Open Security Issues

Very few actually know how any of this works. History, as good of a teacher it is, has taught me that emotions fuel behavior far more effectively than careful consideration. Just like my penis practically clicks on pornhub before my mind has a chance to process the impulse :scream:

There will be zealots and recruitment will not be as hard as you think. Why not start thinking of ways to smash these vectors right out of the gateā€¦ Soooooooooo wuts up doc. :wink:

Secure Random Relocation might be part of the strategy to help mitigate: Secure Random Relocation - RFCs - Safe Dev Forum

As for out-of-band stuff, 100% it will happen, I plan to use it myself (for benevolent reasons of course!) and am currently working on a simple out-of-band software specifically for running alongside vaults. I canā€™t say I like it but I can say itā€™s inevitable and I will participate. I put it in the same bucket as replace-by-fee in bitcoin, a real pain in the arse but also necessary and true-to-reality. We canā€™t just pretend it wonā€™t happen or that thereā€™s no incentives to do it or people are too nice etc.

2 Likes

Yes, but if provide for anyone to use it wonā€™t be a sly thing that does nasties for someone else. People would not download that stuff. But if you have open source out of band stuff that does useful things then yes some will install it.

The issue here was trying to convince a large portion of the vault owners to download an update that changes the purpose of the network either as a ā€œmust haveā€ or as something else. This history shows people will not do in a significant way

1 Like

Yo stop @neo !! Are u kidding me! There is little incentive needed to make people accept regulatory paradigms. If the fucking people decidie to install SAFE it shows the capacity for willingness. No need for vault modification. The program acts as OBSERVER AND HAND for needed changes.

Then please give me some examples where this has happened please, I do not know of any and yet I gave you one where the opposite happened and they rejected the attempt.

Regulatory attempts? Holy shit balls. Bike lanes and nuclear cooling strategies. Hmm i canā€™t of anyā€¦

I wish I had the time for this but the best I can do is post incomplete thoughtsā€¦

Rather than adding layers of complexity and opening up new holes, Iā€™d like to think first if changing something or eliminating something could help.
Like eliminating the concept of sections, increasing their size, (or making this grouping much more dynamic, e.g. randomly regroup every n transactions.)

Also, solving issues on a higher level than protocol, algorithm or implementation would be nice. e.g. Are there ways to create digital signatures of tests of vault behavior and validate test results using a public key (e.g. MaidSafe holding the private key)? The tests would have to be indiscernible from requests seen during regular operation. (Keyword: Run-time certification.)

As a last resort, I think a lot about having centralized (at MaidSafe) ā€œtraining wheelsā€, until things get sorted out. Very un-SAFE Network-like stuff such as permissioning vaults and keeping a central backup of data.

This may be relevant to this topic: Monero is (and many other are) going to switch to a new PoW algorithm RandomX. 1.5B$ is at stake so security is really important. This blog post claims that it is better to have one in-depth audit over many shallow ones: State of the Art Proof-of-Work: RandomX | Trail of Bits Blog I guess thatā€™s right, and that a combination of both would be best.