‹ BackHN Continuity

Thread

Radicle: Disclosure of Vulnerability in the Network Protocol

154 points · 58 comments · lostmsu

  1. john_strinlai · · focus · HN ↗
    >This was reported to us by Konstantinos Maninakis on 2026-06-24.

    announcement 3 months later is not super great, considering that the current advice is "Stop using private repositories (over the network) until the security update is released."

    1. vocx2tx · · focus · HN ↗
      Also: user guide still mentions supporting private repositories [0]

      FAQ still says that "Radicle supports private repositories [...] completely invisible to the rest of the network" [1]

      [0] <a href="https:&#x2F;&#x2F;radicle.dev&#x2F;guides&#x2F;user#initializing-a-private-repository" rel="nofollow">https:&#x2F;&#x2F;radicle.dev&#x2F;guides&#x2F;user#initializing-a-private-repos...

      [1] <a href="https:&#x2F;&#x2F;radicle.dev&#x2F;faq" rel="nofollow">https:&#x2F;&#x2F;radicle.dev&#x2F;faq

      1. gsaslis · · focus · HN ↗
        Thank you for noticing. We need to fix that.
        1. Eduard · · focus · HN ↗
          Also <a href="https:&#x2F;&#x2F;radicle.dev&#x2F;guides&#x2F;protocol#transport-encryption--privacy" rel="nofollow">https:&#x2F;&#x2F;radicle.dev&#x2F;guides&#x2F;protocol#transport-encryption--pr...

          &quot;Transport Encryption &amp; Privacy: Connections between peers in the Radicle network are encrypted using a Noise protocol handshake. [...] After the handshake phase is completed, all data exchanged between peers is fully encrypted and benefits from strong forward secrecy, ensuring secure and private communications across the network.&quot;

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.