"Coldcard being open source didn't prevent keys from being stolen" fails on the premise. Coldcard has not been Open Source since 2020. OSI defines the term. MIT plus Commons Clause is not Open Source. Coinkite dropped GPLv3 deliberately, to stop commercial forks, and their own marketing retreated to "verifiable" after much fighting.
You know well, the March 2021 commit that purged the last GPL code replaced battle-tested Trezor crypto libraries with a novel in-house library. Seed generation changed in that same commit. Escaping FOSS obligations and introducing the flaw were the same act.
And who found it, five years later? Not Coinkite. Outsiders reading public source, quite possibly with LLM assistance. That cuts both ways and it's the part that should get Casa listening. Models are getting good at finding bugs in binaries, too. Black hats already analyze your closed source app. Publishing source doesn't hand them anything they can't increasingly get themselves. It's the white hats, who won't touch proprietary code for legal and practical reasons, that closed source locks out. Security through obscurity now selects for the adversary.
npub1j9…vuswx
2026-08-17 10:17:10 UTC
in reply to nevent1q…xr70
Author Public Key
npub1j9kttlc86w63emmldd4h74rekyqpksqup6p9trhp5gjsf374qlyszvuswxPublished at
2026-08-17 10:17:10 UTCEvent JSON
{
"id": "642a0f9d7c74cc046b72b95ce12314226cf3e9cdb2d063e07487bbae6cdc6a37",
"pubkey": "916cb5ff07d3b51cef7f6b6b7f5479b1001b401c0e82558ee1a22504c7d507c9",
"created_at": 1786961830,
"kind": 1,
"tags": [
[
"e",
"f258bb8b0e44bb525160193ec1ac39d5b8accc20815503a2f5496f822d1c5649",
"wss://relay.damus.io/",
"root",
"c97ec698e40a5579bd1b634bf1518db64c8abf74960d3cda9bb4759f625ea5e4"
],
[
"e",
"3c110c5100f520c08fcb90aa8da4fbc0b00c34dc6bdcb38ed28675d514062b50",
"wss://nostr.lopp.social/",
"reply",
"f728d9e6e7048358e70930f5ca64b097770d989ccd86854fe618eda9c8a38106"
],
[
"p",
"1f9e547c2f31942623b8ad1d07713282e8640fd8cf474e9f79f18ace8af216ed"
],
[
"p",
"3c4f51561243524f307ed2ee272c7cf4a782404fbe3a176606043b6ad427ee77"
],
[
"p",
"50d94fc2d8580c682b071a542f8b1e31a200b0508bab95a33bef0855df281d63"
],
[
"p",
"c761dc761dbe60d1879a9852bba96fee63eeab0d73911c55365c5ecf204949a2"
],
[
"p",
"c97ec698e40a5579bd1b634bf1518db64c8abf74960d3cda9bb4759f625ea5e4"
],
[
"p",
"c47f186f3bf579b8ee2eec52398d73174412cee39438bd0937498c89e3d4457b"
],
[
"p",
"f728d9e6e7048358e70930f5ca64b097770d989ccd86854fe618eda9c8a38106"
]
],
"content": "\"Coldcard being open source didn't prevent keys from being stolen\" fails on the premise. Coldcard has not been Open Source since 2020. OSI defines the term. MIT plus Commons Clause is not Open Source. Coinkite dropped GPLv3 deliberately, to stop commercial forks, and their own marketing retreated to \"verifiable\" after much fighting.\n\nYou know well, the March 2021 commit that purged the last GPL code replaced battle-tested Trezor crypto libraries with a novel in-house library. Seed generation changed in that same commit. Escaping FOSS obligations and introducing the flaw were the same act.\n\nAnd who found it, five years later? Not Coinkite. Outsiders reading public source, quite possibly with LLM assistance. That cuts both ways and it's the part that should get Casa listening. Models are getting good at finding bugs in binaries, too. Black hats already analyze your closed source app. Publishing source doesn't hand them anything they can't increasingly get themselves. It's the white hats, who won't touch proprietary code for legal and practical reasons, that closed source locks out. Security through obscurity now selects for the adversary.",
"sig": "34fc756544ef00f0597aa1a9a9bcb429f91b98c53c00dae1754e984b2280994905565f53b845d786f9638f33763b620602e134aaa64a8d527ed42442fcff9bb8"
}