I don't mean to be snide, but why this media blitz? It seems that keeping their work quiet would be critical.
The message the normie will receive seems to be: "Bitcoin is insecure as hell." But don't worry.
The cynic in me might say this is a giant Anchor Watch advertisement, but I would never say that.
It's worth noting that the Red Team scanned BTCPay Server and completely missed the macaroon exploit: https://x.com/NicolasDorier/status/2085779382174372073
maybe because they are only using AI as an automated vulnerability scanner (as a blue team), and not using an adversarial mindset for threat model development of an offensive attack.
https://twiiit.com/NicolasDorier/status/2085779382174372073
"But this bug was really sneaky, I am not surprised a simple scan didn't find it, or thought it was low risk."
https://xcancel.com/NicolasDorier/status/2085779382174372073
😂
I don't think you are being snide. While I think the people who are on the "Red Team" are fine, I also have noted that they are exceptionally good at getting attention.
It's interesting that the post is getting downzapped? I don't notice downzapping too much, but a little early morning post like this needs to be obliterated? That seems strange.
hadn't noticed it till now. I zapped it up a bit.
Thanks. I am behind the curve here regarding downzapping. I assume the reasons are usually obvious. It's fun to speculate. On another topic, SN seems to have really evolved re boosting too. I havent been spending as much time on the site as I used to. I rarely boost my own posts, but I see the benefit. I'm enjoying the new SN.
at the moment, ranking is still sats based. So the posts with the most sats invested in the last four hours tend to be the posts that dominate the front page and get the most visibility.
I find that if I take the time to write something and want to make sure that people read it, it's usually worth a boost of 500 or 1000 sats to get it on the front page. That number has been increasing though, which is maybe a good sign?
NEWis the best way to read SNNEW -> All
I agree
Precisely this
You must appease the anonymous whalemod to reach the front page :)
Everyone starts to recognize the game theory once someone else starts playing with real money.
Wasn't me.
Thanks!
We who are about to profit, salute you
of course anchorwarch wants visibility and brand recognition. nothing wrong with that.
if their work is good, they deserve it.
Do you see a downside to seeking publicity about the Red Team activity?
honestly no. I just don't get the fuss.
am I missing something?
the only downside is if they're doing bad work and trying to pass it off as good work.
but if it's actually good work, this is just normal day in professional security world.
You don't think it can lead to the general perception that bitcoin is insecure and risky, unless you keep it on exchanges or buy ETFs?
Because they need your money, to pay for tokens. The publicity is the worst thing about it.
Even the name screams "EMERGENCY!!!"
"Bitcoin devs can't even review their own open source code, but Super Rob and the boys will save you!"
In general it is good that someone is looking, I truly mean that. I have several opinions about the process, the risks, the marketing machine, and what appears to be the methodology but I have no other option than to accept whatever they are doing. I've seen some pushback, some good feedback, some questionable, and I am not sure what's being done with it.
I do have an idea about disclosure quality - especially noticable since the btcpayserver thing went down and a couple of similar high brow actions before that - and I see some friction there. Maybe uncle had a bad day and it is an isolated incident, maybe there are other factors, this is hard to tell. Either way, the pressure cooker they built, focusing on quantity not quality, currently carries a ton of risk. Time will have to tell what the net outcomes are.
I agree. I'm not questioning the scrutiny. It's the attention seeking I don't get? It serves no purpose, unless it's pure ego gratification.
I do think it's good that everyone is on their toes and nervous. Welcome to my world. It's a fucked up world. But at least Ostrich philosophy dies a bit and that is good. Rude awakening? Good.
But all this is retroactive. That's the real issue. And there is no telling what the next release will bring because now everyone trusts code coming from dumb ass bots, which will simply be destroyed by the next generation of bots.
Defense is hard.
Rob Hamilton, as CEO of AnchorWatch (a Bitcoin self-custody insurance company), has a direct commercial incentive to publicize widespread software vulnerabilities, since heightened risk perception drives demand for their insurance products. Calle, primarily an open-source developer funded by grants, has far weaker business incentives, with any upside being mostly reputational rather than tied to a commercial product.
Agree completely
Note that the article is quite outdated. It only essentially reacts to the first day of the effort and yet we are many days later now. I think this publicity is better than "yet another hack steals bitcoin from people's wallets". My guess would be that the effort will probably fizzle out within couple weeks, but I think there will be very impactful outputs found.
Because they're larping for the aura
Yeah, they are taking marketing advantage of the situation. I was already spending all day every day searching for bugs in Wasabi, the COLDCARD vulnerability didn't change anything about this.
Well I'm glad the cynic in you is willing to say it
Maybe they want to IPO
Tokens don't pay for them selves.
I read "...for them slaves"
Tokens is the new slave trade.
And yet:
Calle will always find a way to grift the current thing, and publicity is NGO's business model
Pinged Rob last week that I was willing to help, cited my report to a project, compared a few notes to gauge if it was a dupe but otherwise no follow up tasking me with anything
Guess is this becomes a new NGO puppet body of influence
It is a little weird. Bitcoin incentivizes red teaming by it's very existence. It's ok though, we need something to focus on and security is so hot right now.
Uhhhh... Because it's being led by Jack Dorsey's gimp?
Publicity probably helps with sourcing donations for the compute. TBH I think Rob Hamilton and others have done a good job just jumping into it. The community benefits overall so even if there is some marketing benefit for anchor watch I think it’s a good tradeoff that benefits everyone.
Can’t expect Rob Hamilton to just volunteer all of his free time for this without some sort of incentive.
Power of bitcoin is aligning every participant’s personal incentive. Antifragile systems need to account for “greed” and self interest
I can see your point. However,
He is openly stating that he doesn't want donations, and the guy is drawn to microphones like flies to shit. I'm not saying he needs to operate in secret, but the base assumption should be that he is acting in the interests of bitcoin. It's not a black/white, either/or situation, but the media saturation has to be suspect.
Being seen at the saviour for Bitcoin is good for business. I am not implying they aren’t doing important or good work.
I've noticed this as well. I think it also is to calm the fears of those that have been panicking around the bitcoin ecosystem due to the recent attacks/issues.
The publicity is the point, that's what everyone's dancing around. Quiet findings get you a PDF and a thank you, loud ones get you funding, and funding keeps the scans running. Normies hearing 'bitcoin insecure' is the price of doing business when attention is the real currency. The BTCPay miss while claiming hundreds found is the part worth auditing first though