You do. So it has to be a fitting refactor.

I'm not a fan of silent patches and embargoed information in the first place (yet I've still found myself forced to do them). I also agree with modern insights that effective embargo time (ie between find and announcement, and announcement and disclosure) is now hours? A day in total at most? It's insane if you think about it.

This also means that in any case where the exposure has been years, there is only pain. Massive pain.

optimism

You'd still have to tell users to regen their seeds, even if you could obfuscate the code change in a larger refactor you'd still have to highlight the issue at a high level.

Core bugs dealt with that way are more run time, afaik they've never had an entropy or RNG bug.

bitcoin

ColdCard users have allegedly been reporting drains since 2022

justin_shocknet

You'd still have to tell users to regen their seeds, even if you could obfuscate the code change in a larger refactor you'd still have to highlight the issue at a high level.

Core bugs dealt with that way are more run time, afaik they've never had an entropy or RNG bug.