Comment by anonymousiam
18 hours ago
This post assumed that the author of the "runs" commit was not acting maliciously. Has that been established? It's not mentioned in this article.
18 hours ago
This post assumed that the author of the "runs" commit was not acting maliciously. Has that been established? It's not mentioned in this article.
Per the article, not my opinion.
It has been established that "I didn't do it on purpose" is not enough in some cases. You have to _not do it_ _on purpose_. That "fake it till you make it", in this case, understanding what your code does, is perfectly fine in some contexts, not in others, like this one.
When looking through all the other commits the user has made: they all lack a good commit message.
This is systematic for that user. Either the user needs to improve or let go.
The organization needs to learn that good commit messages are a requirement for anything to do with crypto and payment systems.
The commit message is just a surface level manifestation of a deeper issue. Fixing the commit message does not fix the issue.
Ironic:
> NEW POLICY If I don't know you, I don't merge you! Thanks XZ!
https://github.com/switck/libngu
Hanlon’s razor.
Also: writing this stuff in C just begs for bugs.
LLM agents are cheap and good enough that you can write in eg Lean or whatever. Or at least write it in Rust.
The bug has been up since before the LLM shift.
I get the feeling that the bugs found in this instance can be more directly attributed to the author having zero experience operating a microcontroller
Honestly, I'm going to be a bit harsher: I think they're either:
1. A novice who doesn't know how to debug issues.
2. Totally incompetent and copying code from Stack Overflow.
I don't think it's specific to microcontrollers, either, the error from the C compiler is something that a competent programmer would be able to interpret, or at least see it as a signal to get someone more experienced in the domain to learn about.
2 replies →
C isn't the problem here. one might argue that the combination of micro python and C and the person writing it having no understanding of how either one works is the problem.
Also running python on a microcontroller to do cryptography is fucking insane.
> Also running python on a microcontroller to do cryptography is fucking insane.
I feel like I should confess to snubbing this (and some other) hardware wallet projects for the fact it used micropython. I think it's hard to draw the line between systems programmer snobbery and good advice... and I feel a little like a cop guilty of stop-and-frisk on the basis of skin color.
Because in general the ideas necessary to produce reliable software aren't well understood or agreed on there is a risk of letting style preferences which are only correlated with good engineering but aren't causative of good engineering get mistaken-- and this can cause errors in both directions, both mistaking stuff as good because it uses the "right" tools, or mistaking something as bad because it doesn't.