<p>It would appear that Gavin is advising against providing zero-day attack vectors. </p>

<p>Essentially, if someone gives fairly precise instructions (e.g. a code sample) on how to exploit a vulnerability then anyone monitoring that discussion can exploit it. This is the zero-day exploit because no-one has had time to react, create an appropriate patch and disseminate it widely. Until the patch overtakes the exploit then the affected systems are vulnerable.</p>

<p>Consider the famous "Java Double of Death" (see <a href="http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/" rel="nofollow noreferrer">http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/</a> for details, Oracle fixed it here <a href="http://www.exploringbinary.com/fpupdater-fixes-the-java-2-2250738585072012e-308-bug/" rel="nofollow noreferrer">http://www.exploringbinary.com/fpupdater-fixes-the-java-2-2250738585072012e-308-bug/</a>). </p>

<p>Imagine if a malicious coder decided to put that magic number into a request against your web API that and exploited the fact that you haven't patched your JVM? You'd be seeing an awful lot of unexplained JDK downtime and lost business.</p>

<p>There is a fair amount of discussion about this topic <a href="https://security.stackexchange.com/questions/52/how-to-disclose-a-security-vulnerability-in-an-ethical-fashion">over on Security StackExchange</a> which references this <a href="http://en.wikipedia.org/wiki/Responsible_disclosure" rel="nofollow noreferrer">Wikipedia page about responsible disclosure</a>. </p>

CC BY-SA 3.0
2011-09-05T18:39:54.353Z
What Gavin is asking for is a coordinated response to vulnerability discovery. Ideally, if someone discovered a vulnerability in the Bitcoin client software, they'd notify responsible parties for each crypto-currency. They'd all develop and test fixes, then the person discovering the flaw could announce it, and then every currency could release a fix simultaneously. Otherwise, it becomes a race to fix the bug before it's exploited as each crypto-currency happens to discover it, has developers who don't know about the problem, has to race to test a fix during an exploit event, and so on.
David Schwartz
CC BY-SA 3.0
2011-09-08T01:46:08.350Z
What David said.  Creating a patch to fix a potential security exploit almost always gives attackers enough information about what the problem is to create an exploit.
gavinandresen
CC BY-SA 3.0
2011-09-05T08:37:54.127Z
2011-09-05T08:37:54.127Z
2017-03-17T13:14:44.100Z
Gary
<p>I came across this statement from a SolidCoin developer:</p>

<p>Can anyone explain this statement? </p>

<blockquote>
  <p>[06:48] gavinandresen: I came here to ask RealSolid to be responsible
  and report problems or vulnerabilities to the core bitcoin dev team
  before releasing code that fixes the exploit (because releasing code
  tells the hackers what to attack).  RealSolid, I'll ask again:  are
  you willing to do that?</p>
</blockquote>

<p>The user "Gavin" asked RealSolid to first report vulnerabilities and only then fix them, because "releasing code tells the hackers what to attack". The conversation is archived in <a href="http://www.incoherentphotography.com/uploads/2011.09.04-07.17.48.txt" rel="nofollow">this chat transcript</a>.</p>

CC BY-SA 3.0
2011-09-05T08:21:40.957Z
It might be best to quote from the original transcript to allow people behind firewalls who can't access the link, and link decay to be able to answer
Gary
CC BY-SA 3.0
2011-09-05T08:29:50.623Z
@Gary - right you are. Done.
ripper234
CC BY-SA 3.0
2011-09-07T16:41:47.367Z
I reformatted the post to put the focus on the actual question rather than the chat transcript and the two participants. If I missed any of the salient points, feel free to edit them back in.
Robert Cartaino
CC BY-SA 3.0
2011-09-07T17:10:37.437Z
This is not a Bitcoin question (and hardly a question at all). It's about security in software development. Plus, I'm not sure discussing about how valid what somebody said is, is appropriate on a Q&A website. Such a discussion would be more appropriate on a forum.
David Ammouial
<security>
What is meant by "releasing code tells the hackers what to attack"?
ripper234
# What is meant by "releasing code tells the hackers what to attack"?

(Asked by: username_0 on 2011-09-05)

I came across this statement from a SolidCoin developer:

Can anyone explain this statement?

> [06:48] username_5: I came here to ask RealSolid to be responsible
> and report problems or vulnerabilities to the core bitcoin dev team
> before releasing code that fixes the exploit (because releasing code
> tells the hackers what to attack). RealSolid, I'll ask again: are
> you willing to do that?

The user "Gavin" asked RealSolid to first report vulnerabilities and only then fix them, because "releasing code tells the hackers what to attack". The conversation is archived in [this chat transcript](http://www.incoherentphotography.com/uploads/2011.09.04-07.17.48.txt).

**Tags:** security

> **Comments:**
> **username_1**: It might be best to quote from the original transcript to allow people behind firewalls who can't access the link, and link decay to be able to answer  
> **username_0**: @username_1 - right you are. Done.  
> **username_2**: I reformatted the post to put the focus on the actual question rather than the chat transcript and the two participants. If I missed any of the salient points, feel free to edit them back in.  
> **username_3**: This is not a Bitcoin question (and hardly a question at all). It's about security in software development. Plus, I'm not sure discussing about how valid what somebody said is, is appropriate on a Q&A website. Such a discussion would be more appropriate on a forum.  

---

## 1 answers

### Answer by username_1 on 2011-09-05. Score: 11 | Accepted answer

It would appear that Gavin is advising against providing zero-day attack vectors.

Essentially, if someone gives fairly precise instructions (e.g. a code sample) on how to exploit a vulnerability then anyone monitoring that discussion can exploit it. This is the zero-day exploit because no-one has had time to react, create an appropriate patch and disseminate it widely. Until the patch overtakes the exploit then the affected systems are vulnerable.

Consider the famous "Java Double of Death" (see <http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/> for details, Oracle fixed it here <http://www.exploringbinary.com/fpupdater-fixes-the-java-2-2250738585072012e-308-bug/>).

Imagine if a malicious coder decided to put that magic number into a request against your web API that and exploited the fact that you haven't patched your JVM? You'd be seeing an awful lot of unexplained JDK downtime and lost business.

There is a fair amount of discussion about this topic [over on Security StackExchange](https://security.stackexchange.com/questions/52/how-to-disclose-a-security-vulnerability-in-an-ethical-fashion) which references this [Wikipedia page about responsible disclosure](http://en.wikipedia.org/wiki/Responsible_disclosure).

> **Comments:**
> **username_4**: What Gavin is asking for is a coordinated response to vulnerability discovery. Ideally, if someone discovered a vulnerability in the Bitcoin client software, they'd notify responsible parties for each crypto-currency. They'd all develop and test fixes, then the person discovering the flaw could announce it, and then every currency could release a fix simultaneously. Otherwise, it becomes a race to fix the bug before it's exploited as each crypto-currency happens to discover it, has developers who don't know about the problem, has to race to test a fix during an exploit event, and so on.  
> **username_5**: What username_3 said.  Creating a patch to fix a potential security exploit almost always gives attackers enough information about what the problem is to create an exploit.  

---

