Hacking, Distributed

A big problem with micro payments is that the effort that goes in to figuring out if that article is really worth the $0.27 to read it is often worth more than $0.27 http://hackingdistributed.com/2014/12/31/costs-of-micropayments/

Probably started by this http://hackingdistributed.com/2017/07/29/bitcoin-impending-accounting-… Published by another guy worth reading > As one trader puts it Short 1 btc. Buy 1 btc. Get 1 bcc free :).

This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: > The problem is that his programming toolchain allowed him to make these mistakes. Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wallet-not-alone/. ...but hey, if this ends up making Ethereum better, more secure and more robust as a result, then that's a good thing; it probably does need a different better language to express code in. Just remember... > certainly you should not store any money in a hot wallet that you’re not comfortable losing.

It loses data even with WriteConcern.MAJORITY[1]. Emin Gün Sirer summarized[2] it best: > WriteConcern is at least well-named: it corresponds to "how concerned would you be if we lost your data?" and the potential answers are "not at all!", "be my guest", and "well, look like you made an effort, but it's ok if you drop it." [1] https://aphyr.com/posts/284-call-me-maybe-mongodb [2] http://hackingdistributed.com/2013/01/29/mongo-ft/

I'm not exactly a big Bitcoin booster, but I love the way techniques and structures developed for it are being adapted to uses like this. Given that this seems very similar to el33th4xor's Virtual Notary, how would one distinguish between the strengths or use cases of the two? http://hackingdistributed.com/2013/06/20/virtual-notary-intro/

I've avoided, with care, the statement that PHP is unsafe. I've not even hinted at the statement that it is impossible to write good software in PHP. PHP is not unsafe. You can write magnificent software in PHP. But PHP makes the safe often harder than the unsafe. The community even more so. It direct newbies to write crappy software more than that it guides them to learn about architecture, maintenance, patterns. All the stuff the article we're discussing is promoting. And yes, mtgox could have been hacked even if it was written in pure functions only (well...). What the exact reason is, is unclear. But researchers have pointed out that the sourcecode (leaked by the hackers), contained self-written elliptic curve cryptography, in PHP, which was flawed[1]. Before you comment 'writing your own cryptography is always dumb, has nothing to do with PHP', please note that 1. PHP lacked any libraries for this at that time (it still does?), 2. someone has to write these libs or bindings and 3. in this case it was written, in a language that is -and certainly back then was- unsuited to write such code in. It was not the language itself. But PHP is more than a language, it is an ecosystem. And that ecosystem has brilliant code and magnificent contributors. But is overwhelmed with crappy wordpress hacks and similar WordPress "developers". As well as, apparently, frequented by people who think it is wise to write their own crypto libraries in PHP for a Bitcoin Exchange. [1]…

> Do you know any publicly available recommendation from these regulators against MongoDB? If there isn't one, there should be. >Let's assume this is made the top priority, in your opinion, what task immediately follows? Or what former priority does it replace? Mongo jeopardizes the overall security and reliability of the system, thus exposing Stripe to serious liability, so I'd say replacing it is part of the basic expectation from any production-level computer system. Obviously I don't have a copy of "Important Stripe Person's Priority List", but I'd assume such basic functionality is part of an implicitly-assumed functional baseline, and that Stripe would expect said important people to escalate and develop a plan to handle such a fundamental flaw ASAP. If we were just tracking people's favorite cat videos or something, it'd be one thing. Attacks targeting malicious data modification and exploitation of races wouldn't really be that much of a concern. It's not great to have that attack surface but not necessarily the end of the world if someone's favorite cat videos get added to their account 1000 times. But when we're dealing with money, this kind of thing needs to be taken seriously, and tacking on a big pile of crap in front of the datastore is not a serious way to address its fundamental shortcomings, at least not when there are many better, proven options on the market. Just in case someone thinks I'm being an alarmist here, this has already happened; multiple…

> see anyone neutral arguing it wasn't. Well, FWIW, I've never heard _anyone_, neutral or not, claiming the DAO hack was a bug in the Ethereum protocol before now... And that's because, well, it very clearly isn't. hackingdistributed has a good overview[0] of the coding bug in the DAO that enabled the hack which I recommended you to read. Looking at this another way, this could've been avoided by the DAO developers if they developed the smart contract more carefully. And the exact kind of bug that lead to the hack was still possible on Ethereum following the bail-out hardfork. So how can one claim the hardfork fixed a protocol bug? > If you argue The DAO hacker had the right for the Ether I didn't say that. I only argued about the differences between fixing a protocol bug and bailing-out companies that build on top of the protocol. [0] http://hackingdistributed.com/2016/06/18/analysis-of-the-dao-exploit/

