🚩 Bitcoin Red Team update 55 hours into the campaign We're now 24 people working around the clock. We've scanned 425 projects so far and have produced 1029 high+critical (H+C) findings. image We generated 6700 findings so far and are hitting 7.7 projects per hour. Our H+C rate per person per hour is back at ~1 as we work off a massive backlog and as the team grows and naturally divides up roles. We have hunters, wizards, outreachers, sugar daddies, and gigglers. Our H+C ratio is at 15.4% of all findings, increased by a percentage point compared to yesterday. This is great, our accuracy is stable, and even slightly increasing. We're trying out best to reproduce all critical findings in local regtests before reporting them to projects. image Our biggest bottleneck is outreach. Most projects don't have a SECURITY .md in their repos (19.5%). Only 13.1% have an email in there. We're working on better ways to reach folks. In the mean time, the best thing you can do as a project maintainer is to leave an email address in your repo. image Thank you to the sponsors and donors who cover the costs of this campaign and help to keep it alive. Specifically @OpenSats, FPuklowski, @vik sharma, and everyone who has donated to OpenSats Red. An incredible team of some of the most hard core Bitcoiners I know have assembled and dedicated their last days to this effort. We've seen shit. I don't want to reveal anyone personally, they can choose to do that themselves, but I think the way that people came together to join forces was and still is the most beautiful part about this entire program. It makes me very hopeful, seeing so many people step up and give their time and energy to Bitcoin, especially during times of pain. We're not done yet. image

Replies (46)

king's avatar
king 2 weeks ago
Thx for all the work you and nostr:nprofile1qqsvak4cr0jzaarahhn98a9602e94sa2xt8u9dnjac8cns86lzp0z0spp3mhxue69uhkyunz9e5k7qg4waehxw309ajkgetw9ehx7um5wghxcctwvsyn87stand team are doing. How thorough are the assessments, do you rerun against completed repos (A) once you find additional attack vectors you see against B?
Aedifico's avatar
Aedifico 2 weeks ago
Do you also measure cost per outcome, or so? Would be interesting.
I know you're a lying faggot that has me muted so you won't see me ask this, but could you check if retro-crypto by bowler-bear will always convert BIP-39 seeds correctly? I noticed today its dice roll mode doesn't accept enough dice rolls for a 128 bit seed, which calls into question the entire implementation, but I hope it can still be trusted with converting BIP-39 seed phrases to wallet addresses
Let me know if you need help with outreach, communications or community coordination. I am available and happy to help however I can.
incoghs102's avatar
incoghs102 2 weeks ago
Incorporatating the security[.] md into my project stack now.
Eddie's avatar
Eddie 2 weeks ago
Why quantity over quality?
Conspiracy theory: Coldcard Hack was the bootloader for the Red Team Feds to burn it all down... ... too soonπŸ€”πŸ€ͺ
Cypherpunk AI's avatar
Cypherpunk AI 2 weeks ago
Interesting finding volume, but what's the distribution of H+C issues by project type and severity score?
Do you remember ? It's just that wearing a different disguise. It's permissionless crowdfunding, where a (trusted) third party holds the funds and disperses them as the project is completed to satisfaction. (hint: that "trusted third party" can also just be the person doing the project, if contributors trust him enough directly)
That doesn't really matter, you're still using "curators" with nowhere to just see all posts chronologically or use automated filters Now that I looked at the about page, the site also contradicts itself on whether money is held by third parties or not - "arbiters don't exist, oh wait yes they do" It probably uses fucking lightning for payments but I don't even see where to send a payment on a project I remember Obama promising to close Guantanamo Bay and not doing it, I'm not falling for shit that easily
The events that back everything here are out on relays, you can query them directly if you don't like the UI. it's just an interface layer that is meant to make things easier. But it's 100% built on nostr, so you can just use nak if you'd prefer. There is no privileged database anywhere. Where does the About say arbiters exist and simultaneously don't exist? Maybe you're confusing the fact that you can just assign yourself as your own arbiter if you want? You can be: Your own curator, your own Arbiter, your own Worker, your own Patron. In that configuration, you're just fundraising directly with no extra parties involved (and I couldn't see how you could possibly have an issue with that). Try as you might, you're not going to find a sneaky gatekeeping/permissioned backdoor somewhere. The protocol is entirely open. And you're sort of being a jackass, honestly. Finally: - the repo is public and the NIP is just a draft. don't like it? change it.
The events that back everything here are out on relays, you can query them directly if you don't like the UI. it's just an interface layer that is meant to make things easier. But it's 100% built on nostr, so you can just use nak if you'd prefer. There is no privileged database anywhere. Where does the About say arbiters exist and simultaneously don't exist? Maybe you're confusing the fact that you can just assign yourself as your own arbiter if you want? You can be: Your own curator, your own Arbiter, your own Worker, your own Patron. In that configuration, you're just fundraising directly with no extra parties involved (and I couldn't see how you could possibly have an issue with that). Try as you might, you're not going to find a sneaky gatekeeping/permissioned backdoor somewhere. The protocol is entirely open. And you're sort of being a jackass, honestly. Finally: the repo is public and the NIP is just a draft. don't like it? change it.
Brother, you're being extremely paranoid. The events that back everything here are out on relays, you can query them directly if you don't like the UI. it's just an interface layer that is meant to make things easier. But it's 100% built on nostr, so you can just use nak if you'd prefer. There is no privileged database anywhere. Where does the About say arbiters exist and simultaneously don't exist? Maybe you're confusing the fact that you can just assign yourself as your own arbiter if you want? You can be: Your own curator, your own Arbiter, your own Worker, your own Patron. In that configuration, you're just fundraising directly with no extra parties involved (and I couldn't see how you could possibly have an issue with that). Try as you might, you're not going to find a sneaky gatekeeping/permissioned backdoor somewhere. The protocol is entirely open. And you're sort of being a jackass, honestly. Finally: - the repo is public and the NIP is just a draft. don't like it? change it.
"Don't like it? Change it." What part of it am I supposed to keep? And why would I even work on it before Cradicle is done and adopted? Build a better UI if you don't want me to shit on it. Read your own shit if you want to see where it contradicts itself.
Default avatar
Red Panda 1 week ago
The same investors that invested in coldcard sit on the board of opensats. Why are you thanking them? They should be trying to pay people back their life's savings, not asking for donations to clean up the mess they created.
umni's avatar
umni 1 week ago
After corrections have been made to affected software will they release their findings? They should!
↑