delvingbitcoin
Non-disclosure of a consensus bug in btcd
Posted on: October 23, 2024 20:35 UTC
Niklas and AntoineP made a decision to disclose vulnerabilities without adhering to the proposed extended timeline of an additional three months, which would have brought the total wait time to six months, contrary to the wishes of the btcd
maintainers.
This action resulted in the btcd
maintainers releasing software that contained vulnerabilities. The situation underscores a critical viewpoint on the ethics of vulnerability disclosure, emphasizing that individuals who discover vulnerabilities are not inherently obligated to follow the preferences or timelines suggested by the software maintainers, users, or any parties potentially affected by the disclosure. It challenges the notion that discoverers must engage in negotiations or discussions regarding the manner, audience, or timing of the disclosure, highlighting a fundamental disagreement on the moral responsibilities assumed by those who uncover software flaws.