Date: Tue, 23 May 2023 16:45:58 +0000
To: Michael Folkson <michaelfolkson@protonmail.com>
From: alicexbt <alicexbt@protonmail.com>
Message-ID: <a7Lo31vAM-OXFhdLP0IcKI8ps5ceW2Q32s33MI9ASxERoJLsudaRSKFGz2SVItY9_J1dRrghP6pDXCc86JeDeUaodN4V8Q_H3iZxqN96MLk=@protonmail.com>
In-Reply-To: <ZK1WioZUQp4XKBw9a8RxvLRRtlxsnQ8NoZ5SPIbcMVqeW3D9bpnLeJF2V4L68jz3QVaaqYiBbo46Rxobs8hZ9LfK3Jxibi1HHKBgQiqbCUs=@protonmail.com>
References: <73TDuUxE1bU1oorFgqmS9MKA_hQz8W_IdSR9zJK1Fwkp5qfU7eqmA75QMddrME9iwrLmTkB7qLgf94o4c4NT1OgHe2QD_BeWvjZvDmLT6dg=@protonmail.com>
 <I_QFh8MNIEz819n0dEitgXPmS5jfrYkOxTZoo211l1grYmW3yrDYxkso9XSrqLS26WJVXj0LAIpYe77DwWs7sXClVjz_Oz-lQiOV3Hn1U2Y=@protonmail.com>
 <k95MsgwJmus2shEQ3XcON4sPN2jpvN0NOiVuIUk27H-gQno3iH4XEMH_nyaKzUuCM8KKt63qM8cph6Eai7fCgWRxfTdYnKdfVw0i2NZTTf0=@protonmail.com>
 <v7cGm-OTbNjvVuGJ8xMe1pOiBwVH1BZkJMS6DjcK5j9kMHmeCRhKrpbglugLPjyUQmDSzIXNxGz4k-kK4sjkIHgWrbaiO_93qauVKSJzZmY=@protonmail.com>
 <yCRGs9ve5782SDi1mdGMA1x1jOeJzBkfsWJxtFD3gcrPHI7WW2Ah3Qn9_Z1f17pGFAfC4DIx8fnLUMggrRdq0kfYRlJxpgLt_qJ7wSVC9t0=@protonmail.com>
 <ZK1WioZUQp4XKBw9a8RxvLRRtlxsnQ8NoZ5SPIbcMVqeW3D9bpnLeJF2V4L68jz3QVaaqYiBbo46Rxobs8hZ9LfK3Jxibi1HHKBgQiqbCUs=@protonmail.com>
Feedback-ID: 40602938:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Responsible disclosures and Bitcoin development
Precedence: list

Hi Michael,

Yes, I had requested CVE ID after v24.1 was released as Anthony Towns being=
 the discoverer.

I would follow the process shared here: https://github.com/bitcoin/bitcoin/=
blob/master/SECURITY.md when bitcoin core developers do not disclose vulner=
abilities publicly as GitHub issues which are read by everyone including 3 =
letter agencies. I don't think there was anything left in the issue after d=
iscussing it for days for me to add anything new. I was clear about some th=
ings the moment I read the issue and its one of the reasons I created this =
thread on May 9 (public) about a public GitHub issue after following it for=
 a few days.

It would still qualify as a vulnerability if it only affected debug builds.

> You weren't particularly clear with what has occurred.

It would be better we have less assumptions about such things.

/dev/fd0
floppy disk guy

Sent with Proton Mail secure email.

------- Original Message -------
On Tuesday, May 23rd, 2023 at 9:47 PM, Michael Folkson <michaelfolkson@prot=
onmail.com> wrote:


