Take the 2-minute tour ×
Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It's 100% free, no registration required.

I came across this statement from a SolidCoin developer:

Can anyone explain this statement?

[06:48] gavinandresen: I came here to ask RealSolid to be responsible and report problems or vulnerabilities to the core bitcoin dev team before releasing code that fixes the exploit (because releasing code tells the hackers what to attack). RealSolid, I'll ask again: are you willing to do that?

The user "Gavin" asked RealSolid to first report vulnerabilities and only then fix them, because "releasing code tells the hackers what to attack". The conversation is archived in this chat transcript.

share|improve this question
    
It might be best to quote from the original transcript to allow people behind firewalls who can't access the link, and link decay to be able to answer –  Gary Rowe Sep 5 '11 at 8:21
    
@Gary - right you are. Done. –  ripper234 Sep 5 '11 at 8:29
    
I reformatted the post to put the focus on the actual question rather than the chat transcript and the two participants. If I missed any of the salient points, feel free to edit them back in. –  Robert Cartaino Sep 7 '11 at 16:41
2  
This is not a Bitcoin question (and hardly a question at all). It's about security in software development. Plus, I'm not sure discussing about how valid what somebody said is, is appropriate on a Q&A website. Such a discussion would be more appropriate on a forum. –  davux Sep 7 '11 at 17:10
add comment

1 Answer

up vote 11 down vote accepted

It would appear that Gavin is advising against providing zero-day attack vectors.

Essentially, if someone gives fairly precise instructions (e.g. a code sample) on how to exploit a vulnerability then anyone monitoring that discussion can exploit it. This is the zero-day exploit because no-one has had time to react, create an appropriate patch and disseminate it widely. Until the patch overtakes the exploit then the affected systems are vulnerable.

Consider the famous "Java Double of Death" (see http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ for details, Oracle fixed it here http://www.exploringbinary.com/fpupdater-fixes-the-java-2-2250738585072012e-308-bug/).

Imagine if a malicious coder decided to put that magic number into a request against your web API that and exploited the fact that you haven't patched your JVM? You'd be seeing an awful lot of unexplained JDK downtime and lost business.

There is a fair amount of discussion about this topic over on Security StackExchange which references this Wikipedia page about responsible disclosure.

share|improve this answer
5  
What Gavin is asking for is a coordinated response to vulnerability discovery. Ideally, if someone discovered a vulnerability in the Bitcoin client software, they'd notify responsible parties for each crypto-currency. They'd all develop and test fixes, then the person discovering the flaw could announce it, and then every currency could release a fix simultaneously. Otherwise, it becomes a race to fix the bug before it's exploited as each crypto-currency happens to discover it, has developers who don't know about the problem, has to race to test a fix during an exploit event, and so on. –  David Schwartz Sep 5 '11 at 18:39
3  
What David said. Creating a patch to fix a potential security exploit almost always gives attackers enough information about what the problem is to create an exploit. –  gavinandresen Sep 8 '11 at 1:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.