One thing I've been thinking about recently is whether being open source is good or bad for security.
Open source obviously makes software more auditable, but in an age of LLMs whose intelligence is increasing at an exponential rate, it also makes it much easier to find and exploit vulnerabilities.
For example, had ColdCard (the other hardware wallet that got hacked) been closed source, it would have been much more difficult to exploit the randomized number vulnerability that the attacker used to get the private keys.
Maybe the answer (at least in this case) is somewhere in between where most of the thing is open source, but the parts that deal with creating the sensitive data are kept closed source.
Open source obviously makes software more auditable, but in an age of LLMs whose intelligence is increasing at an exponential rate, it also makes it much easier to find and exploit vulnerabilities.
For example, had ColdCard (the other hardware wallet that got hacked) been closed source, it would have been much more difficult to exploit the randomized number vulnerability that the attacker used to get the private keys.
Maybe the answer (at least in this case) is somewhere in between where most of the thing is open source, but the parts that deal with creating the sensitive data are kept closed source.