That’s great news!. I’m just learning about this compromise now. As a forensic security professional for more then 20 years, I have some concerns about this new release. Particularly the way you dismissed the concerns about the signing key in some of the other threads. @hardhatarea’s concerns were (almost) 100% correct, and your reply about trust suggested a misunderstanding about how the PGP cryptographic web-of-trust functions. Are you, yourself, able to create PGP keys and use them to sign other keys, and files? If not, then with all respect, you’re not qualified to comment on the (cryptographic) trust of the releases.
The concern is not a PR matter, and it has nothing to do with how much trust you personally have in one developer or another. The cryptographic web-of-trust has certain rigorous standards to adhere to to maintain trust in a release. That’s why we use it to validate software.
For those who don’t understand: when a private key is used to sign a release, it indicates that the holder of that private key has taken responsibility for the release being a good release. There are clear standards and precedents to use when a developer leaves, to maintain this web-of-trust as the project passes to a new developer who has a different private key. (Those standards were not addressed in your comment about Henrik’s key being used instead of Alejandro’s.)
If a different key is used to sign a new release, without these cryptographically rigorous processes, then it raises the question of why wasn’t the original developer part of this new release? Simply posting on a forum that you trust the new dev team is not cryptographically rigorous, and cryptographic rigor is the only way for the wider community to trust the release. That’s why we use PGP.
All of this feels worryingly familiar. It reminds me of many years ago when TrueCrypt came out with a new release, but it was quite obvious that it had been compromised so the project ended there. It also reminds me of when PIA VPN’s warrant canary disappeared. The PR team said it’s nothing to worry about but that is what they would say if the project had been compromised.
It also reminds me of when the OTR messaging protocol disappeared, shortly after a leak showed that it was one of the two protocols (PGP being the other) that was giving the NSA a hard time. The code couldn’t be cracked, and suddenly the project’s website said that people should start using a different protocol (OMEMO). But the keys that had been used to sign OTR weren’t used for OMEMO, so it was pretty clearly a takeover of the project.
I’m not saying that is what’s happening here. But it certainly could be, and the best way to make it clear that hasn’t happened, is for Alejandro to use the same key he used to sign the previous releases, to sign the new release. Otherwise, you have to wonder why the dev team got switched around just at this moment.
It’s even more worrying, since there is major crypto legislation in the USA right now (the Clarity Act) and I’ve been following this more closely than the Bisq exploit. I don’t want to make any public guesses, but if you read the above (about OTR etc.) and look at the timing of the Bisq exploit, it raises serious questions and the pattern feels a little familiar.
If you continue to treat this like a Public Relations issue, and try to “handle” the people who bring the concerns up, these questions will never go away. The only correct way to address them is with technically rigorous proof that the project is under the same development team - and because the Bisq project has previously chosen to use Alejandros’s PGP key to validate releases, technical rigor now can only be satisfied if Alejandro uses the exact same key to sign the new release.
Please take this seriously. It would be awful if Bisq had been taken over. It would be worse if trust in Bisq vanishes because you’re not taking it seriously.
