Coinkite news responding to Mallers…
Their claim is that it wasn’t a fallback they built in on purpose. The weak PRNG was already living inside MicroPython’s runtime for unrelated things, shuffling, timing jitter. The setting meant to disable it, MICROPY_HW_ENABLE_RNG=0, didn’t do what they intended. So the runtime’s own default activated instead, because of what they’re calling a link-time error.
I want to be clear about what that does and doesn’t do. It’s a real distinction. “We built a backup plan and it failed” and “we tried to shut something off and the toggle didn’t work” are different kinds of mistakes, and if you’re trying to understand what actually happened at Coinkite, that difference is worth knowing.
What it doesn’t touch. The outcome is the same either way. Seeds generated with a fraction of the entropy they needed, for five years, unreviewed, until it cost people real money. Precision about intent isn’t the same as resolution of impact.
Read it yourself. Decide where the line is for you between an explanation and an excuse. I don’t think it has to be one or the other, and I don’t think Coinkite gets to decide that for you either.
Their claim is that it wasn’t a fallback they built in on purpose. The weak PRNG was already living inside MicroPython’s runtime for unrelated things, shuffling, timing jitter. The setting meant to disable it, MICROPY_HW_ENABLE_RNG=0, didn’t do what they intended. So the runtime’s own default activated instead, because of what they’re calling a link-time error.
I want to be clear about what that does and doesn’t do. It’s a real distinction. “We built a backup plan and it failed” and “we tried to shut something off and the toggle didn’t work” are different kinds of mistakes, and if you’re trying to understand what actually happened at Coinkite, that difference is worth knowing.
What it doesn’t touch. The outcome is the same either way. Seeds generated with a fraction of the entropy they needed, for five years, unreviewed, until it cost people real money. Precision about intent isn’t the same as resolution of impact.
Read it yourself. Decide where the line is for you between an explanation and an excuse. I don’t think it has to be one or the other, and I don’t think Coinkite gets to decide that for you either.
52❤️3❤️1
