Seth's avatar
Seth seth@zap.cooking 2 weeks ago
I think it needs to go further. Open source the software. Open source the hardware. Then compete on execution. Trust has been broken too many times to rely solely on audits. A third party auditor is still paid by the company being audited, which creates an incentive structure that can make independence harder to achieve. The strongest trust layer is one where anyone can inspect, verify, and reproduce the work for themselves.
Clark Moody's avatar Clark Moody
Hardware wallet manufacturers need to start publishing third-party test reports on the quality of their internal random number generators.
View quoted note →

Replies (2)

Hanshan's avatar
Hanshan hanshan@hanshan.io 2 weeks ago
I've been thinking and talking about this a lot with some people. There's not a lot of incentive for people to investigate open source firmware, even if the license is unrestricted. It's largely a particular kind of autist that gets off on finding other people's mistakes and bragging about it online. Always has been. And sure, the LLMs lower the bar to review, but it's still just *a lot of llm reviews* good to have but it's just a single kind of audit. So for now, third party audits are awesome and useful.
↑