Post
Topic
Board Development & Technical Discussion
Re: The duplicate input vulnerability shouldn't be forgotten
by
ETFbitcoin
on 22/09/2018, 08:09:49 UTC
Perhaps all large Bitcoin companies should be expected by the community to assign skilled testing specialists to Core. This vulnerability could've been detected through more sophisticated testing methods, and currently a lot of companies don't contribute anything to Core development.

I doubt this will happen since some exchange/services hacked because security hole which isn't related with Cryptocurrency directly. This might work on DEX which is open source and a bug would be fatal.

Perhaps there should be more support and acceptance for running older versions, or a LTS branch, or a software fork focused on stability.

LTS branch/version should work well since some open-source software/OS use similar way and it works well. IMO Newer LTS version only need to be released when there's major upgrade such as P2SH, SegWit and Schnorr.

I do not think that it would be constructive to turn to any of the full node total-reimplementations like btcd, which are very amateur in comparison to Bitcoin Core.

Surely it's very risky since there's higher chance accidentally make new bug, especially if it's done on different language. But that doesn't mean i'm against alternative implementation/client.

I don't know exactly how this can be prevented from happening again, but I do know that it would be a mistake for the community to brush off this bug just because it ended up being mostly harmless this time.

From this bug and 0.8 upgrade bug, IMO there should be draft/plan to upgrade/backroll the network quickly in case critical vulnerability is found or exploited.