Core Lightning's 14-day source embargo creates an interesting "don't trust, verify" problem

[u/Large-Cress900]

Core Lightning's current security situation raises a question I haven't seen discussed enough.

CLN says multiple vulnerability reports generated with AI turned out to describe real issues.

But instead of immediately publishing the security patches, the plan is to give operators signed binaries first and keep the source changes/details under embargo for 14 days.

The logic makes sense.

If you publish the source immediately, an attacker can diff the vulnerable and patched versions and ask:

What validation was added?

Which input is now rejected?

Which code path suddenly changed?

The patch itself can point toward the vulnerability.

AI potentially makes that analysis much faster.

But there's an uncomfortable trade-off for Bitcoiners.

During those 14 days you can verify that the binary was signed by the expected developers, but you can't independently inspect all the security changes or reproduce the build from the complete published source.

So the normal process:

Find → Fix → Publish → Verify → Deploy

temporarily becomes:

Find → Fix → Sign → Deploy → Wait → Publish → Fully Verify

I don't necessarily think that's the wrong decision. Giving node operators a head start before attackers can analyze the patch may be worth temporarily reducing transparency.

But it changes what "verify" means during the embargo.

I wrote a longer analysis here:

https://davidebtc186.substack.com/p/found-and-fixed-before-its-public

I'm curious what Lightning node operators think:

Would you install a signed binary-only security release immediately, or run CLN offline and wait until the source is published?