Coldcard Hack Exposes Flawed Assumptions Behind Open Source Code

The recent Coldcard hack, which resulted in over $100 million worth of Bitcoin (1,500 BTC) being lost, has raised questions about the effectiveness of Open Source software development philosophy. The incident highlights the importance of understanding the difference between Open Source and source-available code.

Coldcard's firmware is released under the MIT terms plus the Commons Clause, which restricts the right to sell the software commercially. This means that while the code is publicly readable, it cannot be used for commercial purposes. In contrast, true Open Source software grants all the rights defined by the Free Software Definition or the Open Source Definition.

The principles of Open Source are based on four essential freedoms: the freedom to run the program as desired, access to the source code, redistribution, and modification. However, these freedoms rely on an economic assumption that enough motivated individuals will examine the code, which is not always the case.

The Coldcard hack demonstrates a classic tragedy of the commons, where individual users prioritize short-term self-interest over long-term group interests. This can lead to software degradation when there is misalignment between individual and collective goals.