Quote from: Luke-Jr on May 05, 2015, 04:56:16 PM

Quote from: Balthazar on May 05, 2015, 03:07:23 PM

There is a vulnerability found in the majority of stratum mining protocol implementations. I've published the disclosure of this bug few weeks ago.

Why did you make a public disclosure in Russian of a security bug in software written and maintained by people who probably don't understand Russian?
The proper procedure for such things is to privately get in touch with the maintainers so they have an opportunity to fix it before public disclosure - especially for bugs easily exploited.

Balthazar contacted me a few days ago, mentioning the possibility of this bug causing poor 'luck' for GHash. I suggested posting an English translation on the pools board so I could see if there was a consensus that the attack was valid. I didn't even think about disclosure to GHash, but it should have been my first suggestion. Hassle me about that, not him. I'll certainly be forwarding GHash this discussion and see if that finally gets a response.

Quote from: kha0S on May 05, 2015, 05:15:30 PM

Nope.
But I read about it a long time ago:

https://github.com/simplecrypto/powerpool/issues/128

I assumed everyone had patched already.

Your link is from 21 days ago and uses the same example as Balthazar. Was there something from longer ago?