Technology · Articlepublished 20h
Radicle tells users to stop networking private repositories after transport flaws
Radicle says every released version sends node traffic without the confidentiality and peer authentication it expected. An on-path observer can read exchanged repository objects, while a second flaw lets a peer present an allow-listed Node ID and fetch a private repository. A breaking network replacement is still in development.
Radicle - Disclosure of Vulnerability in the Network Protocol · Konstantinos Maninakis - Vulnerability disclosure: Radicle nodes send private repositories in cleartext