How can moderation policy expose an attack vector?

[pinheadmz]

I'm having trouble understanding the concept of a moderation policy being used to attack a software project.

1. Alice opens a PR
2. Bob adds a comment about Alice, not about the code changes
3. Moderator bans Bob for 24 hours
4. ???

These are recent comments on the subject I hope will foster discussion so that we can mitigate such attacks.

---

Copied from bitcoin/bitcoin#29507:

@kanzure

Bitcoin is for enemies. It is important to recognize that CoCs and similar policy or governance are effectively just instructions for your adversaries on how to defeat a project.

Copied from #1:

@midnightmagic

I strongly recommend you abandon these efforts. They won't serve you. Kanzure is right—they will only serve as a roadmap for attackers whose actual bad intentions are well-funded and fuelled by a small army of people who have the willingness to maintain a literal active daily attack effort for literally more than a decade.

@ariard

This is certainly very correct that those moderation rules could be exploited by active sabotage from well-funded criminal organizations.

[laanwj]

i think i understand @midnightmagic's point, formalizing moderation policy too much can make it harder to effectively moderate because the attacker can rule-lawyer, and walk the thin line, appealing to people's reasonableness, etc. It can also be used against contributors if they say, violate the letter but not the intent of the policy. But it's mostly a "waste time" and "create drama" kind of attack, and if the moderators aren't the maintainers then it's somewhat mitigated. But all in all, people can become extremely dogmatic about rules (at the expense of everything else) so it's something to watch out for.

i don't understand the argument that it would open the project to legal attacks, as long as it's clear the the moderation policy is not a legally binding document for anyone.

[ariard]

This is certainly very correct that those moderation rules could be exploited by active sabotage from well-funded criminal > organizations.

Very simple. A criminal organization threats a moderator’s romantic partner to coerce this moderator in taking arbitrary bans decisions and use that as coverage to insert backdoors, or whatever. Sadly, we’ve seen crazy things like that during the blocksize war.

I’ve been on the shooting range with few bitcoin core maintainers in the past. They know how to shoot.

[laanwj]

Very simple. A criminal organization threats a moderator’s romantic partner to coerce this moderator in taking arbitrary bans decisions and use that as coverage to insert backdoors, or whatever. Sadly, we’ve seen crazy things like that during the blocksize war.

No no no, this is an example where formalization and transparency of moderation policy actually helps. Project owners can already do anything. The aim of this whole thing is to reduce arbitrariness.

The question here is how rules can be used as an attack. Everyone understands how abuse of moderation can be used as an attack.

[ariard]

I got your point when you're saying it's about the rules. Yet I believe this is not reasoning like a hypothetical adversary, where one will not only consider the rules as attack surface, though also the margin of subjective interpretation allowed by the moderators and the moderators personalities as vectors of exploitation.

So under that considerations (and not saying more on physical attacks in the style of Jameson Lopp's 2017 SWAT), I can think more of three categories of attacks exploiting those moderation rules.

1. "Exploiting Ideological Divergences" Attacks.

We have all philosophical / economical / political environmental opinions, nothing wrong in itself it's human nature and I think cultural diveristy is good. Yet this can become an attack vector for both "micro-issues" / "macro-issues".

"Micro-issues" E.g contributor Xen opens a PR using specialized technical terms, this in turn can be alleged as "offensive terms” by contributor Zoe (with a track records of minor changes in the codebase) and Zoe goes to argue she / his is coming from an under-represented sub-community in bitcoin development and say it was a deliberate offending action from Xen. Zoe argues that Xen should be ban.

Note here on how this line of reasoning has been used in the past to justify changes e.g in #19227: "Simply the possibility that one developer may directly or indirectly be offended/discriminated by code comments or symbol names is a risk that we can't afford to take”.

There is no indication on the "we" making an economic engineering judgement in such situation here. The maintainers, the moderators or any one with at least one merged commit on the latest decade, I don't know. And this is even hard to refer to a given historical tradition as a tie-breaker, as we have peoples coming from a diversity of continents and religions.

"Macro-issues": A major media starts to say bitcoin core software projects shall be changed to make it more compatible with the environment, the local economoy of horse-driven carriers makers or whatever other exogeneous motivation. E.g "Greenpeace"'s
Change The Code initiative.

E.g. Exogeneous Motivation starts to become a proeeminent subject in the political election cycle in in one of the jurisdiction of let's say moderator Yann. Moderator Yann receives a constant inbound flow of media requests asking him about Exogeneous Motivation and Bitcoin, and "what do you do about it ?".

At the same time, a contributor Zoe ingenuinely statrs to open a pull request with said technical changes to align Bitcoin with
Exogeneous Motivation. Moderator Yann might starts to be inclined in moderation comments in a way that favors the advances of
Exogenous Motivation in the codebase.

2. "Side-Channel and Hot Topics”.

Let's say a consensus changes X starts to become a "Hot Topic" in bitcoin technical circles. Consensus changes is officially endorsed by an open-source funding organization O, or even supported by one of its lead developer as consensus changes is related to technical proposal Y, for which they have raised $$$ VC-money in the past.

Moderator Yann is under open-source grant agreement from organization O. At the time of his periodic grant renewal, during a friendly call, organization O informs Moderator Yann that the organization O might have not available funding to renew his grant (sadly!), that by the way they are very interested in consensus changes X and "what do you think about consensus changes X ?” though let’s schedule a new call 2 weeks from now, they might have more source of fundings by then.

Starting from then, moderator Yann can be economically incentivized to adopt a friendly moderation policy towards supporters of consensus changes X, and an unfriendly moderation policy towards opponents of consensus changes X.

There is a variant of this attack, where organization O informs Moderator Yann that they have "privately heard" that supporter Zoe of consensus changes X is not of "good morality" (e.g consuming drugs, sexual misbehaviors or even worst her pirating ip-protected netflix videos) Again, Moderator Yann might be economically incentivized to adopt an unfriendly moderation policy towards Zoe.

3. "Law Enforcement Targeted Attacks”.

Assume Moderator Yann is belonging to a kingdom affiliated to the Alliance (e.g Eastern Kingdoms) and this kindgom has a well-known policy entitled "Control Assets Find & Obtain" (or a.k.a CAFO). Under the CAFO policy, there is a list of sanctioned entities belonging to the "Horde". Any technical operator residing in one of the Alliance territory should ban from online platforms, any contributor known to belong to the "Horde" (e.g the Orc, the Trolls, the Tauren) .

Moderator Yann belonging to Alliance might be legally advised to ban from bitcoin software projects all contributors belonging
or being suspected to belong to the "Horde". This course of actions might not be disclosed to other Bitcoin Core software projects
contributors as moderator Yann might be under "free-speech" order restraint from the CAFO office.

(-- Yes I'm taking examples from World of Warcraft to make the "law enforcement" attack description geopolitically-free).

---

I think 1) + 2) + 3) are enough vector of attacks to meditate on that can adversarily affect Bitcoin Core software project moderation rules and its subsequent development. Still, if you wish more attack examples, I think @naumenkogs or myself can be always reach out in private to give you more of them, if you think it's too delicate to talk about them in public (there is a point with the "security by obscurity" paradigm).