{"type":"rich","version":"1.0","author_name":"npub17rld56k4365lfphyd8u8kwuejey5xcazdxptserx03wc4jc9g24stx9l2h","author_url":"https://nostr.ae/npub17rld56k4365lfphyd8u8kwuejey5xcazdxptserx03wc4jc9g24stx9l2h","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2017-09-12\n📝 Original message:On Mon, Sep 11, 2017 at 07:34:33AM -0400, Alex Morcos wrote:\n\u003e I don't think I know the right answer here, but I will point out two things\n\u003e that make this a little more complicated.\n\u003e 1 - There are lots of altcoin developers and while I'm sure the majority would\n\u003e greatly appreciate the disclosure and would behave responsibly with the\n\u003e information, I don't know where you draw the line on who you tell and who you\n\u003e don't.\n\nIf you can't pick even a small group that's trustworthy (top five by\nmarket cap as a start [0]? or just major bitcoin wallets / exchanges /\nalt node implementations?), then it still seems better to (eventually)\ndisclose publically than keep it unrevealed and let it be a potential\nadvantage for attackers against people who haven't upgraded for other\nreasons?\n\nI find it hard to imagine bitcoin's still obscure enough that people\naren't tracking git commit logs to use them as inspiration for attacks\non bitcoin users and businesses; at best I would have thought it'd\nonly be a few months of development time between a fix being proposed\nas a PR or committed to master and black hats having the ability to\nexploit it in users who are running older nodes. (Or for that matter,\nbeing able to be exploited by otherwise legitimate bitcoin businesses\nwith an agenda to push, a strong financial motive behind that agenda,\nand a legal team that says they'll get away with it)\n\n\u003e 2- Unlike other software, I'm not sure good security for bitcoin is defined by\n\u003e constant upgrading.  Obviously upgrading has an important benefit, but one of\n\u003e the security considerations for Bitcoin is knowing that your definition of the\n\u003e money hasn't changed.  Much harder to know that if you change software.\n\nIsn't that just an argument for putting more effort into backporting\nfixes/workarounds? (I don't see how you do that without essentially\npublically disclosing which patches have a security impact -- \"oh,\ngosh, this patch gets a backport, I wonder if maybe it has security\nimplications...\")\n\n(In so far as bitcoin is a consensus system, there can sometimes be a\npositive network effect, where having other people upgrade can help your\nsecurity, even if you don't upgrade; \"herd immunity\" if you will. That\nway a new release going out to other people helps keep you safe, even\nwhile you continue to maintain the same definition of money by not\nupgrading at all)\n\nIf altcoin maintainers are inconvenienced by tracking bitcoin-core\nupdates, that would be an argument for them to contribute back to their\nupstream to make their own job easier; either helping with backports,\nor perhaps contributing to patches like PR#8994 might help.\n\nAll of those things seem like they'd help not just altcoins but bitcoin\ninvestors/traders too, so it's not even a trade-off between classes of\nbitcoin core users.  And if in the end various altcoins aren't able to\nkeep up with security fixes, that's probably valuable information to\nprovide to the market...\n\nCheers,\naj\n\n[0] Roughly: BCash, Litecoin, Dash, BitConnect, ZCash, Dogecoin?\n    I've no idea which of those might have trustworthy devs to work with,\n    but surely at least a couple do?"}