The Nostr Observer

Security & Protocols

Two Days to Fix, Six Months to Tell: Core Ends Secrecy on Readily Found Bugs

As machine review lowers the cost of rediscovery toward zero, maintaining a year-long embargo no longer protects operators—it merely withholds the patch.

For over twenty years, coordinated vulnerability disclosure operated on a settled economic premise: finding a subtle flaw in complex software was costly and slow, so maintainers could safely withhold details for months while node operators quietly patched. That assumption collapsed this week under the weight of machine-assisted code analysis, prompting Bitcoin Core to rewrite its disclosure doctrine.

The turning point was laid bare by Roger in an exhaustive review of a severe Core Lightning flaw [s588]. Reported on 23 April 2026, the vulnerability allowed an attacker controlling a funded 2-of-2 multisig output to crash any peer by broadcasting a channel announcement naming the same node as both endpoints. Because the code wrote the message to disk before validating unique IDs, an unhandled duplicate-assertion tripped on every startup, permanently trapping the daemon in a crash loop. While a one-line ordering fix was merged the very next day, 182 days elapsed before public disclosure arrived on 24 October.

That six-month silence reflected legacy practice, but maintainers recognized the calculus has inverted. In a policy amendment authored by Antoine Poinsot and merged on 22 October, Bitcoin Core formally abandoned embargoes for flaws that can be discovered with minimal effort: The public disclosure timeline will depend on whether we classify a reported vulnerability as easily discoverable. This classification applies to vulnerabilities that can be discovered with minimal effort, such as through a simple LLM prompt. For this category, backported point releases and public advisories will ship simultaneously.

The shift acknowledges reality: when an artificial model can scan hundreds of repositories and uncover thousands of anomalies in an afternoon, an embargo denies defenders the fix while leaving attackers free to rediscover the hole. As Roger observed, The difference between attacker and defender is not who can find the bug. It is who already has the patch. Defense can no longer lean on secrets; it must rely entirely on velocity and rigorous boundary validation.

Infrastructure

Vector Migrates to Magnitude Relay: 38× Faster Queries, 59% Less Disk

Specialized architecture replaces general-purpose stores for encrypted Nostr traffic.

The pursuit of operational efficiency found parallel expression on the network layer as Vector announced the successful migration of its entire relay infrastructure to Magnitude Relay, an in-house engine engineered strictly for gift-wrapped direct messages and group communities [s560].

Replacing the strfry workhorse, Magnitude Relay groups append-only message logs by inbox and community, compressing indexes behind block filters. Replaying real-world production traffic of 4.9 million events across side-by-side servers revealed dramatic performance gains: request response times dropped from 17.4 milliseconds to 0.45 milliseconds—a 38-fold speedup—while community messages reached online peers 72 times sooner. Furthermore, disk usage shrank by 59 percent, down from 27 GB to 11 GB, allowing high-throughput nodes to run comfortably on two CPU cores and minimal memory.

Artificial Intelligence

Speaking Without Text: Block’s Dessa Learns Language by Ear

Audio-native training bypasses the lossy transcription pipeline.

Most conversational interfaces rely on a tripartite pipeline: convert audio into text, feed tokens into an LLM, and synthesize sound from the reply. In doing so, every hesitation, inflection, and emotional cadence is lost to transcription.

Block’s speech team unveiled Dessa, an end-to-end full-duplex speech model trained from scratch strictly on human voice without ever seeing text [s587]. Operating with bidirectional audio streaming, the model can laugh mid-sentence, speak louder upon request, and emit subtle conversational acknowledgments while the user speaks. By eliminating the transcript middleman, native voice models may establish a fundamentally new category of local, responsive interaction.

Monetary Theory

Alchemy and Absolute Scarcity

Weighing recent venture claims of laboratory transmutation, Roger noted that physical elements remain subject to production cost curves: A good whose scarcity rests on how hard it is to make is only as scarce as the cost of making it. In contrast, cryptographic money is defined by invariant protocol rules: The thing that remains scarce in an age of abundance is not material. It is a rule that nobody can print. [s586].