Coldcard is “source available” not open source (you can’t use it for “commercial purposes”)


You can customize how that turns out unlike the proprietary Coinkite BLOCKCLOCK

Dropping the USD/BTC ticker, or showing as $100K, so on


there is also blockclockapp.com, which was registered before Coinkite’s “blockclock” trademark, and that alongside the DIY Bitcoin Block Clock will most likely render their trademark invalid


trademark law is different to patent law as you can use a name for how long as long as you want before registration, and you still have some rights


there is if it is active use


Blockclock is closed source AFAIK


OK, past few days were quite wild. I am currenly in El Salvador because I was attending the Adopting Bitcoin conference. My very limited internet connection here made it quite difficult to engage, I mostly just got push notifications. Hereby I want to take the opportunity to tell the story from my side.

TL;DR: We were just having fun, we thought it was okay. Apperently it's not and nvk is is so upset that he felt he had to file a GitHub takedown request. I feel that's not how bitcoiners behave.

### How it started
I have been working on the #BTClock since April '23. It started of some sort of bet where I challenged myself to make a BTC ticker as cheap as possible. I just ordered seven eInk displays on AliExpress with the intention of showing information related to bitcoin using an ESP32.
Why seven? Because the words BITCOIN and SATOSHI both consist of seven letters and connecting more screens to the ESP32 did not seem possible without adding I/O-port expanders.

Yes. The idea was inspired (among other projects) by Blockclock, which also uses eInk displays. I don't own one, so I couldn't "reverse engineer" or use any direct inspiration of it but the way you can combine multiple eInk displays to display information in an useful way is very limited.

After getting the schematic right. I created a 3D printable case for it (https://www.thingiverse.com/thing:6009628) and named it BTClock after someone's idea in the Dutch Noderunners community. Since it consists of seven characters I thought it's the perfect name since it fits the seven displays too.

nostr:note19zp3c8lsm4s5lwvuscu4dll3clkzvajrwthvqed5q7s83mazrr2swc6mqe

### May 2023
This allows you to create a BTClock for ±70 euro (if you own a 3D printer).
I shared the progress of the project in the MakerBits telegram group. Ben Arc checked with nvk how he felt about it, and I have seen his responsse where he replied with that he felt honored and that I should go ahead. In hindsight, I should've asked Ben to forward this to me but I wouldn't expect this to "haunt" me like it did last week.

After sharing the very spaghetti-y schematic in some Telegram groups, someone replied that he was working on making an actual PCB out of it. After some DM'ing back and forth we got our first PCB prototype that needed some work. After 4 iterations we finally got it how we wanted and were able to sell DIY kits. The PCB is real artwork, so we wanted to show it off. Therefore we added a acrylic backplate to be able to protect it while still able to see the proof-of-work by Madbo, the PCB artwork designer.  We used a lot of through hole components to make it accesible for anyone who has a soldering iron.

### August 2023
In August 2023 we finally got the kits ready, while the initial plan was to only sell the DIY kit within the Dutch Noderunners community, I brought smoe with me to Baltic Honeybadger '23 as well, where it proved to be pretty succesful while sitting next to Ben in the chilling lounge.

I got a lot of encouraging and positive remarks about the project, including Daniel Prince (@princeysov) who tweeted about this (https://x.com/Princey21M/status/1698257536418267624).
It appeared that this tweet firstly poked the lion, since nvk sent some of his coinkite employees to me after this tweet, a group of 4 people asked a lot of questions while filming me (without my consent, I didn't realize this when they were asking it but when they walked away it was clear to see the iPhone was recording video).
Not a lot later, nvk sent out a tweet which was clearly about the BTClock project without explicitly mentioning the name (https://x.com/nvk/status/1698423362819682400)
However, in my opinion this did still fit the message I read he wrote to Ben that he was more flattered than upset. It was only then when I learned about how he reacted to Foundation Passport and how he behaves regarding the SeedSigner project.

https://m.primal.net/MaIv.png

### March 2024
During Bitcoin Atlantis in March 2024, there was a nice space for the MakerBits projects including the BTClock, the software by this time has many improvements, including real-time new block notifications by utilizing the Mempool.space Websocket API. Since the hardware is also open source, many alternative faceplates are available including a stainless steel one and a completely white one. Multiple people witnessed nvk walking passed the maker space while looking at me, but he did not engage or whatsoever. I would expect if he would take offense by the product, he would've approached me by now but he didn't. He does know who I am though, both in real-life and I'm posting enough on my social media accounts (Nostr and Xitter) to find me there as well.

### Fast forward to November 2024
A lot has happened in the development of the BTClock, among other things I added a BitAxe integration and Nostr Zap Notifications to the software and we managed to add frontlight to the eInk displays which I really think sets the BTClock apart from other "tickers" like the Blockclock mini.
The Blockclock mini hasn't had any updates for two years  (since October 3rd, 2022) which seems to be like the Blockclick mini can be considered end-of-life.

I therefore was very suprised that when I woke up on November 14th, I received an e-mail that the BTClock GitHub organization was flagged because of alleged trademark infringement of the BTClock.
This was according to a report by Coinkite to GitHub. The letter I shared in the MakerBits Telegram group was ONLY sent to GitHub, not to me (although I haven't been home for a while so I don't know something is waiting in my physical mailbox).

Luckily git is decentralized version control and there are already mirrors of the hardware and software source available. Also GitHub allows me to appeal but haven't taken the chance to do so.

Although I do understand that the concept of trademarks exists for a reason, I feel this a very cowardly move and certainly not something that I would expect from fellow bitcoiners. Just sending me a DM on Nostr, X or Telegram is the least I would expect. I don't mean to offend or infringe, and would be happy to discuss options if open to it. Either in DM or out in the open.

I'm all about transparency so  nostr:npub1az9xj85cmxv8e9j9y80lvqp97crsqdu2fpu3srwthd99qfu9qsgstam8y8 here is my invitation to discuss this out in the open. I'm sorry that we seem to upset you. what is it that bothers you, can we find a way to let the projects co-exist? Or even see if the BTClock software can adapted to your Blockclock mini hardware.


There needs to be more emphasis on in person purchases for HWWs or other Bitcoin specific devices nostr:note1znj0mlh5p7c2jrhexmt5fy4qz6dpuqq7wtpcatdwjn3ue5sw7w7qlpq6dk


...Do not ask why a github repo was taken down. Ask why is it possible... nostr:note19q055uvrf0787nxhqvwnyljv2a29d6hwe95763h7xv4a2tma4jvq4end0q


Some #BTClock repo mirrors:

https://git.rof.tools/mirrors/btclock_v3
https://git.rof.tools/mirrors/btclock-webui
https://git.rof.tools/mirrors/btclock_v2

The firmware binaries depended on GitHub Actions workflows so they are not yet on there, but of course you can compile everything yourself


Did you verify it with Apple Pay by putting a file in /.well-known


Go to “payment method domains”
Add your domain


Use Elements?


A very simple fix exists
Store a copy of the follow list locally and don’t accept any older than that from relays

Reduces rollback impact significantly


You can use Apple Pay through Stripe


You do not have to pay Apple for this
Just use Stripe


You cannot use Apple Pay directly and must use a payment processor
Just don’t


the truth is that opensats is burning money on gimmick projects


It is not.
It is sheer developer incompetence and the issues with relay reliability on most ones


go to hist.nostr.land to start recovery if it is within the last 10 revisions


it stores the last 10 revisions


I would not believe Nostr is cheaper to operate on a per user basis with little emphasis on cost and performancd optimization and redundant infrastructure.


The problem is software is not static and cannot be

You need to update it as the userbase scales and the environment changes, if that was not true, we could just not have NostrDB and still use Branle

You also forgot the human cost of operating servers and the gap in user count


language detection is the primary issue


If we have a quantum soft fork, will we also not have a block size increase soft fork?


