比特币核心开发人员推出新的“严重错误”披露政策以增强安全性

比特币核心开发团队引入了“严重错误”披露政策，以改善比特币内部安全漏洞的沟通。

A team of Bitcoin Core developers has introduced a “critical bug” disclosure policy to improve the communication of security vulnerabilities within Bitcoin.

比特币核心开发团队引入了“严重错误”披露政策，以改善比特币内部安全漏洞的沟通。

In a message to the Bitcoin Development Mailing List on July 3, developer Antoine Poinsot and five others acknowledged that the project has historically failed in publicly disclosing security-critical bugs, leading users to mistakenly believe that Bitcoin Core is free of issues:

在 7 月 3 日发给比特币开发邮件列表的消息中，开发人员 Antoine Poinsot 和其他五人承认，该项目历来未能公开披露安全关键漏洞，导致用户错误地认为 Bitcoin Core 没有问题：

“The project has historically done a poor job at publicly disclosing security-critical bugs, whether externally reported or found by contributors.”

“该项目历来在公开披露安全关键漏洞方面做得很差，无论是外部报告的还是贡献者发现的。”

Bitcoin Core is the software that Bitcoin node operators use to access the Bitcoin blockchain, validate transactions, and build blocks, playing a crucial role in securing the over $1.1 trillion locked in the Bitcoin network.

Bitcoin Core 是比特币节点运营商用来访问比特币区块链、验证交易和构建区块的软件，在确保比特币网络中锁定的超过 1.1 万亿美元的安全方面发挥着至关重要的作用。

The new policy aims to enhance communication about the risks of using outdated versions of Bitcoin Core and to standardise the disclosure process, incentivizing researchers to find and responsibly disclose vulnerabilities. Poinsot believes that making security bugs available to a wider group of contributors can help prevent future issues.

新政策旨在加强有关使用过时版本的 Bitcoin Core 风险的沟通，并标准化披露流程，激励研究人员发现并负责任地披露漏洞。 Poinsot 认为，向更广泛的贡献者群体提供安全漏洞有助于防止未来出现问题。

The policy categorises vulnerabilities into four levels of severity. The first stage, ‘Low’, includes bugs that are hard to exploit and have low impact, such as those requiring access to the victim’s machine.

该策略将漏洞分为四个严重级别。第一阶段“低”，包括难以利用且影响较小的错误，例如需要访问受害者计算机的错误。

The second one is ‘Medium’, which covers bugs with limited impact, such as a local network remote crash.

第二个是“中”，涵盖影响有限的错误，例如本地网络远程崩溃。

The last two categories include ‘high’ and ‘critical’, in which there are bugs having significant impact and bugs that threaten the entire network’s integrity, such as manipulating Bitcoin Core to inflate Bitcoin’s supply or committing coin theft, respectively.

最后两类包括“高”和“严重”，其中存在具有重大影响的错误和威胁整个网络完整性的错误，例如分别操纵比特币核心以增加比特币的供应量或进行硬币盗窃。

Low, medium, and high severity bugs will be disclosed two weeks after a fixed version is released, while critical bugs will be disclosed on a case-by-case basis. The policy will be gradually adopted over the coming months.

低、中、高严重性错误将在修复版本发布两周后披露，而严重错误将根据具体情况披露。该政策将在未来几个月内逐步实施。

Poinsot noted that all vulnerabilities fixed in Bitcoin Core versions 0.21.0 and earlier have been disclosed as of July 3, with disclosures for versions 0.22.0 and 0.23.0 to follow later this month and in August. The latest version, Bitcoin Core 27.1, has been adopted.

Poinsot 指出，截至 7 月 3 日，Bitcoin Core 0.21.0 及更早版本中修复的所有漏洞均已披露，0.22.0 和 0.23.0 版本将于本月晚些时候和 8 月披露。最新版本Bitcoin Core 27.1已被采用。

The new policy was praised by fellow developer Eric Voskuil: “Many other projects have been on the receiving end of this misperception, and it has in fact caused material harm to the community. I don’t know what precipitated this change, but props to you all for stepping up.”

这项新政策得到了开发者埃里克·沃斯库尔 (Eric Voskuil) 的赞扬：“许多其他项目都受到了这种误解，事实上它对社区造成了物质损害。我不知道是什么促成了这一变化，但支持你们所有人加紧努力。”