Bitcoin Core new security disclosure Policy

[Ambatman]

I recently came across this and was surprised despite coming up few days ago I couldn't find anything about it on the forum.
As the title stated core have implemented a new policy to combat the growing risk that Ai may pose in finding vulnerabilities.
https://bitcoincore.org/en/security-advisories/



I can understand that such change is needed but wouldn't faster disclosure also expose users who haven't upgraded?
And also on testing time which would likely be reduced or would Ai also be used in the process?

[Donneski]

Maybe they're more concerned in giving users enough time to upgrade before details of a vulnerability become public. You should know that releasing a fix isn't the same as getting users to deploy it, they're two different things. Bitcoin Core can only publish an update, it's then left for node operators to upgrade, some of them do take time to do so. So it might not be ideal to delay disclosure.

While I understand your concern about faster disclosure exposing users who haven't upgraded, it's important for core to find a timeline that gives users a reasonable opportunity to update not just keeping security information hidden longer than necessary and I think that's what they're tryna do.

[DaveF]

Yup if you go to https://coin.dance/nodes and scroll down you can see that there are 1000s and 1000s of people still running Core 25 / 26 / 27 /28
And those are just the reachable ones.
So it's not a bad idea to give people a lot of time.

Now if it's a full RCE error then perhaps a screaming you should update now is not a bad idea. But, for the most part the timeline works for me.

-Dave