Bitcoin Core new security disclosure Policy

[Ambatman]

I recently came across this and was surprised despite coming up few days ago I couldn't find anything about it on the forum.
As the title stated core have implemented a new policy to combat the growing risk that Ai may pose in finding vulnerabilities.
https://bitcoincore.org/en/security-advisories/



I can understand that such change is needed but wouldn't faster disclosure also expose users who haven't upgraded?
And also on testing time which would likely be reduced or would Ai also be used in the process?

[Donneski]

Maybe they're more concerned in giving users enough time to upgrade before details of a vulnerability become public. You should know that releasing a fix isn't the same as getting users to deploy it, they're two different things. Bitcoin Core can only publish an update, it's then left for node operators to upgrade, some of them do take time to do so. So it might not be ideal to delay disclosure.

While I understand your concern about faster disclosure exposing users who haven't upgraded, it's important for core to find a timeline that gives users a reasonable opportunity to update not just keeping security information hidden longer than necessary and I think that's what they're tryna do.

[DaveF]

Yup if you go to https://coin.dance/nodes and scroll down you can see that there are 1000s and 1000s of people still running Core 25 / 26 / 27 /28
And those are just the reachable ones.
So it's not a bad idea to give people a lot of time.

Now if it's a full RCE error then perhaps a screaming you should update now is not a bad idea. But, for the most part the timeline works for me.

-Dave

[ABCbits]

For anyone who need more context behind policy change, check https://github.com/bitcoin-core/bitcoincore.org/pull/1281.

I can understand that such change is needed but wouldn't faster disclosure also expose users who haven't upgraded?

If it's truly easily discoverable, whoever run old version of Bitcoin Core are exposed either way.

[nc50lc]

I can understand that such change is needed but wouldn't faster disclosure also expose users who haven't upgraded?

Do you mean it'll encourage potential attackers who aren't aware of the vulnerability making the attack more widespread than usual?

If so, those to-be-posted "as soon as possible" are just the ones that are easily discoverable anyways,
So most attackers could re-discover it without the posted security advisory.
It'll bring more benefit for the users to know how to protect themselves against it than the risk of more widespread attacks. (a notification via Bitcoin client would be nice)

More serious security issues wont be disclosed right away as the article mentioned.