Skip to content

Process: security reporting #1571

@faddat

Description

@faddat

It is almost impossible for me to say how dismayed I am with the response from informal systems on the recently reported P2P storms issue.

I only wanted to get it fixed.

I have experienced retaliation from informal systems, from the CEO down.

I am not the only one who's experienced this, it's unfortunately easy to find people making reports being totally dismissed and their efforts abused.

@thanethomson has made the bold claim that my factual statements somehow constitute harassment.

I think that environments that are fact averse are incredibly bad.

Thane, can you please lmk what i have done that constitutes harassment?

Spending two and a half months of my life on this? Reproducing it? Trying to stop ICFormal from publishing it without a patch?

If it's something else, please let me know. But while you're at it can you please ask @ebuchman to provide proof of the so-called threatening language he claims my report was full of?

Here's how the CEO of informal systems speaks about security researchers (images pending)

Ok so bulleted list:

  • why did informal and/or amulet publish against my wishes?

  • why are we just now discussing removing the mempool? I was demonstrating this problem on testnets for months prior

  • Why did informal and/or amulet put my name on something I'd not seen?

  • Why did all informal team members simultaneously leave the p2p storms slack channel where numerous other teams were working to fix the problem?

  • the report I made included code. Was it run?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions