#35858 doc: Add privacy.md consolidating network privacy recommendations

ReviewabilityReviewsAgreementSize
#35858 pablomartin4btc doc: Add privacy.md consolidating network privacy recommendationsReady0Mild79
  • Consolidate network privacy advice into a single reference guide for node operators
  • Document how to use private transaction broadcast along with its limitations, prerequisites, and RPCs
  • Ready to review
  • Concept approval without stated reasons (jonatack)
  • Nonblocking objection: guidance on multi-network deanonymization is incomplete or misleading (jonatack)
  • 79 lines added or modified outside tests
  • 0 lines added or modified in tests
  • 19 lines removed in total
  • 4 files, 2 commits
Documentation#2 of 9
P2 · cleanup
  • P2 after comparing with the other PRs here (assessed alone as P3): Raised to P2: documents a privacy feature's prerequisites and scope limits, where absent/fragmented guidance can lead operators to over-trust private broadcast.
  • P3 because it consolidates fragmented and duplicated privacy advice across multiple network docs
  • Helps node operators understand the prerequisites and scope limitations of private transaction broadcast
Ranking notes
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

Consolidates Bitcoin Core network privacy guidance into a new document, doc/privacy.md, and documents the private transaction broadcast feature. It moves duplicated multi-network unlinkability warnings and onion service isolation advice from doc/tor.md and doc/i2p.md into the new file. It also documents the -privatebroadcast configuration flag, its prerequisites, scope limitations, and associated RPCs.

Problem: Privacy advice for node operators was duplicated and split across doc/tor.md and doc/i2p.md. Additionally, users had no documentation explaining how to use the -privatebroadcast feature introduced in PR 29415, what its prerequisites and limitations are (such as only covering sendrawtransaction and not wallet RPCs), or how to use getprivatebroadcastinfo and abortprivatebroadcast.

Evidence of importance:

  • Suggested during review of PR #29415 by reviewer ismaelsadeeq to consolidate privacy documentation (PR description).
  • Removes verbatim duplicated text between doc/tor.md and doc/i2p.md warning node operators against exposing nodes across multiple networks if identity unlinkability is required (diff, commit 886189e83d).

Scope: Pure documentation change across four markdown files.

Reviewability

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

Agreement

Mild

objection that needs an answer has none yet (jonatack)

Thread notes: The author moved the PR to draft and noted it may be better to close in favor of #36608.

Objections, suggestions, and questions:

ReviewerTypeHarm, request, or questionStatusMust beAuthor repliedQuote
jonatack (member)objection, correctnessguidance on multi-network node deanonymization is incomplete and potentially misleading, especially regarding Tor and I2Popen · author deferred to investigate what could be addedansweredyes2026-08-28: 'As-is, (and it isn't your fault), I think this note is incomplete (and perhaps misleading).'

Support:

  • jonatack (member) (Concept ACK, 2026-08-28): Concept ACK [not substantive]

Participants:

  • jonatack (member, objection, 2 statements 2026-08-28 to 2026-08-28): Concept ACK, but noted that guidance on multi-network unlinkability is incomplete and potentially misleading

Files

0 lines under test/bench/ci.

  • doc/privacy.md +72/-0
  • doc/tor.md +3/-12
  • doc/i2p.md +3/-7
  • doc/README.md +1/-0

Card

The short text the ranking pass compares across PRs.

Creates doc/privacy.md as a single source of documentation for Bitcoin Core privacy recommendations and private transaction broadcasting. It moves duplicated multi-network unlinkability guidance out of doc/tor.md and doc/i2p.md into the new document. It also documents the -privatebroadcast option, explaining prerequisites, scope limitations to sendrawtransaction, and related RPCs. The change was suggested by reviewers during the merge of the private broadcast feature.

Data

dossier JSON · extract JSON · model ledger, generated 2026-10-30T01:12, confidence high, input hash 187f365bd5a55ccd
thread read through 2026-10-29 (5 statements), head 1b07681dfe
labels: Docs · draft

Categories

Documentation

P2 · cleanup (assessed alone as P3; Raised to P2: documents a privacy feature's prerequisites and scope limits, where absent/fragmented guidance can lead operators to over-trust private broadcast.)

Consolidates duplicated privacy warnings across doc/tor.md and doc/i2p.md into a new privacy.md, while adding missing documentation for the -privatebroadcast configuration flag and related RPCs. This provides clear value and clarity for node operators configuring privacy networks, but addresses no urgent failure.

Membership: Has the Docs label and modifies doc/privacy.md, doc/tor.md, doc/i2p.md, and doc/README.md.

Factors: security/stability 0, bug 0, performance 0, user value 1, leverage 0