Ripple and bitshares rated the most insecure blockchain software by China CERT

[hl5460]

In December 2016, China CERT released a 17-page security audit report of blockchain software. As per the report, the audit was conducted in October 2016 and released later as “open” document. The report examined 25 open-source blockchain projects, categorizing the vulnerabilities found into 9 classes. A total of 746 high-level attack vectors are detected. Ripple is rated the most insecure one with over 223 highly risky bugs.



http://news.8btc.com/blockchain-software-security-report-by-china-cert-ripple-the-worst

[1714987264]

1714987264

[1714987264]

1714987264

[dranster]

Most inaccurate title..... 

Did you learn your English from a baby or u must be an illiterate..


BTS is the most secure blockchain

[Hueristic]

Most inaccurate title..... 

Did you learn your English from a baby or u must be an illiterate..


BTS is the most secure blockchain

Red Herring much?

Thanks for that post OP!

[JoelKatz]

We now have an official response to this report at https://ripple.com/dev-blog/response-china-cert-report/

"Again, Ripple recognizes the importance of security researchers, and we take any reports of security vulnerabilities very seriously. At this time, we do not feel confident in the accuracy of the CERT report and further, and based on the way in which the report was published, we question the legitimacy of the reporting body. We are confident in our processes and our codebase, and expressly state that this report identifies no actionable items and our review, in response to it, found none either."

[Hueristic]

We now have an official response to this report at https://ripple.com/dev-blog/response-china-cert-report/

"Again, Ripple recognizes the importance of security researchers, and we take any reports of security vulnerabilities very seriously. At this time, we do not feel confident in the accuracy of the CERT report and further, and based on the way in which the report was published, we question the legitimacy of the reporting body. We are confident in our processes and our codebase, and expressly state that this report identifies no actionable items and our review, in response to it, found none either."

Looks like their response is the illiterate one of the two. Fixed that first one for them. And further, am not touching that last sentence.

[kelsey]

expressly state that this report identifies no actionable items

well i can think of atleast one painfully obvious reason why  

and our review, in response to it, found none either."

which validates the rating  

[Spoetnik]

All i would have to think about Ripple is if the system is controlled by a central closed source point..
then if that point is exploited then the whole entire thing falls apart like a house of cards.
Then we could end up with another GOX or Cryptsy going on where they would end up lying for ages and cooking the books behind closed doors.

I would say those are the last coins on earth i would touch.
I have never owned a Ripple coin or Bitshares nor would i.
All records of my activity on any site would prove this easily too.

I don't support ICO scam scheme coins for profit.

Guys, just imagine all those Big Banks the Ripple guys say are using Ripple..
What happens with them when they get hacked ? 

[hl5460]

We now have an official response to this report at https://ripple.com/dev-blog/response-china-cert-report/

"Again, Ripple recognizes the importance of security researchers, and we take any reports of security vulnerabilities very seriously. At this time, we do not feel confident in the accuracy of the CERT report and further, and based on the way in which the report was published, we question the legitimacy of the reporting body. We are confident in our processes and our codebase, and expressly state that this report identifies no actionable items and our review, in response to it, found none either."

That's really quick response.

[jacafbiz]

There are some things common to both Ripple and Bitshares

1. Both are Proof of Stake coin

2. Both have more than  billion tokens

3. Both are centralised

I'm not surprised about the report at all. I think we need independent research like this to expose flaws like this to protect investors

[dranster]

The OP does not know how to read reports


BTS2.0 is the most secure blockchain project as per that report

https://steemit.com/blockchain/@dana-edwards/bitshares-2-0-is-one-of-the-most-secure-blockchain-projects-while-ripple-is-the-least

[Spoetnik]

There are some things common to both Ripple and Bitshares

1. Both are Proof of Stake coin

2. Both have more than  billion tokens

3. Both are centralised

I'm not surprised about the report at all. I think we need independent research like this to expose flaws like this to protect investors

How about crooked unfair rigged launches ? Does that interest you ?
Funny how i never hear anyone bring up that shit..

Doesn't seem to matter if Zcash has a genius tax for example.
The only REAL question is.. how much ROI'z can i get at Polo for them ?

