Public Nodes Firewall rules

[AAH20]

The Monero.fail lists and the public_nodes command of the cli wallet , generates an ultimate attack surface for adversaries with a bunch of vulnerable machines with a lot of open ports from different ISPs ,how was the monero community handling this in the past years ? , and where is the roadmap ? , its very hard for open source communities to maintain a long term roadmap or plan unless they are backed with whales , i think that was the case when RandomX was Launched , finally why is the security policy section of the github is neglected even in the most active projects out there ?

[cirocosta]

finally why is the security policy section of the github is neglected even in the most active projects out there ?

https://github.com/monero-project/meta/blob/master/VULNERABILITY_RESPONSE_PROCESS.md (which, btw, is right there in the README of this repository)

yes, might be worth pointing to that entry from .github/SECURITY.md, although I'd say it makes more sense to do so from a .github repository so it applies to all of them (see Creating a repository for default files)

[AAH20]

then @moneromooo and @luigi1111 are needed here , there are only few hackativity reports on hackerone and the ones less than 1 year ago aren't accessible , why #7830 isn't submitted to hackerone i think that is as critical issue as this one https://hackerone.com/reports/501585

[UkoeHB]

why #7830 isn't submitted to hackerone

1. The issue is publicly known already.
2. It takes a lot of work and expertise to make a PoC exploit.
3. A hackerone report isn't going to get it solved faster.

[erciccione]

why #7830 isn't submitted to hackerone i think that is as critical issue

We asked to the core team how to proceed. After looking into it they were ok with opening a public issue. See @UkoeHB's comment for the reasons.

[selsta]

how was the monero community handling this in the past years ?

This wasn't a problem in the last years. If someone has a vulnerable machine there isn't much we can do. monerod isn't a firewall. Closing this as the other questions were also answered.