> In 2023, Guan posted his opinion on smart contract engineers. According to Guan, projects that pay smart contract engineers $200,000 are “ngmi,” which is short for “not gonna make it.” The Web3 founder said that any solid developer “should be able to write solidity with the help of ChatGPT.”
I worked on Truffle and Ganache (RIP), the first Ethereum development toolchain. We had a default list of accounts and private keys on start up that everyone used, but devs kept using those keys on Mainnet and immediately loading their funds, despite the warning in docs and the CLI ourput. We have had threats from devs who thought we were running scripts to drain the accounts we gave them. So we switched to a randomized mnemonic by default.
So when competitors, like hardhat and foundry, popped up what did they do? Used default shared accounts and keys. We reached out to let them know that users will lose funds, but all they did was add a warning in the CLI output and in docs. Devs still regularly lose funds: https://etherscan.io/address/0xf39fd6e51aad88f6f4ce6ab882727...
> If you’ve got that much money in a project, it’s not a prototype.
How does the monetary value matters? A prototype is a prototype, a quick project to test some concept. If you wanna test some concept around large transfers, does that mean it's suddenly not a prototype?
> This repo should have had all types of static analysis running automatically.
Would that actually prevent this issue? So lets say they make the repository public, the static analysis tool begins screaming at the repo owner. Now, he has 2 minutes to transfer those funds somewhere (manually), before the thief automatically makes that transfer for them, to their own wallets.
Sounds like the guy just needed a hardware wallet instead of whatever they were doing. Who stores unencrypted wallet details containing $40K on disk?! Committed to git?!
> When a community member inquired about how long it took for the funds to be drained, the Web3 founder responded that it took just two minutes for someone to withdraw the funds.
The public events API is delayed by 5 minutes[1]. Unless someone was actively scraping his profile rather than doing large scans on GitHub, this is not possible.
They don't need to proactively scan all of GitHub to exploit this kind of mistake, just active accounts that are known to be involved with cryptocurrency.
I didn't read that to mean a literal two minutes. Based on his style of writing that was quoted in the article and the nature of his mistake I don't think he's reporting an in-depth postmortem on the situation, although I didn't bother going to twitter to take a closer look. He probably didn't even realize his mistake within two minutes.
Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos?
Edit: and what’s the best practice here? Is it using a key management system of some sort? (I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API)
Yes, standard is using a key management system (KMS), but there's a lot of nuance and complexity there. Depending on the threat model, you can use software systems, hardware systems, multiparty crypto systems, and you need to think through all kinds of failure modes very carefully (particularly around disaster recovery or insider attack scenarios.) A good place to start is cloud-based key management systems, because they take care of a lot of the complexity, but you still have to do it carefully (e.g., paper backups in a multiple safes, protecting the cloud resources correctly, 2FA on your account, etc.)
Protecting high-value cryptocurrencies is particularly hard, and as much as crypto people like to say "not your keys, not your coins", the reality is far more nuanced, and the average person is much better off using a well-known platform like Coinbase. Even hardware wallets are not as simple as people thing to use safely.
(If you're building cryptocurrency apps, never upload wallet private keys to cloud KMSs. Instead, generate wallet keys using the KMS itself, and use those wallets for small "in-transit" funds only. Think of them like bank branches, when you manually transfer small amounts of funds securely from a set of central wallets.)
> Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos?
When you deal with high value amount of cryptocurrencies, you have a hardware wallet so things like these are not even possible in the first place, as the keys are safely stored in the hardware. Storing anything on disk (unencrypted at that) that corresponds to $40K is basically begging to be stolen from you.
Besides that, when you open source something that even has a chance of containing something you don't want to make public, you read through every single file before hitting publish.
> I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API
Commonly you use environment variables for this. So the code references `process.env.MY_SECRET_VAR` or equivalent, and then you set that variable inside your server. That's the simplest way, then there are more complex/"secure" ways too, quick search for "secrets management" in your favorite search engine will tell you more.
Or `rm -rf .git && git init && git commit -m "init"` and then read through. Common to scrap previous history when you go from private -> public repository anyways, a lot in order to scrub potential things like this to leak through.
If I'm at all worried about having accidentally committed secrets in the past, I usually create a new repo for the public release with a fresh git init.
It is standard security practice to try to avoid committing keys, yes. Unless it's to a private repo you know will never be made public.
There are a variety of options, depending on what type of software you're developing, how much you're willing to be locked into third party tools, and things like that.
