Coldcard Firmware Bug Cut Seed Entropy to 40 Bits, Coinkite Urges Fund Migration

·1 views

Coinkite warned users on July 30 that Coldcard Mk3 wallets running firmware 4.0.1 or later generated seed phrases using a software-based random number generator instead of the intended hardware RNG, due to a bug introduced in 2021. The flaw reduced effective entropy to roughly 40 bits on the Mk3, far below the expected 128 bits, while Mk4, Mk5, and Q devices were also affected but achieved around 72 bits by mixing in randomness from their secure elements. Because the weakness lies within the seed itself, an attacker could derive and check vulnerable wallet addresses against the public blockchain without ever touching the owner's device. Coinkite has released patched firmware — version 5.6.0 for Mk4 and Mk5, and 1.5.0Q for the Q — but the fix only secures newly generated seeds and does not strengthen existing ones. Affected users are advised to install the corrected firmware, generate a fresh wallet, and transfer their funds away from any seed created under the vulnerable versions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How AI Tools Like Claude and Copilot Are Speeding Up Code Reviews

Developers are increasingly using AI tools such as Claude, ChatGPT, and GitHub Copilot to assist with code reviews, handling routine checks for bugs, security flaws, and performance issues in seconds. These tools can be integrated into CI/CD pipelines via GitHub Actions, automatically flagging potential problems before a human reviewer ever opens a pull request. The approach is not meant to replace human reviewers but to filter out repetitive, low-level issues so engineers can focus on architecture and business logic. Pricing varies by tool, with options ranging from per-review API costs to flat-rate business subscriptions, and most offer free tiers for experimentation. Practitioners note that AI reviews are not infallible and work best when combined with human judgment, particularly for context-specific or design-level decisions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Earth Adds Gemini AI Chat and Imagery Search for Web Users

Google Earth on the web has introduced two experimental Gemini-powered features: Ask Google Earth, a chat interface for natural-language geospatial analysis, and Imagery search, a multimodal tool for finding relevant satellite and aerial imagery. Ask Google Earth allows users to query the map using the active viewport, selected features, or defined areas as context, reducing the need to manually describe geographic details. The Imagery search feature scans satellite and aerial imagery to surface potentially relevant visual results, returning up to 30 non-authoritative leads that require human verification. Both features are currently experimental and available only to Professional and Professional Advanced users in the United States. Google emphasizes that the tools are meant to assist with faster discovery and preliminary analysis, not to replace established geospatial review workflows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TypeScript readonly Arrays Offer Surface-Level Safety, Not Deep Immutability

TypeScript's readonly modifier prevents reassignment and blocks mutation methods like push or splice on arrays and tuples, but only at the top level — nested objects within a readonly array remain freely mutable. The two readonly syntaxes, ReadonlyArray<T> and readonly T[], compile to identical runtime code and differ only in ergonomic preference. A common pitfall is type widening during function calls, which silently strips readonly from literals unless developers use as const assertions or explicit type annotations. Achieving true deep immutability requires recursive utility types like DeepReadonly or as const assertions, both of which carry ergonomic and type-inference trade-offs. Experts recommend applying strict readonly patterns selectively based on domain risk, such as in financial logic, rather than treating it as a universal safety guarantee.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Ways to Auto-Restart a Python Script After a Crash, Compared

Python scripts that crash due to unhandled exceptions stay dead until manually restarted, posing a reliability problem for bots, workers, and pollers meant to run continuously. Developers have four main options to address this: a bash while loop, a try/except block around the main function, systemd's Restart=on-failure directive, and a third-party library called StayPresent. The bash loop is simple but restarts endlessly without limits, while the try/except approach keeps the same process alive, risking restarts into a corrupted memory state. Systemd offers robust supervision with restart caps but requires system-level access unavailable on most PaaS platforms like Render or Railway. StayPresent runs the script as a managed subprocess with configurable restart limits and backoff, works across PaaS, Docker, and VPS environments, and correctly distinguishes a clean exit from a genuine crash.

0 comments Read more at DEV Community