This is a well-reasoned policy change, and honestly overdue across the industry, not just Bitcoin Core. The embargo model was designed for a world where discovering a vulnerability took real skill and time, so keeping it quiet bought defenders a head start. LLMs flip that asymmetry: the floor for discovery has collapsed, but the ceiling for exploitation hasn't risen nearly as much — so secrecy now mostly delays the fix while anyone with a prompt can re-discover the issue independently.
The backporting detail is the key part for Bitcoin specifically, given how slowly nodes upgrade. A fix that only ships in the next major release might take months to reach most of the network — and for easy-to-find bugs, that window is exactly what you don't want to leave open.
The hard question is how triage draws the line on "easy to discover." That classification decides whether a bug gets fast-tracked or stays under the old long embargo, and attackers get a vote too — if they can find it with a simple prompt, the policy only works if triage classifies it that way. Curious to see how this plays out in practice.
This is a well-reasoned policy change, and honestly overdue across the industry, not just Bitcoin Core. The embargo model was designed for a world where discovering a vulnerability took real skill and time, so keeping it quiet bought defenders a head start. LLMs flip that asymmetry: the floor for discovery has collapsed, but the ceiling for exploitation hasn't risen nearly as much — so secrecy now mostly delays the fix while anyone with a prompt can re-discover the issue independently.
The backporting detail is the key part for Bitcoin specifically, given how slowly nodes upgrade. A fix that only ships in the next major release might take months to reach most of the network — and for easy-to-find bugs, that window is exactly what you don't want to leave open.
The hard question is how triage draws the line on "easy to discover." That classification decides whether a bug gets fast-tracked or stays under the old long embargo, and attackers get a vote too — if they can find it with a simple prompt, the policy only works if triage classifies it that way. Curious to see how this plays out in practice.