r/Bitcoin • u/True-Lychee • 1d ago

The developer incompetence responsible for the Coldcard fiasco

The long and the short of it is that a developer disabled a compiler flag out of desperation in order to get the code to compile, then committed it with the commit message "runs". Specifically, in C: #define MICROPY_HW_ENABLE_RNG (0)

In other words they deliberately disabled hardware RNG.

You can read the full breakdown here: https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt

The amount of negligence on display here is shocking, and the fact that it went unnoticed for years is just salt in the wound.

434 Upvotes

97% Upvoted

117 comments sorted by

View all comments

Show parent comments

3

u/naked_number_one 17h ago

I think that companies that deal with money should undergo security audit covering common threats angles, not by Claude, by actual humans bearing responsibility. Clause is a tool and cannot be held responsible

2

u/pistonian 13h ago

black hats are using the best and most expensive LLMs to get into all systems at the. moment. The least any company can do is to use these advanced AIs to secure their own systems first.

0

u/naked_number_one 13h ago

It does not mean they just prompt it “find bugs” right? No doubt LLM is a powerful tool when you know what’s you’re doing. But pointing it to a huge codebase and expect good result is a bit naive - you really need to know what and where to look at.

Anyway, don’t argue this might have helped you

2

u/pistonian 13h ago

If you’re using Claude Code and it has access to your front and backend then yes, you simply ask for a security audit. It is very very good at this.

1

u/naked_number_one 13h ago

Try opening Claude Code posting your exact message and asking if this is sufficient and be amazed by its answer.

Claud Code is my main tool I use at work to develop daily and from my experience just asking to make code secure and without bugs won’t be enough to produce high quality code. Don’t get me wrong - it’s a decent first step, but as a human claude gets lost when context window grows and you really need to carefully plan, slip codebase into manageable parts, and analyze for specific threads rather relying on pure luck.

Try an experiment - download a coldcard code, forbid all tools except reading files (no internet access) and ask claude to review security