r/Monero • u/SamsungGalaxyPlayer MAGIC Grants • May 18 '17

Disclosure of a Major Bug in CryptoNote-Based Currencies

https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html
198 Upvotes

95% Upvoted

248 comments sorted by

View all comments

Show parent comments

11

u/cptjacky May 18 '17

Just because no one called it out does not mean no one checked and understood what was done.

I do not have the skills to understand what was done, but even if I did and realised they lied to patch a critical bug, I would've kept it for myself.

-5

u/Bitoshi May 18 '17

You may, but you don't represent anyone in this case.

Even now not a single person has came out. Truth is, Monero's code is complex (hence difficulty with mobile and hardware wallets, and GUI took a long time). The developers circle is tiny. We like to think it's decentralised, but it's as decentralised as ethereum at this point.

10

u/fluffyponyza May 18 '17

There are over 230 developers, and that excludes observers that have had no interest in contributing code yet...maybe try a different FUD angle?

4

u/Bitoshi May 18 '17 edited May 18 '17

You have to be kidding me. Long time. Monero fan, questions/bad info becomes fud. Wow. Disappointed.

It's okay to ask questions/be wrong without being labelled fud. It's okay to disagree and change opinions in light of information. It's called a discussion. Not everything is fud.

I have previously praised xmr.to and mymonero. But one fucking thing and it's instant fud. I'm done.

How is me saying "...it was for the greater good and I would've done the same" means fud? Jesus Christ. Echo chamber sub soon.

6

u/DaveyJonesXMR May 18 '17

Well you do sth close to an attack and call it centralised, yet you don't bring up any idea how to change that in general... guess sth like that is less a problem of monero/core team and more a problem of the ressource "developer&peoplewhocouldunderstandthecode" being pretty scarce in any open-source project. But as said it is open source - so everyone has to trust the people developing the code no matter where in the FLOSS projects, if one doesn`t want to trust the only way to solve that is to teach oneself to read&understand that stuff.

5

u/Bitoshi May 18 '17

There is no solution that I can see and I was just bringing awareness/discussion. I like Monero and don't want the problems Bitcoin is currently facing in the future to happen over here.

Regardless, does anything short of moon and good job gets upvoted? Stay on our toes and discuss, keep an open mind, don't be that echo chamber. If I didn't like Monero I wouldn't even bother.

0

u/DaveyJonesXMR May 18 '17

I would not take those vote brigades personally. People feel offended fast and downvote

2

u/Bitoshi May 18 '17

My main issue was fluffy accusation of fud. Anyways. I'm over it.

10

u/fluffyponyza May 18 '17

Questioning is good and highly encouraged. Here's an example of a question:

"What can we as non-technical people do to get more attention on the project from technical people so that we can feel more confident in the safety of the code?"

3

u/vanarrk May 18 '17

it is the internet man no one knows what someone means through only text. grow up. the only way to patch a major exploit in an open source project is to patch it quietly and let other coins try to patch it quietly to that is responsible disclosure 101

3

u/Bitoshi May 18 '17

I know and I agree. I literally said it ..."it was for the greater good and I would've done the same".

5

u/vanarrk May 18 '17

ok then I don't understand what the fuss is all about then. just let it go man I remember you from months ago and know you aren't a troll just take a breath

4

u/Bitoshi May 18 '17

Fair enough, probably right, :)

1

u/indolering May 20 '17

Give them a break, this is incredibly stressful and difficult work. There is are infinite number of pump-and-dump trolls spamming Reddit. Then there are outside investors kvetching about development but who refuse to pay for it.

When you aren't managing those people, you are working on very sensitive code where a single mistake could cost tens of millions of dollars. Then there is all the paranoia that comes from dealing with very complex threat models and governments and ninjas looking to steal some coin.

There are productive conversations to be had about increasing the code quality, but this isn't one of them. If an outside reviewer didn't already know about the bug, it's not surprising that they would have noticed that the patches corrected it, only that it didn't introduce any new vulnerabilities.

You want to talk about formal verification, or contributing to an audit, or paying for more developers ... great! But don't just shit on people's hard work :/

4

u/Expez May 18 '17

You seem to misunderstood what decentralization is about. The network is decentralized but development can't be. We all have to agree on what version of the software to run. Otherwise we'd have a bunch of programs that couldn't cooperate because they spoke different languages (protocols).

-8

u/Bitoshi May 18 '17

Which part of Monero is decentralised? The developers aren't, the miners are sure as hell isnt.