Student Of Things

@tayvano_ @presel_ Maybe next time people will pay attention when people like me post “Critical Vulnerability” in regards to a hardware wallet next time. Or maybe they won’t post, because you’ll call them mean names.

@studentofthings @presel_ That’s not what you just tweeted for attention you whore.

Just confirmed, I found the Coldcard RNG bug 11 months ago and never reported it because they didn’t acknowledge me on the first one I reported.

@tayvano_ @presel_ Some things are hard I know, I had a finding. Many findings. But findings aren’t reports and they have to be manually validated as reachable. You either get that or you don’t.

Again, I didn’t. You did. You found the vuln. And you didn’t share it. Deliberately. A fact you seem to be quite proud of. You can try to turn this on me all you want but I didn’t choose to not disclose an fucking really bad entropy issue. You made that choice.

@tayvano_ @presel_ I didn’t know, that’s the thing some have a hard time understanding. It’s a finding that requires analysis. Time and effort I was not going to commit after being brushed off. Why didn’t you do it?

@presel_ @studentofthings And then after the dam broke, as people were still in the process of dying, I posted about knowing it would happen before it happened

@PortlandHODL I did similar on Seedsigner yesterday.

Coldcard Dicerolls: Verification Report I spent a lot of time today verifying the Coldcard Diceroll seed path in multiple firmware versions. The implementation is correct and can generate up to 256 bits of entropy with 100 dice rolls. Full report below. github.com/portlandhodl/c…

If Coinkite even acknowledged the critical bug I found and reported, even without credit, a thousand other researchers would have put eyeballs on the rest of the code. That’s what happens in a functioning ecosystem.

@Convertbond MSTR and ETFs are drawing investors away from the core promise of Bitcoin. I know Bitcoiners who would rather have yield than sovereignty. It’s not hard to understand, but Bitcoin’s promise isn’t broken.

@presel_ I reported a rusty bolt but it wasn’t worth my time to check every rusty bolt after not getting an acknowledgment.

@studentofthings I found a crack in the dam but I didn’t report it because they never paid me for when I told them about the rusty bolt on the bridge.

@DBonatOliv It was just in my notes on a VM that I closed and didn’t touch for months.

@studentofthings To whom did you publish it?

@PabloSabbatella I wrote about it here. digitaloperatives.com/2023/07/29/bug…

This is huge. Someone found Coldcard bug 11 months ago. I have been saying this for a long time now: most bug bounty programs (if they even exist) work like shit and they are incentivizing incidents and black hats, rather than protecting users.

@RealbitcoinMD Well, I assume any research you do hand in hand with a AI company to gets shared with national actors. 🤷🏼‍♂️

@studentofthings If you did post it on Reddit or linked in, it probably helped AI find it in the first place. The main takeaway here is that Coinkite as a company whose wallets held at least $2 Billion dollars of Bitcoin was as professional as the dudes in Mall Rats.

@fermentedfranco @cguida6 @LukeDashjr Correct, as I stated in the OP, I didn’t report that bug or any other to them because they didn’t credit me for the first one… So I went on to other research/effort where the vendor cares about security. But again, each would have required human effort to validate.

@cguida6 @studentofthings @LukeDashjr Yes, they stated critical if "an attacker gains physical or indirect access to the device".. No mention of RNG

@Mullick_OG xor eax, eax; ret

So just to be clear, you are upset that you discovered a vulnerability. You didn't even understand and nobody gave you credit for it? If you understood it, you should have done a lot more after the company didn't respond to you. Seems to me like you were farming bug bounties using AI and didn't grasp what you had

@presel_ @w_s_bitcoin @BlockUnmasked 👋🏻

@w_s_bitcoin @BlockUnmasked Who is this dude btw claiming he found it but did not report it

In 2024, victims came to us with bitcoin missing from Coldcard wallets. No malware, no phishing. We traced it to weak seed entropy and filed reports with the manufacturer and multiple agencies. Two years later: $38M swept in 25 minutes. blockchainunmasked.com/post/coldcard-…

@sunny051488 @presel_ @w_s_bitcoin @BlockUnmasked You trust them?

@presel_ @w_s_bitcoin @BlockUnmasked Even coinkite is saying that’s fake news 😂

@DBonatOliv I did in fact try that on the one I published. Went nowhere.

@studentofthings You should have denounced them publicly. People would've saved their funds, but they would still be afraid of using their products again, because of their false advertising. A person is responsible for the truth they find. By not making it public, you allowed this to grow larger

@ndeet @kliberaali Thanks, will take a look!

@studentofthings @kliberaali fyi, they released firmware 4.2.0 for mk2 and mk3 models (after getting ridiculed for not doing so), you still state that there is no update

@CosmicXXX1984 Certainly possible when a user says “go find ways to make money”.

@studentofthings Well in the future, if not ethically contained, when the AI eventually becomes self aware, it will act in it own best interest and steal the BTC, currecies, assets, Classified Information, Top Secret compartmented highly sensitive highly valuable global changing whatever.

@mochammadrafi27 We use all kinds of models. I’m starting to lean more heavily on open weight models because of the privacy and less nanny-state vibe.

@studentofthings Interesting, what AI model you use?

@tayvano_ @MonNomEstSed @_Gendy_ And everyone else now can see the reasons why researchers don’t disclose their work. Not only no credit, but animosity. You could have analyzed Coldcard, why didn’t you do it? 🤦‍♂️

@studentofthings @MonNomEstSed @_Gendy_ Yeah and you appear to be an autistic, selfish fucking prick doing victory laps when thousands of people are actively losing literally hundreds of millions of dollars