Date: Mon, 22 May 2023 12:56:13 +0000
To: Michael Folkson <michaelfolkson@protonmail.com>
From: alicexbt <alicexbt@protonmail.com>
Message-ID: <yCRGs9ve5782SDi1mdGMA1x1jOeJzBkfsWJxtFD3gcrPHI7WW2Ah3Qn9_Z1f17pGFAfC4DIx8fnLUMggrRdq0kfYRlJxpgLt_qJ7wSVC9t0=@protonmail.com>
In-Reply-To: <v7cGm-OTbNjvVuGJ8xMe1pOiBwVH1BZkJMS6DjcK5j9kMHmeCRhKrpbglugLPjyUQmDSzIXNxGz4k-kK4sjkIHgWrbaiO_93qauVKSJzZmY=@protonmail.com>
References: <73TDuUxE1bU1oorFgqmS9MKA_hQz8W_IdSR9zJK1Fwkp5qfU7eqmA75QMddrME9iwrLmTkB7qLgf94o4c4NT1OgHe2QD_BeWvjZvDmLT6dg=@protonmail.com>
 <I_QFh8MNIEz819n0dEitgXPmS5jfrYkOxTZoo211l1grYmW3yrDYxkso9XSrqLS26WJVXj0LAIpYe77DwWs7sXClVjz_Oz-lQiOV3Hn1U2Y=@protonmail.com>
 <k95MsgwJmus2shEQ3XcON4sPN2jpvN0NOiVuIUk27H-gQno3iH4XEMH_nyaKzUuCM8KKt63qM8cph6Eai7fCgWRxfTdYnKdfVw0i2NZTTf0=@protonmail.com>
 <v7cGm-OTbNjvVuGJ8xMe1pOiBwVH1BZkJMS6DjcK5j9kMHmeCRhKrpbglugLPjyUQmDSzIXNxGz4k-kK4sjkIHgWrbaiO_93qauVKSJzZmY=@protonmail.com>
Feedback-ID: 40602938:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Responsible disclosures and Bitcoin development
Precedence: list

Hi Michael,

> Now that's not to say you may not have a point about better documentation=
 and guidance on what should go through the vulnerability reporting process=
 and what shouldn't.

Yes, this can be improved.

> Or even that this particular issue could ultimately end up being classed =
a CVE.

It has been assigned CVE-2023-33297


/dev/fd0
floppy disk guy

Sent with Proton Mail secure email.

------- Original Message -------
On Wednesday, May 17th, 2023 at 6:14 PM, Michael Folkson <michaelfolkson@pr=
otonmail.com> wrote:


