As a former crypto proponent, after ~17 years I think we have to have a real discussion about the value crypto does or doesn't bring to the world.
Sure, it let's some people keep their savings safe from dictatorial countries. But it also fuels other dictators that are doing pretty nasty stuff to their own people. And crypto is facilitating that.
I am a regular guy but I just never understood the point of Crypto other than for scams and get rich quick schemes. Not to mention it still is tied to the dollar for value which defeats the entire purpose doesn't it ? I thought it was supposed to be an independent currency. And then you have companies like coinbase which are centralizing something that was supposed to be decentralized ? I just don't get it.
At least initially, much of the "point" was to bypass Chinese currency controls. Buy mining hardware and electricity in yuan funny money. Mine cryptocurrency. Sell it for real fiat currency. Buy real estate in Vancouver.
The decentralised mode never interested general public, even though it was mildly interesting as an idea to skip hierarchical trust. The established use of crypto is exclusively money laundering and investment scams, made usable for general public though use of centralised exchanges. The crypto isn’t important, it is just an excuse.
Yea I just don't see any real benefit and it has been almost 20 years. This is why I immediately lose respect for anyone who still peddles crypto even though there were some well meaningful people in early days.
My wealth may be decentralized, but my body is in one location and pretty vulnerable to the 5 dollar wrench. Putting some emergency money in a foreign bank account and a bag is a much better option if I wanted to flee a country.
these randoms assuming foreign banks accept every human is really funny, enjoy your bubble and ignorance. There are normal people that cant even have a bank account in their homeland.
Crypto was originally born during the Great Financial Crisis. It's not surprising that the idea of: "Hey, wouldn't it be neat if we didn't need any of that," seemed attractive back then, even though that is obviously far too simplistic a view of what the financial system actually does.
But the end result is that crypto currencies never really delivered on their promise, because they barely work in practice, and the only reason to engage with them is for gambling or crime. Anything else is just too slow, too expensive, too cumbersome, too error-prone, and just generally far too inconvenient. What's the point of a digital currency that is best stored on an air-gapped device that must never connect to any network?
I know what’s going to happen. I will explain what crypto is for and then it will get downvoted just because it says anything positive about crypto.
The point is to NOT have a single place with access to all the money, votes, etc. Every participant should be acting as themselves, and there should be no way to do things on behalf of others without their consent.
The point of smart contracts is to have code you can actually trust. Your bank or openAI can change their website, APIs and even their models tomorrow. That’s not great for trust. Trust is what enables things to scale.
The same way you trust other internet protocols to just “route around problems” and not have one single point of failure, that is the substrate for Web3.
Imagine a Web2 website such as a student-teacher marketplace NOT handling millions of dollars, accepting money from students and paying them out to teachers. Imagine it being simply an interface while the actual transactions are approved by the students themselves, and instead of the central site signing payouts with some keys, the teachers get paid through smart contracts and code on the blockchain. The site can still take 10% commission from everything, it would be above board, and it can never change it without the consent of the people. The business logic is in the smart contract.
(Since this comment has the keywords “crypto” and “web3”, I know what will happen in advance already.)
I broadly understand this as the utopian vision of what crypto could theoretically be, but it's not playing out this way in the real world and I have a hard time seeing it ever succeeding this way.
Being able to leverage crypto on this scale requires everyone to either A) be technical enough to understand and use smart contracts directly or B) delegate a party that handles this for you. This is where the utopian case usually falls apart, because most people are B and this requires trusting a third party, which kinda defeats the entire point of the vision.
Because most people don't want to do the work of learning and managing crypto directly, a huge industry flourished to service these people, full of its own interests, corruption and various levels of criminality. And well-intentioned crypto people have no way to reign this industry in because the entire point is to operate in a deregulated way.
Ironically, the piece that makes crypto fundamentally unworkable 20 years in is capitalism.
I think that public/permissionless crypto is going to remain a niche. It's clear that there are too many footguns and failure modes for the average user.
