not sure where you're seeing defense. This whole thing is indefensible on so many levels. I'm just trying to figure out the logical sequence if/when a bug is known. Some of that is gaming out the sequence: if NVK had fully understood the problem, either it would have stayed the same (so that he could exploit it later) or it would have been totally fixed (if he was not planning to exploit it). So the somewhat improved but still poor entropy in the later models doesn't make sense to me. I'm also trying to figure out why white hat hacks are not coming up more often as a theoretical solution, because they seem to me the best among terrible options, and it seems to me that Coinkite was uniquely positioned to take this route.

Replies (1)

"there's not much they can do" is a defense. Responsible disclosure protocol: 1. Report the bug 2. Keep confidential until devs have time to take action for prevention (and in this case, remedial action) 3. Devs reach out to possible victims to update them 4. Confirm that measures in (2 and 3) took place and harm has been minimized 5. Disclose to the public Clearly Odell did not do steps 3 and 4 that and possibly let people generate insecure wallets for 5 years. You are doing mental gymnastics to defend someone that doesn't deserve it. Stop coping.