Subject: Re: [bitcoindev] Re: A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core

From: "'Ava Chow' via Bitcoin Development Mailing List" <[email-masked]>
Date: Sun, 21 Jul 2024 20:17:13 +0000

On 07/20/2024 10:06 PM, Antoine Riard wrote:
> "Naive", as saying this is the _Bitcoin Core_ project list only can only 
> provoke blind
> spot among the list members if the security issues are either affecting 
> old part of
> the codebases that younger members have less experiences with (some 
> parts like consensus
> or block-relay are modified only every 5 years) or novel factors from 
> upstream or downstream
> (e.g the internet networking stack or implications on deployed contract 
> protocols like
> lightning). On both the former and latter criterias, I think Peter 
> overly meets the bar.

Peter was not the only "senior" person on the security list. Obviously I 
will not disclose non-public information, but certainly there are people 
on the security list who are just as, if not more, senior than Peter.

Furthermore, the "old parts" still do get changed, and someone who no 
longer actively contributes to the project is more likely to be unaware 
of how the code actually works today, even if they are familiar with 
components that change infrequently.

> When you've big sh*t hitting the fan like inflation bugs or level DB 
> 2013 unexpected fork you
> prefer have experts with a decade of experience to collaborate with, and 
> sharing the same cultural
> and ethical norms of the active contributors evaluated by numbers on 
> commits on the last single-digit
> years.

Not being on the list does not preclude him from being consulted if the 
need arises.

With the two examples you provide, I am not aware of Peter being 
actively involved in the resolution of both of those, whereas there are 
current members of the list who were.

In general though, it is not clear to me how it was beneficial to have 
Peter on the security list, nor how not having him is directly harmful. 
In the 2 years that I have been on the security list, I was unaware that 
Peter was a recipient until shortly before he was removed. My 
understanding is that others who have been on the list longer than me 
were also unaware.

Ava

> 
> I'll repropose Peter admission on the security list mailing list in the 
> coming weeks by opening an
> issue on the bitcoin-meta repository, once this current mailing list 
> thread has slowed down a bit,
> or at least the technical analysis has been dissociated from the 
> proceedings which have all been
> bundle in a big message. In my very personal opinion, I still trust more 
> Peter competence and experience
> than some other people I know who are on the security mailing list.
> 
> All that said I appreciate your answer and I'm satisfied from the 
> personal role you've have played
> in the matter with, and be reassured I'll keep you among the recipient 
> of future security issues with
> a potential impact on bitcoin core that I might find or be aware off.
> 
> Best,
> Antoine
> ots hash: db441b51684ad3a6897f67d42c74ccfcb9a4ffed40d4bdbe30a2edd867ccdd54
> 
> Le samedi 20 juillet 2024 à 01:50:25 UTC+1, Ava Chow a écrit :
> 
>     On 07/19/2024 07:58 PM, Antoine Riard wrote:
>      > As said in one my previous email, I'm still curious about achow101
>      > explaining publicly
>      > why you have been kicked-out of the bitcoin-security mailing
>     list, when
>      > you were certainly
>      > more senior than achow101 in matters of base-layer security
>     issues or
>      > even hard technical
>      > issues like consensus interactions (e.g bip65). I'll re-iterate my
>      > respect towards achow101
>      > as a maintainer from years of collaboration, though this is a topic
>      > worthy of an answer.
> 
>     I am not the one that removed Peter from the mailing list, nor do I
>     even
>     have the login(s) to do so.
> 
>     There was a discussion amongst several members of the security list
>     about who was on the list, and who should be on the list. Given that
>     the
>     security list is the _Bitcoin Core_ security list, we determined that
>     the people who should be on the list are people who still actively
>     contribute to the project. As Peter Todd no longer actively contribute
>     code nor code review to the project, we decided that it didn't make
>     sense to continue to have him on the list.
> 
>     My recollection is that multiple other people were removed from the
>     list
>     for the same reason at the same time.
> 
>     Ava
> 
> -- 
> You received this message because you are subscribed to the Google 
> Groups "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send 
> an email to [email-masked] 
> <mailto:[email-masked]>.
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/bitcoindev/2aa2d6fa-ae72-4aef-9fda-49e2f7c657abn%40googlegroups.com <https://groups.google.com/d/msgid/bitcoindev/2aa2d6fa-ae72-4aef-9fda-49e2f7c657abn%40googlegroups.com?utm_medium=email&utm_source=footer>.

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email-masked].
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/a8eac5f2-b85a-434f-868e-eba7fd2558c6%40achow101.com.