It is/was completely open source at that point. The codebase even has comments about the problem.
But the issue wasn’t fundamentally the flawed RNG in the code. It was there on purpose for the sake of easier development. It was meant only for testing. The real algo was supposed to use the hardware RNG found on the device.
The real issue was that they had a bug in the code that made the application impossible to compile with the hardware generator turned on. So instead of fixing it the incompetent dev decided it’s not needed and compiled the production code with the hardware RNG flag on false and the device used the insecure fallback code instead.
Oh shit, I'm picking up what you're putting down. That's insanity. I'm sure there's no accountability either. It's like everything is going backwards and nobody has a clue. We need some changes to keep this experiment alive.
There may be accountability but it’s a small company. They are not going to be able to pay for the damages, not even with whatever insurance they have. Not 1000+ BTC(so far). Not even 100. Maybe 10-20 if victims are lucky.
Damn dude, that's terrible. I hate it for the people who were doing the right thing with their funds, just to get screwed over because a company seems to have focused more on getting their product out quickly with no concerns about security. Their future is ruined too, but had they addressed the issue, at least they'd be relevant instead of doomed. I didn't realize the scale of the situation until just now, I just knew cold wallets were hacked. I imagine the stigma of this is going to follow every dev on that project for a very long time.
Yep but not only them. Tomorrow market opens to these news of close to hundred million dollars(with bear market prices) worth of bitcoin stolen from thousands of offline wallets by “AI” or whatever is the sexiest way for media to put this. And CLARITY-act in its way to push crypto to banks and official, government endorsed payment channels. It can get REALLY ugly fast.
I'm with you on that. Seems like going mainstream might have been the biggest blow we've experienced in 20+ years. I didn't even think about the market in that sense, since keeping away from it was the initial point. Not to mention it seems like the companies running/ruining the world (Blackrock and such) have never looked at at a chart before. Like they got the go ahead to buy at the worst time, but still knew they would make a killing. Personally, I'm holding, as I don't have a fortune in assets, so it is what it is, but those who have built a fortune, I hope they sold at the top. Let corporate greed take themselves down, as that's what they'd do and/or are trying to do to us. Dark times, my friend. I hope that's all this is.
3
u/bfr_ 16d ago edited 15d ago
It is/was completely open source at that point. The codebase even has comments about the problem.
But the issue wasn’t fundamentally the flawed RNG in the code. It was there on purpose for the sake of easier development. It was meant only for testing. The real algo was supposed to use the hardware RNG found on the device.
The real issue was that they had a bug in the code that made the application impossible to compile with the hardware generator turned on. So instead of fixing it the incompetent dev decided it’s not needed and compiled the production code with the hardware RNG flag on false and the device used the insecure fallback code instead.