What's your take on this moment?

[decodx]

<...>
This get together is something that Ledger and others should form themselves, hardware wallet companies should be the ones doing this,

It's funny that you mentioned Ledger, considering they use closed-source firmware and proprietary secure elements. An independent external audit of their codebase is practically impossible. But to mitigate lack of total transparency, Ledger does have an internal security team (the Donjon).

why are third parties coming together to clean the mess of people who are supposed to protect against vulnerabilities in crypto space? I don't get it.

You don't get how open source software works? All software can have bugs. The whole point of open source is that third parties can actually find and fix them.

[justdimin]

It's a good movement, is all I can say, because there is basically no incentives involved and they are doing this voluntarily only for the betterment of the community and this industry, unless they have ulterior motives hidden from the general public, but we shouldn't think negative about such positive things.

After the recent coldcard attack, the community must have learned one thing: always use systems, such as hardware or anything like that, only if it has open-source software that can be publicly verified by anyone with knowledge about it. When something is open-source, it can be checked by other developers who aren't a part of the project and won't pass biased judgements, this will allow people to have more trust in the projects and also be safer when it comes to their financial holdings.

People will also learn to use passphrases on their wallets from now on, because this attacked has proved that just keeping your seed phrase safe is not enough because you never know, your seed phrase might have reached someone else before it reached you after it was created.

[Die_empty]

The major attraction of open-source projects is that everyone can review the code, identify errors, and propose necessary steps. I know it is everyone's responsibility to check for bugs in these decentralized wallets because we are all enjoying the benefits. But it is frightening that it is only when there is a problem that Bitcoiners with technical skills will start to review Bitcoin projects. My take is that these reviews should be done before these vulnerabilities cause harm.

But I would have to appreciate the effort of the Bitcoin Red Team. They have engaged in a selfless act that deserves commendation.

[OcTradism]

The major attraction of open-source projects is that everyone can review the code, identify errors, and propose necessary steps. I know it is everyone's responsibility to check for bugs in these decentralized wallets because we are all enjoying the benefits. But it is frightening that it is only when there is a problem that Bitcoiners with technical skills will start to review Bitcoin projects. My take is that these reviews should be done before these vulnerabilities cause harm.

But I would have to appreciate the effort of the Bitcoin Red Team. They have engaged in a selfless act that deserves commendation.

With users, not all users have to review the code because they are not capable for it. If all users have to check the code before using Bitcoin blockchain, Bitcoin wallets, I am sure Bitcoin already failed. Fortunately, code checking can be done by community members and there are many people are technical capable to do that, then publish their reviews.

Additionally, reviews will be reviewed by the other people too, so it's how a project with open source code can be considered as reliable and quality if code has been reviewed by many people.

[Die_empty]

With users, not all users have to review the code because they are not capable for it. If all users have to check the code before using Bitcoin blockchain, Bitcoin wallets, I am sure Bitcoin already failed. Fortunately, code checking can be done by community members and there are many people are technical capable to do that, then publish their reviews.

Additionally, reviews will be reviewed by the other people too, so it's how a project with open source code can be considered as reliable and quality if code has been reviewed by many people.

I am not saying that everybody needs to check code before using Bitcoin. My point is that nothing stops anybody from gaining the requisite knowledge to review code. Since the code is open source, you can review it if you have the knowledge. Unfortunately, not everyone has the skills, so we depend on the publications of others. So we benefit from the voluntary work of others since we enjoy a safe, decentralized system. 

[Woodie]

This discussion will now spill over to open source Vs closed source, if coldcard had run their business on an open source platform whatever vulnerability that was recently exploited would have been found and the hack would have been avoided!!

But following all the chatter about this incident , some people are saying this could have been an inside job because they themselves made a joke about this entropy generation bug back in 2021.. and 5years later boom hacked by the the very  "entropy generation bug" talk about coincidence!


Credit: cyber scrilla

-------

Goodluck to Bitcoin Red Team, hunting season is on

[decodx]

This discussion will now spill over to open source Vs closed source, if coldcard had run their business on an open source platform whatever vulnerability that was recently exploited would have been found and the hack would have been avoided!!
<...>

Except Coldcard was open source... Well, sort of. The RNG vulnerability sat right there in the open repo for years, and it still went completely unnoticed until it got exploited. The problem wasn't that the source code was unavailable for inspection, but their arrogant attitude toward criticism and their choice to block a massive chunk of developers who wanted to use, and naturally audit, their code.

Nobody is going to waste hours doing free audit work for a company that acts hostile the second someone finds a flaw.

[BluebloodCXVI]

Honestly, I think this is probably the best response that the Bitcoin community could have had after the whole Coldcard incident.

AI has helped to speed up the process, but it was still humans that verified the findings and pushed for fixes.
Of course incidents like this cause a lot of damages but the real strength of an open source software is that bugs can be independently scrutinized, disclosed and fixed rather leaving it unaddressed.

So if bugs can now be found faster and all these bitcoin related software projects are forced to take security more seriously, then that’s definitely a good thing for the entire bitcoin ecosystem.