比特币核心开发人员推出新政策来披露安全漏洞

该项目历来在公开披露安全关键错误方面做得很差，无论是外部报告的还是贡献者发现的。

Bitcoin Core Developers Roll Out New Security Vulnerability Disclosure Policy

比特币核心开发人员推出新的安全漏洞披露政策

A group of Bitcoin core developers have rolled out a new policy to disclose security vulnerabilities on the Bitcoin blockchain.

一群比特币核心开发人员推出了一项新政策，以披露比特币区块链上的安全漏洞。

“The project has historically done a poor job at publicly disclosing security-critical bugs, whether externally reported or found by contributors,” said developer Antoine Poinsot in an email sent to the Bitcoin developer mailing list.

开发者 Antoine Poinsot 在发送给比特币开发者邮件列表的电子邮件中表示：“该项目历来在公开披露安全关键漏洞方面做得很差，无论是外部报告的还是贡献者发现的。”

“This has led to a situation where a lot of users perceive Bitcoin Core as never having bugs. This perception is dangerous and, unfortunately, not accurate.”

“这导致了许多用户认为比特币核心从来没有错误的情况。这种看法很危险，而且不幸的是，它并不准确。”

The new disclosure policy would classify disclosed vulnerabilities into one of four categories based on severity: low, medium, high and critical.

新的披露政策将根据严重程度将已披露的漏洞分为四类之一：低、中、高和严重。

Low severity bugs would be disclosed within two weeks after a fixed version is released, while medium and high severity bugs would be disclosed two weeks after the last affected software release reaches its end of life.

低严重性错误将在修复版本发布后两周内披露，而中度和高严重性错误将在最后一个受影响的软件版本达到其生命周期结束后两周内披露。

Critical bugs, on the other hand, would not be considered in the standard policy and would require an ad-hoc procedure regarding its disclosure. The developers would consider any bug that threatens the entire network’s integrity to fall in this bracket.

另一方面，标准政策不会考虑关键错误，并且需要一个关于其披露的临时程序。开发人员会认为任何威胁整个网络完整性的错误都属于这个范围。

The new policy is expected to be gradually rolled out in the coming months, but in the spirit of following through with the promise of appropriate disclosures, a page has been added to the official Bitcoin core website summarizing the vulnerabilities that impacted the network.

新政策预计将在未来几个月内逐步推出，但本着兑现适当披露承诺的精神，比特币核心官方网站已添加一个页面，总结影响网络的漏洞。

The document details 12 disclosures that impacted the Bitcoin network before the version 0.21.0 of its software was released.

该文件详细介绍了在 0.21.0 版软件发布之前影响比特币网络的 12 项披露内容。

One of these bugs was a malicious BIP-72 Uniform Resource Identifier (URI), which is used to facilitate payments and interact with wallet addresses, that could cause the BIP-70 implementation in Bitcoin core to silently crash.

其中一个错误是恶意 BIP-72 统一资源标识符 (URI)，它用于促进支付并与钱包地址交互，这可能会导致比特币核心中的 BIP-70 实现无声地崩溃。

Other disclosures included an integer overflow bug that could have caused a network split, a node that could be stalled for hours, and a denial of service (DoS) vulnerability that affected older versions of Bitcoin core.

其他披露的内容包括可能导致网络分裂的整数溢出错误、可能停滞数小时的节点以及影响旧版本比特币核心的拒绝服务（DoS）漏洞。

“I have to say this is one of the most compelling statements I’ve seen from the bitcoin/Bitcoin Core team in over 10 years,” said Bitcoin developer Eric Voskuil.

“我不得不说，这是十多年来我从比特币/比特币核心团队看到的最令人信服的声明之一，”比特币开发人员 Eric Voskuil 说。

“Many other projects have been on the receiving end of this misperception, and it has in fact caused material harm to the community. I don’t know what precipitated this change, but props to you all for stepping up.”

“许多其他项目都受到了这种误解，事实上它对社区造成了物质伤害。我不知道是什么促成了这一变化，但支持你们所有人加紧努力。”