phantom / blocklist

148 stars 254 forks source link

Blocklist not up to date on main branch - directly link to blowfish.xyz for more transparency #1451

Open albatross-ug opened 2 days ago

albatross-ug commented 2 days ago

Problem description:

When a website is blacklisted accidently (please refer to this now resolved issue), a strong warning message similar to the following showes up:

image

Most normal users will leave the side quickly and in fear. However, project owners and developers might review the so called linked "community-maintained database" or click "please file an issue", which both links to this repository.

However, when then reviewing this repository and the relevant blocklist files, one might notice that

Expected behavior

The expected behavior is, based on what the strong warning message suggests, that this repository is actually community maintained and regularly updated, and hence is the source of information for this blocking message.

Actually, the commercial company Blowfish, who is a security company in the Web3 space, is administrating this process (I want to stress that relying on professional services in this case is absolutely reasonable and that I do not have any issue with Blowfish themselves). The problem that arises from this is:

  1. This is only to be found out when opening an issue and then receiving a response by Blowfishs' review team a few days later that requests you to submit information to an address, which imposes a delay in the process. (Sidenote: I recently filed a report to GitHub reporting another users with a similarly name and comment that also commented to the latest Issues like this user https://github.com/samg95-jpg did but linked to a malicious website, causing confusion and damaging reputation of the actual message - luckily, these comments have been removed by GitHub. Still, requesting to get in touch from a user that has very little public commits, no clear name that can be double-checked and no obvious connection to Blowfish might not be the best idea).
  2. Users could assume that the repository is up-to-date, which it is not.

I would recommend to update the strong warning message and add an email address or link to blowfish.xyz to avoid further confusion and remove unnecessary intransparency in the process. Also, I would suggest to update the documentation of this repository, reflecting this information. Third, I would suggest that either the user https://github.com/samg95-jpg updated his profile with a link to Blowfish, in case he is with Blowfish, or Blowfish themselves might create / use a GitHub account to comment in this repository on their behalf to increase trust.

Thank you for your attention to this matter and your commitment to keep the blockchain space safe and transparent.

hot-bott commented 1 day ago

We are sorry for the inconvenience you are facing. Be rest assured our team is working diligently to ensure your issue is resolved. Visit the official live chat support to report this issue to an agent for assistance via customer support @albatross-ug