Shock! Top Bitcoin Developer Tears into Ripple Over Security Blunder

Ah, the sweet, sweet taste of irony! Peter Todd, that ever-famous Canadian Bitcoin guru (oh yes, the one they say might just be *the* Satoshi Nakamoto), recently had a little rant on social media. It wasn’t about Bitcoin’s greatness, no, no, it was all about *Ripple* and its colossal screw-up. Can you believe it? Ripple’s JavaScript library for the XRP Ledger (XRPL) had a backdoor. A *backdoor* that made it easier for hackers to make off with private keys. A real mess, folks. Todd, of course, didn’t hesitate to remind everyone that he’d warned about something like this almost a decade ago. Told you so, right? 🙄

Now, let’s get to the juicy details. Ripple’s very own CTO, David Schwartz, came out with his own warning about a malicious code in the library. This evil little bug, spotted by Aikido Security (and no, they’re not martial artists, but good at spotting hackers!), sent private keys to a shady domain. Basically, it’s like giving burglars the keys to your house and saying, “Help yourself.” Classic! 💀

But wait, it gets better! Todd didn’t just sit back and relax. Oh no, he had a paper from the past (because why not rub salt in the wound) where he had pointed out how Ripple’s security was at risk. His big beef? Ripple didn’t bother with a cryptographic PGP signature to verify their code. Without that, hackers could sneak in some malicious code. So, surprise, surprise! Ten years later, a nasty attack that Todd had predicted actually took place. The backdoor was real, folks! An NPM compromise? Oh, the sweet smell of ‘I told you so.’

But Schwartz wasn’t entirely in the dark. In February, he admitted Todd was right *at the time*. A little late, don’t you think? But let’s move on. Todd, ever the character, also confessed that his own Python library, python-bitcoinlib, wasn’t PGP signed either. Why, you ask? Well, blame it on PyPi, that wonderful hub of software packages that decided to stop supporting PGP signatures. Todd calls it an “idiotic decision,” but hey, what can you do when the entire software industry is, as he puts it, “incompetent”? A bit harsh? Maybe. But who’s counting?

Read More

2025-04-24 09:07