I have a few thousand XVG, and have been interested in Verge for some time. I share this so that you realise I'm not a troll. But neither am I a "fanboy", and I can't help but be disappointed about the way this situation has been handled.
ocminer kindly shared concrete evidence that there was an issue but the attitude towards it (from what I can tell) was somewhat dismissive and/or nonchalant.
I'm a developer by trade, and understand that the likelihood that software is bug-free quickly diminishes as complexity increases. The problem for me isn't that there was a bug in the code that was exploitable — we can be thankful that it has been brought to the attention of the team and will be fixed. The problem for me is that this thread and situation highlights some serious issues.
First, it indicates that the team isn't fully aware of what they're doing. This statement is not an attack, it's just based on the evidence:
Wonder when they are going to hardfork it
why would we do that? we just made a quick simple update and most pools have already updated...
we are now working on a higher level of redundancy checking as well.
the attack only lasted 3 hours, and not all coins produced during that period were intercepted.
After the "quick simple update" (which actually appeared to be botched), it took for
ocminer to point out their error:
nice a new version of the famed timewarp attack.. very interesting.
yep.. we pushed a quick fix and most pools have already updated.. we're already working on a whole new block verification process.
we're kinda glad this happened and that it wasn't as bad as it could have been.
Hmm, you guys are aware that the "fix" you pushed actually IS a hardfork ? So your blockchain snapshot is not valid anymore, the wallet's won't sync up from scratch anymore and the current chain is simply not usable anymore with that new "fix" ?
Your change simply disagrees with the attackers blocks, the first block I see from the attacker was 2007365 - so the wallets will stop syncing there and simply not progress any further.
I remember your first forking dramas when trying to fork into Tor which failed 2 times IIRC.
You should immediately refrain from that "fix" and set a proper fork-height (at least 48h) and the chain up until the fork block MUST accept blocks with the old timestamps and blocks after that fork block then only with the new timestamp.
Maybe conversations have happened privately between
Dogedarkdev and
ocminer, but I would expect at least a "thanks" or some kind of acknowledgement of his contribution. Instead, the next comment from
Dogedarkdev is:
we are not doing a rollback and we are preparing a fork to patch this up.
The second problem seems to be one common to many projects: communication. There are a number of things the Verge team could have done which it doesn't seem they did, or
if they did, didn't do soon enough.
- On first report, notify the community via the various channels (BitcoinTalk, Twitter, Telegram, Discord) that a potential problem has been reported and that it is being investigate (perhaps linking to a BitcoinTalk thread)
- Work closely with the person who reported the issue to confirm (or reject) its validity
- Notify the community (again) once the report is confirmed or rejected and explain what will happen next (if anything) and ETA
- Keep the community updated and thank them for patience and support
Communication is vital if you want to maintain the confidence of your community in your product. As of this post, the last Tweet from @vergecurrency is from 17h ago stating the problem is fixed:
https://twitter.com/vergecurrency/status/981578693062610950Obviously it is not. On top of that, the top tweet when looking at the responses is from a fake Verge account (@verge
kscurrency). Now, I know from this thread that people have already been duped, and yes they should have done their due diligence, or just used common sense and not send money unless purchasing or donating. But still, a simple Tweet to warn people about it wouldn't hurt.
Now, all this said, I understand that if the team is small there might not be resources and there for time fulfil all of the above during a time of crisis (which we can consider this to be, seeing as the hack is resulting in a hard-fork). Even more reason to make the limited communication count. Reassure your community, let them know you're on top of it and taking potential threats seriously.
I've got plenty more to say about it, but I've got things to do and besides, I'm a nobody on here. It's just my two cents.
