Bitcoin Core, the software most bitcoin nodes run, has changed its security policy. Bugs that are easy to find will now be fixed in every supported version as soon as possible, rather than kept quiet for months. Developer Antoine Poinsot announced the change on the bitcoindev mailing list at 18:07 UTC on 22 Oct.
The reason, he wrote, is a rise in reports of flaws that anyone can find again, “largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes”.
What the old policy did
An embargo is the period between fixing a bug and saying publicly that it existed. Bitcoin Core has kept that period long because node operators are slow to upgrade. A fix would usually ship quietly in the next major release, the large release that comes out roughly twice a year, and details would follow later.
That approach has a weak point. A covert fix, a security patch that is not labelled as one, can be spotted by anyone reading the code changes. Software that reads code quickly makes that easier.
“The embargo period achieves little but it delays the availability of a fixed release,” Poinsot wrote of these easy-to-find bugs.
What changes
When a report comes in, developers may now classify it as “easily discoverable”, meaning it can be found with little effort, “such as through a simple LLM prompt”, according to the updated policy.
For those bugs, the project will backport the fix, that is, copy it into each older version it still maintains, and publish a point release, a small update, for each one as soon as possible. A security advisory will come with it.
Everything else keeps the old timetable.
Low-severity bugs are disclosed two weeks after a major release that contains the fix. Medium and high-severity bugs wait until two weeks after the last affected version reaches end of life, which is about a year. Critical bugs are handled case by case.
Where the case holds, and where it is open
The steelman is simple. If a bug can be found in minutes, the attacker probably already has it, so a long silence protects nobody and leaves users on unpatched software.
The test is who decides what counts as easy. The label is a judgement made at triage, and the policy says it is not limited to bugs found with an LLM. More point releases also ask more of node operators, who would need to upgrade more often.
My base case I will call the short fuse: more likely than not, more of Bitcoin Core’s fixes will arrive as point releases with advisories in the next year, and fewer will wait quietly for a major version.
What would change my mind. A run of point releases flagged as easily discoverable would confirm it. If the next major releases still carry most fixes, with advisories months later, the change would be narrower than it reads.
Bitcoin’s developers are also debating longer-range security, as in Coinbase’s post-quantum wish list for bitcoin. Other projects ship fast fixes too, as with the XRP Ledger’s patched overflow bug.
The bottom line: when a machine can find a bug, Bitcoin Core now treats it as already public and ships the fix first.
— Alasdair
This article is for information only and is not investment advice.