
Viper: a new programming language from Ethereum - RabbitmqGuy
https://github.com/ethereum/viper
======
RcouF1uZ4gsC
As a bonus, it wraps all transactions in the VIP monad, where if you are an
important person in Ethereum, you can get your poorly written contracts
reversed.

Sorry, since the DAO fiasco I don't see Ethereum having any purpose. If a
poorly written/unfair contract should be invalidated, I would rather have e
the judicial system with hundreds of years of jurisprudence make that
decision, than a few people at Ethereum.

~~~
vvillena
The DAO contract was not invalidated. It is still there, on the blocks where
it was deployed.

The fact that the people running the nodes stopped seeing that fork of the
chain as the interesting one is distributed consensus at work. Anyone that
wants to keep observing that original fork can do so, that fork is actually
alive in the form of Ethereum Classic.

Ethereum was forked after the DAO fail because people saw more value in a
forked chain with new rules. Speaking about contract reversals or
invalidations is misleading. That is simply not possible, because Blockchain.
And while anyone can decide to fork a blockchain, building consensus around
the fork is what gives it its value.

The DAO was a marketing horror because it promised a world ruled by code,
built on top of blockchain tech. Blockchains, though, don't run on code but on
consensus.

~~~
runeks
What value does the Ethereum protocol provide when a disagreement splits the
network in two, without any recourse for either of the parties involved?

Which hard social/computer science problems are solved through a "consensus"
algorithm that essentially constitutes denying the existence of those who
disagree?

With Bitcoin, determining whether a fork is successful is very simple: are the
tokens on its blockchain as liquid as those on the Bitcoin one? If they are,
they are just as useful for transferring value as the "original" Bitcoin.

What metric would we use to determine whether an Ethereum fork is successful
or not? If nothing is lost when a consensus algorithm fails to establish
consensus, what value did it provide in the first place?

Market cap is an arbitrary measure because, in and of itself, it solves
nothing. At any time, I can fork Ethereum with a buddy of mine, trade the
resulting tokens at whichever price the original Ethers trade at, and the
market cap would be the same. Or, alternatively, trade them at 1/1000 the
Ether price, but change the protocol such that 1000 times as many exist.

~~~
vvillena
>What value does the Ethereum protocol provide when a disagreement splits the
network in two, without any recourse for either of the parties involved?

Don't give splits such importance. The nature of blockchains means that the
network is being constantly forked into many chains at its tip. It doesn't
matter which protocol is running on that blockchain.

>Which hard social/computer science problems are solved through a "consensus"
algorithm that essentially constitutes denying the existence of those who
disagree?

Existance is not being denied. The chain is still there. The problem is that
the rest of the people, a majority of nodes, prefer another version of the
chain.

>With Bitcoin, determining whether a fork is successful is very simple: are
the tokens on its blockchain as liquid as those on the Bitcoin one? If they
are, they are just as useful for transferring value as the "original" Bitcoin.

>

>What metric would we use to determine whether an Ethereum fork is successful
or not? If nothing is lost when a consensus algorithm fails to establish
consensus, what value did it provide in the first place?

Proof of Work consensus algorithms don't "fail" to establish consensus. They
are designed to swiftly choose one of many possible chains, based on a few
simple parameters (the most important one being the amount of work needed to
create the chain). That said, value is an off-chain concept. Just as US
dollars have value because we all know they are widely accepted, Ethereum has
value because there is a team of developers plus a big community plus a lot of
nodes, and all that together allows some use cases that make Ethereum have
value. Ethereum Classic has less value because it is not as widely accepted.
Bitcoin has a lot of value because as of now it is the most popular
cryptocurrency. Nothing about this has to do with the tech itself, but with
the way we see the tech.

------
oconnor0
Decidability. :) I'd love to see that show up in more languages. I believe it
allows for better abstractions without optimization deficiencies because it's
all decidable.