Check markings on the outside of the cable


Okay so TL;DR

Coinkite makes blockclock mini and sells it for $400, closed source

nostr:npub1k5f85zx0xdskyayqpfpc0zq6n7vwqjuuxugkayk72fgynp34cs3qfcvqg2 makes a similar DIY device that is fully open source named BTClock

They get harassed at launch by Coinkite

It goes well for a while, then Coinkite takes down their Github by claiming trademark infringement because BTClock is too similar to Blockclock


This is what happens when you see forks as something to be embraced and not something to be shut down, especially when your views disagree


Also the aluminum case :)


Not like they wouldn’t push back against this


Except nothing said this system could not be built on a WoT — not a follow based one but actual trust


Because these charities are ran by people with conflicts of interest


I do not understand how those two are related


that would be great
only if that happened


Because Nostr doesn’t make everyone suddenly immune to false information or intentional deception


Probably Primal


nostr:npub1l5sga6xg72phsz5422ykujprejwud075ggrr3z2hwyrfgr7eylqstegx9z your follow list was wiped


knowing an IP is about as useful as knowing a PO box


We need community notes for Nostr


not true


they even renamed the trezor libs… shame

there is nothing wrong with building on other products


I did


Would you be willing, for the good of the project, to step down from OpenSats Board?


And there are some things that can never be mistakes


non-USA Swan plebs: withdraw before Dec 1st https://image.nostr.build/0bf64b7362fe91775645e0b00d2f41cd9a28e54f8be634f8e0d88916795ea33b.jpg


I prefer self-hosting Git. Those options are more mature than most Nostr options, and with federation being implemented in Forgejo (which is a perfect use case for federated protocols) I see that it is the best option.

I am considering implementing Nostr sign-in as an external IdP if the need arises.


You do not need to be that to understand that having a device that has a weak chip is a bad idea


Truly… the problem is they still use broken SEs


You are not defending your trademark, but using it to take down a project which had done what you did in a way that is more affordable and gave more control to users.

It is a shame that Coinkite engages in this behavior and harms the Bitcoin and open source ecosystem, the same ecosystem it profits off of, with one example being the starting point of the Coldcard.

It is difficult to see any good faith actions here.

The name BTClock is highly unlikely to be confused with Blockclock. You can only lose a trademark if there is obvious infringement happening and you do nothing.

Should Satochip go after you and your trademark because you made Satschip, which has the actual potential of confusing users? nostr:note1lu2v6y623mgx0xh35jx0tg6euqgqg3xxuy92vdttkfgcgg4nwkmsnhc4u5


No. You can already do that without an attack if you use resident keys. (aka passkeys *without* a username)

This only means that someone with your PIN and extended access can clone it.


The vulnerability doesn’t make sense though.

Sure, someone can clone your YubiKey.
But they can also just tap to log into any website they want without cloning it if they stole it.


I prefer making my own


Signers at discounted cost in exchange for a Bitaxe? 😆


This is a prime example why NVK should step down from open sats. Imagine if Btclock went to opensats for funding. Y’all see the conflict of interest.


you could do access control


That was what I was trying to say. Could be interesting to have one.

The problem is I do not have a Bitaxe. 😅


Automated tuning software? 👀


Patent your design then


git over HTTP and NIP-93 or whatever it was


Discovery on Nostr is not a bad idea, though.

And identity. It would solve having to create an account for each instance.


noticed your follow list got wiped
restore it at https://hist.nostr.land :)


Mostly… self hosting also works and in the case of Git, I do not see any benefit for Nostr over self hosting as most projects have centralized leadership


You may read the original takedown notice here

nostr:nevent1qqspdafxqmzasft60ft6zfxs3nsm6vf3ka0pae43dg66sq2evjay8ygpz4mhxue69uhks6tnwshxummnw3ezumrpdejqzxrhwden5te0wfjkccte9ehx7umhdpjhyefwvdhk6qgkwaehxw309aex2mrp0yhxummnw3ezucnpdejqz9rhwden5te0wfjkccte9ejxzmt4wvhxjmca20tn4


If someone pretends they are affiliated with your product for example when they are not, for example.

Or when someone tries to use your branding for their own product that you don’t endorse.


Check your Signal DMs


Trademarks are a useful tool when people try to do affinity scams or other things.

This is none of that. This is just abuse of the law (with most likely no legal basis either) to take down competitors.


I do not think having a not unique design makes it a good idea to send a false TRADEMARK violation claim. Apparently “BTClock” is infringing on the “blockclock” trademark


Okay so TL;DR

Coinkite makes blockclock mini and sells it for $400, closed source

nostr:npub1k5f85zx0xdskyayqpfpc0zq6n7vwqjuuxugkayk72fgynp34cs3qfcvqg2 makes a similar DIY device that is fully open source named BTClock

They get harassed at launch by Coinkite

It goes well for a while, then Coinkite takes down their Github by claiming trademark infringement because BTClock is too similar to Blockclock


Build a BTClock :)

Only if Coinkite didn’t make it harder to do so


I’m most likely going to be offering a SE chip for hardware wallets with specific features that allows building DIY designs on top of it and offers higher security than some of the common choices.

So, that could become easier too.


https://btclock.store is still up


fact

they posted it themselves in a Telegram channel initially


Was before Coinkite took it down with a trademark claim


nostr:npub15c88nc8d44gsp4658dnfu5fahswzzu8gaxm5lkuwjud068swdqfspxssvx how may I reach out on Telegram, Matrix or Signal?


they rely too much on their big margins


x.com -> xcancel.com


I do not agree fully with throwing it fully out, but current IP regulation means that it is easy to abuse.

Trademarks provide protection against someone pretending to be affiliated with you or your products.


I could have just used a JavaCard and been the same as other products already out there. But then what’s the point?

Big things are coming 👀


Resubmit with it added, I’ll remove it. Or if you used your nym it’s fine, just DM me your Telegram/Signal handle.


This all started because I was tired of the amount of bullshit and insecure products in the hardware wallet space.

Finally, you will be able to get an HWW that isn’t overpriced, that doesn’t use chips with vulnerabilities, and just works without requiring a closed source vendor app.

The SE will also be open to use in DIY projects or other HWWs as a secure starting point. nostr:note160ztxvvpvwn6lvxqlsdn0p492j9xa7lmhe2agfe4lwsjcfr7s7eq390zxq


They had to invest resources in firmware and hardware development too. The great part is you can make this in any form factor by forking the design and add any functions you want


My wording was a bit harsh too and I understand. But overall, this is a pretty disappointing move from Coinkite.

The full, unaltered text of the takedown notice is here:

nostr:nevent1qqspdafxqmzasft60ft6zfxs3nsm6vf3ka0pae43dg66sq2evjay8ygpp4mhxue69uhkummn9ekx7mqpzpmhxue69uhkummnw3ezumrpdejqzxrhwden5te0wfjkccte9ehx7umhdpjhyefwvdhk6qg4waehxw309a5xjum59ehx7um5wghxcctwvsk8nct3


Yes, the code is fully independent from anything Coinkite has made.


Coinkite Inc. is the developer of the "BLOCKCLOCK," a product featuring seven electronic ink digits that provide customizable cryptocurrency and blockchain information, including cryptocurrency price, volumes, exchange rates, current coin supply, block height, and Merkle root. Coinkite Inc owns the trademark "BLOCKCLOCK" (Registration No. 7237159) in Class 9 in the United States.
The infringer BTCLOCK identifies its product as "BTCLOCK". It is defined as “a block with electronic ink displays, which can show stuff related to Bitcoin”. The use of "BTCLOCK" has strong similarities, both in name and functionality, with Coinkite’s registered trademark "BLOCKCLOCK", as follows:
1) Phonetic similarity: "BTCLOCK" and "BLOCKCLOCK" sound very similar. Both emphasize the term "CLOCK," with "BT" and "Block" being the only differences. The phonetic similarity can cause confusion, leading consumers to mistakenly believe the two products are related or come from the same business origin.