I read an article once that argued the big problem with microtransactions was the transaction cost imposed on users. For the sites, sure, everything can be automated. But even in the best case of good browser ui/ux support the burden shifted to users would be massive. The cognitive cost of trying to decide whether to spend 10c on an article I haven’t read yet costs me way more than 10c. Man that article sucked. Did I just get ripped off by clickbait again? This argument is what convinced me that straight per-article “microtransactions” will never take off for very low value things on the web. EDIT: found it: http://hackingdistributed.com/2014/12/31/costs-of-micropayments/ - Think it was Nick Szabo. What’s scary to me is that the one “successful-ish” application we have for microtransactions is mobile gaming. Imagine a huge ecosystem of different beans, gems, flooz, widgets or whatever, and all the dark ux patterns to get people to spend them, and also to hide how much they are spending from people.

So far, we have a long way to go to build higher quality code. There's a few reasons: 1. Blockchain smart contracts are often unchangeable, so you can't fix bugs 2. The language is being built as people write code, with some bad design choices that encourage mistakes (slowly being fixed) 3. Libraries are still being developed 4. Tooling is still limited (even basic linting) 5. People are not taking the time to have a beta process. 6. People prematurely optimize gas, at the cost of readability (For non-Ethereum devs, here's a short tutorial for how the language works: https://learnxinyminutes.com/docs/solidity/ ) My own view is that you have to code expecting that things go wrong, and ensure that your logic survives inevitable mistakes ('resiliency'). There's a lot of great resources on security, for people interested in this space: Ethereum Safety: https://github.com/ethereum/wiki/wiki/Safety Decentralized Application Security Project: https://dasp.co/ Consensys Smart Contract Best Practice Guide (I helped coauthor this back in 2016 after the DAO): https://consensys.github.io/smart-contract-best-practices/ Hacking Distributed is a great blog for blockchain security: http://hackingdistributed.com/ Emin and Phil Daian are great to follow on Twitter: https://twitter.com/phildaian https://twitter.com/el33th4xor Audit Checklist (written by my team): https://github.com/cryptofinlabs/audit-checklist (Disclosure: Our team does audits for a few projects:…

Best estimates are that there are about one million holders of Bitcoin; 47 individuals hold about 30 percent, another 900 hold a further 20 percent, the next 10,000 about 25% and another million about 20%, with 5% being lost. So 1/10th of one percent represent about half the holdings of Bitcoin and 1 percent close to 80 percent (http://www.businessinsider.com/927-people-own-half- of-the-bitcoins-2013-12). The concentration of Litecoin ownership is similar (http://litecoin-rich-list.blogspot.com). Most of the big wallets have been in place from early on, so sitting back and watching your capital grow has been a very successful strategy. The distribution of Bitcoin holdings looks much like the distribution of wealth in North Korea and makes the China’s and even the US’ wealth distribution look like that of a workers’ paradise [1] Both Bitcoin and Ethereum mining are very centralized, with the top four miners in Bitcoin and the top three miners in Ethereum controlling more than 50% of the hash rate. [2] Even taking a conservative skewed estimate [3] of wealth distribution in Bitcoin, it's about twice as worse than normal capital oligarchy. This is because PoW* style cryptocoins allow anyone with capital to proportionally extract the limited supply of Bitcoins/Cryptocoins/Altcoins/Tokens/Etc - but often significantly worse due to how Satoshi style PoW algorithms produce the majority of the supply in a short time…

So this gets into the difference between the rhetoric about smart contracts, and what they actually do. Obviously a smart contract can't ensure that an auction winner or crowdfunder gets the item. At best there could be some kind of reputation system. But to enforce something in the real world, you'd have to get an actual court involved. The smart contract removes the need to have an auctioneer running the auction and handling funds, that's all. But that still means that, for example, when I'm trying to implement a new variant on crowdfunding, I can write the whole backend in several pages of code and just publish it, instead of renting servers, administering databases, signing up with a payment provider and having to comply with its terms of service. An example of a vault is this scheme: http://hackingdistributed.com/2016/02/26/how-to-implement-secure-bitco… ...which some researchers proposed for Bitcoin, saying it'd be "easy" to implement with a hard fork adding a new opcode. I implemented the same scheme in a smart contract and it took 20 minutes. Sports betting needs third-party data, but casino games don't.

