“The DAO” — a rebel without a cause

I am getting increasingly worried about the echo chamber surrounding the Slock.it DAO.

I want to believe in it and I want them to do well, which is why I’m going to be devils advocate right now and ask some hard questions. If these hard questions can be answered well, that is awesome. If they can help make some what I think are needed changes, then even better.

Experimentation is fantastic and necessary. We wouldn’t be where we are today without a lot of people experimenting and a lot of people failing. The failing part is very important here.

For the Ethereum ecosystem to be Anti-Fragile, crazy projects, ideas, and yes even fraudulent ones need to be launched and need to be allowed to fail if needed, so the ecosystem as a whole grows and gets stronger.

Yet given all that here we have my first problem:

1. The DAO

It may seem clever to call it “The DAO”. Yet it also takes the fate of “The DAO” and forever more taints any future DAO’s with it.

Let’s say there is flaw in the code and all funds invested are lost for ever. A group of hackers get a bunch of naive investors investing via data fields on exchanges to sign over control to them. Or any number of other possible failures.

Now the word “DAO” will forever be tainted with this failure.

This is not just academic. Bitcoin was tainted by association with MTGox. Just imagine if MTGox had been called “The Bitcoin Company”? They would have been free to call it that. But it would have done even more harm to Bitcoin in the court of public opinion that it already has.

2. Standard DAO framework

It is very easy to use the term Standard. I have done so wrongly in the past myself. I would much prefer Standards being created bit by bit through experimentation and failure as they do in the real world.

The Stripe Payment API is the Stripe Payment API, it is not the Standard Payment API. If everyone else started copying it, then it could become the de-facto Payment API>

Calling something “Standard” encourages people who haven’t thought about their own needs to use blindly follow the rules without improving or learning.

It also encourages Fraudsters to launch their own “The DAO’s” pushing the fact that they use the exact same code as “The DAO”. This will happen. People will loose money.

3. Rebel without a Cause

A DAO to create a Smart Contract controlled lock has a purpose. A DAO with the purpose of just being a DAO or the Mother of all DAO’s has none. It’s like me launching a kickstarter to you know do stuff.

One part of traditional company law was the idea of a purpose. Even though it is often watered down into “For any legal purposes” in legal templates, there is a good reason for having it. It tells investors what we are doing and focuses the team as well.

No one says you can’t change the purpose, but it is a really bad idea to launch anything without a specific purpose.

4. Blatant disregard of security

I know a lot of non technical investors are would love to invest in the latest greatest thing. So it was important there was a way for them to be able to join in “The DAO” before there being easy to use consumer wallets.

The solutions became adding a data field to the exchanges, where most non technical investors store their Eth.

Yet any security expert will tell you this is a really bad idea. To understand why see this discussion about ethereum URI’s by people who know what they’re talking about:

Someone one some forum tells me to vote for his proposal. Just paste this hex code into the data field. Only thing is that hex code actually transferred all my tokens over to someone else instead.

What about durability of addresses? Most exchanges do not ensure the same address when sending. Or ShapeShift? They don’t even have accounts? This is a bad idea.

There are solutions put forward in the above EIP that are good. But in a rush to launch the crowdfunding Stephan Tual told me on twitter it’s not an issue and has refused to talk more about it.

What needs to be done?

• Decide what the purpose of the DAO is, is probably first order of the day
• Once you know the purpose, change the name to something suitable.
• Remove the Data field and add a function field to the exchange instead and perhaps to protect customers only allow such a field to be used with a SmartContract that is well mapped out on a third party site like Ether.Camp
• Rename “Standard DAO Framework” to “Slock.it DAO Framework” or whatever the new name for the Slock.it DAO is.