Radicle: Disclosure of Vulnerability in the Network Protocol

Aurornis•about 1 hour ago

> What is the issue?

> Network traffic between nodes is not encrypted and not authenticated.

Oh.

After all of the work they put into using cryptographic identities and decentralization tricks, how did they forget to do anything about the network traffic?

Was this a case of thinking they'd handle it later, but then it fell off the TODO list?

dkmb•37 minutes ago

Reading the blog, it sounds more like they were depending on libraries (both by Cyphernet, interestingly) and implicitly trusting them, instead of verifying.

Which I can understand to an extent with large, high-traffic dependencies but these were really low traffic projects with like 10 stars on github and barely any development... Well, hindsight is 20/20.

sondr3•about 1 hour ago

The fact that this was reported three months ago and the "workaround" is to stop using private repos and assume they are all pwnd is quite something. How do you not notice that cross-node traffic is not encrypted when building something like this?

john_strinlai•about 2 hours ago

>This was reported to us by Konstantinos Maninakis on 2026-06-24.

announcement 3 months later is not super great, considering that the current advice is "Stop using private repositories (over the network) until the security update is released."

skullone•about 1 hour ago

This whole project reads like amateur hour. Still using curl pipe to shell install and everything. Plus this lax security disclosure with just an outstandingly foolish security flaw. Gross.

hirako2000•34 minutes ago

It's a team of 3. It's not like they have a security team, dedicated testers. They were for very long released beta software. That in fact already worked.

Velocifyer•about 3 hours ago

My main wish is if radicle had a way to make issues online, without installing the software. Runing a piece of software is a high barrier of entry to make a bug report, which the entire reason I use codeberg instead.

someonebaggy•about 2 hours ago

That's a downside of all decentralised software, isn't it? If there's a convenient access point, that access point is also a point of centralisation. To be distributed, you have to be running the software yourself. The big problem is that the software always ends up being inconvenient. People have no problem using bittorrent because the software is actually usable.

Tiberium•about 3 hours ago

I honestly thought there would be some elaborate chain there, not "we forgot to use encryption"...

csomar•about 2 hours ago

And not using authentication.

> Peer authentication in the connection handshake is broken and allows impersonation. An attacker can connect to your node and present a Node ID that is not its own. Private repositories are shared only with allow-listed Node IDs. An attacker who fakes an allow-listed Node ID can fetch a private repository directly, without being on the network path. This was reported to us by cryptocode on 2026-08-12. We proposed a fix upstream, see this pull request.

They are trying to sweet write it as much as possible. But basically there is neither encryption nor authentication. The person who made the protocol/program simply didn't care.

pixl97•about 3 hours ago

Honestly issues like this crop up pretty commonly. JWT alg:none for example. Or even older people forcing SSL to downgrade to encryption null.

In any system that provides security it should only be designed to run if the security is in use, and to fail immediately with no further action if the security is not used.

ktm5j•about 2 hours ago

I don't think that's the kind of thing that happened here.. apparently they were just sending everything in plaintext over a TCP socket.

gojomo•about 2 hours ago

Is there a risk that other projects that may be using the same cyphernet-labs/netservices.rs code, like Nym & Farcaster, have also been expecting authentication & encryption where it hasn't been happening?

ewy1•about 2 hours ago

thankfully (for me), this is about the git forge and not the oss calendar and contact synchronization software by the same name

https://radicale.org/v3.html

kamranjon•about 2 hours ago

it's not the same name

ewy1•about 2 hours ago

you're right! i can't believe i only noticed that just now, thanks!

Radicle: Disclosure of Vulnerability in the Network Protocol

⚡ Community Insights

Discussion (21 Comments)Read Original on HackerNews