The simplest is to just save the credentials somewhere like the user's home directory, outside of the git repo. This is what a lot of command line tools do.
Environment variables are also a popular option - most CI build systems will let you store 'secrets' that are passed into the build process as environment variables.
Larger scale projects will often end up with a configuration management mechanism, enabling 'configuration as code'. When doing this it will often be interlinked with credential management. After all, why not store the hostname of the database alongside the username and password?
If you're in a cloud environment, they will have 'instance metadata' that can (with configuration) pass cloud provider credentials into your instance. They will often provide a secret store service you can access using those credentials, and will let you authenticate to databases and blob stores and whatnot using those credentials so long as you stay within their cloud ecosystem.
Large corporations like 'credential rotation' where secrets get revoked and re-issued on a regular basis. The cloud environment can do this between your instance and their provided services - or you can do it yourself in an ad-hoc way.
All the major PC operating systems provide a secret storage function or 'keyring' although it's debatable whether it's all that different to just saving a file on disk. It used to be, back before the rise of full disk encryption though.
And of course if you're writing a mobile app, the operating system is a lot more locked down. So there you can store credentials in the system keyring and other applications can't access them.
Usually the simplest way is leveraging environment variables. You can set the API key as one on the remote server, then you can get it with `API_KEY = os.environ.get("API_KEY")`. That's a Python-specific example - but hopefully you get the idea.
There are other services that manage securely saving/storing these keys rather than just hosting it on the server itself (e.g. AWS Secrets Manager)
Generally you deploy or use some sort of secret/config delivery service.
For example most/all VPS provider allow you to give extra data to the machine; this could be the secrets directly or maybe a connection url to a local* redis server with the configs.
Or you can copy paste a file vis ssh.
*AWS-like providers allow you to also deploy private networks so that only approved services vps can access a db
@your edit: you can use environment variables for example, just don't commit your dotfile or just don't store in the same folder as the repo if you don't know what a dotfile is.
The real tragedy here is not that he lost $40K, but that crypto is the controversy generator that is part of the bread and butter of mass media, which in turn is a large part of the reason why cryptocurrencies have value in the first place. The loss of $40K didn't just happen due to this developer's mistake, but also because he was able to store $40K in crypto in the first place, and that partially happened because of people like us, reading this news story.
And I see most professional senior devs training juniors to be more helpful... It is always a blessing to see that perpetual look of terror subside when people finally understand what they should be doing.
A company attrition rate is a reflection of hiring, training, and project management skills. If you have an IT culture problem, than it will manifest in the high-stress areas first. i.e. you are likely not going to survive as a business beyond 3 years.
Happy investing, and I hope someone returns his gambling chips. =)
I don't know about anyone else here but if I had 40k laying around in Cryptocurrency I would have taken some of that and bought a MacBook pro that didn't have my personal information on it for coding, for a start.
Some cryptocurrency isn't a safe store of value to begin with, so he was probably ready to lose that at any moment anyways. Worse way than most to lose it, but he doesn't sound too bummed out.
>Some cryptocurrency isn't a safe store of value to begin with...
If I may, I would posit all crypto is not a safe store of value to begin with. An EMP taking out the entire world power grid would render crypto pretty useless almost immediately, while gold will just sit there. Even paper money is resistant to decentralized unwindings as they are physical and people are conditioned from birth to accept their value.
Money is a key part of the formation of societies and history shows that many independent civilisations came up with money time and time again.
Gold is a great form of money thanks to its unique chemistry:
Its colour and lustre is unique - it's fairly easy to tell something is gold-ish by eye and weight. This is why gold was chosen by our low-tech forebears.
Its lower melting temp makes it easier to purify than say Platinum or even Aluminium.
Its inertness (thanks in part to the relativistic contraction of the 6s orbitals) mean that you can leave it in a safe for 1000 years and it'll basically be the same. You literally need conc HNO3 and H2SO4 aka aqua Regis to dissolve it.
People who think gold is a pet rock and is useless fail to appreciate that even if all stores of value are pointless and arbitrary, we still gravitate around particular stores for a reason.
I'd be fairly happy to hang onto some gold in a post Apocalyptic world if it looks like society may eventually recover.
Even stuff like coffee and oil would be useless in any size because they have a shelf life. And cash at scale can literally rot or get eaten by mice. Gold can be buried and it'll be there forever basically
I don't disagree with you that it would be a disaster, I'm just saying that fundamentally crypto is not a store of value. But don't listen to me, I only deliberately burned my early Bitcoin after evaluating it on its merits, weeks after it came out. Nothing, repeat nothing, has ever moved the needle on my opinion of crypto, although I will say that cryptobros will not stop at anything to try and convince people that crypto serves the 3 functions of currency.
