比特幣核心開發人員推出新政策來揭露安全漏洞

該專案歷來在公開揭露安全關鍵錯誤方面做得很差，無論是外部報告的還是貢獻者發現的。

Bitcoin Core Developers Roll Out New Security Vulnerability Disclosure Policy

比特幣核心開發人員推出新的安全漏洞揭露政策

A group of Bitcoin core developers have rolled out a new policy to disclose security vulnerabilities on the Bitcoin blockchain.

一群比特幣核心開發人員推出了一項新政策，以揭露比特幣區塊鏈上的安全漏洞。

“The project has historically done a poor job at publicly disclosing security-critical bugs, whether externally reported or found by contributors,” said developer Antoine Poinsot in an email sent to the Bitcoin developer mailing list.

開發者 Antoine Poinsot 在發送給比特幣開發者郵件列表的電子郵件中表示：“該項目歷來在公開披露安全關鍵漏洞方面做得很差，無論是外部報告的還是貢獻者發現的。”

“This has led to a situation where a lot of users perceive Bitcoin Core as never having bugs. This perception is dangerous and, unfortunately, not accurate.”

「這導致了許多用戶認為比特幣核心從來沒有錯誤的情況。這種看法很危險，而且不幸的是，它並不準確。

The new disclosure policy would classify disclosed vulnerabilities into one of four categories based on severity: low, medium, high and critical.

新的揭露政策將根據嚴重程度將已揭露的漏洞分為四類之一：低、中、高和嚴重。

Low severity bugs would be disclosed within two weeks after a fixed version is released, while medium and high severity bugs would be disclosed two weeks after the last affected software release reaches its end of life.

低嚴重性錯誤將在修復版本發布後兩週內披露，而中度和高嚴重性錯誤將在最後一個受影響的軟體版本達到其生命週期結束後兩週內披露。

Critical bugs, on the other hand, would not be considered in the standard policy and would require an ad-hoc procedure regarding its disclosure. The developers would consider any bug that threatens the entire network’s integrity to fall in this bracket.

另一方面，標準政策不會考慮關鍵錯誤，並且需要一個關於其揭露的臨時程序。開發人員會認為任何威脅整個網路完整性的錯誤都屬於這個範圍。

The new policy is expected to be gradually rolled out in the coming months, but in the spirit of following through with the promise of appropriate disclosures, a page has been added to the official Bitcoin core website summarizing the vulnerabilities that impacted the network.

新政策預計將在未來幾個月內逐步推出，但本著兌現適當披露承諾的精神，比特幣核心官方網站已添加一個頁面，總結影響網路的漏洞。

The document details 12 disclosures that impacted the Bitcoin network before the version 0.21.0 of its software was released.

該文件詳細介紹了在 0.21.0 版軟體發布之前影響比特幣網路的 12 項揭露內容。

One of these bugs was a malicious BIP-72 Uniform Resource Identifier (URI), which is used to facilitate payments and interact with wallet addresses, that could cause the BIP-70 implementation in Bitcoin core to silently crash.

其中一個錯誤是惡意 BIP-72 統一資源識別碼 (URI)，它用於促進支付並與錢包位址交互，這可能會導致比特幣核心中的 BIP-70 實現無聲地崩潰。

Other disclosures included an integer overflow bug that could have caused a network split, a node that could be stalled for hours, and a denial of service (DoS) vulnerability that affected older versions of Bitcoin core.

其他揭露的內容包括可能導致網路分裂的整數溢出錯誤、可能停滯數小時的節點以及影響舊版本比特幣核心的拒絕服務（DoS）漏洞。

“I have to say this is one of the most compelling statements I’ve seen from the bitcoin/Bitcoin Core team in over 10 years,” said Bitcoin developer Eric Voskuil.

「我不得不說，這是十多年來我從比特幣/比特幣核心團隊看到的最令人信服的聲明之一，」比特幣開發人員 Eric Voskuil 說。

“Many other projects have been on the receiving end of this misperception, and it has in fact caused material harm to the community. I don’t know what precipitated this change, but props to you all for stepping up.”

「許多其他項目都受到了這種誤解，事實上它對社區造成了物質傷害。我不知道是什麼促成了這一變化，但支持你們所有人加緊努力。