<thomasbuilds:matrix.org> roughly 40M opus 5.5 tokens consumed in a 10h session on my laptop, final review is here jeffro256/carrot #16 > <@thomasbuilds:matrix.org> if this is needed I'm willing to propose a fix with claude

<thomasbuilds:matrix.org> now I need sleep lool 🫩

<syntheticbird> we should consider letting people donate their claude subscription as donation to the monero project

<thomasbuilds:matrix.org> lol monero donations is fine tbh

<ack-j:matrix.org> I missed last meeting, was there a vote on incorporation into oss-scanner?

<jpk68:matrix.org> There was not a vote, no, but I don't think any maintainers object to this

yes, we should look into adding this before the new models come out

btcpayserver was merged 20hrs ago anthropics/oss-scanner #944

<jpk68:matrix.org> My bad for bringing this up for the umpteenth time, but I really think this is critical to get done soon

<jpk68:matrix.org> Especially given all of the general security issues discovered in the past few days (not specific to Monero)

I have read the CLA Document and I hereby sign the CLA

<jpk68:matrix.org> Bitcoin Core also re-enrolled yesterday

<rucknium> I didn't see any objections last week except for possibly contributing to a collective action problem that the Monero Project isn't in a position to solve.

<321bob321> i assume people want monero to sign up to the scanner. So when they run a llm it would be cheaper cause the thinking has already been done?

<syntheticbird> to the scanner monero goes

<ack-j:matrix.org> If there is loose consensus, binaryFate could you please open the pull request?

<jpk68:matrix.org> Myself and a few others are currently working on writing the files for this

<jpk68:matrix.org> AFAIK, plowsof will open the patch in a bit

<ack-j:matrix.org> This may help with the attack surface file. github.com/xmrack/monero-review/tree/main/.claude/references/monero

<syntheticbird> epic shit why didn't you share it earlier

<syntheticbird> thats great

ideally we'd have a dockerfile for them on our repo so any updates dont have to be pushed upstream

<jpk68:matrix.org> I don't really have a preference for this, however, adding that to the main repo might make it take longer to be accepted

<jpk68:matrix.org> ...due to the fact that the file won't be there until the PR is merged into monero-project/monero

<ack-j:matrix.org> I would prefer we do the bare minimum now to get it merged. We can always add a docker image or threat model file later down the road

<jpk68:matrix.org> Here is what I've written so far:

<jpk68:matrix.org> github.com/jpk68/oss-scanner/commits/enroll-monero

<jpk68:matrix.org> Any feedback on this would be appreciated

<syntheticbird> jpk68/oss-scanner f721d10#diff-98bab7236fcb9d1a7f32e194a5bb8fc345f18295e1d56de6aa49d5eb9f09b1bdR5-R6

<syntheticbird> no offense of course and there is no wrong answer and all, but is this email actually being looked at ?

<syntheticbird> wrong lines

<syntheticbird> I mean luigi and binaryfate emails

<jpk68:matrix.org> I removed mooo's email already; the rest are just copied from oss-fuzz with selsta added

<syntheticbird> binaryfate I don't know about it but from my observation over the years I find it pretty establish that luigi's mail is not being looked at, or at least the inbox is so bad things are missed.

luigi looks at his gmail, the getmonero one is not looked at

<syntheticbird> oh alright, I thought VRP's one was gmail

<torir:unredacted.org> The threat model notes that the unrestricted RPC may be vulnerable to attacks from browser pages but doesn't specify if those are considered out of scope or not.

<syntheticbird> jpk68/oss-scanner f721d10#diff-be11605f6f85f10cfecfdefbb0e32958e83518d5b2eff01d1045f16d80d1ac93R190-R205

<syntheticbird> I'm not sure this is consistent with hackerone history

<jpk68:matrix.org> Okay, if you have a suggested change, please mention it

<syntheticbird> @torir:unredacted.org: yeah this section seems out of scope to me

<jpk68:matrix.org> Updated the branch; please see latest changes

<jpk68:matrix.org> Looks like it's good to submit now, and other changes can be suggested in review comments

<321bob321> we get double AI with adding gmail account > <@syntheticbird> I mean luigi and binaryfate emails

<syntheticbird> "dear luigi, I just tested this inflation bug you received per mail. The sender is probably a scammer, the bug only work on mainnet, stagenet remains unaffected. Powered by Gemini AI."

<jpk68:matrix.org> anthropics/oss-scanner #1092

<syntheticbird> Enrol ?

<syntheticbird> TIL Enrol is spelled Enrol and not enroll

<jpk68:matrix.org> It can be spelled either way

<jpk68:matrix.org> Looks like the Bitcoin Core PR was just closed again? Not sure why