But I think private/permissioned chains will gain some adoption in the background of tradfi, especially for settlement, clearing, collateral management via tokenisation etc. Your bank might eventually use technology developed in crypto, but it'll be called 'distributed ledger technology' or 'tokenisation' rather than crypto because of the negative image.
I think crypto lead in 99% of cases just to bad actors and use-cases, I still have to encounter one real success story of someone using crypto successfully long-term or to pay for legit, legal stuff where a different method was not allowed due to unfair restrictions.
I think one of the primary motivations for cryptocurrency was that legal ≠ moral. Therefore, I think cryptocurrency's best use cases are all explicitly illegal.
For example, you can donate to Sci-Hub with cryptocurrency. Sci-Hub has an ideological mission which is widely supported, but it runs afoul of copyright law and is illegal in nearly every country and sanctioned in many. You cannot donate to Sci-Hub with fiat currency.
Unfortunately, I agree that in practice >99% of cryptocurrency's use is for scams.
I don't disagree, but the way you say that makes my eye twitch uncontrollably. So many of us have spent the better part of those 17 years trying to get the crypto proponents to have a real discussion about it.
> safe from dictatorial countries.
Yeah, that's definitely an argument. But it's kind of funny when the backdrop is that $6B was taken by North Korea.
It feels like a sibling to the popular attitudes towards not trusting big banks, or voting for <candidate> who demonstrably achieves the opposite of what you're seeking, or feeling that democracy ain't working out great, or that vaccines are scary and dangerous. There's just a fundamental lack of higher-order thinking. It's all vibe-based reasoning. What feels scary is what guides these behaviours. Which, I think, is why it's so unsurprising that people in these camps make such unbelievably strong candidates for exploitation.
I thought that the whole point of crypto was money laundering and tax evasion. Like, it's in cryptocurrency DNA, even if people try to squint and see legitimate use cases. Does anyone think otherwise?
I mean, that's what the big mean government does, they monitor financial transactions and they collect taxes. But when we talk about financial privacy from the prying eyes of the government as a goal, and let's suppose people actually use crypto like was dreamed, this necessarily implies crypto being a tool to launder money. (in practice, this is better realized by privacy coins like Monero and ZCash, since Bitcoin sucks for privacy: your address is an anonymous handle but the network leak metadata. But, the desire for financial privacy was there in the Bitcoin community since the beginning).
And what else people do when they can hide their money from the government? In a lot of cases, they don't pay taxes (which is also a disposition present in the Bitcoin community since the beginning, with a rhetoric like, collecting taxes are not legitimate)
What I think was a later development was the main use case for crypto in real world, which is to collect payment for ransomware and things like this. This, I don't think it's something the early Bitcoin community envisioned.
The unbanked, like myself. People that for any reason is being locked out of the "american" way of doing things
Stripe doesn't cover 200 countries, nor does Apple Pay, Google Pay, Paypal, Visa, etc (all american btw). So a parallel banking system is needed, no questions about that, and Binance provides the best of all, and that's why it's being targeted by we know who (just follow the money)
Now, whether if it is crypto or not, I don't care, all I want is the possibility to pay and receive money (USD, EUR or CNY as the top currencies right now) without the draconian restrictions imposed by the hegemons trying to asphyxiate does who don't kneel
That's exactly why we need a parallel banking system, crypto or not
Cryptocurrencies give sovereignty over your own money... and all the bells and whistles that come with sovereignty: You're responsible for keeping your own funds, and life, safe.
One of the things I was forced to reckon with over the pandemic was that I'd spent my entire life with undiagnosed autism. Looking back, there were lots of warning signs but we know things now we didn't then. For example, up until the 2010s the medical consensus was you couldn't have ADHD and autism.
One of the ways this manifested was my ability to anticipate problems at work and poke holes in things. This made me incredibly unpopular. You never get thanked for this. Instead you get punished for being right too early. You are negative. You are a naysayer. You aren't a team player. And you were 100% correct and it didn't matter.
