Re: [Lightning-dev] [bitcoin-dev] Full Disclosure: CVE-2023-40231 / CVE-2023-40232 / CVE-2023-40233 / CVE-2023-40234 "All your mempool are belong to us"

2023-11-17 Thread Antoine Riard
> IIRC correctly, in your scenario, you're dealing with Carol -> Bob -> Alice. > Mallory can only replace an HTLC-timeout transaction if she's directly > connected with the peer she's targeting via a direct channel. She cannot > unilaterally replace any transaction in the mempool solely with

Re: [Lightning-dev] Lightning Address in a Bolt 12 world

2023-11-17 Thread Andy Schroder
The LNURL way still relies on DNS so I'm confused why you'd want to add a webserver into the mix if you don't have to. Adding a webserver is increasing the latency, data transfer, and cost. There there are so many extra round trips required because you have multiple services and aren't doing

Re: [Lightning-dev] Lightning Address in a Bolt 12 world

2023-11-17 Thread Tony Giorgio via Lightning-dev
Bastien, Maybe I'm misunderstanding option 1 or perhaps it's not clear. Are you saying with that option, all it takes is a single DNS entry for "serviceprovider.com" to service unlimited users? The interchanging between "bob" and "domain owner" is a bit confusing in your gist. I think it would

Re: [Lightning-dev] Lightning Address in a Bolt 12 world

2023-11-17 Thread Andy Schroder
#Comments ## General - I agree that option 3 and 1 should be used. However, you say "clients (mobile wallets) would first make a DNS request corresponding to option 3, and if that fails, they would fallback to option 1. Domain owners would implement only one of those two options, depending

Re: [Lightning-dev] Lightning Address in a Bolt 12 world

2023-11-17 Thread Bastien TEINTURIER
Hi Tony, > For completeness, would you be willing to demonstrate what it might > look like if it were bolt12 in the normal LNURL way? Not sure that would provide "completeness", but I guess it would work quite similarly, but instead of putting data in DNS records, that data would be directly on