Me? I'm not doing enough, at all.

I'm feeling bad about my contributions to society most days because half the shit I do nowadays is validation and getting from idea to hardened implementation takes me forever because I don't want to ship debt that some fucker with a bot can find in 20 seconds. (I do not have trouble sleeping at all though, this shit is exhausting.)

I don't know what the hell you're talking about most of the time, but I'm damn happy you're out there doing what you're doing.

siggy47

I consider source code embargoes after a binary release misguided.

Most of us do. It's a bit of a shitty choice they made and I am quite sure that they're aware of it. Before, sometimes the only way to hide a bug was with a refactor. No one would spend the time reconstructing both versions and finding the vulns in the old implementation, because that is often too costly with very little rewards.

Now that every dum dum is able to tell a bot to analyze it, write the exploit, and attack it... within 30-90 minutes, the case even for delayed disclosure of a vuln has largely been removed, because the disclosure not being there will at most cost 90 minutes, not weeks.

I think that ultimately these new timelines mean that (a) users MUST be aware of everything around the software they run, there never really was fire&forget, but now that's truly dead, and (b) lifecycle management becomes extremely important now on the maintainer side. I saw a GHSA the other day saying "bro you forgot to backport this vuln fix for <2 day earlier GHSA> to x and y"

security

bitcoin

devs

lightning

The end of open source in Bitcoin

AaronDewes

> I consider source code embargoes after a binary release misguided.

Most of us do. It's a bit of a shitty choice they made and I am quite sure that they're aware of it. Before, sometimes the only way to hide a bug was with a refactor. No one would spend the time reconstructing both versions and finding the vulns in the old implementation, because that is often too costly with very little rewards.

Now that every dum dum is able to tell a bot to analyze it, write the exploit, and attack it... within 30-90 minutes, the case even for delayed disclosure of a vuln has largely been removed, because the disclosure not being there will at most cost 90 minutes, not weeks.

I think that ultimately these new timelines mean that (a) users MUST be aware of everything around the software they run, there never really was fire&forget, but now that's truly dead, and (b) lifecycle management becomes extremely important now on the maintainer side. I saw a GHSA the other day saying "bro you forgot to backport this vuln fix for <2 day earlier GHSA> to x and y"