Dear
#LUNCcommunity,
a message from your friendly
#lowleveldev Strath.
It really seems that many don't understand the implications of their behavior and the consequences for chain security.
I did not bring this up before end of the SubDao vote as I, contrary to obviously common habits, don't like to use dirty tricks and fear-mongering to sway votes.
The SubDao approach would have offered a promising way to provide the chain with something it is lacking badly: *governance-approved points of contact*.
These are *especially* relevant for chain security. And I'll explain why.
#TerraClassic relies on upstream code like wasm, Cosmos SDK, CometBft and others. Those code releases can contain security issues.
The normal procedure for (especially high-severity) fixes is to notify chain points of contact *before* making the issue and patch public.
This is to prevent making potentially bad actors aware of the issue and give chains the opportunity to upgrade early.
Fact is: We as a chain do NOT receive these notifications anymore. Why? Because of the public bickering and discrediting, and the missing (approved) point of contact.
So what does that mean? People (voluntarily) need to actively track all upstream repositories for security advisories (which normally anyway are only published *after* private disclosure).
So to give you a more concrete example: I stumbled upon a message from Antier Solutions in a casual group about their SDK upgrade proposal few days ago (they posted it earlier already). They hinted to a Security Advisory with "critical" severity which had already been publicly disclosed in February. After assessing the impact, Frag decided to implement the fix on chain. During the work we realized that other upstream code also released high-severity patches, already publicly announced since a while and had gone unnoticed.
A dedicated *governance-approved* security group would have provided a transparent and efficient point of contact and a way to efficiently coordinate with devs (and validators if necessary) on these matters.
The same applies to the other fields that the DAOs were meant to handle communication in. But that's a different story.
People do not understand that there is no "make everything public" in security. Not even in a decentralized environment.
Demanding this and blocking efforts to streamline this part of the chain is *actively and intentionally* putting the chain at risk. And this is absolutely no exaggeration.
After all, we all are lucky that this chain did not run into unplanned chain halts or more severe problems due to security issues that could not be fixed as quickly as it was the case a longer while ago.
Meanwhile, some are trying their best to discredit all those who step in voluntarily in these situations, and that have done more for the chain than they would and could ever do โฆ of course again and again with false claims, half-truths and populism. Bravo.
Think about this when supporting and cheering those playing "guardians of decentralization". Those using fear-mongering, false claims, deflection and threats. Well, good luck to us all with that mindset.
Cheers.
P.S.: Thank you,
@frag_dude for stepping in. Once again. Although parts of this community absolutely do not deserve it. And according to their talks, don't need it.
#blamefrag (and maybe myself) for going outside of governance to apply various important security patches to the chain and coordinate the upgrade procedure through a governance proposal.
#LUNC #chainsecurity