Hi Peter,

I agree that handling of vulnerability reports could be improved, although 
I have less expectations from bitcoin core to acknowledge any feedback. 
Here are a few things that we can do to improve the process:

- Report vulnerabilities anonymously and share real identity with 
disclosure later if required.
- Send the email to achow101 or sipa or fanquake and keep 
security@bitcoincore.org in Cc.
- Lets create a hall of fame webpage which has the name of all developers 
who reported vulnerabilities along with other details. Community could also 
donate directly to developers.
- Do not expect response on weekends and wait for at least 7-30 days before 
full disclosure if vulnerability report is ignored.

Maybe you and others on mailing list could add suggest more improvements.

/dev/fd0
floppy disk guy

On Saturday, July 20, 2024 at 3:12:46 PM UTC Peter Todd wrote:

> On Fri, Jul 19, 2024 at 10:57:40PM -0700, /dev /fd0 wrote:
> > Hi Antoine,
> > 
> > > I'm interested if you can propose a formal or mathematical definition 
> of 
> > what constitute
> > > an in-topic of off-topic comments on a matters like full RBF, which 
> has 
> > been controversial
> > > for like a decade.
> > 
> > I will quote _willcl-ark_'s last comment as I do not have enough 
> > permissions in bitcoin core repository to moderate comments:
> > 
> > "However the comments section here has become difficult to follow due to 
> > numerous off-topic comments, a few personal disagreements, and 
> repetition 
> > of arguments. In the interest of having a more productive and focused 
> > technical and philosophical discussion we are going to close and lock 
> this 
> > PR."
> > 
> > A new pull request should help reviewers. If you do not agree with it, 
> feel 
> > free to discuss it with moderators in bitcoin core IRC channel.
>
> It's quite bizzare to use "off topic comments" as an excuse to close a 
> pull-req
> fixing a specific security vulnerability, assuming you actually care about 
> that
> vulnerability. As I've said elsewhere, Core could have easily and quietly
> merged that pull-req as-is, possibly by having a few people write some 
> obvious
> ACK rationals.
>
> The only good explanation for closing it is to further delay merging the
> pull-req, as well as disclosing the vulnerability.
>
> -- 
> https://petertodd.org 'peter'[:-1]@petertodd.org
>

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/955e7097-ca7a-452a-953f-718aca14cdc6n%40googlegroups.com.