pull down to refresh
How bad it is is up to you.
For me I think it seems a bit hypocritical, since he was accused of the same thing earlier, and in a much tamer fashion, and didn't see that he was doing anything wrong (which, I don't think he was). But then he turns around and gets mad when others do same thing.
Also ironic because he accused his "cloners" of having gaping security holes
Lastly, it seems a massive rework of dependencies was done, seemingly in a fit about "clones", without proper testing.
That's why it looks bad to me.
Ok. Yeah the arrogance doesn't really work, but it never does if you have a hidden defect, especially not the one you were being nasty to others about.
I was more thinking that it is bad regardless of how it looks because of the hidden defect staying hidden for so long. It's kind of irrelevant what was said, because even if this was all polite and there was a defect, there would still be no way to recover from this barring a miracle. Cryptography is hard, especially when everything depends on it, especially when there's not enough scrutiny.
Right, there's the question of all the circumstances surrounding an incident... and the incident itself.
The incident itself was bad enough, that all these circumstances don't really change any of that. It would still be bad even if NVK was a perfect angel of a person.
So maybe I am just reacting to the human angle of the circumstances. The drama and the irony.
So... using Trezor software good, rolling your own, not good? Rolling your own is always risky.
I'm still not sure why this context makes it looks bad or could have made it look better in the end. The thing that was deemed needed was to get off GPLv3, for commercial reasons. This caused the change in libs which caused the bug.
What it does do is highlight that a lot of people make money off of open source software. It always sucks when you see someone pull in a couple million in VC rounds by using your effort - though I think that it hurts more when you were not selling anything to anyone. Also happens in other parts of FOSS, think... wordpress.
Regardless, can you explain "how bad it is"?