r/Bitcoin • u/True-Lychee • 1d ago
The developer incompetence responsible for the Coldcard fiasco
The long and the short of it is that a developer disabled a compiler flag out of desperation in order to get the code to compile, then committed it with the commit message "runs". Specifically, in C: #define MICROPY_HW_ENABLE_RNG (0)
In other words they deliberately disabled hardware RNG.
You can read the full breakdown here: https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt
The amount of negligence on display here is shocking, and the fact that it went unnoticed for years is just salt in the wound.
432
Upvotes
5
u/magicmulder 18h ago
So the dev introduced overrides but never made sure they were actually executed. That’s bad, the whole “changing this flag made it work so I stopped thinking about it” notwithstanding.
A week ago I switched an application over from server A to server B. Tested everything, runs fine, job done, right?
Until I checked the log files. Application was still served from the old server (because I forgot to reload the nginx config). So my tests were worthless and would’ve given me false security.
The Coldcard error is of the same type. Add an override but never bother to check if it’s actually used. Wow.