// HACKER NEWS — CYBERSECURITY
Radicle: Disclosure of Vulnerability in the Network Protocol
Radicle is a peer-to-peer, local-first code
collaboration stack built on Git.
Two critical security vulnerabilities in the network protocol used by Radicle nodes were reported.
All versions of Radicle that were released to date are vulnerable.
Network traffic between nodes is not encrypted and not authenticated.
Authentication of repository contents via Signed References still detects if attackers along the network path between two nodes modify objects in transit.
Thus, the main concern is information leakage, i.e., attackers along the network path between two nodes reading objects in transit.
For public repositories, information leakage is less of a concern.
However, encryption in transit is crucial for private repositories.
We recommend to stop using private repositories until a fix is released.
Due to a lack of version negotiation features, combined with the fix being incompatible on the wire, a backward compatible mitigation is not feasible; that means the release to fix this issue will be breaking, thus bump the major version number.
Work towards this is under way.
With this disclosure, our goal is, first and foremost, to be honest and clear about the situation, so that users can assess and act accordingly, while we are working on a resolution.
The second flaw is harder to exploit on its own than it sounds. To impersonate an allow-listed Node ID, an attacker must first know one. The allow-list is not public, so an attacker who is not on the network path has to guess.
In practice, the two flaws are most useful when they can be exploited together: an attacker on the path sees the Node IDs at both ends of a connection, and both are normally on the allow-list.
That attacker can read whatever is exchanged while they watch, and can then use a Node ID they saw to fetch the whole repository on demand.
The realistic threat is anyone on the path between your node and node it syncs with, and no setting or allow-list protects against them.
We are publishing this before the security update is available. You can act on it today, and no fix we release later can undo an exposure that has already happened.
Change the seeding policy of very individual repository to “block”: