y'all suck

I used to enjoy rhr, but over the past couple of years it's just degraded into a long infomercial for 1031 projects. The bias is real. I don't blame you guys because no one knows what it's like to walk in another mans shoes and I don't know that I woulda behaved any differently in your situation, we are humans after all. But I hope that you are able to find your objectivity again. 🙏

I practically stopped listening to them and only listen to the Jack mallers show

brutal bear market blues

We appreciate you guys. It’s a learning experience for us all. If you guys see this, I hope we can heal the industry, making solid, user-friendly storage solutions. Follow and work with the guys advocating against hardware wallets and taking flack from NVK for years. Open source, non-BTC specific hardware. Seedsigner BtcCuracao JW Weatherman heavilyarmedc BenWestgate Peter Todd Robert Maxwell Robert Spigler LibertyMugs and Epic Curious

@ODELL Was tough to watch. Thanks for taking responsibility. You guys are a net positive for BTC.

Stay humble & stack sats! 🫡

In light of the coldcard issue, do you know if the bip110 softfork will be delayed?

Mallers LOL. Cantor Fitzgerald, friend of the show.

I think you acted to the best of your knowledge and belief. It's very sad that people have lost their savings. I wouldn't want to be in your shoes. I can see how much you're suffering. Stay humble stack sats!

Mallers show is a view of the world from within the matrix with a side of Bitcoin, from what I've listened to.

Idk he’s pretty down to earth imo

Really? Lol View quoted note →

F fuck owned

F in the chat lads

@ODELL @MartyBent @N Odell, Marty, you guys need to tell NVK he needs to reiumburse everyone. He's got minimum 5000 bitcoin. He needs to do that.

@ODELL "Source viewable" is just a marketing term. The real power of free/libre software comes from the ability to reuse it. This bug would 100% have been found by someone like Foundation if they had been reusing the code for their hardware. Reading code is sooooo hard. Running it on your hardware and checking what it actually does is the real way that bugs are found. This industry needs to relearn all the lessons of the free software movement. Read up on you Richard Stallman. Read The Cathedral and the Bazaar by Raymonds. Back to basics!

Still good?

Whoop, that was close.

You can check the RF coming off it, take a multimeter to various components, etc. it's an airgapped machine, and it's actually painfully simple to just store a Bitcoin key and sign with it. The airgap does MOST of that lifting. Beyond that, it was designed to work with open code. There's no Coldcard Suite like there is with Trezor or Foundation. There's no initializing through Coinkites node like there is with Ledger. No phoning home to an Oracle like there is with Jade. And no wire connecting it to a potentially compromised network like there is with Bitbox. All of which take your choices away and add in an element of trust. Maybe I should be fair and say some of that software is open (so was CC's firmware). Or that Bitbox's wire doesn't even have pins for data (have you cut it open to look?). But just like the assurances about CC's TRNG people are trusting this stuff. So could there be more hardware weaknesses? Sure. But the industry has set a pathetically low bar. And that's why people were so quick to advocate for Coldcards. Just wish more had stressed the line in their own Paranoid Guide about how TRNG key generation required the most trust. And that's not to throw blame at the users (though locus of control is a powerful thing). The RHETORIC NVK used was the particularly damning part. You're too stupid to roll dice well. Our code is so audited and hardware so good, trust the experts. It was a toxic lullaby, and I don't suggest anyone forgive it. But do I think any other off the shelf signer is better when best practices are followed? No. Closest would be Jade, but best practices involve working against their design team at every stage -- rolling your own key and using an airgapped system to get your checksum, hosting your own oracle server, running the additional code so it can operate with QR codes in an airgapped fashion. Just to put it about on par with CC once you realize trusting an RNG is a bridge too far. We're back to square one. Create and OWN your DIY custody apparatus. Because nobody is replacing your coins if it fails.

I left out Bitkey here, as it is a different sort of beast, given that even if their device was dogshit your wallet wouldn't be compromised on its own. I personally don't like a solution where if the government tells Jack to not sign anything and one of my keys is lost I'm out of luck, when I literally can't take steps to back up those keys. Same reason I'm not a huge fan of Casa, Unchained, or even Anchorwatch. They do seem to do what they say they do, but it's counterparty risk I'd just as soon not take on.

Appreciate the honest words and reflections on this. This is a total desaster and the arrogance and negligance that led up to it are unrivaled. The space has a lot to learn from this. Onwards.

What I meant is more that the hw could be as shoddily made as the sw. Ideas and design could be fine, but execution could be just as bad. Not sure the current bricking issues are hw or sw issues, but I think you get my point. But in any case, good hardware with bad software is shit, and bad hardware with good software is also shit. A hw manufacturer needs to get both things right.

Honestly I'm annoyed they had the RNG generation option to begin with, at least without providing the RNG seed to verify before converting it into a seed. That all said, this is because randomness is definitely the hard part with the most at stake. The only other really concerning place would be nonce reuse concerns, but we can verify this isn't happening. Anyway, the hardware is shoddy. I've gone through two CCQ's and sent one tx from one because the first one died just sitting in a box on the shelf (they did replace it at no charge). It's just got a much lower attack surface than the software in this case. Not transferring any sensitive data anywhere, the worst case scenario is denial of service. Well...okay, if the pager attack tells us anything there are worse scenarios. But the point stands that it's not a Bitcoin losing scenario. So I don't see how it could be 'just as bad.' Unless I suppose you're doing something like plugging it in, or using NFC. Or perhaps your evil maid is able to get by the indicator (though this part is arguably firmware too). Why anyone would plug it in or use NFC though is beyond me, and their inclusion was always an eyebrow raiser.

I think this deserves further explanation though. Assumed the mentioned protection is rolling the dice, as that was part of the guides. Yikes, what a mess.

Nobody is waiting on me to confirm or repeat how absolutely of a shit show this is. But this episode and how they conducted themselves are for me a sign of true character. Thank you @ODELL & @MartyBent for being who you are. View quoted note →

The Weekly Streak is dead... 😢

When is Rabbit Hole Recap? I demand Rabbit Hole Recap.

i was already burning out then coldcard took out my legs

Can we get an RHR? We miss you guys.

Bring back RHR!

Simon and Garfunkel just doesn't hit the same without Simon