Quote from: jonald_fyookball on March 16, 2017, 12:14:47 AM

Quote from: Abdussamad on March 16, 2017, 12:04:24 AM

Quote from: Quickseller on March 15, 2017, 04:48:21 AM

Quote from: Abdussamad on March 15, 2017, 04:01:44 AM

Quote from: Quickseller on March 15, 2017, 01:45:51 AM

2 - The allegation is the blockstream core devs were behind the malicious attacks against the BU nodes this afternoon. There is also no question that Peter Todd (a blockstream core dev) did not responsibly disclose the bug that he was made aware of in the BU code.

This is not true. The bug was discovered and patched by BU devs first. Todd simply tweeted about it.

It still violates responsible disclosure principals and was very unethical.

No it doesn't because nothing was disclosed that wasn't already public. The BU devs committed a fix for that bug an hour before Todd decided to tweet about it. It was public info!

if it was public info, it wasn't fixed because...?

They posted a fix on their git repo and that's how Todd got wind of it. So it was fixed but people hadn't downloaded the fix yet. You can't really blame Todd for this. Once a vulnerability is made public people have to scramble to get it fixed. People looking to exploit will also scramble to exploit it. It is the nature of the beast.

In other opensource projects the fix is pushed out first and later the vulnerability is spelled out to the public. In this case the vulnerability was so obvious that they couldn't hide it.

I was wrong that the BU devs found the vulnerability. It was an independent security researcher who found it and disclosed it to them privately. This is what the researcher who found the vulnerability had to say:

Quote

The problem is, the bugs are so glaringly obvious that when fixing it, it will be easy to notice for anyone watching their development process, she said.

https://bitcoinmagazine.com/articles/security-researcher-found-bug-knocked-out-bitcoin-unlimited/?utm_content=buffer6e884&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer