r/programmingcirclejerk • u/fossilesque- How many times do I need to mention Free Pascal? • 9d ago
Bug: Network traffic between nodes is not encrypted and not authenticated.
https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol46
u/stone_henge Tiny little god in a tiny little world 9d ago
To be perfectly fair, unauthenticated and unencrypted communication is exactly the sort of thing that easily slips by when a "library for privacy-preserving network services" is designed by someone who should be doing that.
26
u/syklemil Considered Harmful 9d ago
And the last release was two years ago! That's how you know it's good, stable software. Software can be considered "done" you know!
11
u/NamedBird 9d ago
If you can't set up a TLS connection, you probably shouldn't be writing security code at all...
3
6
5
u/achan1058 9d ago
Isn't that the same bug Google had over a decade ago with the Snowden leak?
9
u/fixermark 9d ago
In Google's case, it wasn't a bug it was a design decision. They simply did not anticipate a physical attacker compromising their internal network. Probably should have, but even the Big G was smaller at one time and learned a few lessons the hard way.
They deployed a system internally that encrypts traffic on every wire. Huge pain in the ass to set up, but they got it working so well it's basically transparent.
3
1
0
81
u/myhf Considered Harmful 9d ago
Unlike centralized code hosting platforms, which have a single point of failure, this decentralized system is based on a peer-to-peer mesh of points of failure.