Radicle 网络协议未加密导致安全漏洞
问题概述
多位用户指出 Radicle 的节点间网络流量未加密也不认证，导致敏感数据暴露。项目在安全公告延迟、迫使用户停用私有仓库，并对实现的业余感和安全漏洞表示强烈不满。
痛点标签
- 节点间网络流量未加密
- 缺乏身份验证
- 安全公告延迟，迫使停用私有仓库
- 项目实现被认为业余且安全漏洞严重
- 用户对采用 Radicle 持保留或放弃态度
待验证问题
- 是否加密的网络流量对您的使用场景是不可接受的风险？
- 您是否考虑转而使用类似 iroh 的替代协议？
- 在采用 Radicle 前，您需要对安全补丁的及时交付有什么保证？
证据
原话 · @匿名
What is the issue? Network traffic between nodes is not encrypted and not authenticated. Oh. After all of the work they put into using cryptographic identities and decentralization tricks, how did they forget to do anything about the network traffic? Was this a case of thinking they'd handle it later, but then it fell off the TODO list?
原话 · @匿名
This was reported to us by Konstantinos Maninakis on 2026-06-24. announcement 3 months later is not super great, considering that the current advice is "Stop using private repositories (over the network) until the security update is released."
原话 · @匿名
The fact that this was reported three months ago and the "workaround" is to stop using private repos and assume they are all pwnd is quite something. How do you not notice that cross-node traffic is not encrypted when building something like this?
原话 · @匿名
Radicle has been one of those projects that had seemed interesting, but something always bothered me about it... they never checked that payloads were encrypted. Ridiculous.
免责声明：本卡片由 AI 从社区讨论中提炼，属于「痛点证据」，是需求分析与验证的起点，不等同于「已验证的市场需求」。AI 存在分析局限，关键决策前请打开上方原始讨论人工复核。