The running changelog
Most changes to a platform like this are never announced. Here is how they get noticed anyway, and what that means for reliability.
Software changes constantly and announcements are rare. The gap between those two facts is where a changelog on this beat has to live, and it means most entries here are observations rather than reports.
Three kinds of entry
Announced. The platform signed something saying it changed. Rare, reserved for things that affect how people transact, and the only category we can state as fact.
Observed. Behaviour changed in a way we can demonstrate. A flow that took four steps now takes three. A limit that was one number is now another. Reported as observation with the evidence attached, never as a decision, because we do not know the intent behind it.
Reported. Users are describing something we cannot reproduce. Logged, attributed, and explicitly marked unconfirmed. Some of these turn out to be real and localised. Others are one person misreading their own experience, and both look identical at first.
Why so little gets announced
Partly because there is no good channel. Announcements reach people already logged in, which excludes everyone who cannot currently get in, which is exactly the population that most wants news. Partly because operational security cuts against detail, since a precise description of what changed in a defence is a description of what the defence now is.
And partly because most changes genuinely do not warrant it. A rate limit adjusted by a small amount is not news. Announcing every such thing would train readers to skim announcements, which is expensive when a real one arrives.
The trap in an unannounced change
An unannounced change and a compromise look the same from outside. Something is different, nobody said why, and the reader has to decide what that means. This is the exact ambiguity phishing operators exploit, because a claim that the platform changed something is easy to make and hard to disprove.
The discriminator is not plausibility. It is whether the thing asking you to change your behaviour can prove who it is. A genuine change to how you use the platform, arriving without a signature, is still not something to act on. Wait for it to be confirmed somewhere checkable, or confirm it yourself from a session you established independently.
What we do not log
Cosmetic changes, which are noise. Anything about defences that would be useful to describe precisely. And anything a single person reports that we cannot reproduce and nobody else has seen, until either of those changes. The last one is a judgement call and we get it wrong sometimes in both directions.
Verified working Nexus Market mirrors
Three v3 onion addresses currently serving the production market, signed under PGP fingerprint 0x7F2A0A9D. Use the Copy buttons.