pull down to refresh

I enjoy reading developer accounts of sleuthing out bugs like these, and Poinsot's narrative in his blog post here is no exception. He tells the story of how, last fall, he and Martin Zumsande tracked down very interesting bug caused by the interaction between the Tor daemon and the node's whitelist function.

With -whitelist set to the IP range of the Tor daemon, your node would lift various DoS and privacy protections for all incoming Tor peers. This meant that affected nodes could be trivially DoSed and footprinted.

It is also clear that, although the filter people have forked off, the fallout from the two or three years of spam-filter-knots debate is going to be with us for a while:

For context, September 2025 was around the release of Bitcoin Core 30, just before the publication of the consensus change later enforced by Knots. On the mass psychosis timeline, we’re right in the middle of the “Bitcoin Core v30 will insta-kill Bitcoin with CSAM” narrative. We are past accusations of Bitcoin contributors being pedophiles and the release of deepfake sexual videos targeting one of them, just not quite yet at the justification of a “temporary” emergency confiscation fork or one of Bitcoin’s most productive contributors in recent years quitting over personal attacks.

Whether you have moved on from that chapter in Bitcoin's history or not, Ponsoit's tale of tracking down this bug is engaging.

135 sats \ 1 reply \ @siggy47 9h

This was an unanticipated pretty exciting tale. Luke's cooperation is oddly timed, but somehow not shocking to me. Based on the narrative, is it fair to say that without the existence of knots and its failure to cache GETADDR responses, the bug may still not have been discovered?

reply

Perhaps. I am certainly not knowledgeable enough about software development to say. But it may be the case that the more random stuff you throw at software, the more likely it is that these kind of things get noticed -- which, I think, may be a point in favor of using software that has a very large user base.

reply
2 sats \ 0 replies \ @Chikasunbeats 7h -30 sats

This is why I love reading these bug hunts. One small interaction - Tor daemon + -whitelist - and suddenly your node don drop all its DoS protection without you knowing.
‎E just show say for Bitcoin, na no be only big consensus debate dey matter. Sometimes na one small config line wey fit expose everybody.
‎Ponsoit and Zumsande tracking this down for months, na real work. Makes you respect node operators more.