Damus
note1qqqr5...
uncleJim21 profile picture
It isn't just plebs though it is very skilled developers.

In a sense I respect the humility behind "I could see myself making this #ifdef error". But IMO it let's the CTO off cheap. This is exactly the type of obfuscation I would introduce if I were up to no good. This is exactly the plausible deniable I would manufacture.

Being real with myself: I could definitely see myself making a fatal error like this that got into an engineering sample lot but NEVER into production. I would lose sleep and probably come up with an empirical way to measure the entropy of seeds produced on the production line itself to detect just such an error.
1
Laser · 5w
Nobody makes the changes Coldcard made without automating testing and the use of an interactive debugger to verify the entropy implementation. Add the use creation of an alibi with the Switck alias. I'm not naive.