These blokes are making some very bold claims, mainly about how easy it is to set up and use...

https://blackbox.host/

Well, I might just have to put that to the test. And if I do, I'm going to write a brutally honest review. Uninvited. Unauthorized. And most certainly unpaid.

I'll try to get it done before the 2600 meeting.

Who first broke the news of the weak PRNG? Do they mention who found the issue?

To those who advocated for Coldcard:

1. Don't beat yourself up too much
2. Disclose if you're being paid for the things you recommend (if you didn't already)
3. Disclose whether you've personally analyzed/audited the product and if not, where the basis for your recomendation comes from
4. If you're not being paid to advertise their product, consider advocating for community projects. Things that are open source hardware, where the community can actually modify the design. Bonus points if there are multiple groups building the hardware.

None of this guarantees you won't ever regret something you recommend, but it provides more transparency and gets you to think about the incentives for building these things and whether they are monetary or not.

If a project claims to be open hardware they should publish their eCAD files (likely a set of KiCAD files).

This is what is required to make modifications, which is the very foundation of open source. Gerber files are generated from eCAD files just like binaries are generates from source code.

The Open Source Hardware Association would never certify a project that only published gerbers.

I consider it dishonest to advertise gerbers-only projects as #OpenHardware. In some ways it's worse than the proprietary hardware vendors calling themselves open source companies.

I want people to know what to look for and to be able separate the companies who are role playing as open hardware from the projects that are living it.

You don't have to choose open hardware, but you should know what you're getting.

This post has nothing to do with ColdCard other than that people might be shopping for new hardware right now.

I feel for these folks who bought coldcards.

Trust in that company has been completely shattered. People expected that buying a closed source hardware product would be run by people who would invest in audits of their firmware and the libraries on which they depend. That's a reasonable expectation, even if it is based on trust instead of verification.

On the flip side, there's open hardware projects like seedsigner and trezor, where it's well known that they're not raking in the money needed to fund a serious audit. Because they are expensive. There aren't a lot of people who can say "yeah, the code looks good" and have that be taken as evidence that the code is vulnerability-free. Their time is valuable.

There aren't any magic answers here. Sure, it's easy for armchair analysts with the benefit of hindsight to say now what people could have done differently. It's a different thing entirely to put in the work to change the game.