CLN operators: would you install the binary-only security release or wait for the source?

[u/Large-Cress900]

The current Core Lightning security situation creates a pretty unusual decision for node operators.

CLN received a wave of AI-generated vulnerability reports, and several reportedly turned out to describe real issues.

The interesting part is how the fixes are being disclosed.

Instead of releasing the patched binaries and source together, the plan is to give operators signed binaries first while keeping the source patches and technical vulnerability details private for 14 days.

The reasoning makes sense: publishing a security patch can also reveal the vulnerability.

Diff the old and new code and you can start asking:

What validation was added?

Which message is suddenly rejected?

Which boundary check changed?

Which old behavior is the developer trying to prevent?

With AI, that kind of patch analysis can potentially happen much faster.

But it puts CLN operators in an unusual position.

For those 14 days, you can verify that the binary came from the expected developers, but you can't yet fully inspect the security changes or reproduce the patched build from the complete published source.

The alternative, if you don't want to install the binary-only release, is also interesting: CLN's guidance points operators toward --offline rather than simply shutting the node down.

That reduces Lightning peer exposure while allowing the node to continue watching Bitcoin for relevant on-chain activity.

So I'm curious what actual Lightning node operators here would do:

1. Verify the signatures and install the patched binaries immediately?

or

2. Run --offline and wait the 14 days until the source is public?

I wrote a longer analysis of the disclosure strategy, patch diffing, AI vulnerability reports and the "don't trust, verify" problem here:

https://davidebtc186.substack.com/p/found-and-fixed-before-its-public

I'm especially interested in what people running CLN in production think about the trade-off.

[u/pdath]

Mythos can reverse binary patches.

This doesn't solve the problem.

[u/RevolutionaryPick241]

don't trust, verify. it will be always better to run it offline and manually connect to nodes than trusting 4 random gpg keys