) [It's a wild west...] Respectfully, this is an unkind or perhaps bigoted statement. I have many friends in crypto who are thoughtful, kind people. They think deeply about the ethical implications of the systems we're building. The same is true of many leaders in the space.
Its undeniable that the proportion of criminals among cryptocurrency enthusiasts is far higher than in the population at large. I don't see how its unkind or bigoted to point that out.
This is a well-articulated list, and captures a lot of my negativity towards crypto.
But as I like to keep an open mind about new tech, I always wonder if something like this could have been said about the early days of Linux:
1) Open-source is pure unadulterated theft of other peoples' work. This model cannot ever be allowed to become significant in the software economy.
2) That people who are into open source have naive ideas about how economy and society works.
3) That the main users of Linux are into other shady activities like hacking (the bad kind) and ripping other people's work.
The main reason I think the analogy doesn't hold that well is that we are now a decade into crypto with few signs of adaptability, while within a much shorter duration you could say that Linux was already showing signs that it was going to lead to a paradigm shift in the software industry.
Having just typed this I realise that one can argue that within a decade the market valuation of bitcoin (whatever that means) reached $200B which is a spectacular achievement, and one can argue that that is its way of showing that it will be a paradigm shift of something in finance.
I'll concede that points 2) and 3) could plausibly be raised in the early days of Linux. Point 1) - I don't think so. Nobody is stealing anything; people are voluntarily giving it up for free, for the benefit of the community. What could be argued is that "open source is literally communism" (therefore bad) - and I believe it was argued at some point.
> one can argue that that is its way of showing that it will be a paradigm shift of something in finance.
Judging by the recent interest of large financial institutions and corporations, I agree - there will be ripple effects of this, one way or another.
> I realise that one can argue that within a decade the market valuation of bitcoin (whatever that means) reached $200B which is a spectacular achievement
I've been on HN long enough to catch the cynicism which tells me that tech market valuations are pure bullcrap, so I'm not reading much from that number :).
I remember having discussions online with people who passionately argued that open source software was effectively theft from programmers at large--permanently filling niches that used to gainfully employ coders. I remember a guy who had some little utility he'd been selling online, which had been providing an income stream for him for years--and then along came some little free tool (that he claimed was an obvious rip-off) that did the same thing, and his income dried up. He absolutely thought OSS was theft.
Also, SCO, MS, and other companies certainly did try to paint a lot of open source software as explicitly stolen or copied. They always stopped short of providing proof, but that sure didn't stop them from making wild claims. SCO in particular went on and on about the sheave of Unix code they'd identified in the Linux kernel (while asking the judge to extend the deadline yet again for them to have to present evidence).
I work in the crypto space and the ability to side step regulations that I find ridiculous is a main selling factor. Red tape has stifled not just the financial space but the entire economy. If you want to cut hair you need 2000 hours of training and tens of thousands of dollars paid to scam schools, when YouTube and brochure on how to sweep hair from the floor is perfectly adequate. How is regulation fair again?
"Satoshi, grant me the serenity to accept that some regulations are good, paid for in tears and blood. Grant me the courage to work towards changing ones that are bullshit, and not just ignoring them. And grant me the wisdom to understand Chesterton's fence."
> I work in the crypto space and the ability to side step regulations that I find ridiculous is a main selling factor.
Yeah, that's my point.
> Red tape has stifled not just the financial space but the entire economy.
After 2008, that's really your opinion?
> when YouTube and brochure on how to sweep hair from the floor is perfectly adequate. How is regulation fair again?
I guess let's get rid of driver's licenses too, while we're at it? After all, if someone feels their driving skills need improvement, they could always voluntarily apply for lessons or download an app or something.
The Ethereum community started talking about this five years ago, which spawned a multi-year effort to move to "Proof of Stake" and stop using large amounts of electricity forever.
Since 99% of blockchain app activity occurs within the Ethereum ecosystem, and Ethereum is dropping proof of work, we should put to bed the idea that crypto industry insiders don't care about this issue or aren't doing anything to solve it.
Exactly. And PoW systems have built-in dampening ("difficulty") that make sure you need to burn even more energy as the system gets used, just to stay where you are.
I sometimes joke that Bitcoin is the closest we've came towards defining trust as a physical quantity - with the unit being watts. You can get a good approximation of the lower bound of the energy costs of trust by just comparing it with a trustful system that is regular economy. In other words, that is how much energy is saved by not pursuing trustless systems. Trust is a very powerful optimization trick.
They do, they blabber about how it's not actually waste because people value the waste. It's effectively a logical extension of the marginal value theory applied to ignorant self-destruction.
While they will talk about marginal value, they don't talk about entire systems incentivized to operate by creating value destructively, aka externalization at its finest.
If there is a geothermal source of energy in a location that is impossible to transmit electricity from, and you use it to mine bitcoin, is this immoral and a “waste” of energy? This literally happens in Iceland.
Not only that, the Proof-of-work system also is prejudicial to holders.
Miners are constantly dumping their newly mined coins to pay for there astronomical electricity bills. (constant selling pressure isn't good for the price)
Also, most of the mining power is always in china, so that isn't good.
Mining is very centralized, miners can just join forces and 51% attack the network, which seems unlikely but not out of this world. It surely can happen, specialy if they find a way to be very profitable.
51% attack a network, or using exploits isn't illegal.
> 1) Proof-of-work systems are pure, unadulterated energy waste (and an ecological disaster as long as we depend on fossil fuels). They cannot, ever, be allowed to become significant in the economy, lest our future will be building a Dyson sphere around the Sun just to power everyone's ability to pay for a hot dog on their way to work.
Proof of Work gets a bad reputation because people have a hard time wrapping their heads around why it is useful. People don't complain about all of the energy that goes into making concrete, or transporting people around, or making houses cooler, because the impact of these things is more direct and less abstract.
