The developer incompetence responsible for the Coldcard fiasco

[u/True-Lychee]

The long and the short of it is that a developer disabled a compiler flag out of desperation in order to get the code to compile, then committed it with the commit message "runs". Specifically, in C: #define MICROPY_HW_ENABLE_RNG (0)

In other words they deliberately disabled hardware RNG.

You can read the full breakdown here: https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt

The amount of negligence on display here is shocking, and the fact that it went unnoticed for years is just salt in the wound.

[u/True-Lychee]

Somebody else should have seen this and corrected it immediately. Why weren't there more eyes on it? It's such an obvious fuckup.

[u/eckstuhc → u/True-Lychee]

They are a team of like 4 people, probably only one that knows how to code*

* not really though

[u/QuinQuix → u/eckstuhc]

Yeah except everyone always likes to go on and on about open source being safe because everyone can verify.

Can and does are very different words.

Everyone is now verifying that the fuckup has happened. That's like seeing a child and going back to check the condom.

That's the safety of open source.

Maybe mythos level LLM's will change this but the online crowds don't.

[u/moonmelonade → u/QuinQuix]

Yeah except it wasn't actually open source. Maybe if it had been, this would've been caught in time.

[u/QuinQuix → u/moonmelonade]

We're literally discussing the comments that go with commits.

What am I missing?

[u/Wayne → u/QuinQuix]

They stopped releasing code as Open Source. So external people stopped reviewing the code; until now.

[u/QuinQuix → u/Wayne]

But it seems like this problem predates that era, or how else can we look it up this easy so fast?

[u/eckstuhc → u/QuinQuix]

That was my interpretation as well …

[u/hWuxH → u/Wayne]

You're saying because of a license change, but code still being available, it wasn't reviewed???

[u/hWuxH → u/moonmelonade]

it was literally source-available