Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Timestamp proofs are interesting but a little hard to find a solid use for in that context. Most people are very happy trusting a post on a mailing list, or even the standard at this point for security researchers is a hash of your disclosure on twitter or IRC. It almost never needs to be cryptographic proof, only social.

They also have a significant issue in that they are non-exclusive. Imagine I timestamp the following messages.

    for i in {1..999999}:
     print "on the 21st of Feb 2022 the Bitcoin price will be exactly $i"
By revealing only a single proof of the possible million, I can prove once and for all that I have complete foresight, and you can't ever prove that I didn't make that prediction. Lots of these things have not entirely obvious issues like that. posting a million hashes on Twitter might raise some eyebrows, posting a million lines on IRC will get me K-lined. I have actually timestamped all of those messages though.


It's not foolproof of course, and it might be overkill for many, but consider this example:

You've found one of the most catastrophic bugs in Bitcoin ever, and you know that the developers are extremely skeptical of anything. The community is also divided and full of toxic people who will try to discredit anything you do.

Now, will you be satisfied with just posting a hash on IRC or on the mailing list? Are you sure people won't distrust you from posting on "the wrong IRC channel"?

I would assume you'll want as solid a proof as you can construct. Therefore you'll timestamp your message on the blockchain in addition to posting on social media somewhere.

And exactly this is what awemany did when he discovered CVE-2018–17144, one of the most catastrophic bugs in Bitcoin ever:

https://medium.com/@awemany/600-microseconds-b70f87b0b2a6




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: