i wont be joining cold card lynch mobs.
Login to reply
Replies (9)
Same. Heck I'll probably use mine.
As far as I can tell it still holds keys just fine, and signs fine.
It'd be nice to see NVK maybe tossed out and someone run with what is solid about them and incorporate better testing, and change the rhetoric and marketing a bit though.
Trashing seedsigner was a bad look, doing fast and dirty coding with minimal comments on commits was a bad look, and downplaying dice rolls was a bad look.
But the core design that made me choose Coldcard in the first place is still mostly good design and that's a rarity. I'm trying to see if running my own oracle can make a Jade an acceptable option but am not convinced yet.
Bitbox's attitude about airgaps seems just as dismissive as NVK's attitude about seedsigners, and I generally don't fuck with companies that support shitcoins, even if they have Bitcoin only firmware. Which obviously rules out Trezor and Ledger. Bitkey is a little too close to custodial for me but I do appreciate their thoughtfulness around the tradeoffs they're engaging with. If I were to recommend one for people who find rolling dice difficult they are probably who I'd look at, but I really think it's study first, then buy and hold Bitcoin.
Coldcard got into this mess because there's just no real market forcing them to do better. People are happy to settle for trash.
Never join the lynch mob. It's unconscious madness.
NVK himself tried to lynch SeedSigner guys, shit on Monero. That should have told you everything you need to know about him.
I think everyone concurs that the features and solidness of the hardware wallet itself is secure and there are more positive security features than anything else out there on the market. That being said, when I first held the MK3 I knew I wouldnt trust the RNG, since that is placing all your trust in one place which could be subject to human error at a critical point. Not saying I foresaw this, but DID feel uneasy about it. Nvk also mentioned many times u should use dice rolls over any computer generated, which leads me to believe he removed some importance to having that process scrutinized further. In my opinion it is a turning point to take it in the chin, make the affected users whole again and double down in security for the future.
I mean, nothing changed about them as airgapped signing devices aside from the RNG issue. There are a few things the RNG gets used in but they're lesser used features. Key teleport, hsm, that sort of thing.
Many are migrating out of an abundance of caution, but I haven't seen anything detailing an attack vector that applies.
We do know more about their sloppiness and poor testing though, so that's enough for some I guess...
Lynch mobs are lame and nobody knows what "psychopath" means apparently.
yeah the thing bothering me is the sloppiness and rushed approach to commits with such poor documentation. But I feel like people will go over everything with a fine toothed comb now and we will hopefully learn of any other potential exploits
Lynch the fucker 👨🌾
Cypherpunks write code.
Anything else is a relative waste of time.
Almost makes you sad they're still gonna go under.
Hope whoever gets their IP in liquidation open sources everything, because while the company was fucked the design is largely good.