~~~
simcop2387
The big problem with that is that if a language is decidable it can't be
Turing complete. That means that a large number of useful programs are just
not going to be expressible. That said for something g like this it's a
perfect fit to have it be decidable.

~~~
chowells
There are no useful programs that require Turing completeness. That's
basically by definition. Turing completeness is what allows programs to have
non-productive infinite loops. Any system that guarantees productivity isn't
Turing complete. All useful algorithms are productive. The only thing you can
do with a non-productive algorithm is convert electricity to heat.

~~~
simcop2387
So I might have made this a bit confusing too by conflating the two things in
my original post. The real thing is that there are a lot of undecidable
programs that don't require Turing completeness. And a lot of those useful
programs are undecidable, an example of a really simple undecidable program:

    
    
        10 PRINT "Enter your name"
        20 INPUT NAME$
        30 PRINT "Hello ", NAME$
        40 IF NAME$ <> "Ralph" THEN
        41 GOTO 10
        42 END IF
        50 PRINT "Goodby Ralph"
    

That program, because it might loop indefinitely isn't decidable and isn't
possible to describe with Viper by design. This kind of program is pretty
analogous to basically every program that communicates with the network, user,
or some other external system.

~~~
Risord
So how non-turing completeness work with infinite streams?

Many practical applications (like this) are working with possibly infinite
stream of user inputs / requests etc. If we can guarantee that our server,
browser or game application just stops eventually we know that something is
wrong. However we like to guarantee that our application won't work infinitely
with single request / input / time tick. So does this say that we want avoid
using turing complete language mostly but turing complete part need to be
handled somewhere maybe outside of our code? Something like how Haskell works
with side effects. What you think?

~~~
tom_mellior
Coq is not Turing complete but has support for coinductive data types (=
infinite streams) and (co-)recursion over them.

Simplifying a lot, it has a syntactic "guard condition" that says that you
must produce some result before you're allowed to make a recursive call. For
example, you can map over an infinite stream because a map produces a result
for each element of the input stream. Unlike Haskell, you cannot write a fold
over an infinite stream because you would need to look at all elements before
producing a result.

So if you can structure your system as a transformation from an infinite
stream of requests to an infinite stream of responses, you're fine in Coq even
though it is not Turing complete.

The intuition is that, just like in Haskell, you don't _actually_ end up doing
an infinite computation if only a finite part of the final result is ever
requested.

~~~
pron
If you have support for coinductive data types then you are Turing complete.
Proof: you can simulate a Turing machine. However, Coq's _term language_ is
not Turing complete, meaning that every syntactic element in Coq evaluates to
a terminating computation.

------
mlangdon
> Bounds and overflow checking, both on array accesses and on arithmetic

I like that one. Anyone know any widely adopted languages that do this?

~~~
masklinn
Seems to be at runtime so, so almost every language for bounds checking.

Overflow checking is a bit more rare:

* Swift has it by default (error)

* So do Python, Ruby, Erlang (promotion to arbitrary precision)

* C# has an optional Checked Context though I don't know how common it is

* Rust has checked operations (opt-in, both error and saturating), will check (error) by default in debug mode, it can optionally check (error) in release mode

~~~
weavie
Idris has compile time bounds checking.

It is a pretty special case though, you have to jump through a number of hoops
using dependent types to get it.

~~~
masklinn
> Idris has compile time bounds checking.

Indeed it does, but I'm guessing it doesn't come close to qualifying for
"widely adopted language", my list is already stretching it.

------
RichardHeart
Can a blockchain project suffer from scope creep, if so, what would that look
like? I have to imagine that you don't have to invent a new language for
writing safe code (which in my noob mind, I think this is.) Maybe pick up
where some other safety oriented languages already are. If security is the
goal, is their path equal to this path:
[https://en.wikipedia.org/wiki/Formal_verification](https://en.wikipedia.org/wiki/Formal_verification)
. I can't imagine so, for they're making a new language?

It could be that they're making it a little safer, and a little easier, but
not really too much safer. The features are described, and they look mostly
like security?

~~~
lmm
You might find
[https://publications.lib.chalmers.se/records/fulltext/234939...](https://publications.lib.chalmers.se/records/fulltext/234939/234939.pdf)
interesting.

------
aqsheehy
What are some non-speculative use cases for ethereum that wouldn't be better
served by just using aws?