Back in 2012 I remember thinking "I don't see how crypto has any applications other than illegal stuff". And I stood by that. Note that morality and legality are two different things. Sending money to relatives in a country that disallows foreign currency transactions may be moral but it's still illegal.
What's frustrating is dealing with the same consequences of being right too early. It's muddied by true disruption. An example that was often brought up was Google. In the late 1990s, it was believed that search was a "solved" problem and there was no money in it. That's 100% true. But you can't ignore any criticism with "people once thought the world was round". It's a useless fallacy to deploy.
The absolutely dumbest people and outright scammers were attracted to crypto. A bunch of people who missed out on Bitcon's meteoric rise didn't want to miss the next meteor or they simply wanted to rug pull before they themselves got rug pulled.
The financial system is an endless series of Chesterton's Fences. So many things work the way they do because of a problem that occurred. They say that safety regulations are written in blood. People died to make those regulations. Well, financial regulations are the same way.
Being able to freeze assets and reverse transactions, for example, is a feature, not a bug.
The real story with crypto is how greed clouds people's judgment. So many people on HN thought they were going to make their bag on crypto and people like myself got shouted down as naysayers.
I really don't know what to do with this information other than those same warnings are beign ignored about AI and in 5 years I will be punished for being right too early. There's simply no market to recoup the trillions invested in rapidly depreciating assets around software with no moat.
Outside of being money for criminals, there is some value for investors. For them, it is a way for their portfolios to get exposure to the booming criminal economy.
If you need crypto to avoid the legal framework when transferring value, accept the risk and operate accordingly. If you want crypto exposure as an asset class, find a custodian who will hold the crypto for you offline, prove it is offline, and allow you to borrow or otherwise leverage it as an asset on fiat or traditional rails that provide you recourse. Anything else is pointing a gun at your feet.
Analogy is holding and trading gold underground that hasn't been mined yet using securities or other representation subject to capital market regulations and the legal framework. Is it an asset? Yes, if proven, documented, etc. Is it safe? Yes. Will you get your value back if the capital market representation of the underlying is stolen? Most likely (finra, sipc, etc).
But having live value on rails that enable instant movement globally with no recourse for unauthorized transfer? You're gonna have a bad time.
I agree with you. Is there a name for this logical fallacy?
I equate it to anonymity on the internet. Yes, if everyone had to associate their real identity with everything they posted on the internet some unjustly persecuted individuals would not be able to get their stories out. And there would be a heck of a lot less other bullshit.
I got more utility from AI within the first week of ChatGPT being originally released than I've ever gotten from crypto, and I've had bitcoin since they were giving it away for free on Tor lol
They're not even remotely close to being comparable.
AI might ruin all white collar labor power and drown the world in useless work via things like expand-message-with-AI --> summarize-message-with-AI. Meanwhile with cryptomemes you can remain unaffected unless someone manages to ransomware you.
The supply chain attack had a software bug which raised error messages that were discovered by a security vendor. I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.
The short duration of this crypto hack isn't particularly noteworthy. Of course it takes time to find or design the exploit, but execution is typically very quick for such events
Not saying this is the case, but the way this unfolded, and announcement reminded me of the crypto scams that were popular a few years ago (ponzy schemes), with the final rug-pull being "oh no, our platform was hacked, all your funds were lost, sorry!", i.e. "coscoin"[0][1] I know this is not the case here, but the way they announce the hack is funnily similar to how those fake platforms did their final announcement.
And if you ingest patches in seconds, you now have an issue of checking that the patch is not poisonous. Many a modern outage comes from changes deployed too fast. Damned if you do, damned if you don't.
if a CVE drops at 23pm, attackers have at least 8 hours before someone in the office has a possibility to take a look at it. nowadays, that seems to be plenty.
I think "good security/engineering practices" still has a chance.
Things like--
* Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum
* Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
* Encrypting data at rest
All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.
Full zero trust internally. Both inbound and outbound proxies (different machines) to carefully limit access, and provide a place to mitigate attacks. Etc.
