Is ckERC20 is done? Can I use it for my custom token?

[Pete]

@Lorimer

I agree - personally I would never manually vote on a proposal without first reviewing and doing my best to understand the changes. However I don’t think this is true for everyone. Personally, I think it would be a good thing to encourage everyone in the community to exercise extreme scepticism in the face of SCM proposals that originate from new or unrecognised neurons. But I’m not sure it’s realistic to expect everyone in the community to exercise that same level of scepticism for every single SCM proposal, particularly not if they’re normalised and typically proposed by anyone. The potential for damage from a nefarious SCM proposal seems enormous.

Rest assured that DFINITY will always be reviewing any SCM proposals!

The reality today is that there is already nothing technically stopping anyone submitting such proposals. DFINITY itself uses a diverse set of neuron IDs which are not cryptographically verified to be acting on DFINITY’s behalf. So we all have to be on guard for the inevitable eventuality that someone else submits an SCM proposal.

Which leads me to think it’s better to normalize the process which we will need to safeguard the system, than rely on it not happening and being a rare event which catches people off guard.

I also agree that one of the possible trust signals is “do I know who the proposer is”, but given that compromising a “trusted account” is a major vector of cyberattacks today, I would not place too much emphasis on it. When it comes to critical parts of the system, better not to trust & verify.