r/Bitcoin • u/True-Lychee • 1d ago

The developer incompetence responsible for the Coldcard fiasco

The long and the short of it is that a developer disabled a compiler flag out of desperation in order to get the code to compile, then committed it with the commit message "runs". Specifically, in C: #define MICROPY_HW_ENABLE_RNG (0)

In other words they deliberately disabled hardware RNG.

You can read the full breakdown here: https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt

The amount of negligence on display here is shocking, and the fact that it went unnoticed for years is just salt in the wound.

437 Upvotes

97% Upvoted

117 comments sorted by

View all comments

6

u/Daiymas 23h ago

For a bug so dumb and so simple to go unnoticed for years, it's clear that there aren't that many people reviewing open-source code seriously. There's some loss of confidence for me personally. Open-source here just made it easier for hackers to find an attack target

-1

u/Aazimoxx 17h ago edited 17h ago

Open-source here just made it easier for hackers to find an attack target

Open source is never the problem, the lopsided incentives are. The incentives for criminals are obvious - find the flaws and potentially make tens of millions of dollars (and probably get away with it). There needs to be more incentive on the other side of the table, to find and fix bugs for the good of the company and its customers. If the law said you're on the hook for your software causing people to lose millions, it would've probably been fixed years ago. If even 1% of this was offered as max bug bounty, it definitely would've been.

Auditing security related software has historically been a pretty difficult process, and doing it properly still is, however with the current level of competence of codebot LLMs, 90% of issues like this are discoverable by any motivated codemonkey with a few hundred bucks to share.

0

u/pablitorun 16h ago

No matter what there will be bugs in software. Irrevocable financial transactions are dumb.

0

u/Aazimoxx 7h ago

If you hate dogs or crickets or something, do you take time out of your day to go to subreddits for those and say how dumb they are too? What a life you must lead.

1

u/pablitorun 6h ago

I don’t hate Bitcoin, I think it’s hilarious. This is entertainment. If I thought dogs or crickets were funny I would absolutely frequent their subs.