You do. So it has to be a fitting refactor.

I'm not a fan of silent patches and embargoed information in the first place (yet I've still found myself forced to do them). I also agree with modern insights that effective embargo time (ie between find and announcement, and announcement and disclosure) is now hours? A day in total at most? It's insane if you think about it.

This also means that in any case where the exposure has been years, there is only pain. Massive pain.

You'd still have to tell users to regen their seeds, even if you could obfuscate the code change in a larger refactor you'd still have to highlight the issue at a high level.

Core bugs dealt with that way are more run time, afaik they've never had an entropy or RNG bug.

justin_shocknet

how could they release a patch that didn't automatically highlight the issue for attack?

Same way Core does it. Hide it in a refactor.

bitcoin

ColdCard users have allegedly been reporting drains since 2022

>  how could they release a patch that didn't automatically highlight the issue for attack?

Same way Core does it. Hide it in a refactor.