News for hackers. Stuff that matters.
Re:Compromised PyTorch-nightly dependency chain December 30t... by ameliaquining on Saturday December 31, 2022 @11:00PM (#34203454)
There's no technical fix for compensating verifiers; it has to be negotiated out of band. This is different from Bitcoin because the Bitcoin protocol is unambiguous, so any well-behaved node that follows it can trust that all other well-behaved nodes will accept its output as valid. By contrast, security review is inherently subjective and reasonable people will disagree, necessitating judgment calls on who to trust.
Re:Compromised PyTorch-nightly dependency chain December 30t... by jakear on Saturday December 31, 2022 @11:49PM (#34203698)
Engineer the act of querying a trusted party to be a paid operation and the problem is solved. It doesn’t really matter if the verification is subjective, you pay 5 people you trust, only accept it if 4 say it’s good, and stop paying the 5th if they consistently disagree and/or vouch for disagreeable content.