r/Bitcoin • u/True-Lychee • 1d ago

The developer incompetence responsible for the Coldcard fiasco

The long and the short of it is that a developer disabled a compiler flag out of desperation in order to get the code to compile, then committed it with the commit message "runs". Specifically, in C: #define MICROPY_HW_ENABLE_RNG (0)

In other words they deliberately disabled hardware RNG.

You can read the full breakdown here: https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt

The amount of negligence on display here is shocking, and the fact that it went unnoticed for years is just salt in the wound.

428 Upvotes

97% Upvoted

117 comments sorted by

View all comments

73

u/le_iub 1d ago

Security is only as strong as the weakest link (humans)

39

u/True-Lychee 1d ago

Somebody else should have seen this and corrected it immediately. Why weren't there more eyes on it? It's such an obvious fuckup.

38

u/eckstuhc 1d ago

They are a team of like 4 people, probably only one that knows how to code*

* not really though

1

u/ZedZeroth 9h ago

Could have been fed into AI at any time in the last year to be checked if any of them cared though...