If your plan is to quickly apply upstream patches, your plan is bad.
I try so hard for this, but don't even get approval to change an internal site to use https instead of http.
I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.
It requires management buy-in, both to allow some number of engineers to be allocated to such "non-production" work, and also to allow the friction security creates to continue to exist and "slow down" the "real work", both by vetoing things that would weaken security and by forcing everyone to use more cumbersome workflows.
That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.
Have on-call sysadmins or have them work in a three-shift schedule. That way there's always someone there to fix stuff as it happens, including deploying security patches or worst case taking affected systems offline until they can be patched
This used to be common before devops and cloud took over. Looks like it might make a comeback. Maybe with a new fancier job title
When seconds matter, it is impossible to patch if you haven't patched already. If you need to patch, or attempt to contain against an adversary who is prepared and sophisticated enough to succeed within minutes, you've already lost. Defenders need to win every time. Offense only needs to win once.
The heist itself only took 20 minutes, but the preparation is a business that has gone on for years. Much like a heist movie, the exciting bit is just the conclusion after a long build-up where Danny gets the gang together, plans it, and executes it.
That's totally on me. I should have asked you before shutting down the subagents. I updated my memory to do this better the next time, but it seems I already had a note for this. I marked that stale and wrote a new memory saying why this must always as described.
First 10 minutes: Making a team, 2 guys or gals living a life, talk about it
11-30 minutes: Demoing how bad our security systems are, we need to patch them, day and night, can't keep up
31-40: But we need money, no one is paying our bounties
41-50: How about? They do not tell what it is
51-60: We are going to hack StarLink (they never say that, it is just the logo in the background when they are talking how easy it is to get in and out)
61-70: Dry Run, text scrolling on the screens
71-85: The Hack, split screens, zoom in and outs
86-88: Oh it was Solozzo (Binance) all along, not Starlink.
89:90: Dude fills up his car with the stolen USDT and realizes that as he is sitting in the car
You need to make the caper a positive enterprise. Nobody cares about enterprise security hygiene; so you need the head of Binance to be an evil-moustache guy, or the proposed hack to be a positive affirmation of the protagonist's skills over a world that does not value them.
I like the final twist. It would be even better if it turns out the protagonist was manipulated by the real players and he ends up with little reward (because crime doesn't pay, kids!) but with renewed faith in his abilities.
Sure, it let's some people keep their savings safe from dictatorial countries. But it also fuels other dictators that are doing pretty nasty stuff to their own people. And crypto is facilitating that.
But the end result is that crypto currencies never really delivered on their promise, because they barely work in practice, and the only reason to engage with them is for gambling or crime. Anything else is just too slow, too expensive, too cumbersome, too error-prone, and just generally far too inconvenient. What's the point of a digital currency that is best stored on an air-gapped device that must never connect to any network?
The point is to NOT have a single place with access to all the money, votes, etc. Every participant should be acting as themselves, and there should be no way to do things on behalf of others without their consent.
The point of smart contracts is to have code you can actually trust. Your bank or openAI can change their website, APIs and even their models tomorrow. That’s not great for trust. Trust is what enables things to scale.
The same way you trust other internet protocols to just “route around problems” and not have one single point of failure, that is the substrate for Web3.
Imagine a Web2 website such as a student-teacher marketplace NOT handling millions of dollars, accepting money from students and paying them out to teachers. Imagine it being simply an interface while the actual transactions are approved by the students themselves, and instead of the central site signing payouts with some keys, the teachers get paid through smart contracts and code on the blockchain. The site can still take 10% commission from everything, it would be above board, and it can never change it without the consent of the people. The business logic is in the smart contract.
(Since this comment has the keywords “crypto” and “web3”, I know what will happen in advance already.)
Being able to leverage crypto on this scale requires everyone to either A) be technical enough to understand and use smart contracts directly or B) delegate a party that handles this for you. This is where the utopian case usually falls apart, because most people are B and this requires trusting a third party, which kinda defeats the entire point of the vision.