Miner consolidation is a long-standing problem with Bitcoin itself. When Ittay and I discovered selfish mining [1], we were quite worried about the size of mining pools at the time. Even though we also came up for a fix against selfish mining, the fix only prohibits selfish mining for pools <25%, and we also found that there can never be a fix to prohibit selfish mining for pools >=33%. Things looked grim for a while, and we played a role in pushing back against GHash when they exceeded 51% around April of '14. The only tool that the community had at the time to break up large miners was just social pressure. In part as a reaction to GHash crossing of the 51% line, we [2] and Andrew Miller et al [3] came up with techniques based on non-outsourceable puzzles. This is a cool technique that would make it difficult for miners to run large open pools. It does require a potentially disruptive change to Bitcoin, so it's good to have in one's back pocket if the mining situation gets out of hand, but it's not something you want to deploy. Luckily, Ittay's subsequent work on the Miner's Dilemma [4] discovered an incredibly interesting result: it pays for miners to attack other miners who are running large open pools. This puts natural pressure on miners to not open themselves up to the public and accept people into their pools willy nilly. This in turn is, I think, fantastic news, as it means that the problem may take care of itself, at least when it comes to open…

I think your track record of alarmism and disrespect to non-academics is relevant, but even if you classify it 'ad hominem', you've earned it with your own prolific slurs of critics. I've addressed your continued "no-you-dint" willful-blindness about earlier analysis elsewhere... including on your own blog at (http://hackingdistributed.com/2013/11/14/response-to-feedback-on-selfi… You failed to discover (and thus footnote) prior community work, from years earlier, that did everything except for your more-rigorous boundary formalizations. So again, nice write-up, but exaggerated novelty. The interested can follow the links and decide for themselves. I'm sure someone said no pool would ever even try to get 51%. Others simply said a pool in such a position wouldn't self-destruct the entire ecosystem, against their own interests. (Instead, they behave like the 'stationary bandit' of Mancur Olson's political-economy. Not ideal, and not what Bitcoin intended, and worthy of attempted-fixes... but also not an instant and unsurvivable crisis.) It's this latter prediction, of stability even in the presence of explicit (or secret) 51% cartels, that is still, so far, outperforming your own. For now they have the same claim to "I told you so!" as you do.

Thanks for writing this. I agree with everything you said. I'd also add the concern of Bitcoin lacking an inflationary mechanism. I can't see it ever becoming a currency without that. If it's lucky, it may be a transactionary vehicle before the next technology displaces it. But, like you pointed out, it doesn't have much of a utility for that purpose anyway - taking transaction fees, security and usability into account. Emin Gün Sirer wrote [0] an excellent survey of the Mt. Gox scandal, and a measured evaluation of the problems with Bitcoin. I loved this part: > What Nigerian scams are to your grandfather, Bitcoin exchanges are to the 20-30 semi-tech-savvy libertarian demographic. He ends by recommending Dogecoin because the community doesn't take itself too seriously. > If one must pick a cryptocurrency, the lowly dogecoin, of all things, is doing everything right. It's based on economic principles that provide the right incentives for a healthy economy. The community does not take itself seriously. Most importantly, no one pretends that Doge is an investment vehicle, a slayer of Wall Street, or the next Segway. No one would be stupid enough to store their life savings in Dogecoins. And people freely share the shiba goodness by tipping others with Doge. So, young people who are excited about cryptocurrencies and want to get involved: Dogecoin is where the action is at. Much community. So wow. I just hope the hoardes of Bitcoin speculators don't ruin it for them. >…

Again, excellent comments! :D > The very last section suggests (to me) that despite what value the BTC protocol has, it doesn't "square the triangle." How so? > However, recent research blew this entirely out of the water, at least as far as Bitcoin goes[0]. They propose a change to the protocol that makes it a >25% percent problem, but currently it is a >0% problem. That is kind of a big deal. There are some good ideas in the "proof of stake" discussions, but none of the answers appear to lend support to the "triangle is squared" hypothesis. I was looking for that paper a while ago! Somehow my google-fu failed me and I got distracted by something else, and so, forgot about it for a while. Thanks to you, I've had a chance to download the paper and read it. Indeed, at first glance it might seem like they're pointing out a big hole in BTC, but I don't think this is the case, and neither do a lot of other folks over on the BTCtalk forum. [1] There is one big flaw in their paper that the authors acknowledge (quite poorly IMO) in their followup blog post to the reactions that they received [2], and that is point #9, that they for some reason buried toward the bottom of the blog post: Our paper does not address what happens when multiple pools employ the selfish strategy. But if all pools were selfish, the blockchain would not make forward progress for large periods of time, while selfish groups hoard their blocks. Then, perhaps, depending on the profit- …