2) Visual similarity: The appearance of "BTCLOCK" and "BLOCKCLOCK" is also quite similar. "BT" and "Block" both consist of short prefixes followed by "Clock", which could easily cause confusion at first glance. In addition, the use of seven screens with electronic ink to display Bitcoin information gives the same impression in the users. The word BTCLOCK is displayed in the same exact position that it is in the BLOCKCLOCK.

3) Same functionality: Both products are aimed at a similar audience - people interested in cryptocurrency, specifically Bitcoin. Since both products appear to perform a similar function (displaying cryptocurrency prices), there is a high likelihood of confusion. Consumers might believe the two products are from the Coinkite, which is not accurate.

4) Risk of confusion: Since both devices seem to have similar functionality (displaying Bitcoin prices), this increases the chances that consumers could be confused about their origin. They may think "BTCLOCK" is a version or a rebranding of Coinkite's "BLOCKCLOCK." If "BTCLOCK" becomes associated with a different company or quality, it could dilute the distinctiveness of Coinkite's "BLOCKCLOCK".
The use of "BTCLOCK" in GitHub could be infringing Coinkite’s trademark rights.

What would be the best solution for the alleged infringement? Are there specific changes the user can make other than removal? (e.g., transfer of trademarked username to an existing company account, removal of trademarked logo or references to company)

(1) Cease and desist the use of the words BTCLOCK, BLOCKCLOCK or similar words in the following websites: https://github.com/btclock; https://btclock.github.io/web-flasher/
(2) Remove any pictures, documents, links with the words BTCLOCK, BLOCKCLOCK or similar words from the following websites: https://github.com/btclock; https://btclock.github.io/web-flasher/
(3) Suspend and/or terminate the infringer's account BTClock.


The takedown claim solely focuses on the fact that thr BTClock and Blockclock are similar devices, and apparently them both having the word “Clock” and starting with “B” makes them too similar


If you’d want me to check, let me know.


BTClock fixes this… best part of open firmware is user control if the vendor abandons the product or does not implement functionality users want


I did.

They made an open source version of the same device that provides more control to users. If you are so pissed about this, then please stop buying phones because every phone is just a copy of an older design but with improvements.


the problem is there is nothing open source or even source viewable about the blockclock

BTClock is actually better because if you want you could turn it into a temperature sensor for example, or change the font, etc… with the Blockclock it is proprietary firmware you cannot modify


You need to press 3 333 times, I think you misread the manual. If you go over by just 1, you will have to press until the 32 bit counter overflows.


It isn’t even source viewable


No, feel free to submit it again if you are unsure and I’ll remove your old response if you already did.

Also, a chance to add some more feedback :)


You did not do any research.

The Blockclock does not have open source design or software and is a proprietary commercial product.

The BTClock is an independent alternative that is meant to be able to be built DIY and is fully open source.

The great part is anyone can customize this base design to do anything they want or add custom functionality.

Using a trademark law in a baseless way does not help.


You can still register for the beta-test of my signing card, using security certified chips. Expecting samples ready by late 2025 Q1.

It also uses a custom platform with security-by-design, compared to the development approach of most other signers.

No bullshit claims, no cutting corners,  no overpriced hardware.

https://forms.office.com/r/CxzzG4Wqam nostr:note1655030y7lvydpfguy5lzwntxtmqqpfqejk3ytdskq0dpvs49zmmqkypgxy


No. I’m referring to the class of attack used.

Laser fault injection has existed since 2005 and defenses can be implemented for the protection of the chip, such as light sensors.

There have been 3 revisions to the ATECC chips and they still do not incorporate light sensors while your cheap credit card or transit pass does.


Go see for yourself
https://github.com/btclock

Their org was taken down because “BTClock” is allegedly too similar to “BLOCKCLOCK” and they would think BTClock is a Coinkite product, even though their names are significantly different and they have different approaches (DIY vs closed source commercial)

It is likely that Coinkite will sue if BTClock does not comply and take down everything, and sends a counter-claim to GitHub


Apparently “BTClock” is too similar to “BLOCKCLOCK” and consumers would totally get confused that BTClock is a Coinkite product… and so they took all their repos and their GH org down


nostr:npub1sg6plzptd64u62a878hep2kev88swjh3tw00gjsfl8f237lmu63q0uf63m will the Bitcoin Legal Defense Fund cover any expenses that may arise from Coinkite’s (what I view to be baseless) legal action against a competing open-source project, BTClock by nostr:npub1k5f85zx0xdskyayqpfpc0zq6n7vwqjuuxugkayk72fgynp34cs3qfcvqg2?


It is somewhat costly to exploit, but the fix is replacing one part with a drop in replacement. And this attack has existed since ~2005. Not informing users about this in general is pretty irresponsible.


its nostr:npub1k5f85zx0xdskyayqpfpc0zq6n7vwqjuuxugkayk72fgynp34cs3qfcvqg2's project


And it is all because apparently BTClock is too similar to BLOCKCLOCK. Wtf?

Also, they have not disclosed vulnerabilities in the SEs they use in the Mk4 and Q, and have not upgraded to a drop-in replacement that is a newer version without those vulnerabilities.


I will see.


Takedown for now. But it will probably be a lawsuit if a counter claim is made or they don’t comply


fixed my NIP-05


Trademark infringement on the name “BLOCKCLOCK” apparently


Fair point but it is already protected by the box


At least remove the screen’s protective cover :)


looks like an open source project got fucked over by a particular overpriced hardware company


Nice.


You send your binary to Apple and they do some checks before signing it. That’s what “Apple checked this application and found no malware” prompt is.

Also, those signatures can be revoked or even blacklisted if required.


This is pretty misleading, as it shows nodes, not capacity, and excludes Tor.

There’s also the fact that at least for a lot of the smaller share ones, they may be used just for proxying for a public IP.

Not that this means anything as if it is shut down, new nodes can come up to replace them in other networks


that and Solana, the other networks at least work sanely

Solana falls apart because they somehow managed to fuck up even PoS beyond repair that also means the network can go down due to one bad node

these deserve a new category


an LLM is just a big data aggregator, anyway.

if it can be solved easily then it probably should be, and that time spent on actual development work instead of centering a div

after some point you run into code quality problems, but as long as you don’t trust but verify, it’ll work


Avoid any with ATECC chips. Trezor Safe checks most of my boxes, including being able to use easily with another app.

Or you can use a SeedSigner depending on what you are doing and you would like to include stateless signing devices and not just HWWs.


What HWW would you recommend?


This issue has been resolved nostr:note16pgwjrgdxh8dvkpwn6676x0lr47tlfxw9sv67u05n9z0asc7xuss0kj8s3


Some nostr.land services are temporarily unavailable due to a networking issue with the upstream.

The issue is currently being resolved.


a raspberry pi and a camera
you will find that you can use standard protocols like RTSP


It never can until users stop having to manage nsecs in a very error prone way.


I guess the best way to redesign would be to have a set of keys (with their bunker nsecs), a set of users, secrets for pairing, and already authorized connections (possibly with descriptive names)


I see several minor issues:
- why encode nsecs as bech32 and not hex?
- bunker npubs should be limited as much as possible (1 key = 1 npub or 1 key per bunker) as it adds additional filtering costs to relays, and therefore be independent from users
- secrets only need to be kept for pairing and should most likely be separate from users
and some other issues


It’s a shitty processing pipeline

PDF > PostScript (rasterized PDF in PS) > PS again > PPM > some color processing > PCL XL

And the PDF to PS converter + Ghostscript is really slow. And it’s performed sequentially.


