I've been thinking about something @optimism said in the CLN thread yesterday.
The interesting part wasn't really the 14-day embargo. It was the timing.
If you know you've got a serious vulnerability but don't have a release ready yet, should you even say anything publicly?
A few years ago I probably would have leaned heavily toward disclosure. More information is generally better, especially with open source.
I'm not so sure anymore.
The obvious problem is patch diffing. That's always existed. If I know version X is vulnerable and version X+1 fixes it, I can look at what changed and try to work backwards.
But now I can throw both versions at an AI agent and have it spend all night looking for security-relevant changes, tracing inputs, generating tests, whatever. That doesn't mean it automatically gets an exploit, obviously. But it makes the search cheaper.
And announcing the vulnerability before the fix exists seems even worse.
You've basically told everyone "there's something interesting in here, go look" while the people running the software still have nothing to install.
Maybe the safer process now is actually to keep quiet, get the fix ready, release it, tell everyone to update, and only disclose enough technical detail later once people have had some time to move.
I don't particularly like that answer. Especially for Bitcoin software. Running code you can't fully inspect yet is a pretty ugly trade-off.
But I'm starting to think immediate transparency and responsible disclosure aren't necessarily the same thing anymore.
Curious what people who actually maintain or review security-sensitive software think.
Has AI changed your disclosure process at all?
pull down to refresh
related posts
Yes.
This is the current policy for the Linux kernel (which has been adapted to an AI reality):
Note that what kernel-security perceives as a "publicly known" bug includes those found with LLMs:
So, for this case with CLN, kernel would have just published the source and y'all better pay attention.
And they'd do the same if it wasn't some LLM-discovered bug unless you beg for it.
Yeah, fair point. I think I was giving AI a bit too much credit for changing the rules here.
The Linux kernel example makes that pretty clear — the basic problem was already there.
What AI probably changes is the speed. If patch diffing and digging through the affected code can be automated more and more, that window between releasing the fix and people actually upgrading gets uncomfortable pretty fast.
So maybe it's less "AI is changing responsible disclosure" and more "AI is making the old rules matter a lot more."
Thanks for the Linux reference btw, I'm going to dig into that.
There's been a lot of chatter on the mailing lists about it. Kernel-security was among the first of the sec teams to say: yo we're now not just getting some dupes, but we're getting dupes all the time, for almost half the bugs (dupe here is you're working on a bug and someone else reports it to you again, and again, and again.)
So they tuned it a bit and wrote some nice "if you use AI tools please don't be a dick, here's instructions" guidelines. I do like that they keep at least the door open to some options to embargo - as much as I've personally hated needing them - because you cannot statically dictate them away. But overall, I see it moving to less embargo, more user responsibility. If something is broken and you don't update, that's on you, not on the devs.
Though QA timing post-fix is still a hurdle. Right now I have a half finished review sitting in my review repo and I've already found so much shit that I'm really out of energy to finish it. But not finishing it also means I don't update, because I hate updating blind. So yeah... AI changed a lot, but the impact on the consumer side is harder than most realize.
Embargo messes with me, no embargo, at this current rate... also.
It takes 30 minutes at most, my guy.
Until you get exploited and find out the maintainers knew all along and could have warned you.
The closed source release and two week embargo are security theatre. Simple as.
Yes. It made both sides faster.