Coldcard Hack Exposes Flaws in Open-Source Software Development
The recent hack of Coldcard, a popular self-custody hardware wallet, has raised questions about what it means for software to be open-source. Over $100 million worth of Bitcoin (1,500 BTC) was lost in the incident.
Coldcard's firmware is released under the MIT license plus the Commons Clause, which restricts the right to sell the software commercially. This has led some to argue that Coldcard is not truly open-source, but rather source-available.
The distinction between open-source and source-available is crucial, as it affects the incentives for developers to examine and verify code. According to the Open Source Initiative's definition, a license must meet ten practical criteria, including free redistribution without royalties and availability of source code in its preferred form for modification.
The Coldcard incident highlights the importance of transparency and auditability in software development, particularly when it comes to financial infrastructure like Bitcoin. The incident also underscores the need for developers to be vigilant and examine code thoroughly, rather than relying on the assumption that others are doing so.