Quote from: jl777B on April 05, 2018, 10:51:38 AM

Quote from: lnoir on April 05, 2018, 10:41:48 AM

I have a few thousand XVG, and have been interested in Verge for some time. I share this so that you realise I'm not a troll. But neither am I a "fanboy", and I can't help but be disappointed about the way this situation has been handled. ocminer kindly shared concrete evidence that there was an issue but the attitude towards it (from what I can tell) was somewhat dismissive and/or nonchalant.

I'm a developer by trade, and understand that the likelihood that software is bug-free quickly diminishes as complexity increases. The problem for me isn't that there was a bug in the code that was exploitable we can be thankful that it has been brought to the attention of the team and will be fixed. The problem for me is that this thread and situation highlights some serious issues.

First, it indicates that the team isn't fully aware of what they're doing. This statement is not an attack, it's just based on the evidence:

Quote from: Dogedarkdev on April 04, 2018, 06:30:52 PM

Quote from: nerreus on April 04, 2018, 06:24:11 PM

Wonder when they are going to hardfork it

why would we do that? we just made a quick simple update and most pools have already updated...

we are now working on a higher level of redundancy checking as well.

the attack only lasted 3 hours, and not all coins produced during that period were intercepted.

After the "quick simple update" (which actually appeared to be botched), it took for ocminer to point out their error:

Quote from: ocminer on April 04, 2018, 07:40:18 PM

Quote from: Dogedarkdev on April 04, 2018, 07:06:39 PM

Quote from: defaced on April 04, 2018, 06:58:33 PM

nice a new version of the famed timewarp attack.. very interesting.

yep.. we pushed a quick fix and most pools have already updated.. we're already working on a whole new block verification process.

we're kinda glad this happened and that it wasn't as bad as it could have been.

Hmm, you guys are aware that the "fix" you pushed actually IS a hardfork ? So your blockchain snapshot is not valid anymore, the wallet's won't sync up from scratch anymore and the current chain is simply not usable anymore with that new "fix" ?

Your change simply disagrees with the attackers blocks, the first block I see from the attacker was 2007365 - so the wallets will stop syncing there and simply not progress any further.

I remember your first forking dramas when trying to fork into Tor which failed 2 times IIRC.

You should immediately refrain from that "fix" and set a proper fork-height (at least 48h) and the chain up until the fork block MUST accept blocks with the old timestamps and blocks after that fork block then only with the new timestamp.

Maybe conversations have happened privately between Dogedarkdev and ocminer, but I would expect at least a "thanks" or some kind of acknowledgement of his contribution. Instead, the next comment from Dogedarkdev is:

Quote from: Dogedarkdev on April 04, 2018, 09:33:16 PM

we are not doing a rollback and we are preparing a fork to patch this up.

The second problem seems to be one common to many projects: communication. There are a number of things the Verge team could have done which it doesn't seem they did, or if they did, didn't do soon enough.

On first report, notify the community via the various channels (BitcoinTalk, Twitter, Telegram, Discord) that a potential problem has been reported and that it is being investigate (perhaps linking to a BitcoinTalk thread)
Work closely with the person who reported the issue to confirm (or reject) its validity
Notify the community (again) once the report is confirmed or rejected and explain what will happen next (if anything) and ETA
Keep the community updated and thank them for patience and support

Communication is vital if you want to maintain the confidence of your community in your product. As of this post, the last Tweet from @vergecurrency is from 17h ago stating the problem is fixed:
https://twitter.com/vergecurrency/status/981578693062610950

Obviously it is not. On top of that, the top tweet when looking at the responses is from a fake Verge account (@vergekscurrency). Now, I know from this thread that people have already been duped, and yes they should have done their due diligence, or just used common sense and not send money unless purchasing or donating. But still, a simple Tweet to warn people about it wouldn't hurt.

Now, all this said, I understand that if the team is small there might not be resources and there for time fulfil all of the above during a time of crisis (which we can consider this to be, seeing as the hack is resulting in a hard-fork). Even more reason to make the limited communication count. Reassure your community, let them know you're on top of it and taking potential threats seriously.

I've got plenty more to say about it, but I've got things to do and besides, I'm a nobody on here. It's just my two cents.

all cut and paste projects run the very real risk of a broken port, regardless of the parent codebase. when a cut and paste dev misses any single important thing, a "simple" change can easily lead to a broken chain

to be fair, even projects with large active devteams still run into exploits/bugs, etc. the danger with cut and pasted coins is that the new team wont be able to properly fix things if any troubles are encountered.

I've had to salvage projects that had clearly been cobbled together from various snippets of (untested) code, so trust me, I've experienced the nightmarish nature of these cut & paste projects. And yes, projects with large teams can still "run into exploits/bugs", that's the nature of software development. As I said:

Quote

...the likelihood that software is bug-free quickly diminishes as complexity increases.

Or to put it more generally: no software is bug-free. At least, this is the attitude that developers should have. Assuming you're not lazy or reckless, thinking this way makes you more proactive in your approach to weeding out the bugs, using various software testing methodologies (e.g. unit-, vulnerability- and generative testing).

The evidence of inexperience and/or incompetence in the Verge dev team in this situation not to mention the downplaying of the significance of what's happening, and the lack of humility has obliterated my enthusiasm for the Verge project. I believe in the right to privacy and anonymity, but there are other coins that can provide these things. From what I've seen, the Verge team isn't fit to deliver a secure and reliable solution, so I'm bailing out.

Any faithful Verge fam wanna buy my XVG?

lnoir

Posts

Merits