3 ms·
My question is less about security by obscurity, and more "how does solana/wormhole move forward"? Would node administrators accept a non-OSS (or post-adoption
by cwkoss 5y ago
My question is less about security by obscurity, and more "how does solana/wormhole move forward"?
Would node administrators accept a non-OSS (or post-adoption open sourcing) patch, and run it on their nodes trusting the devs until adoption is wide enough to prevent exploitation?
It seems like blockchains could be in a pickle where bugfixes will inherently get exploited if they aren't released obscurely, but their users wont tolerate obscurity.
- wmf 5y agoNobody except attackers looks at the code so you can release whatever, claim it's open source whether it is or not, and people will run it. As long as number go up. Also, this hack was on a smart contract not the node software so there's really no convincing needed; Wormhole probably could have updated the contract on chain then released the source seconds later and it wouldn't have been vulnerable. Their mistake was releasing source of the patch over 10 days before applying the patch on chain.