HN

Comments (44)

• Menu

  Aurornis
  > What is the issue?> Network traffic between nodes is not encrypted and not authenticated.Oh.After all of the work they put into using cryptographic identities and decentralization tricks, how did they forget to do anything about the network traffic?Was this a case of thinking they'd handle it later, but then it fell off the TODO list?
• Menu

  john_strinlai
  >This was reported to us by Konstantinos Maninakis on 2026-06-24.announcement 3 months later is not super great, considering that the current advice is "Stop using private repositories (over the network) until the security update is released."
• Menu

  sondr3
  The fact that this was reported three months ago and the "workaround" is to stop using private repos and assume they are all pwnd is quite something. How do you not notice that cross-node traffic is not encrypted when building something like this?
• jscd
  Radicle has been one of those projects that had seemed interesting, but something always bothered me about it. (I think it was very highly tied to the cryptocurrency movement for a while? And the Cyphernet GitHub org seems to have rebranded from a DAO?)This, unfortunately, kinda seals the deal on never using this thing, at least not for anything I intend to keep private. This isn't about proficiency in some protocol which has XYZ footgun: they never checked that payloads were encrypted. Ridiculous.
• Menu

  skullone
  This whole project reads like amateur hour. Still using curl pipe to shell install and everything. Plus this lax security disclosure with just an outstandingly foolish security flaw. Gross.
• lxe
  > The network protocol used by Radicle does not give the confidentiality it was expected to give. Anyone who can observe the network path between two nodes can read the data they exchange as the data is sent in plain text.Is this a... design choice? This feels like too egregious of an omission to be a regular vulnerability here.
• Menu

  iamnothere
  Glad to hear they are moving to iroh instead of a custom protocol. This is the problem with rolling your own stuff.As a bonus, this should help camouflage the traffic. (Iroh is becoming more common.)
• Menu

  Velocifyer
  My main wish is if radicle had a way to make issues online, without installing the software. Runing a piece of software is a high barrier of entry to make a bug report, which the entire reason I use codeberg instead.
• Menu

  throwaway63467
  Just use mTLS via QUIC, it’s standardized, secure, future proof and has implementations in tons of languages and supports proper certificate checks and that whole ecosystem around it which they apparently tried to reinvent. It’s such a great protocol for these use cases, I don’t get why it’s not used more.
• Menu

  Tiberium
  I honestly thought there would be some elaborate chain there, not "we forgot to use encryption"...
• gojomo
  Is there a risk that other projects that may be using the same cyphernet-labs/netservices.rs code, like Nym & Farcaster, have also been expecting authentication & encryption where it hasn't been happening?
• Menu

  ewy1
  thankfully (for me), this is about the git forge and not the oss calendar and contact synchronization software by the same namehttps://radicale.org/v3.html
• boringstack
  [dead]
• mdkaifansari04
  [flagged]