"Don't trust, verify."
Easy to say.
Harder when verifying immediately might help the attacker.
Core Lightning confirmed that some of the recent AI-generated vulnerability reports describe real issues.
Their response creates an unusual trade-off:
signed binaries first, source code and vulnerability details 14 days later.
Why?
Because a security patch isn't only a fix.
It's also a clue.
Diff the vulnerable and patched code and you can start asking exactly where the old version was wrong. Now give AI the same diff and that analysis gets cheaper and faster.
So for two weeks, CLN operators can verify the signature — but not yet fully verify the code behind the fix.
I don't see this as abandoning "don't trust, verify."
I see it as a much harder question:
What exactly should we verify when immediate transparency increases the attack surface for everyone who hasn't upgraded yet?
I went deeper into the disclosure model, AI vulnerability triage, --offline, reproducible builds and what we should check when the embargo expires:
https://davidebtc186.substack.com/p/found-and-fixed-before-its-public
I wrote a full reply. Then I thought deeply about it before hitting
replyand took out everything that will just give a-holes ideas. Here's what's left:Starting from late 2024, there's been a new rule: NEVER announce an embargo before you have the fix/binaries released. In 2026, this rule is harder and more necessary than ever before. I'm not going to explain why.
Not poking for explanations of the core message, but what do you mean by embargo in this context?
I am only aware of the word embargo in the context of not allowing a ship into (or out of) ports or, more generalized, trading with someone.
I don't understand how it fits in with the situation around CLN.
Oh embargo means you're for a limited time not disclosing what you're patching because it is sensitive.
What this rule means practically is: complete radio silence before you have your release ready for download. Work on a patch in silence. Release it. Do your announcement within minutes of publishing the release and as wide as possible - whatever your message is. Don't leak at any point that you're working on something, not even to the reporter.
Yeah, this is the part I hadn't really considered when writing it.
Announcing that something is wrong before operators actually have the binary changes the threat model by itself. You've basically told everyone where to start looking while defenders still have nothing to deploy.
So the 14-day embargo may not even be the most interesting part here. The timing of the announcement vs the availability of the fix might be.
Definitely something I'll revisit once the source drops. Thanks for adding this.
Very nice formulation!!!
Thanks man.
Got it. Thanks for clarifying.