Technical Deep Dive into the Entropy Issue

stackernews-entropy-technical-deep-dive

Organisation: Stacker News
Evidence role: Community discussion
Published: 2026-07-31
Source changes: 0
Detected differences: 0
Unreviewed: 0
Copies held: 1

itsrealfake's technical walkthrough of the entropy failure, stressing that a firmware update does not repair an already-generated weak seed. The technical claims are the author's; where they overlap the vendor and Block accounts those primaries are registered separately. Captured through the site's public GraphQL API: the rendered pages crash the capture tab, and the API answers POST from this host. The query fixes the captured surface to the item's title, text and two levels of comments, each with author and absolute timestamp.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 9 Aug 2026, 23:17 UTC.

Earliest copy held Current

seen 4 Aug 2026, 04:15 UTC · Captured here 5,367 chars

What changed from the previous capture 0 lines

Extracted text as captured

{
  "data": {
    "item": {
      "comments": {
        "comments": [
          {
            "createdAt": "2026-07-31T10:14:54.435Z",
            "text": "![](https://m.stacker.news/150298)\n\n[source](https://x.com/KLoaec/status/2083133361799778719)",
            "user": {
              "name": "Scoresby"
            }
          },
          {
            "createdAt": "2026-07-31T10:09:57.608Z",
            "text": "This [comment](https://github.com/Coldcard/micropython/blob/4107246f8a080807b62c3b4838e71e812ea68b6f/ports/stm32/rng.c#L64-L98) from ColdCard's micropython:\n\n\n```\n #else // MICROPY_HW_ENABLE_RNG\n\n// For MCUs that don't have an RNG we still need to provide a rng_get() function,\n// eg for lwIP and random.seed().  A pseudo-RNG is not really ideal but we go with\n// it for now, seeding with numbers which will be somewhat different each time.  We\n// don't want to use urandom's pRNG because then the user won't see a reproducible\n// random stream.\n```",
            "user": {
              "name": "Scoresby"
            }
          },
          {
            "createdAt": "2026-07-31T08:42:20.347Z",
            "text": "> Why Existing Review Did Not Catch It (the real answer)\n\nNobody at coinkite is attacking their code with AI, case-in-point:\n\n> A few weeks ago, we used one of the best available AI models to review our code for security issues, and it did not find this bug or anything serious.\n\nAI is not just a consultant you book for a weekly review. It can be a 24/7 watchdog that isn't just looking for vague \"security issues\" whenever someone feels like checking the code. It can wake up automatically every hour and re-write it's own prompts to attack the problem from different sides.\n\nThis is how AI-powered attackers find these kinds of vulns. So the defenders should probably get with the times!",
            "user": {
              "name": "nullcount"
            }
          },
          {
            "createdAt": "2026-07-31T07:49:30.253Z",
            "text": "actually, entropy was the feature you were missing \n\n![](https://m.stacker.news/150281)",
            "user": {
              "name": "itsrealfake"
            }
          },
          {
            "createdAt": "2026-07-31T14:28:06.931Z",
            "text": "> ## Why Existing Review Did Not Catch It\n>\n> Both RNG implementations had the same function signature, and the intended board-specific TRNG code was present in the binary. Existing review verified that code but did not verify end-to-end symbol resolution and call reachability from wallet seed generation.\n>\n> The relevant preprocessor guard is visible in this section of code:\n>\n> [random.c:22-31](https://github.com/switck/libngu/blob/cf1988aa54969a7d2dcef261ee664a41a7013262/ngu/random.c#L22-L31)\n>\n> The guard used `#ifndef`, which tests whether `MICROPY_HW_ENABLE_RNG` is defined, rather than whether its value is nonzero. We defined that macro as zero, so the `#error` did not stop the build.\n>\n> The hotfix now explicitly excludes MicroPython’s fallback PRNG object and adds a build-time RNG symbol check. The build fails unless the board-specific object defines the global `rng_get()` symbol and the upstream fallback object defines no symbols.\n\n\nI feel like that last bit should've been part of the package from the beginning.  The process should error out if it can't hardware rng generation.  There shouldn't have been a fallback to begin with.",
            "user": {
              "name": "SimpleStacker"
            }
          },

Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.

Held captures