Kevin Hayes retweeted
The thing that makes me so angry is that this didn’t have to happen.
There were so many warning signs.
But too many people chose tribalism, sponsorship and purity.
First of all Coinkite only had a handful of employees, they never employed a full dev team. Instead they were run primarily by an ego maniac who not only refused to cooperate with the larger community but was outright hostile to anyone that didn’t fawn over him.
Coinkite was not ISO certified, they held NO standard formal security certifications.
Instead demanding that every single user should “don’t trust, verify.” Verification is the very reason tech companies hold certifications.
They did no third party audits. This is the part that makes me sick to my stomach that anyone was ever recommending them.
And they had no bug bounty program.
If you know anything about software, anything at all, those are three HUGE red flags.
Furthermore NVK himself aggressively went after his competition.
He registered a long list of domains and squatted on them so Seedsigner couldn’t use them. See @sesi_the_man
He pivoted his “open source code” to new licensing that is "source available" instead of FOSS. See @zherbert
It seems the bitcoin community wrote this all off because… those products made themselves available for other use cases?
Even if Coldcard had been secure, it should have never been pushed onto normies with limited technical abilities.
“Anyone can roll dice.” Sure.
But should someone who has never even heard the word entropy be required to securely create their own? Absolutely fucking not. There are way too many things that can go wrong.
And clearly, a lot has gone wrong.
Do better.
Godspeed.
Kevin Hayes retweeted
The only reason Rodolfo Novak (nvk) escaped scrutiny for so long is that he’s friends with all the right people
But this realization that he’s a liar was long overdue
He made sure his open source competitors wouldn’t get funding from Open Sats.
He lied that his hardware wallets use open source software, when the license in the GitHub repository is Commons Clause (source viewable, but with restrictions that don’t qualify it as open source).
He initially forked the Trezor code and renamed the files to avoid giving credit.
But most importantly, his product always had bad UX that leads users to make mistakes. A $1 chip generates better entropy than your dice rolls. Sometimes automation is better, as it leads to fool-proof results.
It was about time that people woke up and realized that posting pictures of steaks and making up memes about the overpriced mechanical price device (Moscow time) can hide one big asshole who won’t even admit his own mistakes in order to help his users improve their security