Some things:
rastertopclx falls apart on sRGB raster
pdftoraster is slow as hell, use mupdftoraster or pdf2printable from ppm2pwg instead
Use the CUPS PPD compiler instead of writing your own
Ghostscript is slow as fuck
A lot of printers have weird PJL commands they want to just work nostr:note1t3n8dma7yhjvkqevacc2dsxtda94u2fue6557eagrm0ange5lthqzj8ct5


My printer’s drivers took 10 seconds to rasterize a single page, so I made my own CUPS filter chain to output acceptable PCL for the printer


how tf do you get 24h?


Not your responsibility what others do with information.

If it was about building a nuclear bomb, sure… this?


Oh also it breaks clients that use any form of caching service like Primal.

Unfortunately, local or remote caches are one of the few ways Nostr will stop using gigabytes of mobile data.


A better version of the moderated communities NIP.
Admins can keep a local backup of notes.


Again, with that NIP, groups are single relay, and there’s no transparent migration path. A group should be defined by its owner, not by the relay it is on.

Also, all of these approaches are horrible for clients like nostr:npub1xtscya34g58tk0z605fvr788k263gsu6cy9x0mhnm87echrgufzsevkk5s's Damus as they maintain a local DB. There is no way to sync event deletions by admins, and local caches lose all benefit as they need to make round trips to the centralized community relay to get the latest state of everything.

Relays were designed as data stores, a subset of all events. The construction of views on top of these relays were and always have been the responsibility of a client on top.

A deletion for example, it should still function in clients even when relays don’t give a shit and do the bare minimum of storing events.

Relays support it because there’s no reason for them to store deleted events.


Uh… can you read? Thanks.

I’m saying that one community = one relay.


they aren’t in communities

there’s 1 community relay and that’s it

it makes things easier, because it’s centralized, but good things are never easy


An average user would need to figure out:
- how to do port forwarding
- getting a static IP
- getting a domain name
- configuring a reverse proxy
- installing and compiling strfry
- writing their own relay policy scripts

Pretty easy isn’t it? 😆


Don’t see how relays fix anything. Except it allows developers to be lazier by going back to the centralized model.


The average person will be the main source of new communities though.


Maybe because it wasn’t well thought out? :)


I’m referring to the NIP.


Only if there is a tangible benefit that they can see and care about. “What if”s don’t matter until they happen to a user.


You forgot the part where you get the average person having interest in running a server and learning how to do that.


But why dedicated relays?
Except if you want to make anyone that wants to start a 5-person community pay for overpriced relay hosting


why does it have to be a relay and not something like moderated communities?

but also, to the average person, that doesn’t have much value to them really


I’m intending to be transparent with what my device can and can’t do, unlike most vendors out there.

Also, using a proper SE, same as the ones in a lot of servers + security keys + ID cards etc.


“just one killer app bro. trust me” nostr:note1m263xj0w3mq2awxxn3ett56a3gpvl0emfkdwtjk3jnl9vnqafecsg5appm


Most HWWs are developed using cheap IoT SEs, some with poor track records. These only provide protections against basic attacks and anyone that stole a few HWWs holding 1BTC can easily make a good return on investment.

They also are not developed with security by design: it’s literally “throw shit at a wall until it works”


look outside the bitcoin space for VCs.

unless you want to be bought out by the same people that sell insecure and overpriced gimmick HWWs and use podcasts/influencers to exploit bitcoiners

and the people that made primal, which is falling apart on a technical level as they struggle to scale (they had to last-minute change to PostgreSQL, for example)


not really


It arguably is one of the few devices in the Bitcoin signing device space that properly explains its threat model, risks and benefits.

If you are wondering, your bank card is more secure than 95% of HWWs.


STM32s are already known to be not very difficult to dump.

Along with existing attacks on the DeepCover SE and the ATECC one, this allows extraction of the seed.

The ATECC one especially has poor track record having been defeated by the same attack on 3 revisions of the chip.


😁

https://image.nostr.build/1f57e2f1ede2861710c7dfad97c93857112bf5d0299796357f62af9fcaed667c.jpg

#CatsBeingCats


It is who knows how many years of IPP Everywhere and I still cannot set the color mode for prints and only get a single quality mode choice


it’s not as fast either for going through a 200-page datasheet for one specific detail nostr:note1hmq4hjz9p5tz8g0zv7g9gg6jx58fvh6tgrazyqecsan6lp2jv99s7gmfdg


twitter logged out view orders by popularity


Option 3: move to somewhere less shit


Congratulations your seeds are more secure against physical damage than a $200 gimmick


Someone make a $1000 rugged HWW pls so we can get scammed even more and pretend we are enterprise users
- influencers

The seed backup in the corner: ._.

Oh wait buy our $50 piece of milled steel that should be $20 nostr:note1wfew3pqlvh4ksfl3epkmmfskyh5ztjly06fkppzdg33pxnk84v7sxfwwhm


For it to be experimentation you first need to evaluate if it could work in theory before in practice.

Instead this is just trying random useless shit for the sake of it.


it really isn’t a good hammer either for 50% of things

to be honest, the cashu protocol has been having the same issues with incompetent design as with some nostr NIPs


To be honest this feels exactly like everyone trying to integrate NFTs. Or AI.


At this point why not self custody? What’s the point of having a mint?

Remember how they tried to add NFTs to everything? This is exactly like that


Oh so self custody with a shiny label? nostr:note1kxwsuxhaq48m8ahn0q6vh3aey2qym5fgkztsj8889n9h82wnazjq97g4vn


And that’s rare


Anyone can make shit on Nostr.
Who can make shit that’s good?


Nostr is not that malleable.


What is to say Nostr isn’t?


“why not enhance the fediverse?”
- fediverse people on nostr


I’m working on a lot more than that… :)


red flags:
- using “open source” as audited
- no proper explanation of cryptographic scheme
- devices used in signing are not isolated or protected


Data loss. And you can still be held at gunpoint.


You only need 1. :)


would be great if they existed

and unfortunately NDAd secure elements are way ahead because they have been doing this for decades

and that’s what I’m going with


What changes?
Except that you know someone tried to access it and failed, and that’s what the failed PIN counter is for


Yeah, I said HWWs.

Also one seedsigner can handle all keys.

What to use: your choice and threat model


depends on your threat model


It can’t lol

Welcome to podcast-sponsored HWW manufacturer price gouging where you’ll spend $750+


The best multisig protection model is that physical time and distance requirements.

No duress PIN will protect you when they can extract your multisig descriptor from your laptop or a physical backup and check, or know your amount of holdings.
A wipe/brick feature will be as good as giving no PIN.

Physical backups will always be a weakness too.


Also, it is secure enough that it doesn’t need a brick or wipe PIN to resist attacks unlike some other HWWs nostr:note135yemgzr88wgw2ufmpw22avy7csn32nsdq87sa3c8hcmwz4pkgqszwhlyv


What if a 3-of-5 multisig was only $200? With HWWs that is.


Flatpak fixes this or smth like that


They all work fine for me.

Well except Windows 11. That thing is hot garbage. Windows 10 all the way


video infrastructure is a complex topic

to make it work requires no effort with an MP4 on a server

to make it work WELL requires optimizations, and money for that to be usable (CDNs, servers for transcode and similar)

even one second of buffering can impact viewing experience for a normie

instead of funding ecash wallets maybe someone willing to work on the real problems should be funded


when funding?


