Thread

Radicle: Disclosure of Vulnerability in the Network Protocol

154 points · 58 comments · lostmsu

Aurornis · 1790185330 · focus · HN ↗
> What is the issue?
> Network traffic between nodes is not encrypted and not authenticated.
Oh.
After all of the work they put into using cryptographic identities and decentralization tricks, how did they forget to do anything about the network traffic?
Was this a case of thinking they'd handle it later, but then it fell off the TODO list?
1. dkmb · 1790186579 · focus · HN ↗
  Reading the blog, it sounds more like they were depending on libraries (both by Cyphernet, interestingly) and implicitly trusting them, instead of verifying.
  Which I can understand to an extent with large, high-traffic dependencies but these were really low traffic projects with like 10 stars on github and barely any development... Well, hindsight is 20/20.
  1. Aurornis · 1790191494 · focus · HN ↗
    Do you mean this blog post? <a href="https://maninak.com/blog/radicle-cleartext-transport-vulnerability/" rel="nofollow">https://maninak.com/blog/radicle-cleartext-transport-vulnera...
    It's unfortunate that write-up is AI generated ("Here's the catch... And this is the part that honestly surprised me" tipped me off, and Pangram cites it as 100% AI too), because it's hard to understand what's happening.
    It looks like the Noise API can be confusing. They tried to implement it, got the handshake and key exchange right, but then used Noise API calls intended for sending raw data directly to the wire without the encryption they set up? So keys were exchanged, then never used?
    gsaslis · 1790195127 · focus · HN ↗
    That is the article of the reporter.
    I believe the blog post being referred to here is the one linked to in the title (i.e. <a href="https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol" rel="nofollow">https://radicle.dev/2026/09/23/disclosure-of-vulnerability-i...)
    dkmb · 1790198309 · focus · HN ↗
    Correct, I was referring to the original linked article/disclosure.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.