As far as I know, the Coldcard was designed and evaluated by quite competent people.
The same tools used to exploit the vulnerability in Coldcards are pointed at the legacy banking system designed by...
I thought this would be true at the beginning, and was trying to be generous, as anyone can have a bug. But the software craftsmanship was incompetent on all levels:
* Starting from the management decision to get off open-source for the firmware,
* Using MicroPython wrapping to facilitate shitcoinery, which raised the complexity and added the faulty library to the stack,
* Falling back on a critical path, instead of throwing an error and breaking,
* And what has got to be encryption test cases so bad that they're going to end up in computer science textbooks under "What not to do."
I've been in software development since 1998 and I have **never ever** seen such poor software craftsmanship. Not industry-standard practice and arguably criminally negligible. If we did this in automotive, bioinformatics, or heavy industry, they would sue us into the ground and arrest the CEO.
* Starting from the management decision to get off open-source for the firmware,
* Using MicroPython wrapping to facilitate shitcoinery, which raised the complexity and added the faulty library to the stack,
* Falling back on a critical path, instead of throwing an error and breaking,
* And what has got to be encryption test cases so bad that they're going to end up in computer science textbooks under "What not to do."
I've been in software development since 1998 and I have **never ever** seen such poor software craftsmanship. Not industry-standard practice and arguably criminally negligible. If we did this in automotive, bioinformatics, or heavy industry, they would sue us into the ground and arrest the CEO.
37❤️6🤙3🎉1🎯1💜1💯1
