Mike Schmidt✓

RT @TFTC21: Mike Schmidt broke down Bitcoin Core v32.1 and surfaced something important: Core updated its disclosure policy specifically because LLM tools are making bugs easier to find. "Core's recently updated policy fast-tracks the disclosure of easily discoverable vulnerabilities. LLM-assisted security scans helped motivate the change." All three vulnerabilities disclosed today were found by Project Loupe, an AI-powered scanner built at Spiral. If defenders can find them with LLMs, attackers can too. Beyond security, v32.1 packs 715 merged PRs from 111 authors. Fee estimation now factors in live mempool conditions. Initial sync is 1.2-3x faster. The libevent dependency is fully replaced with in-house code. Stratum v2 keeps advancing. The infrastructure keeps getting stronger.

Bitcoin Core v32.1: a deeper look First, why no 32.0? It was tagged on October 21 but never fully announced or released. A remotely triggerable TCP crash was reported on October 23 and 32.1 shipped on October 27 (yesterday) with that fix and two others. I'll dig into the security updates, but this release also represents months of testing, maintenance, and work to make Bitcoin easier to verify and use. What went into these v32.1 changes and what do Bitcoin users get from them?

Documentation changes help node operators use the software and contributors work on it. Examples in v32.1 include: Adding installation instructions to Linux release packages. (#33451) Updating external-signer instructions for users keeping their signing keys outside Core. (#35424) Warning about the retirement of legacy I2P encryption and the risk of older nodes becoming isolated with a smaller anonymity set. (#35951) Explaining how to structure tests so new contributors can put their work in the right place. (#35260) These are practical instructions for installing a node, managing signing, maintaining private connectivity and contributing useful tests.

The libevent dependency is replaced by in-house code. This removes an external dependency, with Core taking responsibility for maintaining and testing the replacement. (#35182) In a @bitcoinbrink post, we previously wrote about the reasons for reducing dependencies, including supply-chain risk, vulnerabilities in external code and build reproducibility. Libevent was one of the remaining dependencies discussed: More of the validation engine is exposed through Bitcoin Kernel which allows other Bitcoin applications to reuse structural block / transaction checks and access transaction data. (#33796, #33908, #35380) And getopenrpcinfo provides a machine-readable description of RPC methods, parameters and results which is useful for client developers building applications on Core. (#34683)

The 715 Core PRs came from 111 authors. That doesn't include reviewers, testers, translators, and others. Dozens of contributors made their first merged Core commits in v32.1. Core PRs averaged ~60 days from opening to merge. ~26 review comments per PR and a total of 18k+ review comments for the release. Congratulations and thanks to all the contributors who helped write, review, test, translate and maintain this release. 🧡

Testing and fuzzing account for 228 distinct Core PRs. A few examples of these types of PR from this v32.1 release: Fuzz-testing block and transaction validation. (#35850) Testing that disallowed RPC clients are rejected before their requests are read. (#35866) Fuzz-testing compact-block relay and reconstruction. (#33300) Adding script tests that catch deliberately introduced mistakes in script-rule enforcement. (#36054) These changes address gaps in test coverage and help with software assurance.

Build system work helps keep Bitcoin Core buildable (and reproducible) and usable as the compilers, operating systems and development tools change. Examples in v32.1 include: Preventing a macOS build-tool mismatch from producing a node that builds successfully but crashes when run. (#36218) Detecting missing compiler capabilities before the main build, with clearer guidance when something is missing. (#34580) Simplifying language translation updates and making their changes easier to review. (#34808) Enabling contributors to share local build and test results in a common dashboard. (#35222) These changes help contributors produce working software and make their testing and review work easier for others to inspect.

RT @bitcoinoptech: Adam Gibson, Vincenzo Palazzo (@PalazzoVincenzo), and João Dias (@jaoNoctus) joined Optech to discuss Newsletter #428: News ● Trust-minimized exits from a single-issuer layer 2 (1:32) ● Descriptor syntax for hash preimages (18:03) Changes to services and client software ● Ibis Wallet v5.0-beta released (26:31) ● Landfall wallet for Lightning mining payouts (28:57) ● rbitcoin 0.8.0 released (38:44) Releases and release candidates ● Eclair 0.14.4 (43:18) ● BDK chain 0.23.4 (45:37) ● LND v0.21.5-beta.rc1 (47:09) Notable code and documentation changes ● Eclair #3409 (50:16) ● Eclair #3411 (52:20) ● LDK #5126 (55:03) ● LND #10919 (56:19) ● BTCPay Server #7679 (1:01:06) ● BTCPay Server #7684 (1:02:39) ● BDK #2325 (1:04:18) ● BOLTs #1357 (1:07:13) ● BOLTs #1352 (1:10:03)

RT @bitcoincoreorg: Bitcoin Core v32.1 was released! It is available from: Release notes:

RT @bitschmidty: @BitcoinBombadil @boomer_btc @Rob1Ham @coinjoined @ocean_mining An exploited timewarp attack (which BIP54 mitigates) could result in up to 6 blocks/sec, decades of subsidy mined in weeks, node resource exhaustion, network centralization, timelocks disrupted, funds potentially lost, endless reorgs, etc. This is bad for Bitcoin as money.

RT @Rob1Ham: @coinjoined When someone tells you bitcoin is perfect