4 ms·
Holey moley, that is insane. It's pretty wild that a good test engineer can either eat dirt at a big company or help himself to millions of internet dollars by
by Firmwarrior 5y ago
Holey moley, that is insane. It's pretty wild that a good test engineer can either eat dirt at a big company or help himself to millions of internet dollars by robbing poorly-secured startups
Your argument about security is as old as FOSS itself, and it usually comes down to whether security through obscurity is valuable or not. I wouldn't say I'm qualified to weigh in on it either way myself
- cwkoss 5y agoMy question is less about security by obscurity, and more "how does solana/wormhole move forward"? Would node administrators accept a non-OSS (or post-adoption open sourcing) patch, and run it on their nodes trusting the devs until adoption is wide enough to prevent exploitation? It seems like blockchains could be in a pickle where bugfixes will inherently get exploited if they aren't released obscurely, but their users wont tolerate obscurity.
- wmf 5y agoNobody except attackers looks at the code so you can release whatever, claim it's open source whether it is or not, and people will run it. As long as number go up. Also, this hack was on a smart contract not the node software so there's really no convincing needed; Wormhole probably could have updated the contract on chain then released the source seconds later and it wouldn't have been vulnerable. Their mistake was releasing source of the patch over 10 days before applying the patch on chain.