NXP

I cannot disclose much of the approach yet


Nostr lacks in secure identity nostr:note1r7kn47mslfrcqtyezt448rzy0mplwekagyr2ckvp7qkfwnz4wh7qqhgun3


we’re early is a way for devs to distance themselves from the fact that they:
- can’t make proper UX for anything
- can’t make good key management either
- are focusing on the wrong thing
- and are incompetent nostr:note10t6v0chxu20tedvl8u3lvp23cn6qj5q8s8q22ajen6tahsdtfz6ql5s3ys


No. Making my own witn a proper SE at a proper price point that won’t make your wallet cry for multisig.

Depending on your use case either of these could work


I’m working on an HWW because I’m done with all the shit ones.

They sell you an assembled and software loaded in China piece of garbage with “secure elements”. Those “secure elements” are meant for IoT, are cheap, and don’t have many protections and they have been broken over and over and over (example, Mk4 is broken).

Source: I did my research.


They actually don’t.

The average consumer only cares about 1 thing: convenience. Optimize for that or fail

If your experience is subpar in even 1 way your product is DoA


you can’t change users unless it benefits them


trojan horse nostr:note19mj78atqal7ajdr40mvuqst64znxtakjepd0gac2st54f5d9n3rqe4ved0


At least it has a fingerprint sensor unlike the Portal…


become the employer


Podcasts are paid off


ah so you want to go the Nostr Plebs way… :)

but not everyone will want to use it and it will lead to a lot of people being disappointed, compared to a dedicated NIP-05 service


Oh. Don’t bother with NIP-05.
Pubkey whitelist is easier and people with other NIP-05s can use it.


only a matter of time before the RF spectrum becomes unusable


it’s not verification


not you specifically
it just seems to be a general mentality that nsec management for example has to be hard and people have to adjust to it


developers when they can’t make something simple when they didn’t even try: “it’s the users being lazy!” nostr:note1r7kn47mslfrcqtyezt448rzy0mplwekagyr2ckvp7qkfwnz4wh7qqhgun3


also see: Louis Rossmann


why AI?


First, not everything is on Nostr.

Second, Nostr notes are not non-repudiable because of the many ways they could get compromised, even with a remote signer (signing some unintended notes before access is revoked)

And you still need a relay to store that note… which will become harder and harder

Personal relays don’t fix this because they are limited to people who know how to run a server, and are intentionally limited to a small group of people. Also, maintenance cost will only go up while the benefit doesn’t change.


never really


It does not.


that is a very expensive HSM


whatever type of error you are having must be a more widespread issue than a few pages to be triggered so often

the ideal program would have a small pool it nonstop allocates to and deallocates from and a pool it very slowly checks and rotates allocations in/out

write random data and CRC it as I said

you then want to stop the process and get a debugger if there’s a mismatch and see the physical location along with identifying the RAM module


pick 2: security, performance, affordability


ycruncher?


Of course

The only reason this worked was those websites didn’t pin a version of that dependency and loaded the latest one always nostr:note1x5y3gvrvs8dy6v8d4fft237snpr9f4lrfds3l766nrq7dd2ch7ys67cs4u


The problem is that the current state of Nostr media makes it impossible for services to optimize without making someone mad.

Clients should signal what they need (data saving preference, rough resolution, intent such as to view up close/save or just timeline) and servers should provide that. Servers should also be able to optimize however as long as the original can be requested


Some media services do optimizations differently based off of client also. And re-optimizing images.

My personal opinion is that we also need a hash that reflects the overall content of the image roughly, and a way to signal to image services “return original optimized version” in case of things like a zoomed up view or doubt about content integrity.


You also need to consider optimizations by media services
That is pretty common


Due to interleaving and similar you already mostly achieve that


You want real workloads


Write a memory test program that stores 4092 bytes and a CRC


It is supported but not “validated” (don’t blame us if it doesn’t work) for consumer platforms


Will do in a bit


It is detected as ECC too.

G series CPUs don’t support it don’t ask how I know (tried to add ECC RAM to a system with one) and it didn’t detect as ECC


I have bought 2 random ASUS boards, one meant for “professional use” and one meant to be lower end (B)

Both work


another water heater… :)


ryzen supports ecc


Yes.

I have never had a corrupt DB with ECC memory, even with a few hard power cuts. I use RAID 1, though not with checksumming (mdadm) so about 50% of the time any issues should come up with disks if any.


and newer versions interoperate too…


Use a client that actually cares about its users, like Coracle.


Hardware accelerated ChaCha20 🤔


I wonder how many HWWs are developed with proper attention to security, from software to parts used :)

Most common one is cheaping out on SEs and buying one not meant for withstanding anything more than basic attacks. And “just add shit” firmware development


most boltcards are about as secure as magstripe, except it can be skimmed contactlessly


Boltcards: now with NFC, as if magstripe was not bad enough


Your GPU will have a grudge against you


You only get a yes or no, nothing else.


WPA3-SAE fixes this


No, if it also uses paper ballots, why digital also?


Okay so what’s the point then? Redundancy?


let’s also take a page out of most HWWs books and make the code say it is genuine itself


Now, the problem is… how do you know it runs the code it says it does?

Maybe consider this the next time you see “open source” but the boot code cannot be verified except the boot code saying “trust me bro”

Also can we stop calling it boot ROM? Thanks nostr:note17yxrfrm7fy9zmk6wsnkg26z8mnfc20fgpgan4ln6yrw4hmpl8x7sj500ju


this is one use case where PoA makes sense as you do not care about reorgs

any reorgs can be easily proven with an irregutable proof


You forgot the part where they overprovision access, inactive accounts, and economies of scale…

knowledge can’t save you from stupidity nostr:note1c86y0cyr8jm0ndudln2v3tfcjfxz8jp0hhh5nrmze8cfc2lw9q4syrn03h


you can’t really just catch CSAM


not possible


nostr is the perfect breeding ground for this shit

no good way to actually block abusers, marketed as anonymous


it’s much worse than it appears nostr:note1lj29p7mct8a4tyg7m8cyh57cm7563l5c7nynzyevjdng8t0n77rs8r0p83


most SSDs now error instead of returning garbage most of the time also if they detect a checksum error


actually, not really
it’s loaded into the chip in the passport


you can’t do much


I need it for a VM only 😂


I can also just use Win10


nevermind this is dogshit why did I even try 11


no, will see if I can debloat it in a way that works post-install


it’s in a VM but I hate every bit of it

I will try again to run it with wine but that didn’t work out well


ask people running click farms

seriously though, you could probably 3D print a tray


this feels very wrong to do

https://i.nostr.build/AiXI2GN8Hr687yem.png


idk why you feel the need to call me a loser because I told you the truth

chips on passports are now pretty widespread for authenticity validation and it not being detected is often a clear sign of counterfeiting


Good luck getting through border control after that

Also that won’t do it


depending on where you travel to and your country of residence, at border control, scanning your passports will automatically transfer biometric information stored on the chip of the document nostr:note1xrmpwys9xz4f7j9737kg4r3nl0mtc7grc5wh3jzw8m3mn9tmqt8q2vmje7


It’s a side effect of privacy ones actually.

Caching and cookies are now isolated by top level origin


does not work with https and some new caching and isolation countermeasures added by browsers


No FileVault?


