Non-disclosure of a consensus bug in btcd

[AntoineP]

@Crypt-iQ

Unfortunately, it seems like there is a double standard emerging in security reporting between bitcoin implementations. If this were a bitcoind security issue, I doubt there would have been the same pressure to disclosure with such a short timeline.

@roasbeef

Particularly given existing precedence set by other full node implementations to delay disclosure of sufficiently critical issues well beyond the 6 months we requested between patch and disclosure

Trying to deflect this on Bitcoin Core is not a good look. If you disagreed with the timeline, why not state so back when we reported the bug? Why confirm the schedule three months later, when you publicly committed to release the details in 90 days?

Bitcoin Core now has a disclosure policy. Had we reported it to this project and two days before the deadline maintainers requested us not to respect the schedule with no good reason, it would have played the same. But i doubt they would do that in the first place.

@roasbeef

I thought it would be useful to add some additional context here. It is the case that we wanted to further delay the disclosure, as we felt that disclosing just 3 months after a patch landed was too soon.

Again, it’s curious how this sudden concern only made its appearance a few days before the deadline. Not when you actually released and stated you would disclose the details 90 days later.

@roasbeef

Ultimately, Niklas and AntoineP refused to delay an extra 3 months (to bring the total age of the release to 6 months), instead deciding to prematurely disclose themselves against the wishes of the btcd maintainers.

We indeed refused to arbitrarily make an (other) exception to the published schedule. However we still haven’t released the details of the vulnerability. We asked you numerous times privately to give us a good reason not to respect the schedule. I’ll restate it publicly. We’re happy to withhold the details should there be any reasonable concern about publishing them according to the initial schedule.