But proof of work has a massive benefit that - as the market shows - well outweighs the cost. Thanks to proof of work, a group of counter-parties that are all fully mutually distrusting can interact with eachother without electing a mutually trusted subset or finding a trustworthy third party to facilitate the transaction.
Within the rest of society, trust is extremely expensive. Large financial institutions are only able to operate within the context of a massive court system with a massive law enforcement arm and necessarily privacy violating technologies like KYC. Proof of Work allows us to throw all of that away and use something much simpler and more privacy preserving! You trade one expense for another, and in many cases, Proof of Work transactions are able to succeed in areas where banks could never reasonably get established. That is _massive_ value added to society. And yes, the cost is this giant proof of work engine that burns a lot of electricity. But it's not _waste_, it's serving a key purpose that nothing else is able to serve.
In areas where trust is cheaper than Proof of Work, you should use trust instead of PoW. But the world is full of places and opportunities where PoW is by far the cheapest way to get something done.
I haven't done the exact math (I'm sure somebody did, though), but I based on some rough estimates I do believe that for widespread use as currency, trust-based systems beat trustless systems significantly in terms of energy efficiency. Partly because scaling factors - trust scales sublinearly with the number of participants (like average path between two arbitrary vertices in an acyclic graph). PoW energy use scales superlinearly. On top of that, energy use in trust-based systems is upkeep - it's a waste that participants have to pay out of their pocket, so everyone has strong incentives to minimize it. Whereas in PoW systems, energy waste is network security, so the incentive is to maximize it.
"Massive court system with a massive law enforcement arm" doesn't exist just for the large financial institution. It's the baseline, arguably the core piece of social infrastructure. Beyond finances, it serves to protect just about any kind of dealing that involves more than two people. It allows society to coordinate. So if you want to count that in, be sure to limit the scope to just the impact on securing financial deals - otherwise, you'll have to include on the crypto side of the ledger the costs these institutions incur so that crypto developers can spend their days developing financial systems, instead of hunting animals for food with rocks while hiding from the local warlord.
Citation needed? I don't believe this is true. And techniques like payment channels allow you to stretch a significant amount of mileage out of a single transaction. The Sia network for example has payment channels that have over a million payments made per on-chain transaction.
That's also the role of prices - they are signals for people to take action, provided the actors are free. Prices as an information signal simply fail to work when entities like the government use coercive force to interfere. Prices also fail if the markets are based on coercion or violence towards others.
That's true - but arguably orthogonal to the topic of fiat vs. crypto. Yes, the government uses coercive force to interfere, but that's very often to counteract various failure cases of the free market. Another thing that makes prices fail is information asymmetry - which, in reality, is a constant of trade.
Crypto or fiat, there will never be a totally unregulated market that works.
In a way, it's like Star Trek TOS epispode "A Taste of Armageddon" - you can't replace war with a simulation (and then voluntary euthanasia). You won't resolve international conflicts through a friendly match of Q3 Arena. It's an unstable situation, because anyone who disagrees with the result can just pick up a club, or a gun, and force their own result - at which point you're back to square one. And so it is with unregulated markets: someone feels cheated, picks up a gun, and you're back to some form of governance.
> 1) Proof-of-work systems are pure, unadulterated energy waste (and an ecological disaster as long as we depend on fossil fuels). They cannot, ever, be allowed to become significant in the economy, lest our future will be building a Dyson sphere around the Sun just to power everyone's ability to pay for a hot dog on their way to work.
> 3) The main users of cryptocurrencies are (AFAIK) criminals and amateur financial speculators.
The problem is that to fix this, we need governments to wrap their heads around this.
Cryptocurrencies exist as a thing that allows people to engage in pseudonymous financial transactions over the internet. It's going to be really hard to put the genie back in the bottle. Particularly for black market transactions, because then you can't even ban the currency since they'll just ignore the ban on the currency at the same time as they're ignoring the ban on the product the currency is being used to pay for.
Which means that the best thing we could do is out-compete it using a more traditional financial system. When the existing KYC laws have already been voided by the use of cryptocurrency, just admit the loss, stop yielding a competitive advantage to the system which is destroying the environment, and let people have pseudonymous bank accounts and smart contracts and so on, in ordinary banks and based on the trust in ordinary banks and governments rather than the trust in proof of work.
That would destroy the utility of cryptocurrency, and it could be the only way to really do that.
Proof of Work is on its way out already. Ethereum will be running on Proof of Stake soon which uses very little power.
I'm not sure the traditional financial system would ever out-compete the cryptocurrency ecosystem even if you removed the KYC etc as crypto is permissionless which is a breeding ground for innovation and efficiency. It would be impossible for the banks to keep up.
"Breeding ground for innovation and efficiency" also means breeding ground for various scams. The traditional banks have a good value proposition here, should they choose to take it: they can copy the innovations that work, bolt them on top of their product, and offer something that is both innovative and is secured by men with guns.
Yes there are scams. There are scams with any new technology and people have dealt with them in various ways for hundreds of years. I don't think that will ever change but our ability to point them out and protect ourselves from them will.
>they can copy the innovations that work, bolt them on top of their product, and offer something that is both innovative and is secured by men with guns
I don't think this has ever worked. By the time they have cut all of the red tape and finished bolting this feature onto their enormous enterprisey stack the world will have already moved on and the Ethereum ecosystem will be on The Feature 2.0. Also, if your security is provided by men with guns then those same men with guns can change the rules on you or the bank which makes your money much less secure. I'd take "mathematically impossible to cheat" over "men with guns might be angry if someone cheats" any day.
> I'd take "mathematically impossible to cheat" over "men with guns might be angry if someone cheats" any day.
