When random.bytes() runs but doesn't work | Hacker News

The Coldcard RNG bug was not a small flag tweak, but part of a larger rewrite of the hardware-randomness path in MicroPython.

A mix-up between a definedness check and a value check meant the intended STM32 TRNG replacement path never properly turned on.

That left insecure PRNG-based fallbacks available instead of true hardware randomness, and the issue was hard to catch in testing because weak and real randomness can look similar.

Cryptographic devices need to fail safely when real entropy is unavailable; hidden PRNG fallbacks can quietly weaken key generation and security.