Fundamentally, almost nothing is a store of money - not crypto, not fiat, not gold. Only a bunker full of canned food can actually store actual value. The rest is just an IOU from future people.
In that scenario, people still need a medium of exchange. Physical medium of exchange such as precious metal and paper currency will still be more reliable than crypto or anything digital. The countries who are enforcing digital currencies are just digging their own graves when a Carrington level of event (or EMP) hits.
I agree that it is not a store of value, but if we agree on that then I would also ask if you think the current fiat system we have serves the purpose of serving as a store of value.
I think it doesn't do this as we have seen the value of gold shift so much over time.
If we look at Roman Empire during Augustus, your average denarius penny in the empire was worth about 10 hours of minimum wage. A denarius was about 1/10 of a troy ounce of silver, and you needed 25 of these to get an 8 gram gold coin, the aureus.
Going by today's standards, your typical 8 gram coin is worth $604.96 USD
If we go by the average minimum wage in the United states, 25 days at $72.5 USD/day for 10 hours of minimum wage, in order to compare to the Roman Empire during Augustus, pre-tax, the same coin was worth $1812.50 USD.
So to briefly summarize:
1 denarius penny = 1/10oz Silver = 10hrs minimum wage, 4 hours minimum wage today nets 10 times the Silver it did 2000 years ago. You can quickly see that if anything, on the basis of Silver alone, that our currency is worth about 23.7 times more than the currency of Rome ever was if we ignore taxes.
3-5% tax rate on total wealth was murder and why riots happened to begin with.
Then we look at the cost of a average small villa in that time period- 200,000 denarii.
You figure this means 200,000 days for your average agricultural worker at 1 denarii/day, but actually it's way more than that because there's the 3-5% wealth tax on them, plus the tax collector wages came from whatever they could extort on top of that.
200,000/365 = 548 years of payments only to a house at 1 denarii/day.
200,000/30 years= 6666.66 denarii/year
6666.66/270 (because I'm nice and assume we get days off in this time period (today)) = 24.69 denarii/day, or about 98.8% of an aureus per day, would be required to own a small villa on a 30 year mortgage during the Emperor Augustus roman empire, (excluding the extreme 3-5% annual total wealth tax).
I figure most people here would agree that even at minimum wage, a personal villa is much more accessible today. Even a $1,000,000 home on minimum wage with zero other expenses or taxes, working 10 hour days, 5 days a week, would basically pay it off on a 51 year mortgage at 1631.25/month.
I think that's why so many people here feel ripped off. Homes would be much more affordable if the loan terms were slightly longer, but there's a bunch of old people out there trying to min/max their investment based income before they die.
I don't see anything wrong with them wanting to do that, but I think it would be wise if consumers began to push for longer mortgages because as a function over time, while the dollar is still worth quite a bit, it is nonetheless losing value. Keeping your mortgage going means the bank gets less value out of the loan over time, assuming inflation remains static.
I know you didn't expect this reply but I enjoyed learning and making it. If you end up going back over it and have any corrections you'd like to make I'm all ears, but I'd agree. Crypto is a crappy place to have a store of value right now and arguably you'd be a fool to not have it invested in the stock market targeted index fund because that's simply how the world of finance works today.
It's not about what we can do in a day, it's about how we can leverage the income to get more done in a day, even if it's not being done by us directly. That's why investing in the stock market, in stocks you trust as a consumer, is so important to the success of capitalism long term.
And even those kinds of trades will not be fun. I give my bullets to some dude. He gives me some potatoes and cigarettes. He asks me if I have more bullets to trade for another day. I tell him no, those were actually my last bullets. He points his gun at me and tells me to hand him back the potatoes and cigarettes that he just gave me. I have no bullets left, even for my own protection. I hand him my potatoes and cigarettes. Now I have nothing :(
We have an end of the world scenario in this case, "money" in form of paper or metal won't have any value whatsoever then. Money in itself only has value if people trust the value of the system, which is given for example in Bitcoin.
>people trust the value of the system, which is given for example in Bitcoin.
It is in fact not a given(I for one do not trust the value of bitcoin or other cryptos, and I know more people who don't believe crypto has any value than those who do), and your comment is an example of attempting to coerce public opinions and beliefs in such a way as to promote crypto.
