Delivery-date: Wed, 27 Mar 2024 14:56:30 -0700
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of pete@petertodd.org designates 64.147.123.156 as permitted sender) client-ip=64.147.123.156;
Feedback-ID: i525146e8:Fastmail
Date: Wed, 27 Mar 2024 20:30:34 +0000
From: Peter Todd <pete@petertodd.org>
To: "David A. Harding" <dave@dtrt.org>
Cc: bitcoindev@googlegroups.com
Subject: Re: [bitcoindev] A Free-Relay Attack Exploiting RBF Rule #6
Message-ID: <ZgSB6kmLiDG08Yrd@petertodd.org>
References: <f7fbeb4f58904fc5a24b6fc2d829036c@dtrt.org>
 <ZgRfvrYatcpqPNRn@petertodd.org>
 <bbc33ff01e464f8c84a593ac05c5722c@dtrt.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="iriQTBlc0tWbRAE3"
Content-Disposition: inline
In-Reply-To: <bbc33ff01e464f8c84a593ac05c5722c@dtrt.org>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com


--iriQTBlc0tWbRAE3
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline

On Wed, Mar 27, 2024 at 09:50:20AM -1000, David A. Harding wrote:
> On 2024-03-27 08:04, Peter Todd wrote:
> > I was able to verify independently that the relevant people had seen
> > the email and weren't planning on replying.
> 
> Can you provide detail on this?

I'm not going because I don't want anyone else subject to harassment over this.

> > You're just harassing me here; I highly
> > suspect you'd have said nothing at all if I hadn't brought up
> > disclosure.
> 
> I think I would have said something.  Any time I'm writing a description for
> Optech about an attack that affects existing Bitcoin software and was
> responsibly disclosed, I back link to it from a special page [1].  In cases
> of ambiguity about whether or not an attack was responsibly disclosed, I
> investigate.
> 
> I'm sorry this feels to you like harassment.  To me it feels like whiplash:
> I inferred responsible disclosure based on your original text, learned it
> might not have been, and now am being told by you that it was indeed
> responsible.

I'm not the only person who thinks this looks like harassment. The fact is you
started this conversation with: "I'm especially concerned given your past
history of publicly revealing vulnerabilities before they could be quietly
patched and the conflict of interest of you using this disclosure to advocate
for a policy change you are championing."

You haven't substantiated any of this. Nor have you even tried to argue that my
take on the vulnerability is incorrect: it's just an interesting variation of
well-known attacks that doesn't substantially change the situation.

Anyway, this conversation is just wasting everyones' time. If this actually is
a deal-breaking exploit that must be fixed quickly and quietly - the type of
exploit for which responsible disclosure is necessary - what we should be
talking about is how to fix it. I proposed two different design changes that
mitigates it. One of which fixes other issues too. Antoine Riard also proposed
potential mitigations.

Do you have a useful comment on these proposals?

-- 
https://petertodd.org 'peter'[:-1]@petertodd.org

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/ZgSB6kmLiDG08Yrd%40petertodd.org.

--iriQTBlc0tWbRAE3
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmYEgecACgkQLly11TVR
LzfVLw//XHOomL9VAp0Rk3eM47EPYTbOGvKdRT7H/eeMzD8/sAB+2a7TpauSCZ3x
heXPRQgGtHAqOynYNEX7pwX+yI3G6/uPp60AIv8x6dzPRaGGlqBE3Tai8oVnm+pN
hLRfZt2ZeuS1Y3YCHOekJGpOOF5DltSunrI9Vrd2GKH3kokerarDRw8P9U5oZhGQ
I7XiGqF9N9UBoi/pQufxqTDJd3AFXffxoK9ucRqq6WikGI2w/HZ1dnPpcvbJC+Yt
Esbills1PyrerBcjBbQfmkSPsZ541TNekBLzSPWim3gKMdw05cRU45eS7f73mIpc
afznYP88rFsDA0r2gGkw8rOncvdF9tkRV7HKzlus+ODOtd2UUEbrnGOgeXQ3z9IH
FN7a+7DogVCgcfb7LbeCtTUBEAsc28LqRiRnV75Q0OeSCMM2TF8oKloW3Eh9wQIK
DpRnNmMjd8tmHmPBYqR3Y8EnshoY2Nhn92oeRUgAJ9Pu5ZBmXb5KnUYzf96tjb65
8oRQHLnIxPjCboO495v8Ipx6Gxh/0mt1d1IjWLIYnflufyWZobWaoRL1DME11MR3
DOP2cNoCYzIS8V+8i4KhKkMWGr19KMrtoV5W1sKMzbDklpV+qjGvvXNIsIb8zX+w
8sdExKu4KN20kwM6Oeaarc7/tDP4KZFOECRUYHdLGrELBe+o9iQ=
=GRcd
-----END PGP SIGNATURE-----

--iriQTBlc0tWbRAE3--