pull down to refresh

10 sats \ 6 replies \ @k00b 16 Oct 2023 \ on: [bitcoin-dev] Full Disclosure: CVE-2023-40231 / CVE-2023-40232 / CVE-2023-40233 bitcoin

I was spooked for a second. LND only recently released v0.17. Roasbeef followed up:

One small clarification: all of lnd's relevant mitigations were in place by
lnd v0.16.1-beta [1], which was released on April 24th 2023. Since then
we've fixed some performance regressions introduced due to some of the
mitigations (mempool watching), and in 0.17.1 we'll start to use the new
gettxspendingprevout RPC call with bitcoind to further reduce load.
write
preview
0 sats \ 2 replies \ @theariard 17 Oct 2023

Thanks no thanks for the spook accusation. This is insulting.

Warned for years people the mempool was a bedrock of security issues for L2s:
https://github.com/ariard/L2-zoology

reply
100 sats \ 1 reply \ @k00b 17 Oct 2023

I wasn't accusing you of anything! I, me, myself was spooked! I was afraid I was running an effected version of LND.

No offense intended. I'm sorry if my statement wasn't clear. I don't qualify as a critic on this issue, so I would never criticize you on it.

reply
2489 sats \ 0 replies \ @theariard 18 Oct 2023

See Laolu comment on the mailing list about LND.

This is always unclear with coordinated disclosure if you give the latest release number (where mitigations are included) or the ones where they have been effectively included. Latest release number might always have some minor bugs.

Thanks for the work you’re doing on stacker.news.

reply
388 sats \ 2 replies \ @TonyGiorgio 16 Oct 2023

He's got multiple things wrong here. Ldk was also apparently fixed a while back. The version it says in the mailing list isn't even out yet.

reply
388 sats \ 1 reply \ @theariard 17 Oct 2023 freebie

Here to answer your questions on what I get wrong.

To the best of my knowledge you never contributed to low-level lightning parts.

I”ll maintain the LDK version number is correct, has been communicated to me privately last Friday by a LDK maintainers and there is currently more hardening under ways

reply
100 sats \ 0 replies \ @TonyGiorgio 17 Oct 2023

deleted by author