search

Flax-Network / flax-blockchain

Apache License 2.0
148 stars 54 forks source link

[BUG] Official Chia commit history not available! SCAM? #1

Closed jneuhauser closed 3 years ago

jneuhauser commented 3 years ago

Describe the bug The branch chia-1.1.7 doesn't have the original commit history. This makes this project very suspicious to me as you could have modified the source before doing the initial commit of the source.

To Reproduce Steps to reproduce the behavior:

  1. Go to Flax-Network/flax-blockchain/commits/chia-1.1.7
  2. See only one commit and the missing commit history!

Expected behavior A clear and concise description of what you expected to happen.

  1. Go to Flax-Network/flax-blockchain/commits/chia-1.1.7
  2. See the full commit history of the official chia-blockchain source code!
jneuhauser commented 3 years ago

I've cherry-picked your commit https://github.com/Flax-Network/flax-blockchain/commit/0c94a7923843439b233e077255d3af9dbed057f6 to the official chia-blockchain 1.1.7 source code. Please force push it to your main branch as this will keep it trustworthy.

Also please use also the latest branch as last stable release as on chia-blockchain to be fully compatible to the install instructions.

Here is my fork of your fork: https://github.com/jneuhauser/flax-blockchain/tree/latest

delucca commented 3 years ago

@jneuhauser were you able to define if this is trustworthy or not?

jneuhauser commented 3 years ago

There is no hidden bad code if you look at the commit https://github.com/jneuhauser/flax-blockchain/commit/bd6fccc2b0999dfb7f39d7cf64481ea73c9c2cc3. So i would say it's thrustworthy like the chia code is.

If this repo hasn't any hidden bad code...? I don't know... Thats why i cherry-picked the changes on the official chia 1.1.7 git repo.

flax-dev commented 3 years ago

Hey @jneuhauser, thank you for filing this issue. This was my mistake, I wanted to be clear what the starting place was, so I collapsed all the Chia source code into one commit. This understandably makes it appear that we are trying to hide something, so to alleviate your concerns:

  1. Previously, I had the https://github.com/Flax-Network/flax-blockchain/tree/0.1 tag based on the https://github.com/Flax-Network/flax-blockchain/tree/chia-1.1.7 branch which did not have history.
  2. I have pushed the official Chia 1.1.7 branch to https://github.com/Flax-Network/flax-blockchain/tree/chia-1.1.7-full which you can easily verify is the same source as upstream Chia.
  3. I have also pushed a new Flax 0.1 tag with the full history to https://github.com/Flax-Network/flax-blockchain/tree/0.1-full-history, which is a single commit on top of upstream Chia.
  4. You can verify that the chia-1.1.7 and chia-1.1.7-full branches have the same source tree files (except some irrelevant linter ones) with this diff here: https://github.com/Flax-Network/flax-blockchain/compare/chia-1.1.7..chia-1.1.7-full
  5. You can further verify that the 0.1 tag and the 0.1-full-history tag have the same source files (again, except some irrelevant linter ones) with this diff here: https://github.com/Flax-Network/flax-blockchain/compare/0.1..0.1-full-history).

I hope this satisfactorily answers your question and gives you confidence that we are doing the right thing. We will not repush the 0.1 tag right now to preserve the binary release history, but will take your recommended approach going forward. Let me know if you have any other questions, or close this issue if you are satisfied.

room101-dev commented 3 years ago

Describe the bug The branch chia-1.1.7 doesn't have the original commit history. This makes this project very suspicious to me as you could have modified the source before doing the initial commit of the source.

To Reproduce Steps to reproduce the behavior:

  1. Go to Flax-Network/flax-blockchain/commits/chia-1.1.7
  2. See only one commit and the missing commit history!

Expected behavior A clear and concise description of what you expected to happen.

  1. Go to Flax-Network/flax-blockchain/commits/chia-1.1.7
  2. See the full commit history of the official chia-blockchain source code!

Let's see back in the 1960's when UNIX first appeared, we had a cmd called 'diff', where u said 'diff file1 file2' and you got the differences, thus be, here we are some 60 years later and all has been lost.

For god's sake this OP doesn't have a clue how to use her tool-kit set. These days with modern PDB, aka programmers workbench, there must be 10k tools to give you diff between two projects. Do u need someone to go to the toilet with you as well? Do U need a GUI? Color perhaps napkins? & Tiddy's?

agusgrana commented 3 years ago

No entiendo nada de lo que decís. Para ser mas correctos podemos decir que: Es confiable el proyecto de FLAX o por el contrario es una ESTAFA. Gracias.

I don't understand anything you say. To be more correct we can say that: Is the FLAX project reliable or on the contrary it is a SCAM. Thanks

flax-dev commented 3 years ago

@agusgrana Many people have audited this code and not found issues, including @jneuhauser. You should always audit code before you run it.

Closing this issue because @jneuhauser has indicated that he is satisfied.