This may be the point we disagree on fundamentally :). To me, "mathematically impossible to cheat" usually comes with "mathematically unforgiving of mistakes". I estimate chances that the government will cheat me out of my money to be much lower than me getting crushed under a smart contract that, in the fiat land, a human judge would invalidate based on circumstances.
Writing this, I realized I'm thinking from the POV of someone living in a democratic and relatively sane country. I guess the risk calculus is different when you truly, deeply mistrust your nation's government.
> It means that you have to take precautions instead of the government telling you what you can or can't do (using money they took from you anyway).
That's true! And I do prefer the world in which I pay the government to take care of this, because as an individual I have no chance against organized, professional scammers. Wild West is a fun thing to watch in movies (or at least the fictional recreation of it, with more shooting and less filth); but definitely not a nice time to live in, compared to today.
> I hope that the cryptocurrency that ends up winning is energy efficient.
That needs to be a structural change though; shaving off factors of the exponent in the middle of PoW isn't going to help. But 'spir here says that Ethereum cracked the proof-of-stake, which is the exact development that needed to happen for crypto to be feasible.
The only thing I'll note is that Ethereum has committed to moving to Proof of Stake, albeit at a glacial pace, which * should * mostly remove the environmental destruction. The leadership does seem committed, although the rollout is slow.
Not really a fan of crypto overall (although I own some eth as a hedge in case it takes off), not contesting your other points.
Is PoS actually proven to work, the way PoW is? I keep revisiting this topic every now and then, and I always see it in the stage of "we think it should work, but we kind of don't have a mathematical proof just yet". From which I conclude it will most likely be eventually proven to not work at all, and we'll still be stuck with PoW.
Yes, PoS has been proven to work. The research problems are solved. A public testnet of Ethereum's proof of stake is currently live. https://medalla.launchpad.ethereum.org/
Thank you. I'll rethink my perspective in light of this. Energy use concerns were always my primary concern wrt. the entire crypto space (scams will diminish as the space gets regulated, but energy profile of PoW looked like an insurmountable problem in principle).
The feeling is common and here is a justification for you. The bitcoin network now takes 7 nuclear power plants to run [1]. Last year it was responsible for 0.21% of the worlds supply of energy [2]. Whatever benefits it brings (are there any?) I don't think it justifies the environmental cost even if some of the energy used is renewable and close to the source.
Also think what all those engineers could do with all that effort.
Uh... who cares? How many power plants keep houses cool when you can just sit in the shade and meditate? If the market pays the fee then that’s the reality whether you like it or not. I find the fact you use a computer at all mildly distasteful given the energy required to power it.
It's a sentiment that gets expressed under most every blockchain-related submission on HN, and I wonder why.
Maybe it's something about blockchain tech, but I have the nagging feeling that HN is just getting old and complacent. If this community had existed, in 1995, on a BBS, it probably would have found nothing but fault with the emerging web.
I can't understand why a tech-minded person would find blockchain repulsive. It's (in the case of Ethereum) the biggest and most powerful distributed computing environment. BTC has a history of no major losses or exploits in 10y of existing in the most adversarial environment I could think of.
HN meanwhile: let's get totally over-excited by a new ePaper reader with drawing functionality.
Because blockchain keeps promising things and never delivering anything of actual value.
The community appears full of -as another commenter put it: “Blockchain culture is full of Ferengi-style near-religious greed”. Crypto-anarchists with an axe to grind about inflation and monetary policy/government spending.
I find the technology fascinating, if woefully inefficient. It’s a novel idea whose use case doesn’t seem to markedly improve things for the average user, but introduces a number of downsides.
> the biggest and most powerful distributed computing environment
That does what exactly? Wasting energy to determine if I can transfer $0.3 to my friend to demo it? Suppose you wired them and ran scientific studies/simulations. You’d probably get more useful results out of the energy you just spent.
>Because blockchain keeps promising things and never delivering anything of actual value.
Which is true for every early field. I was around in the 2001 dot-com bubble, and it wasn't different. AI has a 70-year history of broken promises, but lately seems to come into it's own. Quantum computing is another hyped tech that may or may not change the world. Video-telephony was hashed out in the 1970's and only after roughly 2010 has become reality.
>That does what exactly? Wasting energy to determine if I can transfer $0.3 to my friend to demo it? Suppose you wired them and ran scientific studies/simulations. You’d probably get more useful results out of the energy you just spent.
All snark aside, it's much more than sending money around. You have a fully digital system of distributed apps that can interact and very strong assurances to authenticity of the results. Finance is only one area where that sounds interesting, logistics, provenance, data recording in regulated fields like health-care or polluting industries, notary services, cadastral land registers, IoT are all fields that could profit from machine-to-machine interactions that are free from human interaction.
> Because blockchain keeps promising things and never delivering anything of actual value
My friends in Argentina would disagree
Blockchains (Ethereum specifically), cryptocurrencies and decentralized finance have allowed them to exit their broken financial system and survive hyperinflation.
They all get paid in stablecoins across borders, self-secure their funds using smart wallets like Argent or Gnosis, and earn good interest rates using lending protocols.
I think many of us forget how broken the financial system are outside of western developed countries.
The value proposition in my head is you can pseudo-anonymously transfer any amount of value for almost no fee across any border to anyone else in the network within minutes. The implementation details aren’t great (energy wastage) but it is a working MVP of that imo.
I don't know about "repulsive", but currently it seems like blockchain burns a lot of electricity (=> CO2 emissions) for very little purpose. For that reason I currently stay away.