Recovery is a better way, you can even reset passwords, it’s integrated, no logs


there’s none
they set their username field to the NIP-05 so it appears confusingly similar to an actual NIP-05 on some clients


this is because they set their username field to “CARLA@nostrplebs.com” and not NIP-05

this confusingly leads to it appearing like a NIP-05 even though it is not


another thing: having privacy measures can be detected and the useless data thrown out

even better, you just narrowed the amount of potential users down


now allow replacing it by a blob store like seaweedfs


Don’t worry your carrier will sell them too


I do not believe so


and there’s already a protection against that


the worst that I can think of is DUP CAT DUP CAT DUP CAT DUP CAT DUP CAT, blowing up the stack size exponentially

the solution is to put a limit on stack element sizes and the stack itself, as this is also possible via other means but somewhat more expensive


Ecash tied to npub developers in disbelief when they learn how easy nsecs can be leaked


Use Firefox


You are missing the entire point


It actually is better for other viewers too as they can see actual conversation instead


a zap and a like express different things

a like indicates that you found something useful, interesting, relevant, whatever. you liked it

a zap indicates it provided you some amount of value that you are willing to pay for, such as paying to support future development of the content

there are some people that think you should only zap and more than (insert some sats number) because some BS, those are usually the ones that can’t provide meaningful value to be worth *paying for*


also one key for everything is a bad idea and delegation should have been actually a thing to some extent along with OTS

You can also just sign an ed25519 key with an nsec


You are probably not affected if you had uBlock nostr:note1x953gmpz6nwhtm5ys6hadgtre90xx9t8984hdj5nkzud93rq36nsuf0saj


Last time I checked it was hardcoded


Not really.

Anyone who uses Nostr for private use also would realize the benefit of switching to it for a public presence.


Yes but that may as well be irrelevant in user counts.

Also, they probably use public relays too for a public presence


Nostr is inherently different.

It has long term identities at its core.


or can they? :) nostr:note189n6ynyudsluqw9w70yp6sk8lyuhkp00jlrpn244zdewru683xyszztzfq


Dead


😂 oh well…

that is what you get for not developing in a way that mitigates nsec compromise risk nostr:note1573nl7htvwap0kyjndg4g02nfkn270cl8e9hlq05y0550r5whdsqru6sgz


You get what you pay for


Iris and Snort


🤣 #catstr #artstr https://image.nostr.build/615256fd527797638383ffdc8bf07ec792183a336d26b73644176f2a88e61824.jpg


Wait, they were once, and they forked?


They are the same client now aren’t they


no


promoting your project (esp. for monetary gain) should not become your primary project

a lot of things in bitcoin have gone wrong because of that: HWWs, shitty grant funding schemes, podcasts, confs nostr:note1z0q26x4tgk5chvs5hesqx6mzjv65em8unz2rkrc8s20vc9q9dd6sdsmd58


“rules for thee but not for me” in the Bitcoin community, exhibit I lost count.

I think we all know what stablecoin means

also, before you say: it is mathematically impossible for there to be a stable store of value even if managed by a perfect algorithm in terms of supply control nostr:note165xdh32epx8javjjr290gw3v25nkl4ky5z4wgcavh4zxn6gt3h7sv6tl7e


I think it may be a takedown request.


That cutoff is in March, hmm
Weird


Also, batch signing does not make much sense.

You need to send the AUTH event immediately for example


Smartcards are also cheap


None of them


You know, you could move the entire signing process onto the card, and I am doing that

You are forgetting that the average user can need to sign up to 5 events/sec. AUTH, media uploads, etc


you are probably overdoing it


Or you can renew


yeah.

there’s the people that are idiots that know they are idiots: they don’t do anything

and then there’s the idiots that don’t know they are idiots or don’t care: they are dangerous because they will fuck things up for themselves and others

another example is the HWW industry…

a bunch of companies cut corners to the point where you could make a “most incompetently developed hww” marketing video and people would believe it

you could also make a “most secure hww” and they would believe it


there are 48k potential keys with prime size 11 bit and less.

9.5k if you look for 11 bit only.


and it is fair because there are lots of idiots that don’t know they are idiots, just like on Nostr…


uhh
RSA bare minimum was 1024 bits, not 2048

768 bits has been cracked with large distributed compute projects

also the cracked key is actually only 11 bits


no they factorized a 11 bit RSA key

one that you could do faster on your own computer


offering a not shit signing device, I guess


last part: did you hear about delegation

I kinda hate the existing spec since it doesn’t define what filters exist AT ALL


I figure they could take a 10% rake, actually have a winner according to their rules, and still always make money.

Smells like a bit or “rent seeking” to me.


But yeah, verifying sigs is good.

Next steps: learn how to use a SeedSigner (always a good tool to have, for example if you need to temporarily handle a seed outside an HWW)


bitcoin seeds: DO NOT SHARE AT ALL COSTS KEEP OFFLINE ONLY

nsecs: “let me enter it into some random shitty site” nostr:note16kvrld6cn9pvzzzm7ed3ypyr23nasdsv7zgzk0xvq8s5p0evjehsvr0khy


I think you forgot context


Of course, since it doesn’t work with wine


Win10 vanilla install


I have a Windows VM on my Linux machine for some things


yes, by that I also include a way to discard everything and start over

the only permanent thing in a service should be its data volumes


I personally prefer automated deployment scripts


Let’s put the influencers on the board also. And also one with a stake in selling their own overpriced but kinda shit HWWs.


Let’s also emphasize it is Bitcoin related just in case


Hear me out.

Influencers get people to donate to some “charity”.

People those influencers know make shitty projects.

That “charity” gives them grants and does not disclose the amount.

Sounds good?


That is also the reason the last innovation in hardware wallets was the introduction of a screen


Developers think they know everything.

“Let’s make another shitty ecash thing” 😂


I wonder the security practices for HWW manufacturing now, especially ones with an STM32 handling keys or whatever.


It’s kind of their right to do whatever. Though it is a shitty move.

Piracy is fine as long as it doesn’t actively try to make less people pay for that content: people pirating due to a subscription model would have never paid anyone


Again, falls under the last one: you wouldn’t have earned from it anyway, so why care about piracy (as a publisher)?

Piracy is often either a pricing or product issue. They can’t afford it so they won’t buy it anyway, or you are offering the product in a way that they don’t want


The only problem imo is when it actively reduces sales.

But if people that wouldn’t have bought it anyway pirate it: who cares? you get free publicity at least


It’s a VC funded company that only wants to eventually sell you subscriptions or ads


25GBASE-T and 40GBASE-T, along with Cat7/Cat8 were dead on arrival

10GBASE-T already has stringent requirements, network cards that get very hot and more.

But if you insist, we have 800Gbps already, but it’s only for backbone connections

10Gbps SFP+ used is dirt cheap

25Gbps with SFP28 is a somewhat the standard for DC deployments as an in-between for 10 and 100 Gbps.

40Gbps serves no use except being cheap homelab crap

100Gbps is still pretty good and the max you’ll see on a server (example, SANs) but also costs a lot more

more and either you are looking at either backbone links or AI


If it’s PON, it’s shared through everyone sharing the same fiber. Also asymmetrical upload (2.5Gbps)


Depends on if it’s PON or not too


it is a relatively easy one to automate


not the issue, it was I installed a new package

since I didn’t update for a while it pulled in newer versions of its dependencies, while other packages were left outdated


good point

except that is considerably better than “throw shit at a wall until it sticks” approach that some HWW manufacturers take

though they also do not know how an SE should be properly used


opensuse


Not much.


Yes.
Integration is not possible due to economic reasons.


You can’t.

It is objectively not in X’s best interests. Being a SPOF is fine for them as long as they retain control and can lock people in


reminder to not update a rolling distro only halfway


What the fuck.
In a bad way.


uhh I mean a signing device


What if it was not unencrypted storage? :)


Kotlin supports types. And it has proper null checks unlike Java


I used it for a web app a few years ago.

Was not good as frameworks like Svelte. But also was somewhat better than writing raw JS


Kotlin is the way.


I do not have a public nextcloud instance yet


Yes.
And import your own!


Wanna be a tester for an actually secure hardware wallet?

nostr:nevent1qqsxet63dzg8rl35s6cjajpy9yh3ztparjyz5l26xqxztkgzpz4x86cprpmhxue69uhkv6tvw3jhytnwdaehgu3wwa5kuef0qgs99d9qw67th0wr5xh05de4s9k0wjvnkxudkgptq8yg83vtulad30grqsqqqqqp30jajv


yes

also, unlike most HWW vendors, proper industry standard software development practices will be employed


you can also send to nostr at hi at <my username> dot dev


formstr is kinda shit


We have an imeta tag already.

