Thread

Radicle: Disclosure of Vulnerability in the Network Protocol

154 points · 58 comments · lostmsu

john_strinlai · 1790180283 · focus · HN ↗
>This was reported to us by Konstantinos Maninakis on 2026-06-24.
announcement 3 months later is not super great, considering that the current advice is "Stop using private repositories (over the network) until the security update is released."
1. vocx2tx · 1790185147 · focus · HN ↗
  Also: user guide still mentions supporting private repositories [0]
  FAQ still says that "Radicle supports private repositories [...] completely invisible to the rest of the network" [1]
  [0] <a href="https://radicle.dev/guides/user#initializing-a-private-repository" rel="nofollow">https://radicle.dev/guides/user#initializing-a-private-repos...
  [1] <a href="https://radicle.dev/faq" rel="nofollow">https://radicle.dev/faq
  1. gsaslis · 1790195903 · focus · HN ↗
    Thank you for noticing. We need to fix that.
    Eduard · 1790200849 · focus · HN ↗
    Also <a href="https://radicle.dev/guides/protocol#transport-encryption--privacy" rel="nofollow">https://radicle.dev/guides/protocol#transport-encryption--pr...
    "Transport Encryption & Privacy: Connections between peers in the Radicle network are encrypted using a Noise protocol handshake. [...] After the handshake phase is completed, all data exchanged between peers is fully encrypted and benefits from strong forward secrecy, ensuring secure and private communications across the network."
2. conartist6 · 1790185298 · focus · HN ↗
  I was floored that they emailed me about it for the first time today saying "of course you already know all the details from the blog post".
  Me: "No!"
  1. gsaslis · 1790195599 · focus · HN ↗
    For the record, that is not what the Zulip announcement wrote. Please don't kick us when we're down.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.