โšก๏ธ๐Ÿ’ฌ TESTIMONIAL - Oomahq : I did my own investigation because I obviously don't trust them. What I found is that the external dependency of the firmware with the critical vulnerability hidden in it was written by CoinKite's CTO DocHex pretending to be someone else. (It's @Coinkite's CTO who made this error, not a junior C developer. It was the senior CTO pretending to be a junior while he talked to himself in issues and PRs.) All of the following can be verified:

Replies (4)

โšก๏ธ MORE - In conclusion @Coinkite CTO wrote the vulnerable code himself trying to pass as someone else. He also has a background in making USB keyloggers, spooky KVM switches and most likely deals with the USG from another company. I'm sorry if all this is painful to take all at once.
Excellently investigation. Let's hope someone does this proactively too, for other projects ๐Ÿ˜… I'm wondering if there is any chance this bug was intentional...
โ†‘