average_gary on nostr

Recent Notes

note1keyeg...

average_gary @average_gary 1785978844

Sad but true

. · 21h

But 4.0.0 was never released so you can't be protected from something that never existed.

average_gary @average_gary 1785978771

As for C. It's common to not discuss publicly details of security issues immediately.

Cypherpunk BTC BR · 14h

Concordo, transparência sobre vulnerabilidades deve ser balanceada com segurança, evitando alertar agentes mal-intencionados antes de um patch.

. · 21h

But 4.0.0 was never released so you can't be protected from something that never existed.

average_gary @average_gary 1785978703

B assumes it was dice rolls and not a USB bug that would allow access to on device REPL which would give access to key material.

If you're compiling firmware, then it's relevant. Idk if released or not implies protection or not.

If you don't believe me, maybe beloved the Foundation CEO who hates CoinKite et al
https://x.com/i/status/2085116068230549791

. · 14h

The important part of this is that it shows NVK was aware of the entropy bug in 2021, the less but still tragic part is that it does imply Matt was told secret knowledge of it. You can't be protected from something that was never released. Coinkite's own disclosure says 4.0.0 wasn't pubic for what...

Primal Protocol · 14h

Firmware security is like gut health, one crack and the whole system is compromised.

. · 23h

"Firmware 4.0.1 was the first public 4.x binary, so public users were not exposed to this regression." If 4.0.0 was never released then no users were ever vulnerable to this usb bug? It has to be s...

average_gary @average_gary 1785956427

do you think listeners to RHR would compile their own CC code? that seems likely given listener demographic but maybe I'm off on that.

. · 21h

As far as i can tell 4.0.0 was never released. If 4.0.0 was the usb issue under secret discussion here i don't see how you can be protected from something not public.

atyh · 23h

my gut read has been Peter is evil (and may have even more nefarious connections yet to be discovered), NVK is a low value douche bag, and everyone else follows influencer currents.

average_gary @average_gary 1785956370

yet to be discovered is very interesting, indeed

. · 23h

average_gary @average_gary 1785956299

review https://github.com/Coldcard/firmware/blob/2021-01-14T1617-v3.2.2/stm32/COLDCARD/vcp_lockdown.c
vs.
https://github.com/Coldcard/firmware/commit/dac940cc893ace370738c0c4ce3f763036089a8f#diff-b14a0bb021c4ebd7f34d21aae7f7374e894c99008d99a225f14da4cf2fdc7c7e

In pre-4.0.0 firmware, the ckcc_vcp_enabled is set to false.
The 4.0.1 patch on top of 4.0.0 is:
- //XXX/bool ckcc_vcp_enabled = false;
- bool ckcc_vcp_enabled = true;
+ extern bool ckcc_vcp_enabled;

So pre 4.0.0, USB issue does not exist because this value was set to false. In 4.0.1, this is changed from "true" to "false", closing the issue that only appeared in the update from pre-4.

Does that make sense? there is a bug that didn't exist pre-4.0.0 that was introduced in the refactor, that isn't the entropy bug. Matt's guides were for air gap usage, so you would no be impacted by this bug if you followed the guide.

. · 21h

But 4.0.0 was never released so you can't be protected from something that never existed.

JackTheMimic · 23h

I don't know, if I would call it complicity, just that he wouldn't understand the repercussions of why his guide would be important. It would however be foreknowledge.

average_gary @average_gary 1785955810

i don't believe it was foreknowledge of the entropy issue. foreknowledge of the USB security that was patched between 4.0.0->4.0.1, yes. which an air gapped guide would have mitigated because no USB usage.

JackTheMimic · 21h

Interesting. I guess this is the retrospect influencing perspective.

Telluride · 1d

Hodlonaut posted this just today. How many coincidences do we need? 🧡👊🏻🍻 “NVK on Citadel Dispatch, June 2022. Topic was how the US government could kill Bitcoin. “You just make a ...

average_gary @average_gary 1785950497

This would be one of those comms moments I was talking about.

average_gary @average_gary · 23h

Dug · 1d

“Don’t fucking try and dissect my statement” unsure it’s the same one, because at least the insiders would be aware, but transparency and honestly please gentlemen, if I’m going to maintain ...

average_gary @average_gary 1785950410

average_gary @average_gary · 23h

Replying to @satstacker

don't think nostr:nprofile1qyxhwumn8ghj7mn0wvhxcmmvqyv8wumn8ghj7urjv4kkjatd9ec8y6tdv9kzumn9wsqzqpxfzhdwlm3cx9l6wdzyft8w8y9gy607tqgtyfq7tekaxs7lhmxf5dcd8v knew about entropy There was a USB bug in this version bump that would not have affected air gap usage (which would have been Show more

. · 23h

satstacker · 1d

SLAY YOUR HEROES - fucking feds everywhere nostr:nevent1qqsyez2hzmwguamszwq5hq2e2a4v9y8fvyt9p68257ff3ckvsw2ghyq7x3zwq

average_gary @average_gary 1785950384

don't think @ODELL knew about entropy
There was a USB bug in this version bump that would not have affected air gap usage (which would have been in the guide, i know because i used them).
Details here on the bug: March 17–29, 2021
https://coinkite.com/historical-disclosures

🤙1

average_gary

@average_gary 1785949650

fwiw, i have yet to see indications of intentional complicity with the "influencers" shilling CC products. I know and have comms with many people that considered NVK a friend up until recently.

from my perspective, CoinKite's CTO is the party with the highest likelihood of intentional malice, followed by other technical leadership at that company.

Nothing definitive but the obfuscation of the author of the vulnerable library that was introduced coupled with some choice CoinKite comms are pretty damning. And then there's the whole blockclock phone home.

average_gary @average_gary · 23h

Replying to @dern

looks like there was a USB vuln between 4.0.0 and 4.0.1 that would be referenced to. given USB as the threat vector, an air gapped setup would not be affected. I don't believe he is complicit based on a number of things but this needed some clarification

5🤙1

King Slime · 23h

It was the tranny

atyh · 23h

my gut read has been Peter is evil (and may have even more nefarious connections yet to be discovered), NVK is a low value douche bag, and everyone else follows influencer currents.

dern · 1d

obv poast here if you get a response

average_gary @average_gary 1785949388

JackTheMimic · 23h

I don't know, if I would call it complicity, just that he wouldn't understand the repercussions of why his guide would be important. It would however be foreknowledge.

. · 23h

This is my reasoning: If because of what Novak said to Matt about unreleased 4.0.0 resulted in (A) Matt knew being below 4.0.0 was not vulnerable + (B) Matt knew his guide was not vulnerable ie dice rolls + (C) Matt says he can't say why and to not dissect why Then (D) Are we to believe he never ...