- Radicle, a code-sharing tool, sends private projects between computers as plain text.
- Every version released so far does it, and there's no fix yet.
- A second flaw lets an attacker who knows a trusted computer's ID pose as it.
- Private projects already sent should be treated as leaked.
Radicle is a place to share code, like GitHub, but people's computers swap code straight with each other. Those computers are meant to scramble their traffic so people watching the connection can't read it. They agree on keys to scramble with, then send everything as plain text anyway, private projects included. Every version so far does this.
Kostis Maninakis, a software engineer, found it while building his own Radicle program that runs in a web browser. His program scrambled its messages the right way, and real Radicle computers couldn't read them. So he recorded what they sent back and saw plain text. Later he recorded himself copying one of his own projects, and pulled its saved changes back out of that recording, author names and all.
That means anyone watching the connection between two computers, like an internet provider, can read that traffic. In August, someone reported a second flaw. Private projects are supposed to go only to computers with an approved ID. But an attacker who knows one of those IDs can pose as that computer and grab the project. The list isn't public, so an attacker who can't watch a connection would have to guess.
The two flaws work best together, because someone watching a connection sees the IDs at both ends, and those are normally on the list. A VPN or Tor can hide the traffic from some watchers, but the team says that isn't enough, since an attacker can still pose as an approved computer. Maninakis reported the plain text problem in June and agreed with the team to keep it quiet for about three months. It went public in September, before any fix. The team says to stop sharing private projects over the network and to treat any already sent as leaked. Any passwords or keys stored in them as plain text should be changed.
Radicle vulnerability disclosure post
The fix is planned for version 2.0, which isn't out yet and won't be able to talk to older versions. So the Radicle network is expected to split into upgraded and older computers that can't reach each other. The team says the flaws don't let anyone fake code, but no fix can undo what's already been sent.
