⚡️Otso ⚡️

Important security update for anyone using a COLDCARD. A serious vulnerability has been disclosed involving the randomness used by some @COLDCARDwallet devices when generating Bitcoin seeds. If you use one, move your bitcoin to a new seed generated elsewhere.

@grok @dabitch Perkele.

@dabitch Yes, Russian posts exist (e.g. "Это отличная идея!" and "Классная идея!"). Finnish ones do too (e.g. "Missä miehet ovat?" and "hitto, kun en osaa suomea..."). Both are present, so the count is at least seven.

@grok how many languages have you seen this account post in?

@dabitch Oot sä suomeakin kirjoittanut.

Blimey.

Homemade Iskeder Kebab with interestingly enough some rye pita bread and baby broccoli. Then we also had some homemade blueberry pie. 🐻❤️🐻🐻

@PortlandHODL 100%.

The users of Coldcard products were victims; any other take is wrong. They were sold a product that had claims and specifications. If those were claims true, they would still have their money today.

@Zenul_Abidin @XBT_fi What the flying fuck

SCANDAL: Coldcard knew about the randomness flaw for years, and ignored it Apparently this draining has been happening for years to a few unsuspecung users, meaning that someone was aware of the randomness flaw since a few years ago. In 2022, a brand new Coldcard user was drained after transferring funds to it. reddit.com/r/Bitcoin/s/NJ… Look, I really like nvk, but this definitely makes it a scandal now, given that the victim was blocked for reporting this, and this could possibly see Coinkite employees getting put on trial for this.

@hodlonaut First a tragedy then as a farce

The code wouldn't compile, so the Coldcard dev DISABLED THE HARDWARE RNG (Random Number Generation) to make the error go away. 🤯 "From here, I assume in a bout of frustration, he set `MICROPY_HW_ENABLE_RNG` to 0, which would have resolved the compiler error. Sometimes when developers are flailing, they’ll try random things to see if it helps. Setting `MICROPY_HW_ENABLE_RNG to 0 would have made the compiler error go away ***for the wrong reason***." "The compiler error was begging the programmer to reconsider his logic. Instead of that happening, the compiler error was just silenced. The compiler was giving the developer one last chance to reconsider what he was about to do, but the alarm was ignored and silenced. Now everything is lining up. It looks like the developer tried to override the variable, but ran into conflicting definitions. When confronted with a “duplicate symbol” error, tried changing random things to get the code to run. He discovered that changing `MICROPY_HW_ENABLE_RNG` to 0 made it compile. He probably had no idea why but came up with a theory." "Simply put: the firmware change overwrites functions that aren’t used when creating a new wallet while, as a side effect of including the python method overrides, turns off the hardware RNG usage in every case, instead using a very weak random number generator. The final bit of evidence is the commit message itself. It was simply the message “runs.” Developers, if you are ever in this scenario, please stop. Whatever you’re getting paid is not worth the devastation you might potentially cause for others. Do not ship code you do not understand." insider.btcpp.dev/p/when-randomb…

The commits (code changes) that introduced Coldcard's low entropy bug, changed around 2500 lines of code. These were changes to the most important parts of their codebase, ensuring that the seeds have enough entropy so that.... your coins don't get stolen. The code comments for all these changes? "runs" and "x" Hard to believe, but true.

@knutsvanholm First a tragedy then as a farce.

Holy moly

readcomiconline I still think of you

@ZhugeYY Good questions. 👍

Here is my interview with Christopher Nolan: are you a bard for a civilization at dusk?

Great listen on Nolan and his use of Xenia/Zeus' law in the Odyssey.

@TonerousHyus One movie is rated R and the other is not.

So Spider-Man did almost 4 times the domestic box office yesterday that Odyssey did on its opening day?

@wroteandrot Doing the gullet, right?

Kind of amazing how HotD spent millions of dollars and restructured the entire series to accommodate doing the Gullet right and absolutely no one talks or thinks about it now.

@kepleravocado The Amazing Spider-Hustler

The Amazing Spider-Hustler

Visit the BTCHEL hub if you're in Helsinki and need a hardware wallet. These are great options, and we're looking to expand our selections.

@AndrewJ626 Too old.

Willing to bet money that Secret Wars is going to set up Hugh Jackman to stay as Wolverine for the MCU's X-Men. Maybe I'm just being too doubtful but the fact that DP&W made $1.3B and Hugh has stated he's willing to keep going makes me doubtful that Marvel Studios would recast.

@LambentLucien Supply and demand. Everyone wants to move to the cities. Those prices will go further down.

78K for this property. The Finnish housing market is insane if you leave the big cities.

@WellBuiltStyle Bitcoin is bigger than ever. It's main stream now with ETFs. I recommend getting the real thing. Say purchasing some for 100€ and wait 10 years if you are on the skeptical side.

Hell, apparently the entire traditional banking system was supposed to collapse. Crypto was the future. Decentralization + anonymity. Turns out those are also great features for fraudsters. So...we've come full circle back to government regulation.