EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 2·5 min read
When random.bytes() runs but doesn't work
TL;DR
A recent investigation into the Coldcard firmware revealed a critical bug related to the random.bytes() function, which failed to generate secure random numbers. This flaw has significant implications for the security of cryptocurrency transactions.
✦ Why It Matters
Review your code for secure random number generation to prevent vulnerabilities in cryptographic applications.
Key Takeaways
- Always document significant code changes with clear commit messages.
- Review code thoroughly, especially in security-critical applications.
- Understand the underlying code and its interactions before making changes.
- Avoid quick fixes that silence compiler errors without addressing the root cause.
How It Works
The Coldcard firmware uses a combination of C and Python, where Python calls C functions for hardware operations. The commit in question disabled the hardware RNG by setting a configuration flag to zero, which led to the use of a less secure RNG instead.