Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of googlemail.com
	designates 74.125.83.68 as permitted sender)
	client-ip=74.125.83.68;
	envelope-from=john.dillon892@googlemail.com;
	helo=mail-ee0-f68.google.com; 
MIME-Version: 1.0
In-Reply-To: <CAAS2fgR7evOkrTpX75EQgJzuDUBqGOKCAvWJR_5T64REOJmJ8A@mail.gmail.com>
References: <CANEZrP2GvgZP_1z3EoSs3p+db7tZB6JfEVAewLpGE5eRpGgR3w@mail.gmail.com>
	<CAAS2fgT+GPgOtvvrjKozYc-Swqw-+HPcyZY5MbqvY9oEhiWRuA@mail.gmail.com>
	<CANEZrP2hn3oXp4CU7-85vpSLc_3GGnRgfQNKDc+28jkB2DE2JA@mail.gmail.com>
	<CAAS2fgR7evOkrTpX75EQgJzuDUBqGOKCAvWJR_5T64REOJmJ8A@mail.gmail.com>
Date: Sun, 28 Jul 2013 18:21:44 +0000
Message-ID: <CAPaL=UWsZ1xAgqSC==FzT3xEi1J6-qw4mYmnL0vycq5ipC0v7g@mail.gmail.com>
From: John Dillon <john.dillon892@googlemail.com>
To: Gregory Maxwell <gmaxwell@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Linux packaging letter
Precedence: list

My signature:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Linux distribution packaging and Bitcoin
========================================
2013-07-23

This note summarises the dangers inherent in the Linux distribution
packaging model for Bitcoin, and forms a request from upstream
maintainers to not distribute Bitcoin node software as part of
distribution package repositories without understanding the special
requirements of Bitcoin.

Distributors typically unbundle internal libraries and apply other
patches for a variety of generally good reasons, including ensuring
that security-critical fixes can be applied once, rather than multiple
times for many different packages. In most cases, the common
distribution packaging policy has many advantages.

However, Bitcoin nodes are an unusual category of software: they
implement a complex group consensus in which every client verifies the
behaviour of every other exactly. Even an exceptionally subtle change -
including apparently harmless bugfixes - can cause a failure to reach
consensus. A consensus failure of one client is a security risk to the
user of that client. A significant number of nodes failing to reach
consensus - as happened in March 2013 due to a change in database
libraries[1] - is a critical problem that threatens the functionality
and security of the system for all users.

For this reason, it is _vital_ that as much of the network as possible
uses _unmodified_ implementations that have been carefully audited and
tested, including dependencies. For instance, if the included copy
of LevelDB in bitcoind is replaced by a system-wide shared library,
_any_ change to that shared library requires auditing and testing,
a requirement generally not met by standard distributor packaging
practices.

Because distributed global consensus is a new area of computer science
research, the undersigned request that distributors refrain from
packaging Bitcoin node software (including bitcoind and Bitcoin-Qt)
and direct users to the upstream-provided binaries instead _until they
understand the unique testing procedures and other requirements to
achieve consensus_. Beyond being globally consistent, upstream binaries
are produced using a reproducible build system[2], ensuring that they
can be audited for backdoors.

1. https://en.bitcoin.it/wiki/BIP_0050
2. http://gitian.org/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBCAAGBQJR9WC5AAoJEEWCsU4mNhiPg6UH/2oHzBWBPaQMhH/GCTHQEi5U
7GSRfqwihIs/M2ROHLNq0HhgWR7mPAh5TTI6+tG95FCGCGNZq0seqw9wW4ZyGCoc
VueY51q4hcn23405oLD/QGK2lDxxywWY8XtFYVPqAzXTq6zRzgpNJkjoRtOAUOP7
3PrRkimYYyj0KrqFg+cEvZDT27dkeX+5PXM6Ua0o7h/TlhR2RJPhej5DI8cNLXgA
f0t+mES4Apb6zLgnEYYlPp22FR9vuFcJO3z1akhVL4DLUMqr58NYHLVnH1FH0Jhn
hVuld159QtCjQ5Qyn19cn86akTQJVi+ikCXqaKriCc2jBFX7TCI8WTDc6aSZpsQ=
=oX5d
-----END PGP SIGNATURE-----