E30：随机的含义 —— Coldcard 签名器致命漏洞暴露之后

<p><strong>主播</strong>：</p><p>曾汨：X@<a href="https://x.com/zengmi2140">zengmi2140</a></p><p>阿剑：X@<a href="https://x.com/AurtrianAjian">AurtrianAjian</a> </p><p><br></p><p><strong>嘉宾</strong>：</p><p>姚翔：原语里弄发起人，X@<a href="https://x.com/TimeOfSand">TimeOfSand</a> </p><p><br></p><p><strong>本期概要</strong>：</p><p>00:00 Coldcard 事故回顾：随机数漏洞与大规模资产被盗 </p><p>03:20 私钥为什么是一种如此特殊的秘密 </p><p>14:54 历史上的弱随机数与弱私钥事故 </p><p>19:04 漏洞如何产生，又为何潜伏多年未被发现 </p><p>36:37 随机性从哪里来：熵源、硬币、骰子与熔岩灯 </p><p>40:29 开源不等于安全：代码审计、工程规范与行业协作 </p><p>44:37 AI 进入安全攻防：发现漏洞、辅助防御与新的风险 </p><p>54:13 普通用户如何降低风险 </p><p><br></p><p><strong>相关链接</strong>：</p><p><a href="https://www.btcstudy.org/2026/08/01/coldcard-mk3-seed-generation-warning/">Coldcard 硬件签名器安全警告（2026-07-30）</a></p><p><a href="https://www.btcstudy.org/2026/08/04/critical-coldcard-flaw-what-happened-who-is-affected-and-what-to-do/">Coldcard 硬件签名器致命漏洞：源头、爆炸范围、应对</a> </p><p><a href="https://blog.coinkite.com/entropy-technical-backgrounder/">Coinkite：Technical Deep Dive into the Entropy Issue</a> </p><p><a href="https://x.com/glxyresearch/status/2084411904924045370">Galaxy Research：Coldcard 被盗资金统计</a> </p><p><a href="https://coldcardwatch.com/">Bitcoin Drained from Coldcards</a> </p><p><a href="https://blog.cloudflare.com/zh-cn/randomness-101-lavarand-in-production/">Cloudflare 随机性的入门介绍：正在生产中的 LavaRand</a> </p><p><a href="https://www.rfc-editor.org/info/rfc6979/">RFC 6979：Deterministic DSA and ECDSA</a> </p><p><a href="https://misra.org.uk/">MISRA C：安全关键型和嵌入式 C 语言开发规范</a> </p><p><a href="https://milksad.info/">Libbitcoin 随机数漏洞</a> </p><p><a href="https://www.ise.io/casestudies/ethercombing/">Ethercombing：Finding Secrets in Popular Places</a> </p><p><a href="https://media.ccc.de/v/27c3-4087-en-console_hacking_2010">Sony PS3 ECDSA nonce 重用漏洞</a> </p><p><a href="https://x.com/callebtc/status/2085024458012586286">Bitcoin Red Team 项目更新</a> </p><p><a href="https://1satpod.org/episodes/E06">亿聪哲史 E06：挑选比特币钱包的自我修养</a> </p><p><a href="https://1satpod.org/episodes/E10">亿聪哲史 E10：Say love in secrets</a> </p><p><br></p><p>联系我们：twitter@1satpod </p><p>播客主页：<a href="https://1satpod.org/">https://1satpod.org/</a></p>