~~~
troymc
Educational transcripts, patent filings, farmland ownership transactions,
small-supply-chain records, lab reports, government transparency reports...
Pretty much any records where the total amount of data is fairly small, but
you want to share it publicly in a place that's long-lived and extremely
tamper-resistant, so others will trust it. Smart contracts (computer programs)
can do more, of course.

~~~
vosper
Wouldn't IPFS be a better fit for storing data than the Ethereum blockchain?

~~~
robto
One idea I heard was you would just store the IPFS hash address on the
Ethereum blockchain, so you can store basically anything in there without
blowing up the size.

~~~
m3ta
What about the ETH blockchain is needed to fulfill this requirement? Bitcoin's
blockchain can be used in the exact same way.

------
SkyMarshal
_> wei_value: an amount of wei_

What is wei? Another name for gas?

~~~
mbrock
It's the name for the smallest unit of ETH value.

------
kim0
How ready is this now to write real beta quality contracts in? I'm just
starting, should i pick this over solidity ?

------
toolslive
for max confusion, there also used to be a programming language called vyper.
[http://lambda-the-ultimate.org/classic/message1064.html](http://lambda-the-
ultimate.org/classic/message1064.html)

------
Temasik
Ethereum or Ethereum Classic?

------
lj3
> Requires python3

o_O _twitch_

~~~
saghm
Does it bother you that it requires Python3 specifically, or just Python at
all? (I can empathize with not wanting to use a language that's​ implemented
in Python, although if I had to, I'd probably prefer it was Python3)

~~~
lj3
The latter. It just seems wrong for a language to require python just to
install.

~~~
tom_mellior
Packages currently installed on my system that depend on Python (2 and 3,
respectively) and don't have "Python" in their name:

    
    
      calibre calibre-bin clang-format-3.8 creduce duplicity gimp gvfs-backends
      inkscape libatk-bridge2.0-dev libatk1.0-dev libatspi2.0-dev libcairo2-dev
      libgail-dev libgdk-pixbuf2.0-dev libglib2.0-dev libgnomecanvas2-dev
      libgtk-3-dev libgtk2.0-dev libgtksourceview-3.0-dev libgtksourceview2.0-dev
      libpango1.0-dev libsmbclient mercurial mercurial-common prosper rubber samba-libs
      texlive-latex-extra texlive-pictures texlive-pstricks virtualbox
      virtualbox-qt virtualenv-clone virtualenvwrapper vlc-plugin-samba
    
      aisleriot apparmor apport apport-gtk aptdaemon apturl apturl-common
      checkbox-converged checkbox-gui command-not-found compiz compiz-gnome
      dh-python firefox foomatic-db-compressed-ppds gconf2 gedit gir1.2-ibus-1.0
      gnome-menus gnome-orca gnome-software gnome-terminal hplip hplip-data ibus
      ibus-table inkscape language-selector-common language-selector-gnome
      libbonoboui2-0 libgnome-2-0 libgnome2-0 libgnome2-bin libgnome2-common
      libgnomeui-0 libgnomevfs2-0 libgnomevfs2-common libgnomevfs2-extra
      lsb-release nautilus-share onboard onboard-data openprinting-ppds
      plainbox-provider-checkbox plainbox-provider-resource-generic
      plymouth-theme-ubuntu-text printer-driver-foo2zjs
      printer-driver-foo2zjs-common printer-driver-postscript-hp
      printer-driver-ptouch printer-driver-pxljr qml-module-io-thp-pyotherside rhythmbox
      rhythmbox-plugin-zeitgeist rhythmbox-plugins sessioninstaller snap-confine
      snapd software-properties-common software-properties-gtk
      system-config-printer-common system-config-printer-gnome
      system-config-printer-udev totem-plugins ubuntu-core-launcher ubuntu-desktop
      ubuntu-drivers-common ubuntu-minimal ubuntu-release-upgrader-core
      ubuntu-release-upgrader-gtk ubuntu-software ubuntu-standard
      ubuntu-system-service ufw unattended-upgrades unity unity-control-center
      unity-control-center-signon unity-lens-photos unity-scope-calculator
      unity-scope-chromiumbookmarks unity-scope-colourlovers unity-scope-devhelp
      unity-scope-firefoxbookmarks unity-scope-gdrive unity-scope-home
      unity-scope-manpages unity-scope-openclipart unity-scope-texdoc
      unity-scope-tomboy unity-scope-virtualbox unity-scope-yelp
      unity-scope-zotero unity-webapps-common update-manager update-manager-core
      update-notifier update-notifier-common usb-creator-common usb-creator-gtk
    

Your mileage may vary, but the prospect of a Python-less system doesn't appear
tantalizingly close :-)

On the other hand, this language seems to take a subset of Python's syntax and
interpret it with different semantics. I find that both theoretically neat and
pragmatically smart. Making up a new syntax and writing a reliable parser is
boring busywork that takes time better invested elsewhere.

