Laser on Nostr: We know that #Coinkite CTO Peter Gray was using the interactive debugger at the time ...
We know that #Coinkite CTO Peter Gray was using the interactive debugger at the time that he had introduced the entropy vulnerability to the #Coldcard source via an alias.
In 4.0.0, the major version containing the entropy vulnerability (ifndef fallback to false/pseudo entropy), Peter explicitly enabled the interactive debugger in order to debug integration of libngu, the library he authored under an alias which contained the entropy vulnerability.
This is so that Peter could step through the execution environment to examine variables and control flow at each stage of the #Coldcard firmware on a live device before integrating the changes and distributing them to customers.
The fact that Yasmarang, a false/pseudo entropy, was ultimately selected for use would be glaring and front center in the code path that Peter was verifying using the interactive debugger.
The idea that Peter was too stupid to use Python, which he had been using for decades, and too reckless to verify the implementation, even as he clearly was using the interactive debugger to verify his own libngu library, is frankly absurd.
They think we are dumb.
https://github.com/Coldcard/firmware/blame/75addaefcb5b1861e1c8986195a448ac3f94a303/stm32/COLDCARD/vcp_lockdown.c#L14Published at
2026-08-22 18:18:24 UTCEvent JSON
{
"id": "00000ee6af34f37c9d3f7eed7180813c9ba89d0a75a50ea2802245c7da6ff1f5",
"pubkey": "64acf4055fa826bcab8457e24ef8fba7490abb1e76dbab6aa8752a53a0eb4d4a",
"created_at": 1787422704,
"kind": 1,
"tags": [
[
"t",
"coinkite"
],
[
"t",
"coldcard"
],
[
"imeta",
"url https://blossom.primal.net/fbdae0c72b825520d00a5e7f1234ae3e211594964fb7bb818e6768309f2c748f.jpg",
"m image/jpeg",
"thumbhash yPcBCoALR8loTLO4iICHCEg=",
"dim 1006x223"
],
[
"client",
"Dark Wisp"
],
[
"nonce",
"76377",
"18"
]
],
"content": "We know that #Coinkite CTO Peter Gray was using the interactive debugger at the time that he had introduced the entropy vulnerability to the #Coldcard source via an alias. \n\nIn 4.0.0, the major version containing the entropy vulnerability (ifndef fallback to false/pseudo entropy), Peter explicitly enabled the interactive debugger in order to debug integration of libngu, the library he authored under an alias which contained the entropy vulnerability. \n\nThis is so that Peter could step through the execution environment to examine variables and control flow at each stage of the #Coldcard firmware on a live device before integrating the changes and distributing them to customers. \n\nThe fact that Yasmarang, a false/pseudo entropy, was ultimately selected for use would be glaring and front center in the code path that Peter was verifying using the interactive debugger.\n\nThe idea that Peter was too stupid to use Python, which he had been using for decades, and too reckless to verify the implementation, even as he clearly was using the interactive debugger to verify his own libngu library, is frankly absurd.\n\nThey think we are dumb. \n\nhttps://blossom.primal.net/fbdae0c72b825520d00a5e7f1234ae3e211594964fb7bb818e6768309f2c748f.jpg\n\nhttps://github.com/Coldcard/firmware/blame/75addaefcb5b1861e1c8986195a448ac3f94a303/stm32/COLDCARD/vcp_lockdown.c#L14",
"sig": "75b783cdbbea533f7c3137a61f1e6a2ef6a9931403d0585c2ae94f57497cfc6fa9fef74fbe1638424f36d8e496aa8a7009861fb91cf83b021fb5c22b0a9435a2"
}