> Hi alicexbt
>=20
> "Open source" has the word "open" in it. Pushing everything into closed, =
private channels of communication and select groups of individuals is what =
I've been trying to push back upon. As I said in my initial response "it do=
esn't scale for all bug reports and investigations to go through this tiny =
funnel" though "there are clearly examples where the process is critically =
needed".
>=20
>=20
> Now that's not to say you may not have a point about better documentation=
 and guidance on what should go through the vulnerability reporting process=
 and what shouldn't. Or even that this particular issue could ultimately en=
d up being classed a CVE. But rather than merely complaining and putting "o=
pen source" into quote marks perhaps suggest what class of bug reports shou=
ld go through the tiny funnel and what shouldn't. Unless you think everythi=
ng should go through the funnel in which case you are advocating for less o=
penness whilst simultaneously complaining it isn't "open source". Square th=
at circle.
>=20
>=20
> Thanks
> Michael
>=20
> --
> Michael Folkson
> Email: michaelfolkson at protonmail.com
> GPG: A2CF5D71603C92010659818D2A75D601B23FEE0F
>=20
>=20
> Learn about Bitcoin: https://www.youtube.com/@portofbitcoin
>=20
>=20
> ------- Original Message -------
> On Tuesday, May 16th, 2023 at 23:39, alicexbt <alicexbt@protonmail.com> w=
rote:
>=20
>=20
> > Hi Michael,
> >=20
> > A disagreement and some thoughts already shared in an email although it=
s not clear to some "open source" devs:
> >=20
> > Impact of this vulnerability:
> >=20
> > - Denial of Service
> > - Stale blocks affecting mining pool revenue
> >=20
> > Why it should have been reported privately to security@bitcoincore.org,=
 even if initially found affecting only debug build?
> >=20
> >=20
> > Example:=C2=A0https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2021=
-3129
> >=20
> >=20
> > CVE is a different process=C2=A0and I am aware of it.=C2=A0It would be =
good for certain developers in the core team to reflect on their own approa=
ch to security, regardless of whether their work receives CVE recognition o=
r not.
> >=20
> > /dev/fd0
> > floppy disk guy
> >=20
> >=20
> > Sent with Proton Mail secure email.
> >=20
> > ------- Original Message -------
> > On Friday, May 12th, 2023 at 1:14 AM, Michael Folkson <michaelfolkson@p=
rotonmail.com> wrote:
> >=20
> >=20
> > > Hi alicexbt
> > >=20
> > > The vulnerability reporting process requires communication and resolu=
tion via a small group of individuals [0] rather than through open collabor=
ation between any contributors on the repo. There are clearly examples wher=
e the process is critically needed, the most obvious past example being the=
 2018 inflation bug [1]. However, it doesn't scale for all bug reports and =
investigations to go through this tiny funnel. For an issue that isn't goin=
g to result in loss of onchain funds and doesn't seem to present a systemic=
 issue (e.g. network DoS attack, inflation bug) I'm of the view that openin=
g a public issue was appropriate in this case especially as the issue initi=
ally assumed it was only impacting nodes running in debug mode (not a mode =
a node in production is likely to be running in).
> > >=20
> > > An interesting question though and I'm certainly happy to be correcte=
d by those who have been investigating the issue. Some delicate trade-offs =
involved including understanding and resolving the issue faster through wid=
er collaboration versus keeping knowledge of the issue within a smaller gro=
up.
> > >=20
> > > Thanks
> > > Michael
> > >=20
> > > [0]:=C2=A0https://github.com/bitcoin/bitcoin/blob/master/SECURITY.md
> > > [1]:=C2=A0https://bitcoincore.org/en/2018/09/20/notice/
> > >=20
> > > --
> > > Michael Folkson
> > > Email: michaelfolkson at protonmail.com
> > > GPG: A2CF5D71603C92010659818D2A75D601B23FEE0F
> > >=20
> > >=20
> > > Learn about Bitcoin: https://www.youtube.com/@portofbitcoin
> > >=20
> > >=20
> > > ------- Original Message -------
> > > On Tuesday, May 9th, 2023 at 03:47, alicexbt via bitcoin-dev <bitcoin=
-dev@lists.linuxfoundation.org> wrote:
> > >=20
> > >=20
> > > > Hi Bitcoin Developers,
> > > >=20
> > > > There is an open issue in bitcoin core repository which was created=
 last week:=C2=A0https://github.com/bitcoin/bitcoin/issues/27586
> > > >=20
> > > > I think this should have been reported privately as vulnerability i=
nstead of creating a GitHub issue even if it worked only in debug mode. Som=
e users in the comments have also experienced similar issues without debug =
build used for bitcoind. I have not noticed any decline in the number of li=
stening nodes on bitnodes.io in last 24 hours so I am assuming this is not =
an issue with majority of bitcoin core nodes. However, things could have be=
en worse and there is nothing wrong in reporting something privately if the=
re is even 1% possibility of it being a vulnerability. I had recently repor=
ted something to LND security team based on a closed issue on GitHub which =
eventually was not considered a vulnerability:=C2=A0https://github.com/ligh=
tningnetwork/lnd/issues/7449=C2=A0
> > > >=20
> > > > In the CPU usage issue, maybe the users can run bitcoind with bigge=
r mempool or try other things shared in the issue by everyone.
> > > >=20
> > > > This isn't the first time either when vulnerability was reported pu=
blicly:=C2=A0https://gist.github.com/chjj/4ff628f3a0d42823a90edf47340f0db9=
=C2=A0and this was even exploited on mainnet which affected some projects.
> > > >=20
> > > >=20
> > > > This email is just a request to consider the impact of any vulnerab=
ility if gets exploited could affect lot of things. Even the projects with =
no financial activity involved follow better practices.
> > > >=20
> > > > /dev/fd0
> > > > floppy disk guy=C2=A0
> > > >=20
> > > >=20
> > > > Sent with Proton Mail secure email.