The Debian OpenSSL bug (CVE-2008-0166) was a critical vulnerability in Debian’s OpenSSL package that severely weakened the random number generator used to create cryptographic keys. This flaw affected SSH keys, SSL certificates, and VPN keys generated on Debian-based systems (including Ubuntu) between September 2006 and May 2008.
The bug was caused by a patch that removed the use of uninitialized memory from the random seed, leaving only the process ID as the primary source of randomness. This reduced the key space to a small, predictable range (approximately 32,767 possible outcomes), making keys easily guessable via brute-force attacks. The removal of uninitialized memory was due to a Debian policy: packages should compile without warnings. The compiler was (correctly) displaying a warning when using uninitialized memory because that's not a normal thing to do... unless you need entropy to generate random keys.
The bug was discovered by chance, a patch was issued, weak keys revoked and everybody lived happily everafter. But if such a huge opensource project with thousands of eyes looking at the code had this issue, I believe ColdCard (a much much smaller operation) acted in error like the quoted screenshot says, but it was not an immediately obvious one. Yes, they did have literally one job and failed at it. Nobody should ever do buisness with them again.But hindsight is 20 20.
It is unfortunate people lost their life savings (literally my worst nightmare; I don't have a ColdCard and this is making it hard for me to sleep), but if it happened to a giant like Debian, it could happen to ColdCard, Trezor, Ledger or Blockstream.
If FTX and Celsius accelerated self-custody, this is going to significantly set it back. Self-custody is already this niche within a niche: stacking sats not being a super common thing to do and self-custody being a sub-set. Needing to roll dice in a windowless room and inputting that in a DIY airgapped device? Not happening at any large scale.
My heart goes to those affected. I'm genuinely sorry this happennd to you.
quoting
nevent1q…sl2f