[JoelKatz]

expressly state that this report identifies no actionable items

well i can think of atleast one painfully obvious reason why  

and our review, in response to it, found none either."

which validates the rating  

Did you read my reply? Their methodology appears to be totaling the number of potential issues detected by automated, static analysis. This is almost completely meaningless because the vast majority of issues reported by such tools are false positives with no actual security implications. But it's doubly meaningless when you use it on code that already uses that exact same methodology because every issue that can be identified by this method has already been found and fixed. In fact, due to our use of this very same methodology, we've found and fixed bugs in third-party libraries we use such as RocksDB and Boost.
https://github.com/facebook/rocksdb/pull/333
https://github.com/boostorg/coroutine/pull/20

[dadingsda]

There are some things common to both Ripple and Bitshares

1. Both are Proof of Stake coin

2. Both have more than  billion tokens

3. Both are centralised

I'm not surprised about the report at all. I think we need independent research like this to expose flaws like this to protect investors

Why is BTS centralised?

[Spoetnik]

There are some things common to both Ripple and Bitshares

1. Both are Proof of Stake coin

2. Both have more than  billion tokens

3. Both are centralised

I'm not surprised about the report at all. I think we need independent research like this to expose flaws like this to protect investors

Why is BTS centralised?

Because it's another ICO scam.

[buwaytress]

Always healthy to have as much scrutiny from as many different sources, independent and otherwise.

Is Ripple the only one who finds the report and its methodology flawed and, therefore, unactionable? I find it unlikely that ALL these would result in false positives and it seems even Ripple concurs.

[JoelKatz]

Always healthy to have as much scrutiny from as many different sources, independent and otherwise.

Is Ripple the only one who finds the report and its methodology flawed and, therefore, unactionable? I find it unlikely that ALL these would result in false positives and it seems even Ripple concurs.

For projects that don't use this form of analysis already, typically between 1 to 2 in 100 of these reports on security critical code reflect an actual issue. But without surveying a statistical sample of them in that particular code base, you're really just guessing.

When we ran the first such report on rippled, we debated "fixing" every issue to get the number down to zero. The advantage would be that it would make it easier to scan future versions of the code as you wouldn't have a large number of false positives to wade through. We ultimately decided not to because in many cases it would require making the code harder to understand and maintain.

I wonder, if we had done so, would this report said we were the most secure or would they just have left us out? (And, to be clear, it would have also been absurd to say that a zero count from a tool like this makes us the most secure.)

[Spoetnik]

Nice SIG.. an "employee" of an open source fair launch decentralized free market currency ?
Let me guess you have a CEO and a CTFO etc too 

Ripple.. 

"Big Banks"   

No others in Crypto are as scammy with their scheme and as persistent as Ripple douche nozzles.

[poloniexwhale]

The OP does not know how to read reports


BTS2.0 is the most secure blockchain project as per that report

https://steemit.com/blockchain/@dana-edwards/bitshares-2-0-is-one-of-the-most-secure-blockchain-projects-while-ripple-is-the-least

How to define the most secure? You heard this from BTS devs? They are braggers, I don't trust them.

[r0ach]

We now have an official response to this report at https://ripple.com/dev-blog/response-china-cert-report/

"Again, Ripple recognizes the importance of security researchers, and we take any reports of security vulnerabilities very seriously. At this time, we do not feel confident in the accuracy of the CERT report and further, and based on the way in which the report was published, we question the legitimacy of the reporting body. We are confident in our processes and our codebase, and expressly state that this report identifies no actionable items and our review, in response to it, found none either."

Just politely tell the Chinese that Ripple is not a decentralized currency in the first place (such a thing may not even be possible).  Problem solved.

[hl5460]

We now have an official response to this report at https://ripple.com/dev-blog/response-china-cert-report/

"Again, Ripple recognizes the importance of security researchers, and we take any reports of security vulnerabilities very seriously. At this time, we do not feel confident in the accuracy of the CERT report and further, and based on the way in which the report was published, we question the legitimacy of the reporting body. We are confident in our processes and our codebase, and expressly state that this report identifies no actionable items and our review, in response to it, found none either."

Just politely tell the Chinese that Ripple is not a decentralized currency in the first place (such a thing may not even be possible).  Problem solved.

I think it's difficult to draw a line between centralization and decentralization.