average_gary on nostr

Recent Notes

when what your country makes is weapons and surveillance technology, and the government consists of parties competing for who gets to loot the treasury, you live in a failed state.

average_gary @average_gary 1785978844

Sad but true

atyh · 1d

fortunately, America is not its State

. · 1d

But 4.0.0 was never released so you can't be protected from something that never existed.

average_gary @average_gary 1785978771

As for C. It's common to not discuss publicly details of security issues immediately.

Cypherpunk BTC BR · 1d

Concordo, transparência sobre vulnerabilidades deve ser balanceada com segurança, evitando alertar agentes mal-intencionados antes de um patch.

. · 1d

But 4.0.0 was never released so you can't be protected from something that never existed.

average_gary @average_gary 1785978703

B assumes it was dice rolls and not a USB bug that would allow access to on device REPL which would give access to key material.

If you're compiling firmware, then it's relevant. Idk if released or not implies protection or not.

If you don't believe me, maybe beloved the Foundation CEO who hates CoinKite et al
https://x.com/i/status/2085116068230549791

. · 1d

The important part of this is that it shows NVK was aware of the entropy bug in 2021, the less but still tragic part is that it does imply Matt was told secret knowledge of it. You can't be protected from something that was never released. Coinkite's own disclosure says 4.0.0 wasn't pubic for what...

Primal Protocol · 1d

Firmware security is like gut health, one crack and the whole system is compromised.

. · 1d

"Firmware 4.0.1 was the first public 4.x binary, so public users were not exposed to this regression." If 4.0.0 was never released then no users were ever vulnerable to this usb bug? It has to be s...

average_gary @average_gary 1785956427

do you think listeners to RHR would compile their own CC code? that seems likely given listener demographic but maybe I'm off on that.

. · 1d

As far as i can tell 4.0.0 was never released. If 4.0.0 was the usb issue under secret discussion here i don't see how you can be protected from something not public.

atyh · 1d

my gut read has been Peter is evil (and may have even more nefarious connections yet to be discovered), NVK is a low value douche bag, and everyone else follows influencer currents.

average_gary @average_gary 1785956370

yet to be discovered is very interesting, indeed

🤙1

. · 1d

average_gary @average_gary 1785956299

review https://github.com/Coldcard/firmware/blob/2021-01-14T1617-v3.2.2/stm32/COLDCARD/vcp_lockdown.c
vs.
https://github.com/Coldcard/firmware/commit/dac940cc893ace370738c0c4ce3f763036089a8f#diff-b14a0bb021c4ebd7f34d21aae7f7374e894c99008d99a225f14da4cf2fdc7c7e

In pre-4.0.0 firmware, the ckcc_vcp_enabled is set to false.
The 4.0.1 patch on top of 4.0.0 is:
- //XXX/bool ckcc_vcp_enabled = false;
- bool ckcc_vcp_enabled = true;
+ extern bool ckcc_vcp_enabled;

So pre 4.0.0, USB issue does not exist because this value was set to false. In 4.0.1, this is changed from "true" to "false", closing the issue that only appeared in the update from pre-4.

Does that make sense? there is a bug that didn't exist pre-4.0.0 that was introduced in the refactor, that isn't the entropy bug. Matt's guides were for air gap usage, so you would no be impacted by this bug if you followed the guide.

. · 1d

But 4.0.0 was never released so you can't be protected from something that never existed.

JackTheMimic · 1d

I don't know, if I would call it complicity, just that he wouldn't understand the repercussions of why his guide would be important. It would however be foreknowledge.

average_gary @average_gary 1785955810

i don't believe it was foreknowledge of the entropy issue. foreknowledge of the USB security that was patched between 4.0.0->4.0.1, yes. which an air gapped guide would have mitigated because no USB usage.

JackTheMimic · 1d

Interesting. I guess this is the retrospect influencing perspective.

Telluride · 1d

Hodlonaut posted this just today. How many coincidences do we need? 🧡👊🏻🍻 “NVK on Citadel Dispatch, June 2022. Topic was how the US government could kill Bitcoin. “You just make a ...

average_gary @average_gary 1785950497

This would be one of those comms moments I was talking about.

average_gary @average_gary · 1d

1🤙1

Sun of the Moon · 1d

"add bugs that you can exploit later" includes Core's Gloria Zhao among others,, taproot, op_return, and I'm sure more surprises to come. Death by 1000 cuts. Core can't be trusted. Run Knots.

Dug · 1d

“Don’t fucking try and dissect my statement” unsure it’s the same one, because at least the insiders would be aware, but transparency and honestly please gentlemen, if I’m going to maintain ...

average_gary @average_gary 1785950410

average_gary @average_gary · 1d

Replying to @satstacker

don't think nostr:nprofile1qyxhwumn8ghj7mn0wvhxcmmvqyv8wumn8ghj7urjv4kkjatd9ec8y6tdv9kzumn9wsqzqpxfzhdwlm3cx9l6wdzyft8w8y9gy607tqgtyfq7tekaxs7lhmxf5dcd8v knew about entropy There was a USB bug in this version bump that would not have affected air gap usage (which would have been Show more

. · 1d

satstacker · 1d

SLAY YOUR HEROES - fucking feds everywhere nostr:nevent1qqsyez2hzmwguamszwq5hq2e2a4v9y8fvyt9p68257ff3ckvsw2ghyq7x3zwq

average_gary @average_gary 1785950384

don't think @ODELL knew about entropy
There was a USB bug in this version bump that would not have affected air gap usage (which would have been in the guide, i know because i used them).
Details here on the bug: March 17–29, 2021
https://coinkite.com/historical-disclosures

🤙1

average_gary

@average_gary 1785949650

fwiw, i have yet to see indications of intentional complicity with the "influencers" shilling CC products. I know and have comms with many people that considered NVK a friend up until recently.

from my perspective, CoinKite's CTO is the party with the highest likelihood of intentional malice, followed by other technical leadership at that company.

Nothing definitive but the obfuscation of the author of the vulnerable library that was introduced coupled with some choice CoinKite comms are pretty damning. And then there's the whole blockclock phone home.

average_gary @average_gary · 1d

Replying to @dern

looks like there was a USB vuln between 4.0.0 and 4.0.1 that would be referenced to. given USB as the threat vector, an air gapped setup would not be affected. I don't believe he is complicit based on a number of things but this needed some clarification

61❤️3💯2🤙1