Damus
HODL · 6w
Worth a read https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt?r=2jfs7&utm_campaign=post&utm_medium=web&triedRedirect=true
thepurpose profile picture
Not to justify things, but this was in front of everyone's eyes for 5 years. Therefore I assume:

a) nobody looked at it,
b) some looked at it and didn't bother to further investigate,
c) some looked at it, investigated, and the findings were quietly buried. I.e., it was known but inconvenient to act on,
d) some saw it, investigated, understood the severity, but lacked the authority or leverage to force action.
1❤️1
Jay · 6w
This just goes to show that "it's open source" is never sufficient to make a case that the code is correct, secure, or even works. Only when people build on that code and actively use it in their own projects do these kinds of bugs get found. And NVK spent his every waking hour to ensure that never...