6

I came across this statement from a SolidCoin developer:

Can anyone explain this statement?

[06:48] gavinandresen: I came here to ask RealSolid to be responsible and report problems or vulnerabilities to the core bitcoin dev team before releasing code that fixes the exploit (because releasing code tells the hackers what to attack). RealSolid, I'll ask again: are you willing to do that?

The user "Gavin" asked RealSolid to first report vulnerabilities and only then fix them, because "releasing code tells the hackers what to attack". The conversation is archived in this chat transcript.

Improve this question
4
  • It might be best to quote from the original transcript to allow people behind firewalls who can't access the link, and link decay to be able to answer
    – Gary
    Sep 5, 2011 at 8:21
  • @Gary - right you are. Done.
    – ripper234
    Sep 5, 2011 at 8:29
  • I reformatted the post to put the focus on the actual question rather than the chat transcript and the two participants. If I missed any of the salient points, feel free to edit them back in.
    – Robert Cartaino
    Sep 7, 2011 at 16:41
  • 2
    This is not a Bitcoin question (and hardly a question at all). It's about security in software development. Plus, I'm not sure discussing about how valid what somebody said is, is appropriate on a Q&A website. Such a discussion would be more appropriate on a forum.
    – David Ammouial
    Sep 7, 2011 at 17:10

1 Answer 1

Reset to default
11

It would appear that Gavin is advising against providing zero-day attack vectors.

Essentially, if someone gives fairly precise instructions (e.g. a code sample) on how to exploit a vulnerability then anyone monitoring that discussion can exploit it. This is the zero-day exploit because no-one has had time to react, create an appropriate patch and disseminate it widely. Until the patch overtakes the exploit then the affected systems are vulnerable.

Consider the famous "Java Double of Death" (see http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ for details, Oracle fixed it here http://www.exploringbinary.com/fpupdater-fixes-the-java-2-2250738585072012e-308-bug/).

Imagine if a malicious coder decided to put that magic number into a request against your web API that and exploited the fact that you haven't patched your JVM? You'd be seeing an awful lot of unexplained JDK downtime and lost business.

There is a fair amount of discussion about this topic over on Security StackExchange which references this Wikipedia page about responsible disclosure.

Improve this answer
2
  • 5
    What Gavin is asking for is a coordinated response to vulnerability discovery. Ideally, if someone discovered a vulnerability in the Bitcoin client software, they'd notify responsible parties for each crypto-currency. They'd all develop and test fixes, then the person discovering the flaw could announce it, and then every currency could release a fix simultaneously. Otherwise, it becomes a race to fix the bug before it's exploited as each crypto-currency happens to discover it, has developers who don't know about the problem, has to race to test a fix during an exploit event, and so on.
    – David Schwartz
    Sep 5, 2011 at 18:39
  • 3
    What David said. Creating a patch to fix a potential security exploit almost always gives attackers enough information about what the problem is to create an exploit.
    – gavinandresen
    Sep 8, 2011 at 1:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.