Because most people don't want to do the work of learning and managing crypto directly, a huge industry flourished to service these people, full of its own interests, corruption and various levels of criminality. And well-intentioned crypto people have no way to reign this industry in because the entire point is to operate in a deregulated way.
Ironically, the piece that makes crypto fundamentally unworkable 20 years in is capitalism.
But I think private/permissioned chains will gain some adoption in the background of tradfi, especially for settlement, clearing, collateral management via tokenisation etc. Your bank might eventually use technology developed in crypto, but it'll be called 'distributed ledger technology' or 'tokenisation' rather than crypto because of the negative image.
For example, you can donate to Sci-Hub with cryptocurrency. Sci-Hub has an ideological mission which is widely supported, but it runs afoul of copyright law and is illegal in nearly every country and sanctioned in many. You cannot donate to Sci-Hub with fiat currency.
Unfortunately, I agree that in practice >99% of cryptocurrency's use is for scams.
That seems valuable, but I’m not sure how much truth there is to a story I read on the internet.
Of course, the bottleneck then becomes converting stablecoin dollars to real dollars.
In the end, maybe that friction is actually a net positive for safety.
> safe from dictatorial countries.
Yeah, that's definitely an argument. But it's kind of funny when the backdrop is that $6B was taken by North Korea.
It feels like a sibling to the popular attitudes towards not trusting big banks, or voting for <candidate> who demonstrably achieves the opposite of what you're seeking, or feeling that democracy ain't working out great, or that vaccines are scary and dangerous. There's just a fundamental lack of higher-order thinking. It's all vibe-based reasoning. What feels scary is what guides these behaviours. Which, I think, is why it's so unsurprising that people in these camps make such unbelievably strong candidates for exploitation.
The original promise of crypto and blockchain was to cut out the middleman and NOT concentrate a lot of money under a few custodial keys.
If you took your crypto off exchanges when not in use, you’d be fine. Not your keys, not your crypto.
I mean, that's what the big mean government does, they monitor financial transactions and they collect taxes. But when we talk about financial privacy from the prying eyes of the government as a goal, and let's suppose people actually use crypto like was dreamed, this necessarily implies crypto being a tool to launder money. (in practice, this is better realized by privacy coins like Monero and ZCash, since Bitcoin sucks for privacy: your address is an anonymous handle but the network leak metadata. But, the desire for financial privacy was there in the Bitcoin community since the beginning).
And what else people do when they can hide their money from the government? In a lot of cases, they don't pay taxes (which is also a disposition present in the Bitcoin community since the beginning, with a rhetoric like, collecting taxes are not legitimate)
What I think was a later development was the main use case for crypto in real world, which is to collect payment for ransomware and things like this. This, I don't think it's something the early Bitcoin community envisioned.
> The Times 03/Jan/2009 Chancellor on brink of second bailout for banks
Bitcoin DNA trait #1: minting rules are in the protocol and they are deflationary.
The unbanked, like myself. People that for any reason is being locked out of the "american" way of doing things
Stripe doesn't cover 200 countries, nor does Apple Pay, Google Pay, Paypal, Visa, etc (all american btw). So a parallel banking system is needed, no questions about that, and Binance provides the best of all, and that's why it's being targeted by we know who (just follow the money)
Now, whether if it is crypto or not, I don't care, all I want is the possibility to pay and receive money (USD, EUR or CNY as the top currencies right now) without the draconian restrictions imposed by the hegemons trying to asphyxiate does who don't kneel
That's exactly why we need a parallel banking system, crypto or not
One of the ways this manifested was my ability to anticipate problems at work and poke holes in things. This made me incredibly unpopular. You never get thanked for this. Instead you get punished for being right too early. You are negative. You are a naysayer. You aren't a team player. And you were 100% correct and it didn't matter.