Perhaps at some point someone will design a distributed blockchain system that (a) isn't a total power hog and (b) provides some sort of human curation that I can do so that I'm not hosting someone else's NSFL picture collection.
there are plenty low power proof of stake blockchains. they are becoming a lot more popular for scalability and efficiency reasons. currently everyone is on the hunt for the next proof of stake 'ethereum killer' with a lot of speculative investment. ethereum itself is planning a migration to proof of stake.
right now, i'm not personally a huge fan of proof of stake because of the 'nothing at stake' problem, but one will eventually take off.
Storing everything forever perpetually on the blockchain just doesn’t seem like a feasible or good idea to me, and the wasted computation to do anything is annoying. The whole space seems filled with people who hold similar views about economics: all inflation is bad; all government and financial intervention in the economy is bad; all our money problems would be solved if people could just trade with each other, etc.
Also, pet peeve-many times I’ve heard blockchain enthusiasts talk about this idea that you can just put your data on the blockchain and pay a reasonable free and people will keep it there forever, you can move all your business computation to the blockchain by paying people who perform the computation. Nevermind how much of an outrageously poor idea that is: why on earth would I store my data on there, encrypted or otherwise? Why would I want random people carrying out business critical computation for me? Some of the chains are already pretty huge, can you imagine how big they’ll balloon out to within 6 months if businesses started lumping all their stuff on there, let alone 10 years. Storage being cheap is the “throw more hardware at it to make it go faster” off blockchains and is in no way a good fix, not is it in any way preferable to running your own machines.
> why on earth would I store my data on there, encrypted or otherwise? Why would I want random people carrying out business critical computation for me?
Well, I am working in big old industry outside the USA and we just bought a data ingestion solution from... Palantir! The NSA company which is basically a spy arm of the US government.
If it saves a buck, companies will do way dumber things than move to blockchain in an instant.
Also, storing data on the BTC or ETH chains isn't economically feasible - there are chains especially for that and usually, you just store the SHA-256 hash of your data on chain to prove authenticity while storing the data off-chain.
I can attest that I have a distrust of Brave Browser purely due to it's use of blockchain tech. I don't even have that much against Brendan Eich. I just think any use of blockchain technology for fiscal purposes is a way of financially incentivizing spam.
I think financing a company with a token is a very interesting experiment. But if you prefer, take your 0.1% equity vesting over 5 years from some MBA and let him tell you what to build. Way better system emirite?
It is pretty common, and substantiated by the scam networks that surround "coins" based on ethereum contracts, the fact that anyone with enough computers and bandwidth can have a majority of votes in any publically available block chain and that contract authors are fallible.
The traditional american school of thought on money is that
1) the optimal supply of money is externally determined by the needs of commerce for liquidity,
2) new money can be created to meet the needs of commerce through public loans secured by real property pledged as collateral without any fixed artificial limits on supply
3) money may be circulated with an expiration date to discourage long term hoarding,
4) general governments should retain the ability to suppress the private issuance of bank notes and regain public control of the circulating medium of exchange in order to emit unsecured notes to pay for defensive war expenditures in the event that it cannot obtain loans from private banks and it is existentially necessary to do so
So some of the ideals espoused by blockchain activists may clash a bit with that.
I've never heard of 3, I love the idea, but it's literally the first time I've heard of it. Are there any sources that that is indeed a common opinion?
I have it as well. But I recently started to think about it differently.
I think the reason people dislike blockchain so much is because the promise that blockchain will do DoEverythingBetter™ is not very convincing.
All things considered, this industry is pretty small... but it's an industry. It's already been around a decade and could easily last for many more.
In that time, people who work in the blockchain space will bring those ideas, concepts, and ideologies to other industries.
When you think of it that way, looking under the surface for interesting ideas does not seem so far fetched. I think this post did a great job telling a story about the new and fascinating concepts.
I think it was more interesting when it looked like there would be use cases other than speculation. The first example in the O'Reilly Bitcoin book has someone buying a cup of coffee, these days most cryptocurrency proponents would laugh at it.
(Someone will reply that you're supposed to use a layer 2 protocol for that, but that looks insanely complex for most people.)
It always makes me think of that STTNG episode where they destroy the Borg collective by injecting a fascinating but impossible geometry problem. Cryptocurrency basically did that to the hacker and startup spheres, wasting unfathomable amounts of money, resources, and brain power.
Do you honestly believe, and this is a real question, that all of these brilliant people who come from well known companies spend nearly a decade of their life working tirelessly on building an ecosystem that many thousands of other developers interact with daily, just haven't realized yet that it's completely useless?
There are complex developed pseudo-sciences filled with serious people too deep and stubborn and too invested and too old to start over - so they continue, creating a masterpiece of fiction that carries too many fools to ever end. Religions, pseudo-sciences, short sighted and impossible political ideologies are rampant today and have been throughout human history. Of course I believe it is a sham.
I agree. I don't even understand what is happening here honestly, and why it is seemingly so popular. Could someone explain what exactly these bots are sniping, and why it's so hard to avoid?
This is a super special case and I am honestly amazed that some bot is watching for it.
The common use-case on Ethereum is sending tokens from A to B, and that can't be front-run or falsified by a bot. This is the original use-case of crypto: sending around symbolic tokens that represent money.
Ethereum also has a lot of other usages though, and here is where it can get hairy. For instance, exchanges exist (Uniswap) where you can swap Token A for B. However, your intent is an Etherereum transaction which can be read by bots as you publish it and can be front-run if you are not careful.
In this case, someone basically misplace money: instead of sending it to an account, they put it onto their car rooftops, up for grabs. And then, some Mexican stand-off happened: the bots wouldn't notice but once the white-hat hackers moved, the bot would try to grab the money faster.
Ideally, the white-hatters would have crafted their Uniswap interaction in one transaction - they are atomic and the bots wouldn't have a chance to interfere. But it got late and they tried to hammer away the problem and allowed the interaction to spread over two transactions.