What you as a single person trust or not doesn't matter in this case. Enough people already decided to "trust" Bitcoin, that why it's worth 70k. I'm not promoting anything, thats just how money works. There is simply no Intrinsic value.
>please don't try to argue about the value of gold coming from its physical properties
I understand why you would want to discount from the conversation the very things that make gold valuable; but I don't have to let you move the goalposts. Gold has properties of corrosion resistance (store of value), rarity, and desirable qualities(such as its color and weight, using it in jewelery to attract mates) which allows it to be a medium of exchange, and the fact that it is easily separated from other metals by its low melting point, not to mention its luster is different from other base metals used for currency, makes it easy to use it as a unit of accord for payment of taxes and such. These properties are unmatched by other more common, natural materials-- that humans have long recognized it as unique and rare on Earth merely raises its intrinsic value to human society. Ya can't eat gold as a person, after all.
(lest you think me a gold bug, I don't have any gold and actively recommend that humans not possess it except where they actually need the properties in question. I do the same for fiat currency too. They're all just tools for getting by in life)
Most of the world money is purely numeric; only ~10% is printed in cash IIRC, so a worldwide EMP (outside of all its drastic consequences on the world) would wipe out much more value in fiat money than in cryptocurrency.
And most of the gold owned in the world is not in someone's basement, but as a line in a database; so you can wave goodbye to that as well.
Has it died? I am getting mixed signals. For example, the Javascript Jabber podcast, which targets front-end web developers in general, ran an episode with some sort of introduction to web3 (and not in the negative sense) just two months ago [0].
I give NVIDIA about 4 years before M_A_G (-AN) develop their own AI chips. NVIDIA's stock is way overvalued in the long run once their few customers are satiated and so will eventually tank, and could go under if they over-expand on the basis of a couple of temporary, whale customers. Their only hope is to ship as much as possible and raise prices while customers are panic buying like it's toilet paper during COVID.
I feel like as a long term holder of Nvidia I have enjoyed their business decisions thoroughly enough to say I wouldn't be disappointed if it was memed enough that one day they see this Nvidia logo as some sort of inherited "Eye of Horus" god clan of mathematics and machinery.
Assuming we have an ice age because let's be real that's the best way to make sure everything plastic or nonmetal stays preserved.... Ice age for most things, but we leave the technology buried near an area with high probability of pyroclastic flow.
That, or we get real and we begin leaving time capsules with mathematical proofs and scientific discoveries, maps, etc, on the moon and other planets.
This is your reminder that every crypto"currency" using a transaction fee is fundamentally a scam and everything that is happening using them is merely hype to get you involved in them.
That's a bit like saying that every public toilet that charges a fee is a scam. Surely there are scams and hype in this industry.
Fees are for inclusion of a transaction in a block. And some pretty clever game theory was implemented as part of eip1559 in Ethereum to make fees efficient and fair.
No, it's not, read Jorge Stolfi on this. While he insists the scam should be called a Ponzi, I am not sure of that , but the name doesn't change anything at all, we could call it a Nakamoto scheme as Preston Byrne did to avoid that particular debate.
That sounds like black-and-white catastrophizing lacking nuance.
Some semi-centralized infrastructure and development is needed and costs money to run, but the questions unique to each circumstance are: "What do revenue and EBITA look like?" and "How efficiently are CapEx and OpEx used?"
OTOH, if a social venture nonprofit ran a coin with survival in mind rather than get-rich-quick fintech profiteering, it could make a promise to keep overhead low and any sort of profit margins for reinvestment in robustness, stability, features, and auditing controls to a small, fixed %.
I'm all for bashing crypto bros, but really? The fundamental benefit of crypto currencies is being independent of central authorities. Do you think it has failed in that regard?
hackerone975 @ gmail com is your solution when your phone falls victim to hacking. With their expertise in data recovery and advanced detection techniques, they provide a reliable and efficient service to help you regain control of your device and secure your personal information. In today's digital age, our smartphones hold a plethora of personal and sensitive information, making phone security a top priority. From financial details to personal photos, the data we store on our phones can be valuable and vulnerable. Protecting it from hackers is crucial to maintaining our privacy and preventing potential loss or misuse of our information. hackerone975 @ gmail com is a trusted firm to ensure that you are saved from hackers who are out there to steal
But but but Crypto will change the world?! And everyone should have their private wallet? And who cares about recovering your funds because everyone of us will be handling private data / secrets (like passwords or keys) perfectly, always!111
Cryptobros telling you never to use an exchange due to FTX and other examples, also its super easy to use...
Ah, schadenfreude.