<ap4sh:matrix.org> Yep > <@jpk68:matrix.org> It looks like most of the prominent ones listed above have just been merged.

<ap4sh:matrix.org> What about Monero now? :p

<thomasbuilds:matrix.org> bitcoin:

<thomasbuilds:matrix.org> anthropics/oss-scanner #89#issuecomment-6090085084

<thomasbuilds:matrix.org> > Sorry -- I clicked enroll on this one incorrectly. Reverting momentarily. On both this one and #94 yeah I would like to get a core maintainer to make a final decision here. We hope that these reports will be useful but don't want to send reports unless they're definitely wanted.

<thomasbuilds:matrix.org> I think bitcoin is less controversial than monero to merge for them

<thomasbuilds:matrix.org> let's ease the process for them, to stack chances on our side...

<ofrnxmr> @thomasbuilds:matrix.org: I think the comment here is about their AI policy

<ofrnxmr> bitcoin's ai policy implies that they dont want such reports

<thomasbuilds:matrix.org> Isn't it because of anthropics/oss-scanner #89#pullrequestreview-5470108834

<ap4sh:matrix.org> Yeah but it's also about the 90-day disclosure period

<ofrnxmr> Or not

<ofrnxmr> looks like its this

<ofrnxmr> > Bitcoin Core has no auto-updates, so fixes only reach users as node operators upgrade, and our policy discloses medium/high severity issues after the last affected release goes EOL - at least that's what we did until now.[... more lines follow, see mrelay.p2pool.observer/e/8efa_LILcHVBaFA0 ]

<ofrnxmr> (or not, was in response to myself)

<thomasbuilds:matrix.org> Yeah anyways I would settle any objection before the PR is opened. Like I think we should add security.txt, which makes it extra clear for anthropic, the PR should be opened by tobhtot IMO, because he merges PRs and they can see he is core maintainer easily.

<ofrnxmr> It should be opened by luigi1111

<ofrnxmr> Or better, binaryfate

<ofrnxmr> Since they are core team, and sign releases

<jpk68:matrix.org> At least tob is online more than like, once a year

<syntheticbird> selsta or luigi, take it or leave it

<sgp_> red.anthropic.com/oss-scanner/#disclosure-policy

<sgp_> > We will not place any form of 90-day coordinated disclosure period on these unvalidated findings. Because it is possible these findings may contain false positives, we do not feel comfortable forcing maintainers to carefully read each finding if we have not yet done the same.

<sgp_> > If we later validate one of these reports manually through our existing CVD program, we may disclose it under our CVD policy starting 90 days from when you are notified that a human has validated this report. As we gain greater confidence in OSS Scanner’s performance, we may in the future impose a disclosure period on some [... too long, see mrelay.p2pool.observer/e/jc-j_bILdW83TEtF ]

<ofrnxmr> @jpk68:matrix.org: Luigi is online everyday, despite popular belief

<ofrnxmr> he just doesnt like you /s

<syntheticbird> access to the cold wallet is another story tho

<ofrnxmr> .. in any case, both luigi and bf are active enough (quite literally have never been away for more than a week) to submit this, and the only ones in a position of "authority"

<jpk68:matrix.org> Was exaggerating, but yes

Once a year, but each time being 51 weeks at a time.

I'm online? 😜

They were talking about luigi1111w.

I'm reading fwiw

catching up rather

<syntheticbird> catching up imply reading so you are good

it does; just meaning I'm reading the recent convo as we speak

<syntheticbird> 👍️.

<jpk68:matrix.org> github.com/jpk68/oss-scanner/tree/enroll-monero

<jpk68:matrix.org> I slopped an example, obviously not going to submit it myself

Ok at first glance: I'm fine to KYC myself to them if that helps the project. I'm not quite anonymous anyway. I probably have the right authority to PR and enroll given my core team role + binaries signing for 7 years now. HOWEVER while I do have informal discussions with others, in the name of avoiding centralization I am not personally part of the hackerone/security informal group. So things like receiving fresh zero day issues, in

theory should not go to me.

<jpk68:matrix.org> Email addresses are taken from the oss-fuzz project file

Now of course in the context of this we can setup a new alias/ contact group whatever. I'm just saying this is the current setup atm

I'm the official contact for google oss-fuzz I think

doesn't seem to be related to oss-fuzz and we can specify whichever email addresses we want to get results it seems. Probably we want them PGP encrypted

<syntheticbird> Another day Another prayer for Post quantum PGP standard to get out of draft phase

<ap4sh:matrix.org> @syntheticbird: So much

<sgp_> if you prefer to assign MAGIC Grants, we would probably be willing to get the reports. @ack-j:matrix.org in particular has been doing a lot of bug reporting recently

<sgp_> just so long as monero is signed up somehow

<sgp_> Best case would be the main dev email though imo

main dev email is fine but PGP encryption of results is a must

<ack-j:matrix.org> I dont want to receive reports but magic can submit the pr on behalf of monero and fill out the CLA so devs dont have to and then core devs can ACK in comments. I think selsta, vtnerd, jeffro, and jberman would be the best choices if willing

<jpk68:matrix.org> I know this is a total long-shot, but in the off-chance that people are fine with me helping in that regard, I'd be fine with being added

<jpk68:matrix.org> Same for anything related to VRP; I have helped selsta triage a few minor issues already

<syntheticbird> since we are at it I'm also proposing my dog Ciro. He already has experience with the VRP and im sure he is ready to KYC for the greater good.

<ap4sh:matrix.org> Same here! Happy to help with triage or anything else if needed :)

<thomasbuilds:matrix.org> > <binaryFate> Ok at first glance: I'm fine to KYC myself to them if that helps the project. I'm not quite anonymous anyway. I probably have the right authority to PR and enroll given my core team role + binaries signing for 7 years now. HOWEVER while I do have informal discussions with others, in the name of avoiding centrali [... too long, see mrelay.p2pool.observer/e/-ZL_grMLQXBRN21I ]

<thomasbuilds:matrix.org> I don't think u need to kyc

<thomasbuilds:matrix.org> binaryFate: seems supported in pgp: field