Delivery-date: Sun, 21 Jul 2024 13:49:17 -0700
Received-SPF: pass (google.com: domain of lists@achow101.com designates 185.70.40.22 as permitted sender) client-ip=185.70.40.22;
Date: Sun, 21 Jul 2024 20:17:13 +0000
To: bitcoindev@googlegroups.com
From: "'Ava Chow' via Bitcoin Development Mailing List" <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] Re: A "Free" Relay Attack Taking Advantage of The
 Lack of Full-RBF In Core
Message-ID: <a8eac5f2-b85a-434f-868e-eba7fd2558c6@achow101.com>
In-Reply-To: <2aa2d6fa-ae72-4aef-9fda-49e2f7c657abn@googlegroups.com>
References: <Zpk7EYgmlgPP3Y9D@petertodd.org> <18fc443d-c347-4a84-94fe-81308ae20b76n@googlegroups.com> <Zpm73WHBNIkkIT0Y@petertodd.org> <CALZpt+HJvBXM_geK7JC8umrt1goq8bc+pnY0mk+o+r_+bjrtew@mail.gmail.com> <Zpp6U00Mp7Z/bOej@petertodd.org> <4d950527-4430-49f2-8e38-3755bc58e301n@googlegroups.com> <4f7eddff-9e2d-4beb-bcc6-832584cb939d@achow101.com> <2aa2d6fa-ae72-4aef-9fda-49e2f7c657abn@googlegroups.com>
Feedback-ID: 53660394:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Reply-To: Ava Chow <lists@achow101.com>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

On 07/20/2024 10:06 PM, Antoine Riard wrote:
> "Naive", as saying this is the _Bitcoin Core_ project list only can only=
=20
> provoke blind
> spot among the list members if the security issues are either affecting=
=20
> old part of
> the codebases that younger members have less experiences with (some=20
> parts like consensus
> or block-relay are modified only every 5 years) or novel factors from=20
> upstream or downstream
> (e.g the internet networking stack or implications on deployed contract=
=20
> protocols like
> lightning). On both the former and latter criterias, I think Peter=20
> overly meets the bar.

Peter was not the only "senior" person on the security list. Obviously I=20
will not disclose non-public information, but certainly there are people=20
on the security list who are just as, if not more, senior than Peter.

Furthermore, the "old parts" still do get changed, and someone who no=20
longer actively contributes to the project is more likely to be unaware=20
of how the code actually works today, even if they are familiar with=20
components that change infrequently.

> When you've big sh*t hitting the fan like inflation bugs or level DB=20
> 2013 unexpected fork you
> prefer have experts with a decade of experience to collaborate with, and=
=20
> sharing the same cultural
> and ethical norms of the active contributors evaluated by numbers on=20
> commits on the last single-digit
> years.

Not being on the list does not preclude him from being consulted if the=20
need arises.

With the two examples you provide, I am not aware of Peter being=20
actively involved in the resolution of both of those, whereas there are=20
current members of the list who were.


In general though, it is not clear to me how it was beneficial to have=20
Peter on the security list, nor how not having him is directly harmful.=20
In the 2 years that I have been on the security list, I was unaware that=20
Peter was a recipient until shortly before he was removed. My=20
understanding is that others who have been on the list longer than me=20
were also unaware.

Ava

>=20
> I'll repropose Peter admission on the security list mailing list in the=
=20
> coming weeks by opening an
> issue on the bitcoin-meta repository, once this current mailing list=20
> thread has slowed down a bit,
> or at least the technical analysis has been dissociated from the=20
> proceedings which have all been
> bundle in a big message. In my very personal opinion, I still trust more=
=20
> Peter competence and experience
> than some other people I know who are on the security mailing list.
>=20
> All that said I appreciate your answer and I'm satisfied from the=20
> personal role you've have played
> in the matter with, and be reassured I'll keep you among the recipient=20
> of future security issues with
> a potential impact on bitcoin core that I might find or be aware off.
>=20
> Best,
> Antoine
> ots hash: db441b51684ad3a6897f67d42c74ccfcb9a4ffed40d4bdbe30a2edd867ccdd5=
4
>=20
> Le samedi 20 juillet 2024 =C3=A0 01:50:25 UTC+1, Ava Chow a =C3=A9crit=C2=
=A0:
>=20
>     On 07/19/2024 07:58 PM, Antoine Riard wrote:
>      > As said in one my previous email, I'm still curious about achow101
>      > explaining publicly
>      > why you have been kicked-out of the bitcoin-security mailing
>     list, when
>      > you were certainly
>      > more senior than achow101 in matters of base-layer security
>     issues or
>      > even hard technical
>      > issues like consensus interactions (e.g bip65). I'll re-iterate my
>      > respect towards achow101
>      > as a maintainer from years of collaboration, though this is a topi=
c
>      > worthy of an answer.
>=20
>     I am not the one that removed Peter from the mailing list, nor do I
>     even
>     have the login(s) to do so.
>=20
>     There was a discussion amongst several members of the security list
>     about who was on the list, and who should be on the list. Given that
>     the
>     security list is the _Bitcoin Core_ security list, we determined that
>     the people who should be on the list are people who still actively
>     contribute to the project. As Peter Todd no longer actively contribut=
e
>     code nor code review to the project, we decided that it didn't make
>     sense to continue to have him on the list.
>=20
>     My recollection is that multiple other people were removed from the
>     list
>     for the same reason at the same time.
>=20
>     Ava
>=20
> --=20
> You received this message because you are subscribed to the Google=20
> Groups "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send=20
> an email to bitcoindev+unsubscribe@googlegroups.com=20
> <mailto:bitcoindev+unsubscribe@googlegroups.com>.
> To view this discussion on the web visit=20
> https://groups.google.com/d/msgid/bitcoindev/2aa2d6fa-ae72-4aef-9fda-49e2=
f7c657abn%40googlegroups.com <https://groups.google.com/d/msgid/bitcoindev/=
2aa2d6fa-ae72-4aef-9fda-49e2f7c657abn%40googlegroups.com?utm_medium=3Demail=
&utm_source=3Dfooter>.

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/=
bitcoindev/a8eac5f2-b85a-434f-868e-eba7fd2558c6%40achow101.com.