pull down to refresh

30 sats \ 2 replies \ @anon 18 Sep \ parent \ on: bolt11: reject duplicate payment hashes in invoices security lightning

It was fucked already anyway. Red team is the example of responsible now.

write
compose
3 sats \ 0 replies \ @optimism 19 Sep
Red team is the example of responsible now.

Please, no?

reply
3 sats \ 0 replies \ @ek OP 18 Sep

Well, I guess I should go through everything I found confusing about the lightning spec again and look at it with an adversarial mindset, rather than just thinking, “Damn, this sucks to implement.” I think I wasn't expecting to find a vuln in something as superficial as parsing a BOLT11 invoice (compared to everything that's going on in lightning), so I didn't look at things from the right perspective.

reply