pull down to refresh

1697 sats \ 4 replies \ @Lobotomite 31 Jul \ on: Mk3 Security Advisory security bitcoin bitdevs

Block's security team posted a blog on their analysis of the exploit.
https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware

write
compose
155 sats \ 2 replies \ @k00b OP 31 Jul

mfing macros

they used

#ifndef MICROPY_HW_ENABLE_RNG

when they meant

#if MICROPY_HW_ENABLE_RNG == 0
reply
126 sats \ 1 reply \ @Lobotomite 31 Jul

I never got far enough into C to learn about ifndef. It seems like a fairly different thing than a boolean comparison. You think someone brain farted, or an accidental fat finger?

reply
135 sats \ 0 replies \ @k00b OP 31 Jul

Brainfart. C macros are notoriously inscrutable. It's a really easy mistake to make and macros make the error really easy to miss and mistest. No one, and I'm sure others have audited the code, saw this until now.

I like macros, but mostly because I like inscrutable things sometimes.

reply
3 sats \ 0 replies \ @BlokchainB 31 Jul

Great report!

reply