pull down to refresh

104 sats \ 2 replies \ @optimism 29 Aug \ parent \ on: The CLN Embargo: Would you run unverified binaries? lightning

Relying on their reports, or assuming that there are people that look? Do you have a report from someone that went over CLN and says: "I went through it all and found a few bugs which I reported but otherwise this is awesome"? Didn't we recently have some findings in the field on the assumed level of review Bitcoin software is getting?

Last night I found and verified a nasty asymmetric state bug in the latest release of a software I and 200M others run (released this Tuesday) that survives process termination and leads to permanent crash cycles - I verified that in a VM that was running over Car's face on SNL last night and after all that, I was exhausted so I went into snore mode. Before I opened SN this morning I looked at their repo and turns out that while I slept, a fix was pushed (but not yet formally released.) So there, it works, as clearly I wasn't the only one that found it. Noting that I was slow with my review this time because I'm busy - as normally I frontrun any fixes and I send them an email. It gives hope though, I like it when I'm not the only one looking, though arguably, due to the 90h day gap between release and commit, this could have come from someone actually sitting in a crash loop instead of running through the code.

This is at 200M deployments, centralized, fully subsidized FOSS. In comparison, Phoenix has 200k installs or so. How many more people besides myself do source review on that? Is anyone even looking at the iOS branch? Ethan sounded surprised someone was looking at Zeus source code at all[1] the other day when I made a little note about the liveness check.

The only software where I more often have a duplicate finding than not is Bitcoin Core (almost always there, I'm slow). I don't remember any instance of Bitcoin software other than that in the past 5 years where my finding was a dupe.

  1. and due to the size/complexity I can't even review that as fully as I want to - my backlog of code and, perhaps most importantly deps, on that grows faster than my progress on doing the reviews, so I mostly look at diffs and some hot path dep diffs only, and I focus on features I'd use (but I can't really use it for production still after 6 months of effort now.) ↩

write
compose
127 sats \ 1 reply \ @unboiled 29 Aug

No need to shoot the messenger.

But then again, I rely on that myself. I certainly haven't checked every single line of code running on my machine.
I'd be astonished if I even got a reviewed-in-person-rate of as high as 1%.

reply
104 sats \ 0 replies \ @optimism 29 Aug

Not shooting at all really, just questioning if what you assert makes any effective difference to reality.

How do you rely on it?

PS: Of course you cannot review everything, even on Android you have to make choices because you cannot 100% end-to-end review ACK or AOSP's platform/*, that's more than a dayjob, also with unlimited bots.

reply