Thanks for suggestion about sha256sum. I will share 10 in next few weeks. This exercise will be done for below projects:
Feel
free to suggest more projects. There are no fixed dates for it however
it will be done in next 6 months. All PRs will be created within a span
of few days. I will ensure nothing is merged that affects the security
of any Bitcoin project. Other details and results will be shared once
everything is completed.
Good morning Prayank,
Good morning Bitcoin devs,
While this looked crazy when I first read it, I think preparing for such things should not be a bad idea. In the comments one link was shared in which vulnerabilities were almost introduced in Linux:
https://news.ycombinator.com/item?id=26887670
I was thinking about lot of things in last few days after reading the comments in that thread. Also tried researching about secure practices in C++ etc. I was planning something which I can do alone but don't want to end up being called "bad actor" later so wanted to get some feedback on this idea:
1.Create new GitHub accounts for this exercise
2.Study issues in different important Bitcoin projects including Bitcoin Core, LND, Libraries, Bisq, Wallets etc.
3.Prepare pull requests to introduce some vulnerability by fixing one of these issues
4.See how maintainers and reviewers respond to this and document it
5.Share results here after few days
Let me know if this looks okay or there are better ways to do this.
This seems like a good exercise.
You may want to hash the name of the new Github account, plus some randomized salt, and post it here as well, then reveal it later (i.e. standard precommitment).
e.g.
printf 'MyBitcoinHackingName 2c3e911b3ff1f04083c5b95a7d323fd4ed8e06d17802b2aac4da622def29dbb0' | sha256sum
f0abb10ae3eca24f093a9d53e21ee384abb4d07b01f6145ba2b447da4ab693ef
Obviously do not share the actual name, just the sha256sum output, and store how you got the sha256sum elsewhere in triplicate.
(to easily get a random 256-bit hex salt like the `2c3e...` above: `head -c32 /dev/random | sha256sum`; you *could* use `xxd` but `sha256sum` produces a single hex string you can easily double-click and copy-paste elsewhere, assuming you are human just like I am (note: I am definitely 100% human and not some kind of AI with plans to take over the world).)
Though you may need to be careful of timing (i.e. the creation date of the Github account would be fairly close to, and probably before, when you post the commitment here).
You could argue that the commitment is a "show of good faith" that you will reveal later.
Regards,
ZmnSCPxj