比特幣核心開發人員推出新的「嚴重錯誤」揭露政策以增強安全性

比特幣核心開發團隊引入了「嚴重錯誤」揭露政策，以改善比特幣內部安全漏洞的溝通。

A team of Bitcoin Core developers has introduced a “critical bug” disclosure policy to improve the communication of security vulnerabilities within Bitcoin.

比特幣核心開發團隊引入了「嚴重錯誤」揭露政策，以改善比特幣內部安全漏洞的溝通。

In a message to the Bitcoin Development Mailing List on July 3, developer Antoine Poinsot and five others acknowledged that the project has historically failed in publicly disclosing security-critical bugs, leading users to mistakenly believe that Bitcoin Core is free of issues:

在 7 月 3 日發給比特幣開發郵件列表的訊息中，開發人員 Antoine Poinsot 和其他五人承認，該專案歷來未能公開披露安全關鍵漏洞，導致用戶錯誤地認為 Bitcoin Core 沒有問題：

“The project has historically done a poor job at publicly disclosing security-critical bugs, whether externally reported or found by contributors.”

“該專案歷來在公開披露安全關鍵漏洞方面做得很差，無論是外部報告的還是貢獻者發現的。”

Bitcoin Core is the software that Bitcoin node operators use to access the Bitcoin blockchain, validate transactions, and build blocks, playing a crucial role in securing the over $1.1 trillion locked in the Bitcoin network.

Bitcoin Core 是比特幣節點運營商用來存取比特幣區塊鏈、驗證交易和建立區塊的軟體，在確保比特幣網路中鎖定的超過 1.1 兆美元的安全方面發揮著至關重要的作用。

The new policy aims to enhance communication about the risks of using outdated versions of Bitcoin Core and to standardise the disclosure process, incentivizing researchers to find and responsibly disclose vulnerabilities. Poinsot believes that making security bugs available to a wider group of contributors can help prevent future issues.

新政策旨在加強使用過時版本的 Bitcoin Core 風險的溝通，並標準化揭露流程，激勵研究人員發現並負責任地揭露漏洞。 Poinsot 認為，向更廣泛的貢獻者群體提供安全漏洞有助於防止未來出現問題。

The policy categorises vulnerabilities into four levels of severity. The first stage, ‘Low’, includes bugs that are hard to exploit and have low impact, such as those requiring access to the victim’s machine.

該策略將漏洞分為四個嚴重程度。第一階段“低”，包括難以利用且影響較小的錯誤，例如需要訪問受害者電腦的錯誤。

The second one is ‘Medium’, which covers bugs with limited impact, such as a local network remote crash.

第二個是“中”，涵蓋影響有限的錯誤，例如本地網路遠端崩潰。

The last two categories include ‘high’ and ‘critical’, in which there are bugs having significant impact and bugs that threaten the entire network’s integrity, such as manipulating Bitcoin Core to inflate Bitcoin’s supply or committing coin theft, respectively.

最後兩類包括“高”和“嚴重”，其中存在具有重大影響的錯誤和威脅整個網路完整性的錯誤，例如分別操縱比特幣核心以增加比特幣的供應量或進行硬幣盜竊。

Low, medium, and high severity bugs will be disclosed two weeks after a fixed version is released, while critical bugs will be disclosed on a case-by-case basis. The policy will be gradually adopted over the coming months.

低、中、高嚴重性錯誤將在修復版本發布兩週後披露，而嚴重錯誤將根據具體情況披露。該政策將在未來幾個月內逐步實施。

Poinsot noted that all vulnerabilities fixed in Bitcoin Core versions 0.21.0 and earlier have been disclosed as of July 3, with disclosures for versions 0.22.0 and 0.23.0 to follow later this month and in August. The latest version, Bitcoin Core 27.1, has been adopted.

Poinsot 指出，截至 7 月 3 日，Bitcoin Core 0.21.0 及更早版本中修復的所有漏洞均已披露，0.22.0 和 0.23.0 版本將於本月晚些時候和 8 月披露。最新版本Bitcoin Core 27.1已被採用。

The new policy was praised by fellow developer Eric Voskuil: “Many other projects have been on the receiving end of this misperception, and it has in fact caused material harm to the community. I don’t know what precipitated this change, but props to you all for stepping up.”

這項新政策得到了開發者 Eric Voskuil 的讚揚：「許多其他項目都受到了這種誤解，事實上它對社區造成了物質損害。我不知道是什麼促成了這一變化，但支持你們所有人加緊努力。