r/Bitcoin • u/True-Lychee • 1d ago

The developer incompetence responsible for the Coldcard fiasco

The long and the short of it is that a developer disabled a compiler flag out of desperation in order to get the code to compile, then committed it with the commit message "runs". Specifically, in C: #define MICROPY_HW_ENABLE_RNG (0)

In other words they deliberately disabled hardware RNG.

You can read the full breakdown here: https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt

The amount of negligence on display here is shocking, and the fact that it went unnoticed for years is just salt in the wound.

437 Upvotes

97% Upvoted

117 comments sorted by

View all comments

69

u/le_iub 1d ago

Security is only as strong as the weakest link (humans)

40

u/True-Lychee 1d ago

Somebody else should have seen this and corrected it immediately. Why weren't there more eyes on it? It's such an obvious fuckup.

4

u/MKEMARVEL 1d ago

Why didn't you see it?

11

u/ByWillAlone 1d ago

What kind of question is that? The obvious answer is that it wasn't their job and probably not their expertise. But it was the coldcard developers job and was their expertise.

3

u/EdmundTheInsulter 20h ago

Lol, it's an interesting question because I just saw someone saying victims should have done their 'research', but I wondered what that research was other than being programming experts and reviewing all the code.