Subject: [bitcoin-core-dev] Bitcoin Core update notice

From: Pieter Wuille via bitcoin-core-dev <bitcoin-core-dev () lists ! linuxfoundation ! org>
Date: Wed, 19 Sep 2018 00:06:17 +0000

Hello all,

Bitcoin Core 0.16.3 was just released with a fix for
CVE-2018-17144:
https://bitcoincore.org/en/2018/09/18/release-0.16.3/

We urge all network participants to upgrade to 0.16.3[*] as soon
as possible.

[*] For those who build from source, the 0.14, 0.15, 0.16, 0.17,
and master branches on GitHub (https://github.com/bitcoin/bitcoin)
are fixed as well.

- --
Pieter
_______________________________________________
bitcoin-core-dev mailing list
[email-masked]
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-core-dev

---

From: Andrew Chow via bitcoin-core-dev <bitcoin-core-dev () lists ! linuxfoundation ! org>
Date: Sat, 22 Sep 2018 04:56:13 +0000

The backported versions have not been released yet. They are still going
through the gitian build process. 0.16.3 was the first one to be
released so that is the one that everyone is being recommended to
upgrade to. Regardless, you should upgrade to a patched version, whether
that is 0.14.3, 0.15.2, or 0.16.3. It is not misinformation that
everybody must upgrade.

On 09/21/2018 06:39 PM, gb via bitcoin-dev wrote:
> If the bugfix can be backported to earlier versions why is the
> hype/hysteria about "everybody" must immediately upgrade to 0.16.3
> currently being spread on the forums/reddit?
>
> https://bitcointalk.org/index.php?topic=5034070.0
> https://old.reddit.com/r/Bitcoin/comments/9hp90p/1775_nodes_out_of_9616_185_are_currently_on/
>
> I don't see any effort to correct this misinformation either.
>
> Regards.
>
> On Tue, 2018-09-18 at 17:06 -0700, Pieter Wuille via bitcoin-core-dev
> wrote:
>> Hello all,
>>
>> --
> bitcoin-dev mailing list
> [email-masked]
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

---

From: Gregory Maxwell via bitcoin-core-dev <bitcoin-core-dev () lists ! linuxfoundation ! org
Date: Sat, 22 Sep 2018 04:59:53 +0000

> If the bugfix can be backported to earlier versions why is the

Have been backported, not merely can be.

> currently being spread on the forums/reddit?

For instructions to be effective they need to be concise.  Presenting
people with a complex decision tree is not a way to maximize wellfare.

The few parties that would be better off on some other version already
know that they have some reason to not run the latest stable, and can
do more research to find out their other options.   The announcement
posted on the bitcoin core site, I think is adequately clear but if
you see an opportunity to improve it, please make suggestions.

> I don't see any effort to correct this misinformation either.

It's decent advice, not misinformation.  You can run the fixed earlier
versions but they have other issues, I wouldn't recommend anyone run
older versions generally.

Reasoning about risk is complicated. For example, when people were
talking about only the crash component of the issue there were some
people stating "I don't care if I go down, an unlikely delay in
processing payments would not be a problem."  But, in fact, a network
exploitable crash is pretty dangerous: an attacker can carve up the
network into partitions that will produce long valid forks and reorg
against each other, enabling double-spends.   The best one sentence
advice available is to upgrade to the latest version. You'd probably
have to get up to two page explanations discussing trade-offs before
it makes sense to talk about running a fixed 0.14 or what not.

Theymos' language is stronger than I would have chosen, but I think
it's language that errors on the side of protecting people from harm.
_______________________________________________
bitcoin-core-dev mailing list
[email-masked]
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-core-dev