3 ms·
The spiciest bit: > During our accelerated coordinated disclosure to the Libbitcoin team, the Libbitcoin team quickly disputed the relevancy of our findings an
by comex 3y ago
The spiciest bit:
> During our accelerated coordinated disclosure to the Libbitcoin team, the Libbitcoin team quickly disputed the relevancy of our findings and the CVE assignment. By our understanding, they consider bx seed a command that should never be used productively by any bx user since it is sufficiently documented as unsuited for safe wallet generation.
> We do not agree with this assessment.
https://milksad.info/disclosure.html#libbitcoin-vendor-response https://milksad.info/disclosure.html#libbitcoin-vendor-respo...
- lclc 3y agoLook at the big warning there: https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-seed https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-se... He's right.
- lrvick 3y agoI would call your attention to the several places it was demonstrated for use by libbitcoin team members -without- a warning, such as in their contributed examples in Mastering Bitcoin. We cover a few of such examples in the writeup. Also note that the tool bothers to refuse to use a flag to specify 32 bit seeds, due to their known risks, but then proceeds to give you only 32 bits of entropy anyway even if you ask for 256.
- yodelshady 3y agoNo, he's not. Why have it? This isn't a general purpose programming language, a pile of ore from which you might conceivably construct a footgun. It's a toolkit specifically designed for financial applications with a "leak your financial details" tool built in. Sure, it's AGPL, they're not literally liable, but it's not great.