5

On 17 August 2016 0.13.0 Cobra was able to bypass peer review and issue a Binary Safety Warning on Bitcoin.org.

The contributor who uploaded the alert, “Cobra-Bitcoin,” is understood to be in control of Bitcoin.org, Core developer Peter Todd told me in an encrypted message, and so they were able to bypass the peer review process for posts to the site.

How many people currently have a similar level of permission to update getmonero.org without any peer review? For pull requests to update the website from those without any special permissions, how much peer review is conducted before they are merged?

Improve this question

1 Answer 1

Reset to default
6

I believe that fluffyponyza controls getmonero.org and ultimately has the power to update the website on his own or by merging pull requests of others. This does not seem like the type of thing that could be easily and safely delegated.

There is a formal procedure for developer contributions to Monero addressed in this question. However the procedure is likely much less formal for the website. My guess is that most relatively "harmless" pull requests such as merchant or moneropedia updates receive an eyeball review and critical updates such as links to new binaries or security alerts similar to the "Cobra" update to Bitcoin.org are carefully reviewed by fluffyponyza.

Improve this answer
2
  • 1
    Pretty much this. It's not the sort of thing that could be delegated, but the Core Team and individual contributors ALWAYS double-check the SHA256 sums once new downloads are live, in case I become malicious.
    – fluffyponyza
    Commented Aug 25, 2016 at 16:01
  • 2
    @fluffyponyza "in case I become malicious." I wish more developers thought like that.
    – Christopher King
    Commented Aug 26, 2016 at 1:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.