We could add a field to force inline display.


I was proposing more of an idea for future implementation.


Images that should be grouped should be listed in succession


THE HWW REVOLUTION IS HERE

A DEVICE YOU CAN ACTUALLY TRUST WITHOUT INSECURE SE’s LIKE THE ATECC608B MEANT FOR A SMART LIGHT BULB

AND MADE TO BE ACTUALLY SECURE

REGISTER NOW FOR EARLY ACCESS nostr:note1gwvldxqwf3wfjvt8x86vlzc4h872csqpv925ewqjg3wpjf5kue6smprq0h


There’s also the issue that you can’t verify whatever the factory may have loaded initially (so all installed “updates” are tampered with by the previous FW) and that I cannot provide the toolchain to compile it even if I share the code


Unfortunately not, the firmware interface and DPA and fault injection countermeasures are under NDA.

All tooling outside it though will be.


You will be able to lock the HWW remotely (this uses a completely self-hosted server, and it can be backed up with a small file).

After you do, it can’t sign even if you found a way to attack it: the server holds an encryption key that encrypts the seed on device and with that destroyed or not provided, it’s useless.

You can also use this to do a lot more nostr:note1gwvldxqwf3wfjvt8x86vlzc4h872csqpv925ewqjg3wpjf5kue6smprq0h


there are people that should be more concerned if that was the case


I see no reason to use Nostr for this, and if Microsoft decides to censor my very simple product survey, I can always self host.


CatX is ready to launch StarKitty

#lol #catstr

https://image.nostr.build/09f10b7788aaf4ec4962f570c5bd73737eb25b9eb5632cf024a43b3833c59f77.jpg


Want to join early signer device testing? nostr:note1gwvldxqwf3wfjvt8x86vlzc4h872csqpv925ewqjg3wpjf5kue6smprq0h


Forgot to say, but you will get a testers-exclusive design if you register now :) nostr:note1gwvldxqwf3wfjvt8x86vlzc4h872csqpv925ewqjg3wpjf5kue6smprq0h


At the end of the survey there is extra comments


Uh.. kind + pubkey is an ID lol


Please fill this short survey if you can related to my in development signer, and renote for visibility.

You can also register for testing for early access + a free signer (only shipping) in what I expect to be late 2025 Q1.

https://forms.office.com/r/CxzzG4Wqam


Because you usually only need one


I have made this more clear and added it to the start of the survey instead of the bottom of the first section.


It’s explained in the survey. But it’s a smart card.

You can either use it with NFC or the contact interface.

BIP-39 seeds, BIP-32 xprvs or nsecs are supported.

A PIN code of any length with any characters is used for access control.


and then we manage to pollute the earth’s orbit and make space junk even worse nostr:note15nuc7t5ld5qhjksmayhvsh6pxcxpzlhzf254en0y5mywl42dfp0q0hh6tv


so a /96… wtf? 😂
Standard allocation should be /64, no?


Also, reflash if you are suspicious.

Otherwise, I use SeedSigner often and have nothing against it like some of the other HWW vendors… :)

They serve different purposes, where in an HWW the responsibility for seed protection is on the SE, with SS it expects you to protect the seed yourself.

The former is better for carrying wkth you, but the latter works well when you are trying to build a larger multisig affordably (since you need a physical copy either way)


that is different for a different use case with a different threat model


The Brother laser I got has no chips on cartridges, and separate drum is great because it means compatible cartridges are way cheaper

Being able to reset the cartridges very easily in case it still has a bunch left is also great


Epson EcoTank ones are decent… though it is an older one

just don’t leave it unused


Brother laser ones are great


Even with dual SE, both are vulnerable to laser fault injection. This could be solved easily by using a different SE but no, they upgrade to the newer version of the inherently flawed series of ATECC chips.

And they intentionally make it so that their devices turn to e waste instead of wiping the seed (like 90% of HWWs) if you forget your PIN for example.

Also, your money will go directly to propaganda against competitors like SeedSigner


With SE? Infineon chips are pretty good but some of them have a few vulns (does not affect the Trezor use though)

I cannot speak about their architecture fully though, will need to look into that.


Which ones would you like to know about?

But if it has “Bitcoin only” in its marketing, it 99% of the time falls under these categories.


I assume v4


clients also discard ordering info

I think we should add a new REQ-like message type meant for this with cursors


Ledger thankfully is made by a more competent group of people


Most people think they are paying $150-$200 for an HWW.

What they are paying for is an overpriced gimmick with a very small amount of security added.

All the major HWWs, including their latest revisions, use insecure SEs or ones which a viable attack exists for.


they even announce IPv6 routes.


Oh, I do hate it. But also I hate it less than NAT.


my ISP does not give v6 to even their business customers even though they could


ISPs have shit infrastructure


what you need:
- money
- more money
- even more money


Yes.

What I said was being connected to cellular is the norm, and Wi-Fi is the exception.

So the amount of time you serve media for is limited.


which is the exception than the rule

better off making a blossom umbrel app or something


So it would use mobile data to allow people to download…?


Then what you are running would not be a blossom server.

It would be a local media backup.


Yes, when making it public


uploading a 1MB image and having it be loaded 2000 times (just appear for a second, especially on apps without cache, on every view by the same person) will eat 2GB+ of your mobile data

the sheer amount of stupidity on here is insane nostr:note1vltaxrmxckfpg0ra6zwxn39t4h965mfdqctm87mgej6srh6ahjeq8qsa7c


Arguably a higher chance of success that way.

Or if your team has Rust developers, start shouting that C++ is better


Yes


sha256 is safe from quantum computers

secp256k1 is not


No, I specifically said “only pushes one without mentioning others as much” and “bashes other options and alternatives to those”


Just think about the top podcasts.

Which of them are influenced by people with bags VC funds like Ten31?

Do they constantly push a certain HWW vendor and not others?

Do they bash projects like nostr:npub17tyke9lkgxd98ruyeul6wt3pj3s9uxzgp9hxu5tsenjmweue6sqq4y3mgl with false claims?

And so on.


The problem with HWWs is that the overlap between people that know or learn how to write secure software and best practices, and those who make a HWW, is small.

The industry is rotten to the core with a lot of podcasts being paid off to FUD competitors or alternative solutions that don’t pump their VC bags.

They don’t care about money. They care about selling you a cheap product for a lot even if it means cutting big corners in security.


“When we told our developers about our plans to do a certification, they disappeared into the server room and didn't come out! We think they're hiding under the floor, is there anyone who can help?”


No, the ST32s are different even though similarly named

https://www.st.com/en/secure-mcus/st32-arm-core.html


it would be cool if it existed


when my chip vendor responds


I can confidently say that the HWW space is being ran by 95% clowns.
If you exclude the wallets that are not bitcoin only, that becomes 100%. nostr:note1upvg0s73kj57387rpq3zq55jm29fsrf838vnps79k3zzk3ypaldshhpnft


Your following list got wiped(?)


Look at:
- ST32 from STmicro
- TEGRION series from Infineon
- SmartMX3 from NXP

The SE050 is just a configuration of the P71D321 in a chip form factor with JCOP and an applet


Yes, MCU side.

We cannot audit the MCU because there’s code protection measures unless you were to have equipment to do a fault attack on it, and this needs to apply to every user.


A good change.

But far from ready. Security ICs take years to develop and perfect.

