19:02:54 roughly 40M opus 5.5 tokens consumed in a 10h session on my laptop, final review is here https://github.com/jeffro256/carrot/pull/16 > <@thomasbuilds:matrix.org> if this is needed I'm willing to propose a fix with claude 19:03:56 now I need sleep lool 🫩 19:05:01 we should consider letting people donate their claude subscription as donation to the monero project 19:06:01 lol monero donations is fine tbh 19:57:13

I missed last meeting, was there a vote on incorporation into oss-scanner? 20:03:57 There was not a vote, no, but I don't think any maintainers object to this 20:05:53 yes, we should look into adding this before the new models come out 20:06:55 btcpayserver was merged 20hrs ago https://github.com/anthropics/oss-scanner/pull/944 20:08:14 My bad for bringing this up for the umpteenth time, but I really think this is critical to get done soon 20:08:36 Especially given all of the general security issues discovered in the past few days (not specific to Monero) 20:09:01 I have read the CLA Document and I hereby sign the CLA 20:10:28 Bitcoin Core also re-enrolled yesterday 20:16:04 I didn't see any objections last week except for possibly contributing to a collective action problem that the Monero Project isn't in a position to solve. 20:38:57 <321bob321> i assume people want monero to sign up to the scanner. So when they run a llm it would be cheaper cause the thinking has already been done? 20:42:09 to the scanner monero goes 21:14:38

If there is loose consensus, binaryFate could you please open the pull request? 21:15:19 Myself and a few others are currently working on writing the files for this 21:15:26 AFAIK, plowsof will open the patch in a bit 21:19:16

This may help with the attack surface file. https://github.com/xmrack/monero-review/tree/main/.claude/references/monero 21:20:44 epic shit why didn't you share it earlier 21:20:53 thats great 21:22:20 ideally we'd have a dockerfile for them on our repo so any updates dont have to be pushed upstream 21:24:10 I don't really have a preference for this, however, adding that to the main repo might make it take longer to be accepted 21:24:23 ...due to the fact that the file won't be there until the PR is merged into monero-project/monero 21:26:15

I would prefer we do the bare minimum now to get it merged. We can always add a docker image or threat model file later down the road 21:27:04 Here is what I've written so far: 21:27:04 https://github.com/jpk68/oss-scanner/commits/enroll-monero/ 21:27:14 Any feedback on this would be appreciated 21:29:15 https://github.com/jpk68/oss-scanner/commit/f721d1018055a237b5b179204f834d6d66a0ea42#diff-98bab7236fcb9d1a7f32e194a5bb8fc345f18295e1d56de6aa49d5eb9f09b1bdR5-R6 21:29:15 no offense of course and there is no wrong answer and all, but is this email actually being looked at ? 21:29:36 wrong lines 21:29:43 I mean luigi and binaryfate emails 21:30:16 I removed mooo's email already; the rest are just copied from oss-fuzz with selsta added 21:31:10 binaryfate I don't know about it but from my observation over the years I find it pretty establish that luigi's mail is not being looked at, or at least the inbox is so bad things are missed. 21:31:59 luigi looks at his gmail, the getmonero one is not looked at 21:32:44 oh alright, I thought VRP's one was gmail 21:35:33 The threat model notes that the unrestricted RPC may be vulnerable to attacks from browser pages but doesn't specify if those are considered out of scope or not. 21:35:51 https://github.com/jpk68/oss-scanner/commit/f721d1018055a237b5b179204f834d6d66a0ea42#diff-be11605f6f85f10cfecfdefbb0e32958e83518d5b2eff01d1045f16d80d1ac93R190-R205 21:36:01 I'm not sure this is consistent with hackerone history 21:37:05 Okay, if you have a suggested change, please mention it 21:37:10 @torir:unredacted.org: yeah this section seems out of scope to me 21:41:15 Updated the branch; please see latest changes 22:04:05 Looks like it's good to submit now, and other changes can be suggested in review comments 22:16:24 <321bob321> we get double AI with adding gmail account > <@syntheticbird> I mean luigi and binaryfate emails 22:23:10 "dear luigi, I just tested this inflation bug you received per mail. The sender is probably a scammer, the bug only work on mainnet, stagenet remains unaffected. Powered by Gemini AI." 22:49:00 https://github.com/anthropics/oss-scanner/pull/1092 22:50:21 Enrol ? 22:51:18 TIL Enrol is spelled Enrol and not enroll 22:52:45 It can be spelled either way 22:59:55 Looks like the Bitcoin Core PR was just closed again? Not sure why