I suspect it's a political bias. It could be that you see that the blockchain frees people from traditional controls that you have long internalized as valuable.
As such, the permissionless-ness of it, where anyone can send value to any one or thing, for any purpose, evokes disgust.
It's basically libertarianism, institutionalized as a technological platform and network, and if it succeeds, it means the ideological camp you identify with will have suffered a crushing and lasting defeat.
I would say its a measure of maturity as a developer if you have no interest in touching something that has no use and is 99% hype. I would not have a problem of working on a useful blockchain in my job, however it remains to be seen if there is such a thing.
Blockchain is like a solution without a problem. The only thing that can be done with blockchain that can't be done without (i.e. decentralization) is something that mostly has no application in the real world. And there is no need for it because the technology for that exists since over 2000 years. If it was needed, someone would have done it already long ago.
But who knows, perhaps at some point in the future a use case will emerge.
> On Wednesday afternoon, someone asked whether it was possible to recover Uniswap liquidity tokens that had been accidentally sent to the pair contract itself.
Uniswap itself is a pretty interesting protocol:
> Uniswap is an exchange protocol that allows users to trustlessly swap ERC20 tokens. Rather using the traditional order book model, Uniswap pools tokens into smart contracts and users trade against these liquidity pools. Anyone can swap tokens, add tokens to a pool to earn fees, or list a token on Uniswap.
I thought the biggest flaw in 3BP was that none of the characters and none of the unknown assailants seemed to do any temporal discounting. A species that might be a threat in a billion years is not worth worrying about now. Resources should be used for immediate survival, not for eventually-it-might-be-nice extermination. It made the story seem more like a fantasy of contending royals than speculative fiction of scientists and soldiers. Of course, it probably seems natural to those who have different priors than I have. It's funny to see it cited in this context; I'm sure everyone on Ethereum knows about temporal discounting.
"A species that might be a threat in a billion years is not worth worrying about now. Resources should be used for immediate survival, not for eventually-it-might-be-nice extermination."
In the third book we are treated to some pseudo-dialog between an attacker and their supervisor(s) deciding whether to preemptively attack an area of space (trying not to spoil here) and the options on the table - a tiny kinetic strike at near light speed vs. the "flattening" that they eventually decide upon are both presented as nearly zero-cost...
We know from discussion elsewhere in the story that "photoids" are considered to use at least a solar system's worth of energy. In the passage you cite we learn the "two-vector foil" uses even more (which makes sense given the fantastical nature of this attack). ISTM the party who has "easy" access to an armory of these doomsday devices will have to wait a really long time for a good reason to fear the party who is still stuck in orbit around a single star.
Liu does lampshade the idea that performing such high-energy attacks should itself be a giant "here is a dangerous enemy" signal, but does so just to write it off as something that never happens. At the very least, frugal genocidal galactic civilizations should probably leave it to other genocidal galactic civilizations to actually do the tremendously expensive genociding. Given the eagerness we see in this passage, it can't be uncommon for multiple attacks to be launched by different parties simultaneously!
It's a great trilogy, and I'm glad Netflix are going to do something with it. (I really hope they don't whitewash the casting like many other productions. The fact that most characters are Chinese is important to the story.) This particular aspect just stood out to me.
Not sure if it's covered in the novel but reading this really makes me think these adversarial environments could be very cool hosts for emerging (or seeded and self replicating) intelligent agents some day.
Ethereum or some other cryptocurrency will likely be the 'glucose' of future AI organisms.
I'm excited (and slightly terrified) to consider a future where autonomous agents rent compute time to host themselves, provide 'services' autonomously within the cloud to earn funds, and then periodically reproduce by splitting their wallet and moving it to a new host. Add in the ability to mutate (or even hire humans to implement directed mutations), and I think this hits all the requirements for my definition of 'what is a living organism'.
Did the author get permission for this attempted Good Samaritan deed? Or did he go out on his own and screw up the implementation without the contract owner's knowledge?
He says it in the article. The first person to call that function gets the extra money. Why would you ask permission in that case? You can't make it worse.
I don't think what the author did was illegal. This is more of an ethical consideration where consent should have been requested from contract owner before doing a known risky operation.
The Copenhagen Interpretation of Ethics strikes again. OP tried to help and didn't actually make things worse, but they touched the situation so now it's their fault.
Nothing in this article seem to make any sense, does the gibberish pseudo-code actually mean something for anyone?
I feel like the dumbest of all (and maybe it's normal it's far away from my area of expertise). But seriously this sound more like a sci-fi plot that actual engineering.
There's no pseudocode in the article. There's Solidity (what the contracts are written in) and there's Javascript (what the rescue script is written in).
I'm glad someone else feels like this. One of my friends is in the space, and I don't understand anything he says. I wonder if this community has created a whole language / framework to give a feeling of value to what they are doing. It's kind of like gamers talking about KDA, meta, etc.
My god, have you tried to explain React code so someone outside of coding? Every field with any kind of intellectual depth invariable has to create an own set of terms to describe what they are doing.
Stop talking down on people just because you don't understand their jargon. Either keep quiet and learn or don't judge at all.
And maybe also stop talking down on people just because they don't understand your jargon. Either keep quiet and learn what's not obvious for outsiders or just explain your jargon so that more people understand it.
I have dabbled extensively in the "traditional" *coin scene, but always shied from eth and the associated ecosystem. Stories like this are the reason why.
While I could articulate -and genuinely believe in- a raison d'être for the alt-finance tools created by blockchain systems, the premise and concrete value of the exceedingly sophisticated mechanisms in ethereum continue to elude me.
Given the primitives of account & transactions through distributed ledgers, one can construct a wide variety of services and use cases that interface with the real world on the user side and on the 3rd party service side.
