I’d pivot to selling the movie rights to Christopher Nolan.

Used car salesman > Hardware wallet sponsor

Human slop.

The fatal commit

When random.bytes() runs but doesn't work

What a commit message tells us about the recent COLDCARD bug

hashing and trusting are one-way functions.

Reposting again, because this is what I am focused on. View quoted note →

abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon

GN

F*** this.

Don't influence. Verify.

Always pick a slow news day to announce the new phase of a project. Introducing #safebox #acorn - once released, it will be a separately installable component to manage identity, funds and records that live independently on replaceable relays, mints and blossom servers.

Acorn - Acorn

A protocol-first component for safeguarding user-controlled keys, balances and records.

128 bits of entropy versus 72 bits (more likely, 35)

Unfortunately, the big lesson here is - don't upgrade hardware wallet firmware unless the company has gone through a third-party audit that is signed off.

X (formerly Twitter)

Lucia Miller (@LuciaMillezyj) on X

@giacomozucco You don't need to move anything if your seed is generated before 29.03.2021 because 4.0.1 version wasn't live yet. I think it is impo...

My bet this attack was weeks in the making. Once the attackers assembled enough private keys for high value utxos they executed. My biggest disappointment is relying on a hardware vendor that has 'Don't Trust. Verify.' plastered all over their product marketing and the primary motivation that led to the bug was a 'get out of open source' licensing issue. Let this be a lesson for all in the industry. 'Not your keys, not your coins' rings a bit hollow now. It's more like: 'God plays dice for those who self-custody.'

This is the Ford Pinto moment for the Bitcoin hardware wallet industry.

Ford Pinto - Wikipedia

I notice that @npub12vkc...pugg and @npub13myx...v3qk websites are no longer considered as secure in the Google Chrome Browser. Any idea @npub16c0n...6nvr @npub1jlrs...ynqn ? #asknostr