Hacker News new | ask | show | jobs
by comex 1044 days ago
The spiciest bit:

> During our accelerated coordinated disclosure to the Libbitcoin team, the Libbitcoin team quickly disputed the relevancy of our findings and the CVE assignment. By our understanding, they consider bx seed a command that should never be used productively by any bx user since it is sufficiently documented as unsuited for safe wallet generation.

> We do not agree with this assessment.

https://milksad.info/disclosure.html#libbitcoin-vendor-respo...
1 comments
lclc 1043 days ago
Look at the big warning there: https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-se...

He's right.

link
yodelshady 1043 days ago
No, he's not. Why have it?

This isn't a general purpose programming language, a pile of ore from which you might conceivably construct a footgun. It's a toolkit specifically designed for financial applications with a "leak your financial details" tool built in.

Sure, it's AGPL, they're not literally liable, but it's not great.

link
lrvick 1043 days ago
I would call your attention to the several places it was demonstrated for use by libbitcoin team members -without- a warning, such as in their contributed examples in Mastering Bitcoin. We cover a few of such examples in the writeup.

Also note that the tool bothers to refuse to use a flag to specify 32 bit seeds, due to their known risks, but then proceeds to give you only 32 bits of entropy anyway even if you ask for 256.

link