Are there any services and use cases in ethereum-land that are actually oriented towards users? Because it seems to me that the only group getting measurable value beyond education are actors seeking to extract profit from "legitimate" value store or flow.
And I thought getting away from them was the entire point of Bitcoin et al. for the ordinary man.
A lot of this DeFi stuff is about people getting returns by providing liquidity to financial instruments that would have been done by centralized exchanges otherwise. So, still speculation driven ultimately, but not totally useless.
The whole thing is a complicated, wacky game. The DeFi stuff is especially fun right now. Opportunities (and danger) abound. There is so much money locked up in DeFi.
It's not necessarily always good for the bots either. They can be exploited and tricked as well.
Is the money really "locked up"? No money actually enters these systems; whenever someone buys a token with money, there was someone else selling that token for money, and the money went from the buyer to the seller, who is free to do anything with that money.
You are confusing money with value. Value is what something is worth and is what people prize. Money is just a convenient way to transfer value. I think you got stuck on that one piece of money (USD) that went from buyer to seller but forgot that the value transferred between them as well.
hmm, maybe you are referring to money as currency, where i am referring to it as assets (tokens)
anyway, yes there is money locked in the lending platforms. most of it is used as collateral, which is locked when borrowed against. the reserve ratios are high (60-80%), so unlike a regular bank, no money is "printed" when lent.
"real money" does enter these systems. people spend resources to acquire real money which is subsequently traded then locked into these platforms. also, while a lot of ethereum tokens are simply minted with no real backing, some are mined (even erc20), which again people dedicate finite resources to
Why did they try rescuing the $12,000 pot on their very first attempt instead of planting a bunch of $10 dummies and rescuing those instead? Once they perfected how to rescue the dummies, then move onto the real target.
We also couldn’t have been sure that a method that could recover $10 would be able to recover $12,000. Bots won’t bother to snipe opportunities that are too small (they have to put a little money at risk to even try).
Finally, there was a nagging worry that demonstrating this kind of transaction for the bots could “teach” them to look for this opportunity, which could lead them to this money even before we tried to pick it up (since they could scan the blockchain for it). I had heard that these bots sometimes used recent transactions as “hints” to look for new profit opportunities. It sounded like a wild idea, but all of this was pretty wild.
This paper is really worth a read, if only because it shows how much smart contracts is a brand new territory, mostly unexplored, full of opportunities (and therefore dangers).
If you're a blockchain naysayer [1], I'd invite you to go read this paper to measure how deep, rich and complex the world of smart contracts is, and at the very least get a feeling that you may simply not know how uninformed your negative opinion is.
For me, there weren't enough words to actually make any sense of it. What I got is approximately "if you try to do ethereum stuff, bots will somehow do the same thing but earlier, and you'll lose your money".
Agreed, somehow bots are able to jump the queue but there’s no description of how or why that’s possible. Why would the bot transaction be given higher priority than the submitted transaction?
There's an old idea called "front running". Back when the stock market was based on pieces of paper being passed around, you could hear something useful/valuable and literally outrun the other person to make a profitable trade.
To understand the equivalent in Ethereum you need to understand 3 things:
1. All transactions require something called "gas" which is based on the complexity of the transaction. The simplest transfer is 21,000 and seriously complicated tasks can go up to millions (11 million-ish is the cap now)
2. Miner's get to decide which transactions go in the blocks they mine. They get the fees associated with those transactions, so they pick the most profitable.
3. You don't get to decide how much gas your transaction uses, but you do get to decide how much Ether you're willing to spend per unit of gas, e.g. gasPrice of 3 Gwei(1/1,000,000,000 of an Ether) means you multiply your 21,000 gas transaction by .000000003 and that's how much Ether the miner gets for including your transaction.
Net Result:
Right now on Ethereum Mainnet 100 Gwei is standard, so I see you have a transaction waiting where you offered 100 Gwei. I just swap out my address instead of yours and offer 200 Gwei. Now a miner will pick up my transaction first because they get twice the profits for the exact same amount of work.
“Mempool” is a pool of transactions and price offered for each VM instruction rather than a queue.
Frontrunning in this context is detecting transactions that yield in profit and submitting them to the pool with a higher price for each instruction (gas price).
They (by accident) put the money in a spot where anyone can claim it. Arguably, that's where they lost it, OP just tried to recover it without someone else noticing "ohh, there's free money there" and failed. (that's not a very satisfying answer, but pretty much seems to be the logic behind those things)
I'm not sure when Ethereum supporters would wake up. Ethereum's design creates this kind of Dark Forest problem. When it is programmable, you are at risk of being overpowered by bots. Computers are far more efficient than humans. Smart contracts are not smart. If they're too complicated (smart), humans can't comprehend them. So they're mostly dumb. Bots will overrun humans. With Ethereum, you know you're entering a digital Dark Forest. But you still want to explore it. You venture into the Dark Forest and got attacked. It does make an interesting story. But it's a fairly useless system.
With cryptocurrencies, you want to "slow" the system down. You want more redundancy. You want less efficiency. It's the only way to fight the automation monsters. Bitcoin is money. Ethereum is a fun and experimental Dark Forest.
Does anyone else think that Solidity is far too low-level for the purpose it serves? I really don't think connecting to ports (as an example) should be something in a financial contract.
Yes. They should have gone with something simple and declarative, like decision tables.[1] Those have a finite number of cases and can be exhaustively tested. Which is what you want for a smart contract for something real.
But no, they had to make it Turing-complete. That failed quickly. Remember the DAO debacle. That should have been a teaching moment. But no. Because the people burned were insiders, the whole Etherium blockchain was split to rescue them.
At the very least people should be formally verifying the behavior of their smart contracts before investing millions of dollars in them. The ETH VM is actually pretty simple to model and formally verify at least some of the basic properties of contracts.
