My 2 cents about the and fail and the value of true open-source:

Don't try to blame Coinkite's failure on their customers. ColdCard firmware is *not* open source by any definition of that term, except 's own skewed definition. Ironically, this vulnerability was even introduced during the code refactor to get rid of the open-source license (MIT) they inherited in their fork from Trezor 😖😖😖 As a dissatisfied Coinkite customer I pointed to the stupidity of the license change/code refactor decision when they announced it. The only follow up they gave was to block me...

🎉