How Solana Ignores Security Best Practices

#solana #security #opensource

I really thought "I saw it all" within crypto and open-source.

But then, today, Solana managed to surprise me.

I visited the project on github (https://github.com/solana-labs/solana), and tried to get an overview of the ~800 open issues and ~100 open PRs.

Far too much, so I focused on the older issues, narrowed it further down to security issues.

To my surprise, I was... blocked:

https://github.com/solana-labs/solana/issues/30328

Even issues like

Potential privilege escalation in sys-tuner
https://github.com/solana-labs/solana/issues/9141

are left open. The team maybe knows that the issues are non-critical.

But a visitor cannot be sure.

I guess that this is what happens after a team is successful financially: they simply do as it pleases them, joking around when visitors (of their open-source code-base) have concerns.

So disappointing all this.

Still need to find a smart-contract platform where the core-devs have kept some (technological, procedural) sanity, despite their financial success.

Build apps, not infrastructure.

Dealing with servers, hardware, and infrastructure can take up your valuable time. Discover the benefits of Heroku, the PaaS of choice for developers since 2007.

Visit Site