Back in 2012 I remember thinking "I don't see how crypto has any applications other than illegal stuff". And I stood by that. Note that morality and legality are two different things. Sending money to relatives in a country that disallows foreign currency transactions may be moral but it's still illegal.
What's frustrating is dealing with the same consequences of being right too early. It's muddied by true disruption. An example that was often brought up was Google. In the late 1990s, it was believed that search was a "solved" problem and there was no money in it. That's 100% true. But you can't ignore any criticism with "people once thought the world was round". It's a useless fallacy to deploy.
The absolutely dumbest people and outright scammers were attracted to crypto. A bunch of people who missed out on Bitcon's meteoric rise didn't want to miss the next meteor or they simply wanted to rug pull before they themselves got rug pulled.
The financial system is an endless series of Chesterton's Fences. So many things work the way they do because of a problem that occurred. They say that safety regulations are written in blood. People died to make those regulations. Well, financial regulations are the same way.
Being able to freeze assets and reverse transactions, for example, is a feature, not a bug.
The real story with crypto is how greed clouds people's judgment. So many people on HN thought they were going to make their bag on crypto and people like myself got shouted down as naysayers.
I really don't know what to do with this information other than those same warnings are beign ignored about AI and in 5 years I will be punished for being right too early. There's simply no market to recoup the trillions invested in rapidly depreciating assets around software with no moat.
Analogy is holding and trading gold underground that hasn't been mined yet using securities or other representation subject to capital market regulations and the legal framework. Is it an asset? Yes, if proven, documented, etc. Is it safe? Yes. Will you get your value back if the capital market representation of the underlying is stolen? Most likely (finra, sipc, etc).
But having live value on rails that enable instant movement globally with no recourse for unauthorized transfer? You're gonna have a bad time.
I equate it to anonymity on the internet. Yes, if everyone had to associate their real identity with everything they posted on the internet some unjustly persecuted individuals would not be able to get their stories out. And there would be a heck of a lot less other bullshit.
They're not even remotely close to being comparable.
https://cyberplace.social/@GossiTheDog/117528831681803563
https://en.wikipedia.org/wiki/Recency_bias?wprov=sfti1
Cursor's security announcement was posted on Oct 29 and says that the malicious extension was live "between about 2:27am PT and 1:35pm PT today"
This article says the attack took place "on Thursday" (which means Oct 29) and began at 4pm ET (which is 1pm PT)
and Binance has been tweeting that the cause of the hack may be a compromised employee laptop. yikes
[0]: https://www.bbc.com/news/articles/ce9p6x5ylrzo
[1]: https://www.bbc.com/news/uk-england-tyne-67586863
i don't have a solution.
Things like--
All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.If your plan is to quickly apply upstream patches, your plan is bad.
I try so hard for this, but don't even get approval to change an internal site to use https instead of http.
I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.
That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.
This used to be common before devops and cloud took over. Looks like it might make a comeback. Maybe with a new fancier job title
That tooling should be shut off from the internet [1], and if it uses a LLM that should be at least a few years old.
[1] technically impossible if it also has the ability to veto responses, but the surface can be very small.
I think people here underestimate how profitable these exchanges are.
First 10 minutes: Making a team, 2 guys or gals living a life, talk about it
11-30 minutes: Demoing how bad our security systems are, we need to patch them, day and night, can't keep up
31-40: But we need money, no one is paying our bounties
41-50: How about? They do not tell what it is
51-60: We are going to hack StarLink (they never say that, it is just the logo in the background when they are talking how easy it is to get in and out)
61-70: Dry Run, text scrolling on the screens
71-85: The Hack, split screens, zoom in and outs
86-88: Oh it was Solozzo (Binance) all along, not Starlink.
89:90: Dude fills up his car with the stolen USDT and realizes that as he is sitting in the car
who is Barzini and who is Tattaglia, just so i can call the latter a pimp
I like the final twist. It would be even better if it turns out the protagonist was manipulated by the real players and he ends up with little reward (because crime doesn't pay, kids!) but with renewed faith in his abilities.