Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid - welcome to the Stubsack, your first port of call for learning fresh Awful you’ll near-instantly regret.

Any awful.systems sub may be subsneered in this subthread, techtakes or no.

If your sneer seems higher quality than you thought, feel free to cut’n’paste it into its own post — there’s no quota for posting and the bar really isn’t that high.

The post Xitter web has spawned so many “esoteric” right wing freaks, but there’s no appropriate sneer-space for them. I’m talking redscare-ish, reality challenged “culture critics” who write about everything but understand nothing. I’m talking about reply-guys who make the same 6 tweets about the same 3 subjects. They’re inescapable at this point, yet I don’t see them mocked (as much as they should be)

Like, there was one dude a while back who insisted that women couldn’t be surgeons because they didn’t believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I can’t escape them, I would love to sneer at them.

(Credit and/or blame to David Gerard. Nearly forgot to put this up, whoops)

  • Sailor Sega Saturn@awful.systemsEnglish
    14·
    3 days ago

    There was a cryptocurrency wallet hack the other day which has so far gone unremarked here because the popcorn is stale and we all pivoted to AI. And yet there are dozens of voices of bagholders crying out in pain wanting to be heard. This is their story.

    For some reason the best explanation comes from a boring company that makes point of sale credit card readers https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware

    COLDCARD firmware contains an RNG integration error that causes ngu.random to use MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware RNG.

    Oh hey they got the most important thing not to get wrong wrong in the regulation free money settlement layer of the future.

    The bug? Well in one file they wrote #define MICROPY_HW_ENABLE_RNG 0, and a library they depended on had this code:

    # ifndef MICROPY_HW_ENABLE_RNG
# error "get a HW TRNG plz"
# endif

    This should have caused a build failure, but since MICROPY_HW_ENABLE_RNG was defined, to zero, it did not and instead continued down an insecure codepath.

    As a C++ programmer this isn’t an unheard of sort of mistake to make in the moment. Many libraries use undefined for preprocessor variables, but there are some people who also use zero.

    But it’s less excusable to not catch it when this is literally the most important thing to get right in a bitcoin wallet. Did they not trace the code path when writing the code? Did they have no integration tests or unit tests for RNG seed quality? Poor RNG seeding has come up a ton in literature, so is the sort of thing people writing cryptographic code should check for…

    We’ll have to addend that old saying: “don’t roll your own crypto unless the other person’s crypto is from a blockchain developer in which case you’re probably better off rolling your own after all.”

    I personally don’t want to sneer at the bagholders too much here. It’s 2026 and at this point it just feels kinda sad. But I’ll end this comment with this glowing review:

    I thought I was secure because Cold Card was always praised as one of the best and most secure wallets. It’s open source, so anyone can verify.

    “It’s open source, so anyone can verify” – unfortunately for them the verifier was also a hacker.

    • rook@awful.systemsEnglish
      10·
      3 days ago

      I was gonna link someone else’s observations on it, but got sidetracked by a shiny object or something.

      https://mastodon.catgirl.cloud/@49016/117021988214007605

      They didn’t link the sources, but apparently the all-my-apes-gone twitter crowd are still breathtakingly ignorant of technology and statistics, despite how many years of bitcoin catastrophes have passed.

      Quite a few people suggesting/using dice to mitigate the Coldcard vulnerability.

      Note that common dice are not designed to be cryptographically secure.

      If you are going to do this, you probably should buy precision casino dice. And even then, have another source of entropy.

      Posted entirely unironically, apparently. Hard to say, but Poe’s law has yet t be repealed.

      • Architeuthis@awful.systemsEnglish
        7·
        2 days ago

        New things I think learned from this thread:

        • the thief used a blockchain provider instead of an ad-hoc local node, making all the transactions incredibly traceable with (unclear to me) implications about their ability to launder them or keep their identity concealed indefinitely.

        • even if they are found out, the previous owners probably won’t see a dime back since the vulnerability affects exactly the ability to prove you really were the previous owner.

        Unclear which thief since the web3isdoinggreat writeup says there had been up to 15 unique groups doing mass drains by 31/7, maybe the initial 500 wallet sweep was one person or group?

      • Soyweiser@awful.systemsEnglish
        7·
        2 days ago

        apparently this issue became obvious YEARS AGO since the birthday problem struck a random redditor, who promptly got gaslit that this is completely impossible and it was dismissed. lol. lmao even

        Hahaha

      • YourNetworkIsHaunted@awful.systemsEnglish
        10·
        2 days ago

        All the dice discourse in particular has made this a fun throwback to the days of crypto bros earnestly arguing about which wall in your house you should hide your hand-stamped seed phrase record inside and whether you could trust a published book of truly random numbers over a series of 256 coin flips. Ironically I can only assume that by the time any of the concerns about entropy sources were validated most of them lost their crypto to some combination of get-richer-quicker ponzi schemes and twitter DMs claiming to definitely be FTX tech support.

    • BlueMonday1984@awful.systemsOPEnglish
      5·
      2 days ago

      “It’s open source, so anyone can verify” – unfortunately for them the verifier was also a hacker.

      Also, most of the would-be verifiers are frying their brains with AI

    • gerikson@awful.systemsEnglish
      6·
      3 days ago

      I’ve been following it a bit, there’s a lot less comedy gold to mine nowadays

      here are some links from another forum

      https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep (crypto shill outfit link)

      https://bitcoinenthusiast.org/uploads/31820a53956b53c5/image.png

      https://bitcoinenthusiast.org/uploads/c0804335a52922e4/image.png - this last is attributing to malice what’s clearly stupidity