~~~
saghm
Fair point. I can only answer for myself, but for me it's more of the idea of
a language being implemented in Python rather than an issue with having Python
installed. I'll admit that I'm a bit of a PL snob, but writing a language in
Python just feels inefficient.

Another thing to note is that the vast majority of the packages you list are
things that might not be installed on a server environment; I admit I haven't
thoroughly read through every single package you listed, but the vast majority
of them seem to be GUI-related (Gnome, Unity, etc.) or printing related, none
of which would be necessary on a server environment. The only ones that stick
out as not fitting into these categories are the Ubuntu-specific things like
apparmor and the various apt-related packages (which would presumably not be
present on a machine that isn't Ubuntu or some other Debian-based system),
clang-format (which wouldn't really necessary on a server, since ideally you'd
format your code before pushing), and lsb-release (which may or may not be
necessary; on the machine where I'm currently writing this, the only package I
have that depends on lsb-release is mongodb, so for servers not having a
database (or having a different database), this wouldn't be necessary either.

------
mycall
Is Viper Turing complete? If so, is that a mistake? Bitcoin Script
specifically is not.

~~~
runeks
As I understand it, the entire purpose of Ethereum is a blockchain with a
Turing-complete scripting/contract language.

~~~
heckerhut
nope, it's ICOs

------
DonbunEf7
Stop. Read
[http://www.erights.org/talks/promises/paper/tgc05.pdf](http://www.erights.org/talks/promises/paper/tgc05.pdf).
Then start again.

~~~
jpolitz
Is there a particular piece of insight from that paper that indicates a
mistake in the design of Viper? I love erights' work and don't doubt that
there is a lot to be learned from it in this context, but some guidance on how
to apply it here would help.

~~~
DonbunEf7
The DAO attack was plan interference. Absorb and grok that idea, and then the
rest will hopefully follow.

Specifically, Viper has two glaring flaws, both of which are not suffered by
E, Monte, etc. The first is a lack of correct encapsulation. Viper appears to
have a Python-style object model, which means that it's not possible to
closely hold a value. As a test, how would you build an object with a value in
its closure which no other object can access?

Second, Viper doesn't have mitigation for plan interference, which means that
it's possible for certain kinds of recurrences to alter your program's
security guarantees. As a test, how would you mitigate the DAO attack in
Viper?

Finally, I fear that these flaws may be inherent to Ethereum, meaning that any
language on Ethereum inherits these flaws structurally and cannot mitigate
them. In that case, maybe it's time to design a capability-safe Ethereum!

~~~
abecedarius
Indeed, in the (pre-DAO) Ethereum audit report
[https://github.com/LeastAuthority/ethereum-
analyses/blob/mas...](https://github.com/LeastAuthority/ethereum-
analyses/blob/master/GasEcon.md#hazards) they brought up your second issue and
recommended Mark Miller's thesis (which covers the material in the OP).

I haven't looked into Viper and how it might address these matters.

