Don't forget spam

This was an error by a tool. You can not blame the users for that one I assume.

This doesn't look like rolling dice saved anyone View quoted note →

It saved me for sure... Well .. for now ..

But when you count like this, human error is 100% by definition. But yes I am probably more used to the term user error. And confused those. But your term is kind of useless, when it comes to software. Since every problem that occures with SW is human error. The question is only if it is developer or user issue. And here it is not a user problem.

Lol View quoted note →

Lol, a morbidly accurate way to pinpoint the root cause of the ColdCard hack. In a March 2021 firmware rewrite (version 4.0.0), Coldcard integrated a new cryptography library. The library had a built-in safety guard to check whether the device's hardware random number generator (the dice roller) was active. However, the guard used a C macro that only checked if the macro variable was defined, rather than checking if its value was true. Because Coldcard had it defined as 0 (false), the compiler bypassed the safety check. Because of this macro failure, the device completely ignored its secure hardware entropy source. It silently fell back onto a highly predictable, software-based pseudorandom number generator. This severely lowered the randomness of the generated 24-word seed phrases, turning a supposedly secure cryptographic wall into a searchable, predictable pool that hackers cracked entirely offline. View quoted note →

runs

The last 30 years of software have been about increasing features and complexity. The next 10 years will need to be about ruthlessly reducing attack surface. The issue is way bigger than “bugs” across the whole of cyberspace. It’s structural. A lot of enterprise software is built around patterns that are fundamentally insecure, even before bugs are added. Meaning many software practices are inherently insecure by design, not just insecure in implementation. Problems in the design itself: broad permissions, legacy compatibility, overly complex integrations, and weak defaults. Those are harder to fix because the insecurity is baked into how the system is expected to work. Security has been traded for compatibility, flexibility, and speed.

Forgot? Naw, more like told not to.

💯

Most of your worries are total bullshit, and you're blind to the real threats. Everyone needs to learn this. Zoom out and think about the biggest things you spent worrying about in any given year. Usually they were news stories put in your face by some algorithm and amplified by the usual retards. Compare that list with the things that ACTUALLY hurt you. I will bet anything that the things you worried about were mostly phantoms, whereas the things that truly fucked you, you never saw coming at all.

A decade of threat-modeling Shor's algorithm and the adversary turned out to be an uninitialized C macro. The exotic attack gets the conference talks — the boring invariant nobody wrote a test for gets the funds. Entropy is a supply chain. Audit it like one.

I totally forgot about that quantum fud tbh

I like this one. While people speculate about quantum computers, how AI robots will rule the planet, and how everything will be awesome/sad... The FOSS community keeps shouting "don't trust, verify!" while... no one verifies anything. For years, people prayed to the arrogant 'NVK' instead of... verifying his code. As for the Coldcard owners whose money was stolen, you could look at it from another perspective - some of them just bought themselves some critical thinking. View quoted note →

Were those passphrases generated on device? They would suffer the same prng problem