12:02:18 Yep > <@jpk68:matrix.org> It looks like most of the prominent ones listed above have just been merged. 12:02:18 What about Monero now? :p 13:37:51 bitcoin: 13:37:51 https://github.com/anthropics/oss-scanner/pull/89#issuecomment-6090085084 13:37:51 > Sorry -- I clicked enroll on this one incorrectly. Reverting momentarily. On both this one and #94 yeah I would like to get a core maintainer to make a final decision here. We hope that these reports will be useful but don't want to send reports unless they're definitely wanted. 13:39:51 I think bitcoin is less controversial than monero to merge for them 13:40:25 let's ease the process for them, to stack chances on our side... 13:52:10 @thomasbuilds:matrix.org: I think the comment here is about their AI policy 13:52:38 bitcoin's ai policy implies that they dont want such reports 13:53:28 Isn't it because of https://github.com/anthropics/oss-scanner/pull/89#pullrequestreview-5470108834 13:53:28 Yeah but it's also about the 90-day disclosure period 13:53:50 Or not 13:53:50 looks like its this 13:53:50 > Bitcoin Core has no auto-updates, so fixes only reach users as node operators upgrade, and our policy discloses medium/high severity issues after the last affected release goes EOL - at least that's what we did until now.[... more lines follow, see https://mrelay.p2pool.observer/e/8efa_LILcHVBaFA0 ] 13:54:58 (or not, was in response to myself) 13:56:14 Yeah anyways I would settle any objection before the PR is opened. Like I think we should add security.txt, which makes it extra clear for anthropic, the PR should be opened by tobhtot IMO, because he merges PRs and they can see he is core maintainer easily. 14:00:50 It should be opened by luigi1111 14:00:57 Or better, binaryfate 14:01:23 Since they are core team, and sign releases 14:07:50 At least tob is online more than like, once a year 14:12:22 selsta or luigi, take it or leave it 14:13:43 https://red.anthropic.com/oss-scanner/#disclosure-policy 14:13:43 > We will not place any form of 90-day coordinated disclosure period on these unvalidated findings. Because it is possible these findings may contain false positives, we do not feel comfortable forcing maintainers to carefully read each finding if we have not yet done the same. 14:13:43 > If we later validate one of these reports manually through our existing CVD program, we may disclose it under our CVD policy starting 90 days from when you are notified that a human has validated this report. As we gain greater confidence in OSS Scanner’s performance, we may in the future impose a disclosure period on some [... too long, see https://mrelay.p2pool.observer/e/jc-j_bILdW83TEtF ] 14:21:34 @jpk68:matrix.org: Luigi is online everyday, despite popular belief 14:22:07 he just doesnt like you /s 14:25:02 access to the cold wallet is another story tho 14:25:05 .. in any case, both luigi and bf are active enough (quite literally have never been away for more than a week) to submit this, and the only ones in a position of "authority" 14:30:37 Was exaggerating, but yes 14:48:52 Once a year, but each time being 51 weeks at a time. 14:51:27 I'm online? 😜 14:52:36 They were talking about luigi1111w. 15:22:22 I'm reading fwiw 15:24:34 catching up rather 15:24:50 catching up imply reading so you are good 15:25:59 it does; just meaning I'm reading the recent convo as we speak 15:27:03 👍️. 15:36:42 https://github.com/jpk68/oss-scanner/tree/enroll-monero 15:36:57 I slopped an example, obviously not going to submit it myself 15:37:07 Ok at first glance: I'm fine to KYC myself to them if that helps the project. I'm not quite anonymous anyway. I probably have the right authority to PR and enroll given my core team role + binaries signing for 7 years now. HOWEVER while I do have informal discussions with others, in the name of avoiding centralization I am not personally part of the hackerone/security informal group. So things like receiving fresh zero day issues, in 15:37:09 theory should not go to me. 15:38:06 Email addresses are taken from the oss-fuzz project file 15:38:15 Now of course in the context of this we can setup a new alias/ contact group whatever. I'm just saying this is the current setup atm 15:38:51 I'm the official contact for google oss-fuzz I think 15:44:31 doesn't seem to be related to oss-fuzz and we can specify whichever email addresses we want to get results it seems. Probably we want them PGP encrypted 15:47:41 Another day Another prayer for Post quantum PGP standard to get out of draft phase 15:47:53 @syntheticbird: So much 15:50:46 if you prefer to assign MAGIC Grants, we would probably be willing to get the reports. @ack-j:matrix.org in particular has been doing a lot of bug reporting recently 15:51:08 just so long as monero is signed up somehow 16:00:16 Best case would be the main dev email though imo 16:01:31 main dev email is fine but PGP encryption of results is a must 16:03:59

I dont want to receive reports but magic can submit the pr on behalf of monero and fill out the CLA so devs dont have to and then core devs can ACK in comments. I think selsta, vtnerd, jeffro, and jberman would be the best choices if willing 16:39:28 I know this is a total long-shot, but in the off-chance that people are fine with me helping in that regard, I'd be fine with being added 16:40:09 Same for anything related to VRP; I have helped selsta triage a few minor issues already 16:41:52 since we are at it I'm also proposing my dog Ciro. He already has experience with the VRP and im sure he is ready to KYC for the greater good. 16:43:28 Same here! Happy to help with triage or anything else if needed :) 17:33:30 > Ok at first glance: I'm fine to KYC myself to them if that helps the project. I'm not quite anonymous anyway. I probably have the right authority to PR and enroll given my core team role + binaries signing for 7 years now. HOWEVER while I do have informal discussions with others, in the name of avoiding centrali [... too long, see https://mrelay.p2pool.observer/e/-ZL_grMLQXBRN21I ] 17:33:30 I don't think u need to kyc 17:37:43 binaryFate: seems supported in pgp: field