binbash
Coldcard’s source code is 100% open source
No, that's inaccurate. COLDCARD isn't open source but rather it uses a source available license. The vulnerability was introduced as part of their rewrite to move away from open source licensing. It wasn't ever present in the open source code and wouldn't have happened if they hadn't moved to source available licensing.
with thousands of contributors and auditors
That's a completely false claim that's extraordinarily far from the reality. It has near zero people outside of COLDCARD using or looking at the code to improve it. The vulnerability was shown to be easily detected by running AI code review tools on the codebase without any custom prompt.
GrapheneOS has drastically more contributors reviewing the code. We have far different practices for how we write code, commit messages and review the code ourselves too.
Yet a severe vulnerability remained unnoticed for five years.
It appears to have been noticed by a few users who had their money stolen via the low entropy. It also appears to have been noticed by AI code review tools in the past year but not confirmed by the people who ran those tools. Someone who reported earlier vulnerabilities claims to have found this but didn't report it due to past vulnerabilities being downplayed.
You may argue that the two projects are unrelated, but I don't think they are.
It's not an open source project, doesn't take the kind of care we do and has a drastically different threat model than most of what we're defending against.
The broader lesson is that open source alone is no longer a sufficient security guarantee.
GrapheneOS has never claimed being open source provides any security guarantee. We've often said open source does not get any automatic security bonus. COLDCARD hasn't been open source for years and introduced this vulnerability as part of migrating away from open source. GrapheneOS security is primarily not based on it being open source. GrapheneOS does heavily benefit from being open source, unlike most open source projects and certainly unlike the post-open-source COLDCARD with a source available license.
As software complexity grows, and with AI dramatically accelerating vulnerability research
Google has nearly unparalleled access to AI. Android and Chrome are going to heavily benefit from it. There will be a time period where there's a massive stream of vulnerabilities being fixed as AI ramps up in capabilities. There aren't an unlimited number of vulnerabilities in the existing code and increasingly better practices can be used for new code including safer languages, libraries and the fact that code is going to start being heavily scanned by AI prior to ever shipping.
We have multiple accounts granted cyber access from Anthropic. We plan to obtain sponsorships from companies providing us with a large amount of tokens so we can do a lot more. Anthropic and/or OpenAI may be willing to sponsor us if we reach out to them.
You're raising AI as if it only benefits attackers but yet it may end up benefiting defenders taking good advantage of it much more in the long run. Offense is becoming far easier in the short term but that doesn't mean it's going to remain that way.
Well-funded organizations or nation-states will almost certainly have access to capabilities beyond those available to independent projects.
Google has plenty of resources, as do major large Android OEMs. We can obtain sponsorships from AI companies similar to what other open source projects are getting.
Furthermore, if Google were ever to move Android to a closed-source model
This is pure speculation on your part about something you think may happen but which is likely not even legally permissible for Google to do in practice.
Continuing the project in its current form would no longer be possible without maintaining a hard fork of the last available open-source release.
Even if your theoretical situation did happen, Android has a massive amount of stakeholders in it who want it to be open source instead of solely Google's project. We would not be alone and would be working with many large companies on a successor to AOSP. You're inventing a scenario which may actually turn out to be a good thing. We'd likely be happy with Android being split away from Google and given to the Linux Foundation with many organizations involved including us.