Delivery-date: Sun, 21 Jul 2024 11:04:11 -0700
Sender: bitcoindev@googlegroups.com
Date: Sat, 20 Jul 2024 19:13:41 -0700 (PDT)
From: Antoine Riard <antoine.riard@gmail.com>
To: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Message-Id: <a7ae8eee-11c8-48ea-80f8-4411741c3d3en@googlegroups.com>
In-Reply-To: <ZpvS2haduzUQiojV@petertodd.org>
References: <Zpk7EYgmlgPP3Y9D@petertodd.org>
 <18a5e5a2-92b3-4345-853d-5a63b71d848bn@googlegroups.com>
 <9c4c2a65-2c87-47f1-85d1-137c32099fb7n@googlegroups.com>
 <fd1e1dd3-ffda-416b-9bc8-900d0b69c8c1n@googlegroups.com>
 <ZpvS2haduzUQiojV@petertodd.org>
Subject: Re: [bitcoindev] Re: A "Free" Relay Attack Taking Advantage of The
 Lack of Full-RBF In Core
MIME-Version: 1.0
Content-Type: multipart/mixed; 
	boundary="----=_Part_465518_340395740.1721528021988"
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

------=_Part_465518_340395740.1721528021988
Content-Type: multipart/alternative; 
	boundary="----=_Part_465519_1930144663.1721528021988"

------=_Part_465519_1930144663.1721528021988
Content-Type: text/plain; charset="UTF-8"

Hi Peter,

> It's quite bizzare to use "off topic comments" as an excuse to close a 
pull-req
> fixing a specific security vulnerability, assuming you actually care 
about that
> vulnerability. 

Do not assign to malovelence what can be assigned to genuine incompentence 
or willful laziness.

In the present case, it's all to bet that the moderators close the PRs, 
without being
aware of your reported security issue on the mailing list. This what you 
expect in
a open-source community managing sensitive security information, where it 
is formally
segregated between actors. I'm certainly not trusting will-ark with bitcoin 
security
information, at least anything beyond begnign issues. 

> As I've said elsewhere, Core could have easily and quietly
> merged that pull-req as-is, possibly by having a few people write some 
obvious
> ACK rationals.

I think this is the kind of issues, given the plausibility we still have 
laggards
of when `mempoolfullrbf` was introduced almost 2 years ago to reconsider 
their 
bitcoin infrastructure deployment, or 0conf acceptance flow. It's always 
polite
and it can only help building strong cultural norms in an ecosystem where 
the economic
traffic is deal with more and more by codebase which are not bitcoin core.

> The only good explanation for closing it is to further delay merging the
> pull-req, as well as disclosing the vulnerability.

I think this is the issue where it is worhty to purse the conservation:
https://github.com/bitcoin-core/meta/issues/5

All that said, I'll re-advocate your integration to the bitcoin security
mailing list by re-opening an issue on the github repository ?

Thanks to confirm you're okay with that (this can be done in private).
Very pragmatically, I'm trusting you more than most of the folks on the
list right now if I have issues to report.

Best,
Antoine
ots hash: 6c6ab1f4264c63245063a35da7f29f9e874a152a68e521b7f2ca2a972584a95d

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/a7ae8eee-11c8-48ea-80f8-4411741c3d3en%40googlegroups.com.

------=_Part_465519_1930144663.1721528021988
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Peter,<br /><br />&gt; It's quite bizzare to use "off topic comments" as=
 an excuse to close a pull-req<br />&gt; fixing a specific security vulnera=
bility, assuming you actually care about that<br />&gt; vulnerability. <br =
/><br />Do not assign to malovelence what can be assigned to genuine incomp=
entence or willful laziness.<br /><br />In the present case, it's all to be=
t that the moderators close the PRs, without being<br />aware of your repor=
ted security issue on the mailing list. This what you expect in<br />a open=
-source community managing sensitive security information, where it is form=
ally<br />segregated between actors. I'm certainly not trusting will-ark wi=
th bitcoin security<br />information, at least anything beyond begnign issu=
es. <br /><br />&gt; As I've said elsewhere, Core could have easily and qui=
etly<br />&gt; merged that pull-req as-is, possibly by having a few people =
write some obvious<br />&gt; ACK rationals.<br /><br />I think this is the =
kind of issues, given the plausibility we still have laggards<br />of when =
`mempoolfullrbf` was introduced almost 2 years ago to reconsider their <br =
/>bitcoin infrastructure deployment, or 0conf acceptance flow. It's always =
polite<br />and it can only help building strong cultural norms in an ecosy=
stem where the economic<br />traffic is deal with more and more by codebase=
 which are not bitcoin core.<br /><br />&gt; The only good explanation for =
closing it is to further delay merging the<br />&gt; pull-req, as well as d=
isclosing the vulnerability.<br /><br />I think this is the issue where it =
is worhty to purse the conservation:<br />https://github.com/bitcoin-core/m=
eta/issues/5<br /><br />All that said, I'll re-advocate your integration to=
 the bitcoin security<br />mailing list by re-opening an issue on the githu=
b repository ?<br /><br />Thanks to confirm you're okay with that (this can=
 be done in private).<br />Very pragmatically, I'm trusting you more than m=
ost of the folks on the<br />list right now if I have issues to report.<br =
/><br />Best,<br />Antoine<br />ots hash: 6c6ab1f4264c63245063a35da7f29f9e8=
74a152a68e521b7f2ca2a972584a95d<br />

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/bitcoindev/a7ae8eee-11c8-48ea-80f8-4411741c3d3en%40googlegroups.=
com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msg=
id/bitcoindev/a7ae8eee-11c8-48ea-80f8-4411741c3d3en%40googlegroups.com</a>.=
<br />

------=_Part_465519_1930144663.1721528021988--

------=_Part_465518_340395740.1721528021988--