I'm the "radical" author of this post. It expands this other post (http://hackingdistributed.com/2013/03/07/partition-tolerance-myth/) that busts some commonly propagated myths about partition tolerance in data stores. But the part that I really wanted to emphasize, and I worry might get lost in the surrounding discussion about partition-obliviousness, is the following: NoSQL has the potential to supplant RDBMSs and capture the bulk of the database market. The "daddy knows best" attitude that RDBMSs bring to data management, the way they strip all information that the developer had about her data and force her to write a declarative specification of what she wants, only to try to then come up with an efficient evaluation plan in the query optimizer, all reflect a klunky aesthetic to system design that the lean and mean NoSQL movement can and will supplant. NoSQL is to RDBMSs what Unix was to Multics. My group is working on bridging the gap between NoSQL and traditional RDBMSs (with a second-generation NoSQL store called HyperDex that provides strong guarantees), and so are others. And meanwhile, RDBMSs are trying to retrofit NoSQL features. Overall, there is a big revolution afoot in data management, and it's an exciting time for system builders and application developers alike.

My post is a secondary research regarding potential issues with weak isolation levels. It includes a link [0] to an in-depth description of what happened to Flexcoin. Additionally, the post references another similar BTC attack [1] that exploited a "lost update" due to weak isolation levels. The goal of the post is to highlight this problem, as cited research papers clearly demonstrate that such issues occur more frequently than commonly perceived. Again, I'm sorry that the title might be misleading and you have expected a different content. [0] https://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-f… [1] https://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_roughly_1…

>For those that aren't aware. It's pretty easy to write an escrow smart contract which ensures both parties got what they signed up for. Press F [0][1] to doubt. [0] https://hackingdistributed.com/2016/06/18/analysis-of-the-dao-exploit/ [1] https://hackingdistributed.com/2017/07/22/deep-dive-parity-bug/

No, Craig Wright is Fakoshi! https://hackingdistributed.com/2016/05/04/logical-fallacies-hunt-satos…

This has been a known issue for a while: https://hackingdistributed.com/2013/01/29/mongo-ft/ MongoDB: Broken By Design

> ...network connection to the servers holding keys. It's a tech pioneered by cloudflare... They announced Keyless SSL way back when: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-det… I'm a fan of Facebook's take on this, though: https://engineering.fb.com/security/delegated-credentials/ Also see, Google's answer to JWTs: Macaroons-- https://hackingdistributed.com/2014/05/16/macaroons-are-better-than-co…

I wonder why macaroons [1] are not even mentioned in this discussion yet. They have all the upsides of cookies, but also can be narrowed down to be handed to third parties (good for APIs), caveats, and have a standardized and implemented [2] verification scheme. I wonder why they don't see wider use. Do they have significant downsides? [1]: http://hackingdistributed.com/2014/05/16/macaroons-are-better-than-coo… [2]: https://github.com/rescrv/libmacaroons

Have you looked into using Macaroons[1] at all for distributed systems? I used them for a client's multi-site intranet a while back, and it made some of the very complicated parts very simple. I'm just wondering why they never seem to have caught on. [1] http://hackingdistributed.com/2014/05/21/my-first-macaroon/

> Selfish mining with less than 50% does not exist. False Incorrect, and this has been well known for nearly five years: http://hackingdistributed.com/2013/11/04/bitcoin-is-broken/

This article would make more sense if crypto currencies were actually decentralized... that ship sailed maybe five years ago? Today, only a handful of corporations control the majority of the proof-of-work hashrate [0]. What’s more, development teams represent another centralized group (ie. you can count the devs that contribute to consensus code on 2 hands if you’re generous). So my question is: in what way are crypto-currencies not already in the state the article is warning about? If I capture the lead commiter to your chain as well as the lead miner, don’t I effectively own the chain? [0] “Both Bitcoin and Ethereum mining are very centralized, with the top four miners in Bitcoin and the top three miners in Ethereum controlling more than 50% of the hash rate.” http://hackingdistributed.com/2018/01/15/decentralization-bitcoin-ethe…

I had to lookup what exactly Paradex was and it seems the platform is based on 0x. Given that decentralized exchanges have issues like front running, open arbitrage etc[0], I think this might not be a wise move. [0]: http://hackingdistributed.com/2017/08/13/cost-of-decent/

Another day, another bunch of irresponsible reporting in the cryptocurrency world. Wired fails to disclose that the first mentioned correspondent is Andrew Miller of the Zcash foundation. He previously published a blog containing much the same content about Monero. https://z.cash.foundation/about/ http://hackingdistributed.com/2017/04/19/monero-linkability/ So how much money are some people making today on Monero shorts and Zcash longs thanks to a front page Wired article?

There was some research exposing vulnerabilities in Monero privacy tech[0], but AFAIK ringCTs and enforced minimum sizes of ring signatures fixes it. [0]http://hackingdistributed.com/2017/04/19/monero-linkability/