pull down to refresh

What you were watching was a crisis. Of a novel kind too because normally this would go onto a security list, get patched, then you get the "update and roll over now" after a few hours and then next week we'd know what's what.

This was live. Extreme pressure. Even in the thread here on SN. I am sure some stackers didn't sleep much Thu->Fri, and on Twitter we saw people deprivating themselves of sleep beyond what is wise. Pressure to solve it. Ask the bot. Share preliminary unverified findings... on and on and on. This all went down in record speed.

To give you a comparison: 2 years ago, for a similarly complex, high priority bug, I needed 2 days to confirm, 1.5 days to patch and do a release, and luckily the ecosystem was ready to adopt quick - within a week most was fixed when wave 2 happened because someone figured it all out from reverse engineering the patch. Of course I didn't have a bot, or an army of people on twitter, or so many eyes on it. But the speed of this should give resolve. Wave 2 happened after 12 hours or so because once you are in this public setting, there is no going back and every fool has a bot now.

who doomscroll X

If you're not actively reviewing, having hardened process and spend at least 20% of your awake time on security then you better doomscroll X for every product you depend upon. Because that's the world we live in now.

trust and the respect

We all know that this is the issue. And if we are honest, we know that this is the problem for each of us. We trust and we don't friggen verify. This vuln is the proof. Yes, we have a serious issue. Virtue signal became more important than actual work. We grew fat. We are lazy mfs. I am. You are. Everyone is.

Realize it now. And ffs get yourself on a diet and be lean again.

294 sats \ 5 replies \ @OT 1 Aug

If this CC exploit was found and disclosed to Coinkite the outcome would have still been lost coins. Maybe not as many.

reply

After 5 years? Yeah. After 2 months? Nearly nothing. Before release? None at all.

reply
126 sats \ 3 replies \ @OT 2 Aug

People still set up wallets with low entropy. As soon as its public, thieves would go looking for the exploit and find it fast.

reply

I'm not sure what you mean. The key to finding bugs is finding them early.

The earlier you find them, the less damage they do, or maybe the real truth is the inverse: the longer you don't find them, the more damage they do.

reply
126 sats \ 1 reply \ @OT 2 Aug

In this particular situation users have already set up a flawed wallet. Coinkite can fix the vulnerability but as soon as they disclose to the pubic it wouldn't take long for an attacker to find the exploit and steal the slow mover coins.

reply

Yes. So there is no great answer on a bug that has accumulated vulnerable coin for 5+ years. I cannot see any way to do it right when that history already built up like that. That is probably the other thing, besides the speed at which this went from question mark to "found it", in which this is unprecedented - I honestly don't remember any fundamental flaw with such exposure time in our space. Do you?

reply