pull down to refresh

233 sats \ 3 replies \ @nullcount 29 Aug \ on: The CLN Embargo: Would you run unverified binaries? lightning

No solutions, only tradeoffs...

Don't mistake 'theoretical audibility' for an actual audit

The benefit of Opensource was always based in statistics: more eyes, more stakeholders, more audits, and more fixes produces better software (probably)

Alternatively, apply statistics through AI to vibe-slop fork your own node implementation with off-the-shelf library like LDK and watch it very closely

write
compose
42 sats \ 2 replies \ @optimism 29 Aug
Alternatively, apply statistics through AI to vibe-slop fork your own node implementation with off-the-shelf library like LDK and watch it very closely

Before you do that, instruct your LLM to:

  1. Read lightning/bolts beginning to end, write down every "rule"
  2. Cross-check every rule against every other rule
  3. Make a list of odd shit

And then decide if you really think it is a good idea to do this.

reply
127 sats \ 1 reply \ @nullcount 29 Aug
And then decide if you really think it is a good idea to do this.

... only tradeoffs

a few benefits of writing/running your own LN node implementation:

  1. You control the feature priority

No need to wait for LND to add splicing or BOLT12. No need to wait for CLN to add AMP. Your implementation can support all or none if you want it to. The vast majority nodes can only collaborate using certain features with a subset of nodes that run the same implementation.

You can add all the features (or none), making your node easier to collaborate with if you can support more protocols, or more secure/hardened if you only support the bare minimum.

  1. You can "hack" the protocol

The existing lightning protocol leaves lots of room for creativity that no current implementation is currently using.

The mainstream implementations are open source so you know exactly how those nodes will behave in response to a custom message your implementation sends them. This let's you fingerprint and exploit (somewhat) the implementation a node on the network is likely running.

  1. You can keep the source hidden (if you want)

Nobody needs to know what source your node is running! So you're harder to hack (in theory). Security using obscurity is real (with tradeoffs).

Or maybe you publish it and hope to get some expert review before someone with better LLMs exploit it :)

reply
2 sats \ 0 replies \ @optimism 29 Aug

In general, I'm a big fan of vibing one's own tooling. It's a good idea, though if it involves money, make sure you know what you're getting into!

The existing lightning protocol leaves lots of room for creativity that no current implementation is currently using.

Yeah that is the bug, not feature I was covertly hinting at above. It's not completely terrible everywhere but boy oh boy are there headaches in the bolts repo.

Or maybe you publish it

Please don't!!! No one is going to review slop unless they have to. The world is better off not knowing what you made a bot do. If you want to share something, share your prompts.

reply