Thinking that buying coffee is an important use case for Ethereum is pretty ignorant. It's literally holding billions of dollars in value and building an ecosystem of companies that work together with a shared purpose. Just because you can't buy a coffee with Ethereum for some reason doesn't mean it's somehow failed.
It’s far too everything. Too low level, too high level, bad abstractions, bad syntactic constructs, bad evaluation model.
The more I see people burning themselves on “smart contracts” the more I realize how deeply thought through bitcoin’s design is. Creators have thought of so many things in advance, it’s outright creepy.
That’s a myth. Blocksize limit increase was rejected by all parties relevant to bitcoin: miners, developers, users, and merchants.
Blockstream has no control over bitcoin protocol. They built a product on top of it and there isn’t anything in bitcoin that prevents you from building a competing product.
IMO this is why anyone dumb enough to spend time building trading algos for crypto should really just use that time looking for vulnerable smart-contracts / projects if they actually want to see returns LMAO.
I used to work in the space in the blockchain tracing space - I helped build one of the first intelligent tracing systems that could handle tokenized assets on ETH.
Similar things happen with real money all the time. Many players can hack, over charge, short, manipulate etc. It may be less obvious, or somehow perceived legit, but we are not really shielded from other players taking our invested money with all kinds of "financial tools" that are hard to understand. Ethereum is just more direct, more feasible
Perhaps due to a certain naivete I enjoy almost all discussions on HN. There are few exceptions and discussions under blockchain-related posts are the a prime example. I will disclose right away that I wholeheartedly think that blockchains are here to stay and to solve many problems. The general sentiment on HN, and this thread so far is an example, seems to be animosity toward the idea in general lightly veiled by pretext of pointing out technical challenges (which are numerous, I do not think the most ardent blockchain proponent will deny). Every time I try to point some great ability of "smart contracts" in return I hear blanket unthoughtful responses like "well how is it better than a database" or "how is it better than a REST call" (for example this exchange about the Baseline protocol https://news.ycombinator.com/item?id=23824584).
Perhaps starting with a general accusation of the community is not the best method. But I'll move on... There are things that are very important to understand about blockchain. The most important one is that the technology and the systems built on it are _extremely_ young. Blockchain is like the 80s of computing. I would compare it to editing Unix system settings with "nano" to adjust a basic setting of your operating system - lots of horror stories for sure. The big difference is that people are out there to make money off of your mistakes. Yes, it can be a hostile environment. As the article alludes to - full anonymity of transactions is still in the pipeline! I do no know a single blockchain project out there that allows to interact with contracts anonymously yet. If blockchain is still alive a few years from now (and I have little doubt about that) then things like Optimism (mentioned in the article) will have made a whole array of shortcomings obsolete. Awesomeness does not happen overnight, it took _decades_ for the internet to become the ubiquitous integral thing that it is now.
Actually, I'm glad the author used Uniswap as an example, because it is a simple and powerful system that would not have been possible without blockchain. (Aside: Uniswap is actually one of the first products to create a POC of running on top of Optimism's Optimistic rollups, so they are no unaware of issues). It was conceived initially by Vitalik himself and implemented as an Ethereum grant. The basic idea is that a contract controls two pools of tokenized assets. The assets are provided by people who get a cut when a trade happens. The price of assets being exchanged is equal to the ratio of their quantities in every pool. That is it!!
Now, why do I think that a system as Uniswap is awesome. Right now most tokens are either tokens for other projects or USD. As the variety of tokenized assets grows (for example some Japanese banks are looking to create a digital Yen, and there are clues that suggest it might be on Ethereum) what you get is an extremely simple no-middlemen system for exchanging things of value. Now, in theory, any programmer can write a program, say, for currency exchange in one evening - no middlemen, no 3rd parties to trust, no banks, no clearing houses and a basic API anybody can integrate. The system is not perfect, and that's what the article is about. But the concept can be revolutionary.
The blockchain money-grab is disgusting to look at. But do not throw the baby out with the bathwater.
I won’t dare to speak for anyone but me, but personally the issue I have with blockchain is that is a solution looking for a problem.
If you’ve ever done any business (sales/purchasing), you’ll soon see that trust is not really a problem. Trust is only a problem in single-transaction deals (two entities trade once and expect to never trade again), which is pretty rare. Even in that weird case, branding and reputation are actually quite good ways of providing trust.
In fact I would go further and say that the only entities that are impervious to the “conventional” approach are governments, by virtue of being monopolies.
I’ve heard amazing tales of what blockchain should be able to do, but so far it looks like they’ve failed in everything they’ve set up to do.
Blockchain currency (I’ll generalize a bit) was supposed to be a store of value. They are so bad at this that they’ve become an investing bubble, and one of the assets with highest volatility out there.
I’m still waiting for useful demos of blockchain technology that aren’t contrived situations or just smoke and mirrors for startups to get funded.
> If you’ve ever done any business (sales/purchasing), you’ll soon see that trust is not really a problem. Trust is only a problem in single-transaction deals (two entities trade once and expect to never trade again), which is pretty rare. Even in that weird case, branding and reputation are actually quite good ways of providing trust.
It absolutely is a problem in business, but maybe not in the businesses you have experience in. For example - try selling gift cards online for payment. Your only real option is credit cards, which is ripe with fraud, and involves hefty fees (2-3%). Cash for the internet (which is one thing "blockchain" enables), solves both of these problems.
