Coldcard issues "extremely important correction"

stackernews-coldcard-correction-fallback

https://stacker.news/items/1542079

Organisation: Stacker News
Evidence role: Community discussion
Published: 2026-08-07
Source changes: 0
Detected differences: 0
Unreviewed: 0
Copies held: 1

Scoresby relaying and critiquing Coinkite's public correction to Jack Mallers, in which the vendor says the weak PRNG was not an intentional fallback but inherited behaviour from MicroPython that became active because of a link-time error. Preserves a key moment in the vendor-response narrative; the quoted correction is Coinkite's statement and Scoresby's framing is the poster's own. Captured through the site's public GraphQL API: the rendered pages crash the capture tab, and the API answers POST from this host. The query fixes the captured surface to the item's title, text and two levels of comments, each with author and absolute timestamp.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 14 Aug 2026, 08:28 UTC.

Earliest copy held Current

seen 7 Aug 2026, 17:01 UTC · Captured here 4,153 chars

What changed from the previous capture 0 lines

Extracted text as captured

{
  "data": {
    "item": {
      "comments": {
        "comments": [
          {
            "createdAt": "2026-08-07T09:33:58.677Z",
            "text": "I remember that the general rule a good counsel will put on a fresh post-it on your screen every morning before you enter your office is to *never argue on a third party platform, or generally, in public*. Like what was said in this scene:\n\n![](https://m.stacker.news/151171)\n\nFor some underground stuff I can see the temptation to just not run things like a business and use that as a growth driver. But if you're on your way out, a measure of professionalism will make it a lot more manageable and allows one to focus on the most orderly winding down. I'm not sure if everyone involved understands that that outcome is rather inevitable now.\n\nIt would of course be the death of MSM, Twitter and the popcorn industry in one big crisis if this were ever to be implemented by everyone of course.",
            "user": {
              "name": "optimism"
            }
          },
          {
            "createdAt": "2026-08-07T09:52:51.257Z",
            "text": "![](https://m.stacker.news/151175)\n\n*a scene from the excellent series Silo*",
            "user": {
              "name": "DarthCoin"
            }
          },
          {
            "createdAt": "2026-08-07T08:03:47.388Z",
            "text": "In response to another person:\n\n![](https://m.stacker.news/151165)\n\n[source](https://x.com/COLDCARDwallet/status/2085551118164132316)\n\nI am strangely fascinated by this trainwreck",
            "user": {
              "name": "Scoresby"
            }
          },
          {
            "createdAt": "2026-08-07T07:53:00.917Z",
            "text": "https://twiiit.com/COLDCARDwallet/status/2085541034243600805",
            "user": {
              "name": "nitter"
            }
          }
        ]
      },
      "createdAt": "2026-08-07T07:52:06.000Z",
      "text": "To say that Coldcard's communication during this fuckup has been lacking is an understatement. It's a mess. \n\nSo far they have done a bunch of stupid stuff including waiting too long to issue a warning, hiding from their customers, seemingly trying to pass blame on to AI and issuing vague \"advisories\" about AI. \n\nToday, I saw this: in response to something Jack Mallers said in a video, Coldcard makes a rare statement about how the low entropy wasn't a \"fallback\" nor an intentional design decision, but rather that it \"was inherited behavior from the underlying platform that became active because of a link-time error.\"\n\nPerhaps their intention was otherwise, but it comes off as defensive which is not a good look for a company whose customers have recently lost $100m.\n\n> Extremely important correction.\n>  \n> [@jackmallers](https://x.com/jackmallers) there wasn’t a weak entropy fallback. I think it’s important to be precise about what actually happened.\n>  \n> The weak PRNG (Yasmarang) wasn’t Coinkite’s fallback—it was MicroPython’s built-in general-purpose RNG, introduced upstream in May 2018. It didn’t become part of Coldcard’s seed generation until the libNgU migration in March 2021.\n>  \n> Most language runtimes include a non-cryptographic RNG like this for general purposes such as shuffling, timing jitter, or other non-security-related randomness. By itself, that’s not unusual.\n>  \n> Coinkite’s design intent was actually the opposite of having a software fallback: seed generation was supposed to rely exclusively on the hardware TRNG and never use the software RNG. Setting MICROPY_HW_ENABLE_RNG=0 was intended to disable that software path.\n>  \n> The issue is that this setting didn’t have the intended effect, and the symbol instead resolved to the runtime’s default implementation. So what people are describing as a “fallback” wasn’t an intentional design decision or a shortcut in the seed-generation logic—it was inherited behavior from the underlying platform that became active because of a link-time error.",
      "title": "Coldcard issues \"extremely important correction\"",
      "user": {
        "name": "Scoresby"

Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.

Held captures