From: Antoine Riard <antoine.riard@gmail•com>
To: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] Re: A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core
Date: Sat, 20 Jul 2024 19:13:41 -0700 (PDT) [thread overview]
Message-ID: <a7ae8eee-11c8-48ea-80f8-4411741c3d3en@googlegroups.com> (raw)
In-Reply-To: <ZpvS2haduzUQiojV@petertodd.org>
[-- Attachment #1.1: Type: text/plain, Size: 2314 bytes --]
Hi Peter,
> It's quite bizzare to use "off topic comments" as an excuse to close a
pull-req
> fixing a specific security vulnerability, assuming you actually care
about that
> vulnerability.
Do not assign to malovelence what can be assigned to genuine incompentence
or willful laziness.
In the present case, it's all to bet that the moderators close the PRs,
without being
aware of your reported security issue on the mailing list. This what you
expect in
a open-source community managing sensitive security information, where it
is formally
segregated between actors. I'm certainly not trusting will-ark with bitcoin
security
information, at least anything beyond begnign issues.
> As I've said elsewhere, Core could have easily and quietly
> merged that pull-req as-is, possibly by having a few people write some
obvious
> ACK rationals.
I think this is the kind of issues, given the plausibility we still have
laggards
of when `mempoolfullrbf` was introduced almost 2 years ago to reconsider
their
bitcoin infrastructure deployment, or 0conf acceptance flow. It's always
polite
and it can only help building strong cultural norms in an ecosystem where
the economic
traffic is deal with more and more by codebase which are not bitcoin core.
> The only good explanation for closing it is to further delay merging the
> pull-req, as well as disclosing the vulnerability.
I think this is the issue where it is worhty to purse the conservation:
https://github.com/bitcoin-core/meta/issues/5
All that said, I'll re-advocate your integration to the bitcoin security
mailing list by re-opening an issue on the github repository ?
Thanks to confirm you're okay with that (this can be done in private).
Very pragmatically, I'm trusting you more than most of the folks on the
list right now if I have issues to report.
Best,
Antoine
ots hash: 6c6ab1f4264c63245063a35da7f29f9e874a152a68e521b7f2ca2a972584a95d
--
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/a7ae8eee-11c8-48ea-80f8-4411741c3d3en%40googlegroups.com.
[-- Attachment #1.2: Type: text/html, Size: 2790 bytes --]
next prev parent reply other threads:[~2024-07-21 18:04 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-18 15:56 [bitcoindev] " Peter Todd
2024-07-18 23:04 ` [bitcoindev] " Antoine Riard
2024-07-19 1:05 ` Peter Todd
2024-07-19 13:52 ` Antoine Riard
2024-07-19 14:38 ` Peter Todd
2024-07-19 23:58 ` Antoine Riard
2024-07-20 0:46 ` 'Ava Chow' via Bitcoin Development Mailing List
2024-07-21 2:06 ` Antoine Riard
2024-07-21 20:17 ` 'Ava Chow' via Bitcoin Development Mailing List
2024-07-22 1:59 ` 'Anonymous User' via Bitcoin Development Mailing List
2024-07-24 0:44 ` Antoine Riard
2024-07-24 0:35 ` Antoine Riard
2024-07-19 12:41 ` /dev /fd0
2024-07-19 23:56 ` Antoine Riard
2024-07-20 5:57 ` /dev /fd0
2024-07-20 15:08 ` Peter Todd
2024-07-21 2:13 ` Antoine Riard [this message]
2024-07-21 6:16 ` /dev /fd0
2024-07-21 2:12 ` Antoine Riard
2024-07-19 18:26 ` [bitcoindev] " Murch
2024-07-20 14:10 ` Peter Todd
2024-07-20 6:41 ` David A. Harding
2024-07-20 15:03 ` Peter Todd
2024-07-20 15:30 ` Peter Todd
2024-07-21 15:35 ` David A. Harding
2024-07-21 20:25 ` Peter Todd
2024-07-24 0:38 ` Antoine Riard
2024-07-21 2:10 ` Antoine Riard
2024-07-22 15:10 ` Peter Todd
2024-07-24 0:41 ` Antoine Riard
2024-07-22 11:45 ` [bitcoindev] RBFR makes the CPFP carve-out obsolete with cluster mempool, without upgrading LN nodes; TRUC/V3 does not Peter Todd
2024-07-22 16:43 ` David A. Harding
2024-07-22 20:06 ` Peter Todd
2024-07-22 22:08 ` David A. Harding
2024-07-23 11:29 ` Peter Todd
2024-07-24 0:42 ` Antoine Riard
2024-07-22 17:13 ` [bitcoindev] A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core Peter Todd
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a7ae8eee-11c8-48ea-80f8-4411741c3d3en@googlegroups.com \
--to=antoine.riard@gmail$(echo .)com \
--cc=bitcoindev@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox