ccs wallet incident blog post up for review monero-project/monero-site #2208

<e​rc:cryptoriot.org> let's wait for an input from core

I think it makes sense to publish as is. We had already spent some time finding info and discussing that post.

<e​rc:cryptoriot.org> plowsof are you around to fix those two minor issue in the pr?

<e​rc:cryptoriot.org> after that's done we can merge and deploy straight away. This should be out as soon as possible

<e​rc:cryptoriot.org> especially because media will be on this soon if they are not already

<e​rc:cryptoriot.org> if plowsof is not around i would just merge and deploy.

hi

checking

<e​rc:cryptoriot.org> plowsof. I see the edits, only needs to be squashed and then it's ready imo

<p​lowsof:matrix.org> should be ready for squashing now ErC

<p​lowsof:matrix.org> ok thanks! apologies, i was asleep

<e​rc:cryptoriot.org> no worries no problem

<p​lowsof:matrix.org> squashed x

<e​rc:cryptoriot.org> I'm having a moment where i'm not completely sure we should post that message as a blog post. It assumes people already know terminology like ccs and mentions fluffypony's arrest, which could be confusing and give a wrong impression. Maybe would be better to write a shorter blog post with an explanation in simpler words of what happened and clarify that this doesn't imply a proble<clipped message>

<e​rc:cryptoriot.org> m in Monero itself?

<e​rc:cryptoriot.org> it's just a thought i'm having right now and i would be fine to go with the post as it is. But this is a very sensitive matter and we should definitely be sure we are as clear as possible without possibility of misunderstanding and confusion

yeah I know, I thought the same

<e​rc:cryptoriot.org> we would link to the github issue from the blog post, but i'm not sure about posting that entire text

maybe it's better to write something and say there was an incident, and here's the GitHub issue

that details it

<e​rc:cryptoriot.org> yeah

somethin happened, everything is fine, we're actively working on a solution , heres the details kinda things?

<e​rc:cryptoriot.org> yeah a clear simple communication from core that points to the github issue for details.

i've pushed the shorter version

i have added "The General Fund (which remains intact) will be used to cover this loss. Contributors with [in-progress](ccs.getmonero.org/work-in-progress) CCS proposals will remain uneffected. "

this statement needs to be confirmed and or edited by core

<p​lowsof:matrix.org> preview 127.0.0.1:4000/2023/11/03/ccs-wallet-incident.html

<p​lowsof:matrix.org> lol localhost deploy-preview-2208--barolo-time-75….app/2023/11/03/ccs-wallet-incident

<e​rc:cryptoriot.org> Fluffypony are you working on a statement from core?

<e​rc:cryptoriot.org> If not we can come up with something like plowsof suggested (but in that case i would suggest some changes)

<p​lowsof:matrix.org> my only requirement is for the clarification on work in progress proposals being unaffected, very important

oh apologies - I've not been working on anything, other than just bouncing the idea around here

<e​rc:cryptoriot.org> what about:

<e​rc:cryptoriot.org> Today, during a routine transfer, we noticed the '[Community Crowdfunding System](ccs.getmonero.org)' (CCS) main Wallet was drained of 2,675.73 XMR (the entire balance) on September 1, 2023. The hot wallet, used for payments to contributors, is untouched; its balance is ~244 XMR. We have thus far not been able to ascertain the source of the breach. An internal investigati<clipped message>

<e​rc:cryptoriot.org> on is ongoing and further details will be released once we have them.

<e​rc:cryptoriot.org> The General Fund (which remains intact) will be used to cover this loss. Contributors with [in-progress](ccs.getmonero.org/work-in-progress) CCS proposals will remain unaffected.

<e​rc:cryptoriot.org> Further details and discussion can be found on this [issue on GitHub](monero-project/meta #916).

<e​rc:cryptoriot.org> plowsof ^ added a couple of details and changed a couple of lines

thanks

<e​rc:cryptoriot.org> it's just a suggestion tho

<e​rc:cryptoriot.org> don't know what core thinks about it

<e​rc:cryptoriot.org> fluffypony?

<p​lowsof:matrix.org> "today we noticed" would have been 28th september

<p​lowsof:matrix.org> otherwise seems perfect

<e​rc:cryptoriot.org> ah ok let's drop it then

looks good to me, thanks for doing this!

<p​lowsof:matrix.org> final review ErC

<e​rc:cryptoriot.org> i would leave the link to the css website plowsof. So people know what we are talkingabout

<e​rc:cryptoriot.org> beside that i'd just squash and get it merged

<p​lowsof:matrix.org> yep (link was dropped during copying, will add)

<e​rc:cryptoriot.org> looks good

<e​rc:cryptoriot.org> binaryfate blog post ready to be merged and deployed: monero-project/monero-site #2208