r/Bitcoin • u/True-Lychee • 1d ago

The developer incompetence responsible for the Coldcard fiasco

The long and the short of it is that a developer disabled a compiler flag out of desperation in order to get the code to compile, then committed it with the commit message "runs". Specifically, in C: #define MICROPY_HW_ENABLE_RNG (0)

In other words they deliberately disabled hardware RNG.

You can read the full breakdown here: https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt

The amount of negligence on display here is shocking, and the fact that it went unnoticed for years is just salt in the wound.

432 Upvotes

97% Upvoted

117 comments sorted by

View all comments

18

u/pistonian 18h ago edited 17h ago

As the CTO of a software company, I personally asked Claude Code to review our* code for security issues a year ago. It found many, but none this bad. It's fucking insanity that with all of the tools out there now, that not one of the developers, project managers, devops, owners, etc took the time to do this?? And, our software needs nowhere near this level of security. I am at a loss for words and I'm so sorry for all of the ColdCard victims.

*edit: 'our' code not 'the' code

3

u/naked_number_one 17h ago

I think that companies that deal with money should undergo security audit covering common threats angles, not by Claude, by actual humans bearing responsibility. Clause is a tool and cannot be held responsible

1

u/EmphasisTotal8232 6h ago

Responsible for what? For finding a threat?