It is hard to believe that such a critical bug could happen. What is the post-mortem and learning from this incident?

David asks for a comment on the recent vulnerability CVE-2018-17144. David says, "It is hard to believe that such a critical bug could happen." "What is the post-mortem and learning from this incident?" I haven't studied this in great detail, so at the moment I can only give you a very brief overview. The bottom line is, a bug was discovered in Bitcoin Core and copied by other Bitcoin forks. A lot of the other forks, and even other coins, use much of the same codebase. This is a transaction validation bug that affects the consensus rules. It would have allowed miners who exploited this bug to create a transaction that isn't properly validated, and effectively has an extra input, if I'm not mistaken.

Not only that it happened, but that it went unnoticed

The worst case scenario is, they could create an amount of bitcoin from nothing. It hasn't been exploited; the bug was fixed before it was exploited. It could have been used to create a denial-of-service attack against Bitcoin by causing nodes to crash. "It is hard to believe that such a critical bug could happen." Well, on the one hand... Yes, it is hard to believe that a critical bug could happen because of all the code review that is done. There are so many people running it, etc. Not only that it happened, but that it went unnoticed... for almost two years, affecting a broad range of versions of Bitcoin Core and other [fork-coins]. I believe [it affected versions] 0.14.x to 0.16.x. Fortunately, it was discovered and responsibly disclosed to the developers in an encrypted message, so that it wouldn't be exploited until it was fixed, and it was fixed.

You need to upgrade to 0.16.3, which contains that fix

For that reason, if you are running a Bitcoin node, you need to upgrade to 0.16.3, which contains that fix. I upgraded my node the day that the notification came out, that there was a critical vulnerability. Many of the nodes have upgraded; some have not yet. Those are still vulnerable to being remotely shutdown, [to being] crashed through a malformed transaction. Fortunately, none of the worst problems of this vulnerability have been exploited.

The software that runs cryptocurrencies is enormously complex, especially consensus-level code

The software that runs cryptocurrencies is enormously complex, especially consensus-level code. Consensus-level code, where everyone must run the same rules across a distributed system, is the hardest form of software development that exists today. It is one of the hardest, probably close to aerospace engineering, in terms of the fact that... every tiny change in the code could have far-reaching effects. In this case, it was from an optimization to improve the processing time for blocks. This optimization had an unfortunate side effect, which was an error in the implementation.

We will continue to see bugs. All software has bugs

We will continue to see bugs. All software has bugs. There is no such thing as bug-free software. The important thing is to look at is, how serious are the bugs (this one was serious), how quickly are they fixed, whether they are exploited before they're fixed; if they are, what the long-term consequences are, and whether they have a lasting impact. Arguably, once again, we see that the network is very resilient. [The Bitcoin] blockchain is much more resilient than we thought. Because of the dynamic nature of the system, with a lot of independent operators running nodes... and developers reviewing code, bugs are found and bugs are fixed. [Response] systems are [deployed] when things go wrong, and the system continues to run. [This bug] didn't kill Bitcoin, it made Bitcoin stronger, which is one of the aspects of Bitcoin which... continues to surprise me, in how resilient it is.