Bitcoin

cross-posted from: https://lemmy.blahaj.zone/post/35554467

⚠️ PSA for Bassin users:
A security issue was discovered and fixed in the latest Bassin app, but you're not safe until you update it.
Open the Umbrel App Store and update Bassin ASAP.

https://github.com/duckaxe/bassin/issues/23#issuecomment-3640779220

What happened? Bassin uses the ckPool container from hub.docker.com/r/pinkyswear/ckpool-solo - this is linked in the readme: duckaxe/bassin#repositories
Bassin itself does not set a payout address, which can be seen in the code: getumbrel/umbrel-apps@master/bassin/data/config/ckpool.conf.template
Does this mean that the ckPool image i used in Bassin hub.docker.com/r/pinkyswear/ckpool-solo is compromised?

Following a discussion on Discord, I can confirm that the ckPool Docker image I use for Bassin has been compromised.

umbrel decides to make their own, legit docker image at https://github.com/getumbrel/docker-ckpool-solo

https://github.com/getumbrel/umbrel-apps/pull/4230#issuecomment-3641463579

@duckaxe I have created a new ckpool Docker image under the @getumbrel org. It's a drop in replacement for the existing image you're using. You can use it at ghcr.io/getumbrel/docker-ckpool-solo:590fb2a. It builds ckpool-solo from source at the commit 590fb2a which is the current tip of the solobtc branch. (The last version tag is quite a few years old so I presume this is what is considered the latest version)