I think the concerns are real. And I addressed some of what you are saying in a reply to the other comment. But I think the concerning difference in how you see the technology and how I see is due to the word "cryptocurrency". In seeing blockchain as only addressing payment or, worse, being an actual currency. Ethereum and other "smart contract" platforms are basically immutable virtual machines and people are coming up with novel ways to use it. Payments and currency narrative just sort of stuck. As I repeat often in these conversations my, by far, favorite project in recent times has been the Baseline Protocol which uses blockchain not for payment but for interbusiness communication. I posted some links of examples of it's use in my other reply: https://news.ycombinator.com/item?id=24313941
You sound pretty well informed, so I'm genuinely curious - what's the "killer app" of smart contracts? What use case do they fulfill that the traditional financial system just falls flat on?
Um, well I'll try my best. In a way it's true that it's a solution looking for a problem and I think we are seeing novel ways to use it. I think a problem is that people still associate blockchain with "currencies" and payment. That is a fairly narrow view of an immutable ledger.
A project that, in my opinion, gives a glimpse of the direction blockchain will go in is the Baseline Protocol - a joint project between EY, MS and Consensys. I have tried describing it in another comment [1]. But to give a basic idea is that it does not necessarily use blockchain to transfer value, but instead to coordinate two entities. Basically it puts communication between business entities exchanging, for example, supply chain orders on the blockchain. Essentially the blockchain becomes an auditable protocol for communication, reducing technical overhead and making things like adjudication easier.
Please forgive my ignorance, because I still don't get it.
Can you give me an example of how this would work in practice? What two assets would you swap in this manner, for example, and why wouldn't that work with traditional financial instruments?
Well it would work with traditional financial instruments. But what wouldn't work with traditional financial instruments is an ability to integrate with them in a matter of, literally, an hour or two. These systems are open and nobody can be stopped from inter-operating with them in any way their imagination suggests. If you wanted to write a bot that does arbitrage between Yen and USD you would be able to do it, easily actually.
If we are going to talk "decentralized finance" - I agree it is weird and dangerous, but I see it a proof of concept. You can get a collateralized loan in seconds, even if you live in a country where banking is almost unheard of. Yes, there need to be things of value that you own on the blockchain but value tied to physical world is becoming more of a thing. And, again, yes it's dangerous and untested. But these are the hacking and experimentation years. One must be able to crawl before one can run.
I have the feeling that there might actually be more "professional DeFi thought leaders" out there than people who have deployed something to Ethereum.
https://defipulse.com/ is a good dashboard that highlights the amount of money "locked" (i.e. as collateral) in various DeFi protocols. It currently indicates $8 billion USD worth of locked funds.
In reality, the number is lower, because folks use "yield farming". You can put some collateral in one protocol, use that to mint some funds, and then collateralize that in another protocol. And rinse and repeat. There was a Twitter post[0] recently where someone analyzed this, and they found that the "true" TLV was more like ~3.5 billion out of $6.7b.
The space is growing quite quickly. A month ago, the TLV was 50% of what is was right now.
DeFi is basically financial applications built on top of cryptocurrencies. Sometimes these financial applications (like exchanges, money markets, loan offerings, etc.) are decentralized.
There are varying levels of decentralization an application can take on, e.g. the back end (often Ethereum for financial applications), the front end (hosting on a peer-to-peer database like IPFS or Sia), and governance (by a DAO (decentralized autonomous organization) or some voting mechanism). Many DApps are founded with certain parts being decentralized and other parts centralized, and transition to a more/fully decentralized model.
This is fascinating. I never thought of writing a bot to watch the mempool for exploitable transactions. Perhaps in the future it will be more common to send your transactions privately to a miner instead of putting them in the mempool.
In additional to the "Dark Forest" analogy here, there's another hilarious analogy of Ethereum I've heard of - it's a game of Core War, but with money in it.
Ok, I got the part with the arbitrage bots and frontrunners - but could someone ELI5 to me what the uniswap contract was supposed to do in the first place?
It depends on your definition of illegal. It's not illegal in lots of places and is a gray area in most places. It's hard to know who would even handle the case since you're not sure who has jurisdiction, if anyone.
I have rarely seen so much effort and intellect expended for something so wildly pointless... conspicuously missing from these whole shenanigans: anyone doing anything that a normal person could recognise as being of practical use.
See also Facebook, as well as large swaths of Google. A generation of our best and brightest are using their talents to spy on users and get ads into their eyeballs.
And the value of those ads is totally speculative. We live in a 0-utility economy.
No wonder Warren Buffet's 'intrinsic value' investment strategy doesn't work anymore.
Since the 1970s, the true driver of the economy was the Fed and its reckless borrowers; not workers, not consumers.
It took 50 years for rich investors and their descendants to lose touch with reality to the point that they can't tell the difference between something important and something which is completely useless.
But if you think that this is just a problem with crypto, you should look under the hood of today's top S&P500 corporations and academic institutions.
The Fed did such a great job printing money to meet its 100% employment mandate that many people can literally feel their jobs getting more useless by the day (but at least they get to keep them).
Intelligence has become completely detached from utility.
Also, I have never seen a project simultaneously so intelligent and so devoid of wisdom (or vision) as Ethereum. Its complexity is going to turn people insane. It's a case of the blind leading the blind; making things up as they go.
I think "wildly" is an overstatement - decentralised systems have a place in the world, but it's IMO more niche than what current supporters are expecting.
OTOH, in the long tail case where we see a revolution in monetary policy theory, early crypto adopters can stand to make ridiculous amounts of money.
I’d prefer to live with a system where frontrunning is available for anyone rather than exchanges and brokers only. So that we could upgrade the system to be frontrunning resistant for good.
There’re front running resistant decentralized exchange PoCs on Ethereum. It’s only a matter of time (and governance) before we could have this technology on Ethereum.
After one hour, wire transfers sent in error are no more recoverable than crypto.
How the thieves knew so much about the process and timing is supposedly being investigated, but no one is holding out much hope. And the attorneys have a strong incentive to cover up any evidence of intrusion on their side, assuming it was their infrastructure infiltrated.