The Zeppelin team writes about Ethereum smart contracts, Solidity internals, and ZeppelinOS, a tool set for building smart contract applications.
HN commenters cite its account of the Parity multisig wallet hack, in which one call froze many wallets, and its fat-protocols and Solidity posts.
They've also shown an unwillingness to fork other hacks, such as the Parity one: https://blog.zeppelin.solutions/on-the-parity-wallet-multisig-hack-405a8c12e8f7
I do understand that reverting is somewhat against fundamental blockchain ideals, but on the other hand – you could always just continue using Ethereum classic – if you're a more principled blockchain enthusiast.
Also the use of the word "embarassing" makes me wonder if you truly understand what massive efforts it takes to create something as ambitious as Ethereum without running into some critical bugs.
Last night after reading about the Parity Multi Sig attack I decided to finally try and read up on this subject, but quickly got annoyed with all the 'how bitcoin/blockchain works' videos that repeat the same high level points without scratching any of my technical itches. That was until I found this very concise gem of an introduction:
http://www.imponderablethings.com/2013/07/how-bitcoin-works-under-hood.html?m=1
Via. https://blog.zeppelin.solutions/the-hitchhikers-guide-to-smart-contracts-in-ethereum-848f08001f05
This is the most useful explanation I've found about the vulnerability so far: https://blog.zeppelin.solutions/on-the-parity-wallet-multisig-hack-405a8c12e8f7
The explanation is a bit scary about what actually ended up in parity code:
The wallet contract forwards all unmatched function calls to the library using delegate call... This causes all public functions from the library to be callable by anyone, including initWallet, which can change the contract’s owners.
Edit: formatting
Lots of smart people in this space disagree with "fat protocols."
I'll immodestly list my own first: https://www.evanvanness.com/post/166666272011/theres-no-such-thing-as-fat-protocols
See also CoinFund's Jake Brukhman: https://blog.coinfund.io/fat-protocols-are-not-an-investment-thesis-17c8837c2734
And Zeppelin's Teemu Paivinen: https://blog.zeppelin.solutions/thin-protocols-cc872258379f
I hear that even Joel doesn't agree with how his piece has been interpreted.
Not exactly clients, but the Parity multisig "hack"[0] was pretty wild. All it took was one permissionless call to permanently wipe the shared library of a large bunch of multisig wallets, thereby freezing those wallets forever. Some of the impacted people, including Parity, are still pushing for overriding the wallets to be unlocked, despite no support from anyone else.
0: https://blog.zeppelin.solutions/on-the-parity-wallet-multisig-hack-405a8c12e8f7
This is a retelling of the Parity Multi-Sig Wallet hack, from the hackers perspective:
https://blog.zeppelin.solutions/on-the-parity-wallet-multisig-hack-405a8c12e8f7
We're talking about 40mn USD here so I doubt that this account was written by the original hacker.