🚩 Bitcoin Red Team update 55 hours into the campaign We're now 24 people working around the clock. We've scanned 425 projects so far and have produced 1029 high+critical (H+C) findings. image We generated 6700 findings so far and are hitting 7.7 projects per hour. Our H+C rate per person per hour is back at ~1 as we work off a massive backlog and as the team grows and naturally divides up roles. We have hunters, wizards, outreachers, sugar daddies, and gigglers. Our H+C ratio is at 15.4% of all findings, increased by a percentage point compared to yesterday. This is great, our accuracy is stable, and even slightly increasing. We're trying out best to reproduce all critical findings in local regtests before reporting them to projects. image Our biggest bottleneck is outreach. Most projects don't have a SECURITY .md in their repos (19.5%). Only 13.1% have an email in there. We're working on better ways to reach folks. In the mean time, the best thing you can do as a project maintainer is to leave an email address in your repo. image Thank you to the sponsors and donors who cover the costs of this campaign and help to keep it alive. Specifically @OpenSats, FPuklowski, @vik sharma, and everyone who has donated to OpenSats Red. An incredible team of some of the most hard core Bitcoiners I know have assembled and dedicated their last days to this effort. We've seen shit. I don't want to reveal anyone personally, they can choose to do that themselves, but I think the way that people came together to join forces was and still is the most beautiful part about this entire program. It makes me very hopeful, seeing so many people step up and give their time and energy to Bitcoin, especially during times of pain. We're not done yet. image

Replies (23)

Aedifico's avatar
Aedifico 1 month ago
Do you also measure cost per outcome, or so? Would be interesting.
Conspiracy theory: Coldcard Hack was the bootloader for the Red Team Feds to burn it all down... ... too soonπŸ€”πŸ€ͺ
Do you remember ? It's just that wearing a different disguise. It's permissionless crowdfunding, where a (trusted) third party holds the funds and disperses them as the project is completed to satisfaction. (hint: that "trusted third party" can also just be the person doing the project, if contributors trust him enough directly)
That doesn't really matter, you're still using "curators" with nowhere to just see all posts chronologically or use automated filters Now that I looked at the about page, the site also contradicts itself on whether money is held by third parties or not - "arbiters don't exist, oh wait yes they do" It probably uses fucking lightning for payments but I don't even see where to send a payment on a project I remember Obama promising to close Guantanamo Bay and not doing it, I'm not falling for shit that easily
The events that back everything here are out on relays, you can query them directly if you don't like the UI. it's just an interface layer that is meant to make things easier. But it's 100% built on nostr, so you can just use nak if you'd prefer. There is no privileged database anywhere. Where does the About say arbiters exist and simultaneously don't exist? Maybe you're confusing the fact that you can just assign yourself as your own arbiter if you want? You can be: Your own curator, your own Arbiter, your own Worker, your own Patron. In that configuration, you're just fundraising directly with no extra parties involved (and I couldn't see how you could possibly have an issue with that). Try as you might, you're not going to find a sneaky gatekeeping/permissioned backdoor somewhere. The protocol is entirely open. And you're sort of being a jackass, honestly. Finally: the repo is public and the NIP is just a draft. don't like it? change it.
Brother, you're being extremely paranoid. The events that back everything here are out on relays, you can query them directly if you don't like the UI. it's just an interface layer that is meant to make things easier. But it's 100% built on nostr, so you can just use nak if you'd prefer. There is no privileged database anywhere. Where does the About say arbiters exist and simultaneously don't exist? Maybe you're confusing the fact that you can just assign yourself as your own arbiter if you want? You can be: Your own curator, your own Arbiter, your own Worker, your own Patron. In that configuration, you're just fundraising directly with no extra parties involved (and I couldn't see how you could possibly have an issue with that). Try as you might, you're not going to find a sneaky gatekeeping/permissioned backdoor somewhere. The protocol is entirely open. And you're sort of being a jackass, honestly. Finally: - the repo is public and the NIP is just a draft. don't like it? change it.
"Don't like it? Change it." What part of it am I supposed to keep? And why would I even work on it before Cradicle is done and adopted? Build a better UI if you don't want me to shit on it. Read your own shit if you want to see where it contradicts itself.
umni's avatar
umni 1 month ago
After corrections have been made to affected software will they release their findings? They should!
↑