3 ms·

One of the more interesting aspects of this incident is that it's possible that they attacker discovered the attack via reading the bugfix: https://twitter.com

by cwkoss 5y ago

One of the more interesting aspects of this incident is that it's possible that they attacker discovered the attack via reading the bugfix: https://twitter.com/kelvinfichter/status/1489050921938132996?s=20&t=WqWvqW6fY7byXgpzF9d9iQ https://twitter.com/kelvinfichter/status/1489050921938132996... I love FOSS, but attackers being able to exploit bugs they read in fixes before they are deployed is certainly a downside - especially when the project manages billions of dollars. What process can/should be implemented to address this attack vector?

_3u10 5y ago
More importantly, how much does it cost to find these clauses in the smart contracts before the contract is modified? With $320M pay days it's one of the best bounty programs I've ever heard of.
Firmwarrior 5y ago
Holey moley, that is insane. It's pretty wild that a good test engineer can either eat dirt at a big company or help himself to millions of internet dollars by robbing poorly-secured startups Your argument about security is as old as FOSS itself, and it usually comes down to whether security through obscurity is valuable or not. I wouldn't say I'm qualified to weigh in on it either way myself
- cwkoss 5y ago
  My question is less about security by obscurity, and more "how does solana/wormhole move forward"? Would node administrators accept a non-OSS (or post-adoption open sourcing) patch, and run it on their nodes trusting the devs until adoption is wide enough to prevent exploitation? It seems like blockchains could be in a pickle where bugfixes will inherently get exploited if they aren't released obscurely, but their users wont tolerate obscurity.
  - wmf 5y ago
    Nobody except attackers looks at the code so you can release whatever, claim it's open source whether it is or not, and people will run it. As long as number go up. Also, this hack was on a smart contract not the node software so there's really no convincing needed; Wormhole probably could have updated the contract on chain then released the source seconds later and it wouldn't have been vulnerable. Their mistake was releasing source of the patch over 10 days before applying the patch on chain.

by cwkoss 5y ago

_3u10 5y ago

More importantly, how much does it cost to find these clauses in the smart contracts before the contract is modified? With $320M pay days it's one of the best bounty programs I've ever heard of.

Firmwarrior 5y ago

Holey moley, that is insane. It's pretty wild that a good test engineer can either eat dirt at a big company or help himself to millions of internet dollars by robbing poorly-secured startups Your argument about security is as old as FOSS itself, and it usually comes down to whether security through obscurity is valuable or not. I wouldn't say I'm qualified to weigh in on it either way myself

cwkoss 5y ago
My question is less about security by obscurity, and more "how does solana/wormhole move forward"? Would node administrators accept a non-OSS (or post-adoption open sourcing) patch, and run it on their nodes trusting the devs until adoption is wide enough to prevent exploitation? It seems like blockchains could be in a pickle where bugfixes will inherently get exploited if they aren't released obscurely, but their users wont tolerate obscurity.
- wmf 5y ago
  Nobody except attackers looks at the code so you can release whatever, claim it's open source whether it is or not, and people will run it. As long as number go up. Also, this hack was on a smart contract not the node software so there's really no convincing needed; Wormhole probably could have updated the contract on chain then released the source seconds later and it wouldn't have been vulnerable. Their mistake was releasing source of the patch over 10 days before applying the patch on chain.