Disclosure: Fake channel DoS vector



Summary:

The email begins with the sender expressing their disagreement with the recipient's approach to measuring review contributions in an open-source project. They argue that relying solely on quantitative measurements overlooks the importance of reviewing the hard and sensitive parts of the codebase. They also mention working on a decentralized bitcoin open-source project where there is no designated authority to determine major contributors.The sender recalls their previous work on the anchor output patchset and the time they spent reviewing other people's contributions to move the project closer to production-readiness. They mention proposing changes related to mempool monitoring and custom script support, but feel that there is still a lack of qualified eyes to provide technical opinions in those areas.They explain their decision to remove themselves from the security-reporting list due to concerns about the weak and non-consensual code of conduct introduced by the recipient. They highlight the potential vulnerabilities this code of conduct brings and express disappointment at not receiving a response regarding their concerns.The sender refutes the recipient's claim about their lack of involvement in development calls, stating that they were the original host of the LDK development meetings and initiated the LDK review club. They emphasize that development decisions are made through continuous review and testing processes.They address the recipient's comment about their understanding of the LDK codebase, offering to demonstrate it by using the latest release and sending funds through channels. They mention being actively involved in reviewing and working on Bitcoin Core's sensitive parts related to Lightning.The sender acknowledges the need for making Lightning more usable and useful, citing their previous talk on the liquidity toolchain and their current review of dual-funding at the spec-level. They assert that they have been in contact with actual LDK users and are aware of their complaints about the poor usability of the LDK interface.They question the recipient's opinion that people who contribute less do a better job, stating that they have contributed significantly to the robustness of the Lightning ecosystem. However, they express concern about the project's technical debt in terms of security, safety, performance, and code modularity.The sender draws parallels between Lightning's current weaknesses and the security weaknesses of major Internet protocols like BGP, SMTP, and DNS. They warn that if Lightning experiences massive ecosystem hacks, it could lead to centralized "wallet gardens" and render efforts in liquidity management, routing, and state management useless. They suggest that the Lightning community needs to prioritize open-source ethics and safeguarding end-users' interests.They conclude by affirming their commitment to speaking up for the LDK project when they see the current maintenance team not fulfilling their responsibilities. They acknowledge the potential for conflicts in an open-source project but express gratitude for the recipient's hard work on LDK. They suggest that if the recipient desires more social recognition, they are free to work on another open-source project. Finally, they propose organizing the 1st LDKDev community event to improve communication within the LDK community.


Updated on: 2023-08-29T02:17:56.184666+00:00