> Hi alicexbt
>=20
> > It has been assigned CVE-2023-33297
>=20
>=20
> Did you personally request the CVE ID? Say via here [0]? Did you confirm =
with someone listed on the vulnerability reporting process [1] for Bitcoin =
Core that it made sense to do that at this time? I'm not sure whether compl=
etely bypassing that list and requesting CVE IDs for the project as an indi=
vidual is the way to go. If you have already contacted one of them and they=
've given you the go ahead to start the CVE process then fine. You weren't =
particularly clear with what has occurred.
>=20
> Thanks
> Michael
>=20
> [0]: https://cve.mitre.org/cve/request_id.html
> [1]: https://github.com/bitcoin/bitcoin/blob/master/SECURITY.md
>=20
> --
> Michael Folkson
> Email: michaelfolkson at protonmail.com
> GPG: A2CF5D71603C92010659818D2A75D601B23FEE0F
>=20
>=20
> Learn about Bitcoin: https://www.youtube.com/@portofbitcoin
>=20
>=20
> ------- Original Message -------
> On Monday, May 22nd, 2023 at 13:56, alicexbt alicexbt@protonmail.com wrot=
e:
>=20
>=20
>=20
> > Hi Michael,
> >=20
> > > Now that's not to say you may not have a point about better documenta=
tion and guidance on what should go through the vulnerability reporting pro=
cess and what shouldn't.
> >=20
> > Yes, this can be improved.
> >=20
> > > Or even that this particular issue could ultimately end up being clas=
sed a CVE.
> >=20
> > It has been assigned CVE-2023-33297
> >=20
> > /dev/fd0
> > floppy disk guy
> >=20
> > Sent with Proton Mail secure email.
> >=20
> > ------- Original Message -------
> > On Wednesday, May 17th, 2023 at 6:14 PM, Michael Folkson michaelfolkson=
@protonmail.com wrote:
> >=20
> > > Hi alicexbt
> > >=20
> > > "Open source" has the word "open" in it. Pushing everything into clos=
ed, private channels of communication and select groups of individuals is w=
hat I've been trying to push back upon. As I said in my initial response "i=
t doesn't scale for all bug reports and investigations to go through this t=
iny funnel" though "there are clearly examples where the process is critica=
lly needed".
> > >=20
> > > Now that's not to say you may not have a point about better documenta=
tion and guidance on what should go through the vulnerability reporting pro=
cess and what shouldn't. Or even that this particular issue could ultimatel=
y end up being classed a CVE. But rather than merely complaining and puttin=
g "open source" into quote marks perhaps suggest what class of bug reports =
should go through the tiny funnel and what shouldn't. Unless you think ever=
ything should go through the funnel in which case you are advocating for le=
ss openness whilst simultaneously complaining it isn't "open source". Squar=
e that circle.
> > >=20
> > > Thanks
> > > Michael
> > >=20
> > > --
> > > Michael Folkson
> > > Email: michaelfolkson at protonmail.com
> > > GPG: A2CF5D71603C92010659818D2A75D601B23FEE0F
> > >=20
> > > Learn about Bitcoin: https://www.youtube.com/@portofbitcoin
> > >=20
> > > ------- Original Message -------
> > > On Tuesday, May 16th, 2023 at 23:39, alicexbt alicexbt@protonmail.com=
 wrote:
> > >=20
> > > > Hi Michael,
> > > >=20
> > > > A disagreement and some thoughts already shared in an email althoug=
h its not clear to some "open source" devs:
> > > >=20
> > > > Impact of this vulnerability:
> > > >=20
> > > > - Denial of Service
> > > > - Stale blocks affecting mining pool revenue
> > > >=20
> > > > Why it should have been reported privately to security@bitcoincore.=
org, even if initially found affecting only debug build?
> > > >=20
> > > > Example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2021-=
3129
> > > >=20
> > > > CVE is a different process and I am aware of it. It would be good f=
or certain developers in the core team to reflect on their own approach to =
security, regardless of whether their work receives CVE recognition or not.
> > > >=20
> > > > /dev/fd0
> > > > floppy disk guy
> > > >=20
> > > > Sent with Proton Mail secure email.
> > > >=20
> > > > ------- Original Message -------
> > > > On Friday, May 12th, 2023 at 1:14 AM, Michael Folkson michaelfolkso=
n@protonmail.com wrote:
> > > >=20
> > > > > Hi alicexbt
> > > > >=20
> > > > > The vulnerability reporting process requires communication and re=
solution via a small group of individuals 0 rather than through open collab=
oration between any contributors on the repo. There are clearly examples wh=
ere the process is critically needed, the most obvious past example being t=
he 2018 inflation bug 1. However, it doesn't scale for all bug reports and =
investigations to go through this tiny funnel. For an issue that isn't goin=
g to result in loss of onchain funds and doesn't seem to present a systemic=
 issue (e.g. network DoS attack, inflation bug) I'm of the view that openin=
g a public issue was appropriate in this case especially as the issue initi=
ally assumed it was only impacting nodes running in debug mode (not a mode =
a node in production is likely to be running in).
> > > > >=20
> > > > > An interesting question though and I'm certainly happy to be corr=
ected by those who have been investigating the issue. Some delicate trade-o=
ffs involved including understanding and resolving the issue faster through=
 wider collaboration versus keeping knowledge of the issue within a smaller=
 group.
> > > > >=20
> > > > > Thanks
> > > > > Michael
> > > > >=20
> > > > > --
> > > > > Michael Folkson
> > > > > Email: michaelfolkson at protonmail.com
> > > > > GPG: A2CF5D71603C92010659818D2A75D601B23FEE0F
> > > > >=20
> > > > > Learn about Bitcoin: https://www.youtube.com/@portofbitcoin
> > > > >=20
> > > > > ------- Original Message -------
> > > > > On Tuesday, May 9th, 2023 at 03:47, alicexbt via bitcoin-dev bitc=
oin-dev@lists.linuxfoundation.org wrote:
> > > > >=20
> > > > > > Hi Bitcoin Developers,
> > > > > >=20
> > > > > > There is an open issue in bitcoin core repository which was cre=
ated last week: https://github.com/bitcoin/bitcoin/issues/27586
> > > > > >=20
> > > > > > I think this should have been reported privately as vulnerabili=
ty instead of creating a GitHub issue even if it worked only in debug mode.=
 Some users in the comments have also experienced similar issues without de=
bug build used for bitcoind. I have not noticed any decline in the number o=
f listening nodes on bitnodes.io in last 24 hours so I am assuming this is =
not an issue with majority of bitcoin core nodes. However, things could hav=
e been worse and there is nothing wrong in reporting something privately if=
 there is even 1% possibility of it being a vulnerability. I had recently r=
eported something to LND security team based on a closed issue on GitHub wh=
ich eventually was not considered a vulnerability: https://github.com/light=
ningnetwork/lnd/issues/7449
> > > > > >=20
> > > > > > In the CPU usage issue, maybe the users can run bitcoind with b=
igger mempool or try other things shared in the issue by everyone.
> > > > > >=20
> > > > > > This isn't the first time either when vulnerability was reporte=
d publicly: https://gist.github.com/chjj/4ff628f3a0d42823a90edf47340f0db9 a=
nd this was even exploited on mainnet which affected some projects.
> > > > > >=20
> > > > > > This email is just a request to consider the impact of any vuln=
erability if gets exploited could affect lot of things. Even the projects w=
ith no financial activity involved follow better practices.
> > > > > >=20
> > > > > > /dev/fd0
> > > > > > floppy disk guy
> > > > > >=20
> > > > > > Sent with Proton Mail secure email.