And in the end, you still cannot verify code running on it, the only difference being NDAd documentation and architecture which makes little difference to the end user.


the goals of security and verifiability are inherently conflicting as to verify you need a chip that anyone can check the content of, but for security you want a chip that no one can see the content of

the MCU may have open source code but the moment it is compromised it could log your PIN on next attempt


still, a pointless attempt.

coldcard for example has a dedicated privileged flash segment (the “boot ROM” which is not ROM at all) that handles retrieving the key and could store the PIN/root key in its small flash segment

it is not truly verifiable without ripping out the chip and faulting it


both of those are not a good fix for public relays, but they are needed


I have sent some things over on Telegram


and false “verifiability” in HWWs, as their designs also mean it makes verification impossible (SE code) or requiring somewhat costly tools to work around security measures (MCU)

having NDAd secure elements is arguably better for security than “verifiability” as in both cases the manufacturer could slide in a backdoor but one means you usually end up opting for worse parts


doing something you are unfamiliar with is fine

but when it comes to securing millions in funds… you need to do research. and be honest where you fall short

too much time is wasted on marketing and the likes: eye candy over functionality, security taking a backseat (“resolved” by adding one or two IoT SEs with a lower bar for security compared to even a credit card, made by manufacturers that do not have a track record for high security SEs) and exaggerated marketing claims (“most secure”, “only airgapped wallet”)


in a market where people don’t verify marketing claims anything can happen


well, technically yes

in practice no


And everyone keeps sourcing their SEs from a company (Microchip) which had made 3 revisions of their chip with only ROM changes and still has not fixed the root cause of flaws in the ATECC508A, 608A and 608B (used in a lot of HWWs) which is that there is no light sensors or self-terminate mechanism in the case of an attack

Their way of rating chip security is via the JIL rating system which is a very low bar to pass and involves the vendor coming up with their own numbers on how hard it could be to attack it, which they conflate with EAL5/6 because that is a lot harder and expensive for what is supposed to be an IoT SE nostr:note1upvg0s73kj57387rpq3zq55jm29fsrf838vnps79k3zzk3ypaldshhpnft


The inherent culture in this protocol means the people that have proper experience with large scale infrastructure are either not here because most of the devs are clowns, or they are here only for personal gain.

And without them you will never scale. nostr:note1nfsjr9kt4j58p43dac6djdrgnp0epwte5dv72jxw2dtk8tratr0q3s09v3


While developing an HWW, I have started to realize that 90% have no idea what they are actually doing and they think that adding a secure element is a silver bullet to all security issues


I’m working on some things that again need something more than a mnemonic… and arguably mnemonics are just shit, being a pain in the ass to implement in hardware


it is not


Contributions get counted based off of the author email…


it should be spread


No. It’s some ordinals shenanigans. I should have checked the address histories more


Yeah it is a node sweeping multiple anchors at once I think


LN node anchors (?)


That is bad for onboarding. Or efficiency.

Why spin up a relay per community if they trust a friend and they have a relay already running?


You either have a server running Debian and manually configure everything, or you don’t run a node. It’s that simple.

If you can’t do that then you will lose funds


Communities are needed but not when they centralize onto individual relays and everyone has to pay just to start one because they can’t use an existing relay by a friend or a public one


Nostr devs are too dumb. And who cares, everyone can pay for a relaybto host.


Didn’t check that


Actually if you hate manually going to their profile on Twitter to verify, there is a spec to link profiles on different platforms to Nostr and even PGP keys


That does not matter

We are verifying that their Nostr identity is linked to a known good identity (their twitter handle with a lot of followers)


If you can’t verify then don’t say shit I guess

The end result will be nostr getting a reputation for fake and scam accounts


Nitter


it is funny watching people trust and not verify

is it really that hard to check for a tweet or something? nostr:note1wdc870agyglksfy9279zws88kd7rqdepq4az46pk0lfmg0xqu38qrecnxj


read the name of the account you are replying to


Yeah because no one has implemented forward secrecy yet.

And gift wraps are shit and don’t work.


DM username


so what? you need some amount of limited access for ecash too


No the UX sucks

Matrix or Signal?


Can redo it if needed, I have a way of doing it about 80x faster than my previous algorithm.

Do you use Telegram so I can DM you there?


Yes and people want to slap it onto everything just because they can

This reminds me of something…. Shitcoins


tbh, one relay per community means people have to pay to start a community, even when using public relays

communities must be encrypted, private relay or not, the hosting service can get compromised, etc


Yes and so why not use LN? Why ecash?


You haven’t read the last part of my post


There is so much data on nostr left to be analyzed


We are going back to centralization with relay = communities


the problem is that you can’t mint ecash without being connected to the internet, and you can’t connect to the internet without paying

also using ecash is utterly stupid for this as not everything supports it compared to LN, and you have to use a “preferred mint” etc and any mint conversion mechanism already uses, you guessed it, LN nostr:note1sldhcs0l0uxkkajkwxynlj3f7sfkcltntu8rds97ckd8x4hfcvyqatlwj2


bitcoin core USED to do nondeterministic


To test this there also should be a “fuck them both” option


the only way to make a secure hardware wallet is by not being able to leak what you don’t know

:) nostr:note1e5ecgteu25r2dvrcn9y64cts2c6jx03c90ccuju7ksjp3zr5qseqeaqske


preventing side channel attacks is really fucking hard


That is caused by the transaction system used by ZFS: all writes are committed in 5 second transactions, and before that the blocks reserved for the write and the original blocks for CoW are both “used”

This is kind of the shittier part of the FS, as it means sync writes run twice: one to the ZIL, and then to the actual disk.


inkjets are arguably the dumbest printers that could exist: a motor to move the paper, a motor to move the print heads, the ink itself, print heads that just spray ink droplets, and some sponge to hold waste ink for cleaning

it’s all the extra bloat on top

and the software that means that the printer either clogs after no use, or it keeps dumping shitloads of ink every day as “maintenance”

you can dump a ml or two of ink through the heads every few days and it’ll never clog or accumulate air while powered


I own an epson ecotank that is decent, and have the software for resetting the waste pad counters if need be (they are on sketchy websites, but it works and you can run them on a VM with USB passthrough and no internet only)


also nothing can beat laser in water durability, pages per minute and reliability for low volume use


modern inkjet printers are the work of the devil

yes, inkjets arguably have their place in high resolution printing, especially for color images

that doesn’t mean shit if the printer keeps clogging instead of using the bare minimum amount of ink every few days to prevent clogs when unused, having the problem of non user serviceable waste ink sponges + print heads for tank printers, expensive af cartridges, and DRM on those

something composed of a dumb print head, two motors, a paper feeder and a sponge apparently has to be so fucked


I like ZFS but I cannot deny it feels very out of place

It tries to integrate block device abstractions and the filesystem into one layer.


Yes, that is the only option. You must add the relay used by the NWC server I believe


And yet they still fall for bullshit propaganda from HWW manufacturers, are delusional about the state of Bitcoin and Nostr, and keep bitching about stuff they don’t know about. nostr:note1mh7c2qx9hxp7wjf3prd7wmu9kzs7ktjjvs9nlhqcdr3qfsk8a9wqtz8vc5


Cancel your credit card


Getting ready to face a new day ... #catstr
https://image.nostr.build/411531303f502da261fdaaa29aadc9af6bca52217940e72787c2c4168a92b889.jpg


still has latency, considering USB is still polling based


no one cares, they just want to complain

nostr nests had no relation to nostr for a year+


on Pi’s this actually negatively impacts performance and SD card longevity


the in other words part is wrong


They charge additional fees as a credit card provider to merchants.
Then they take most of it and give you pennies.


If you're not paying attention to what's going on with The Internet Archive, you're missing a BIG story.  This is NOT good.  Currently they are under DDOS and this is after they're being sued out of existence for digitizing 78rpm records that aren't even available anymore.  They're facing a $600+MM lawsuit.  They previously lost a suit during the 'demic when they released digitized books for free.  The likelihood that they will end up shut down and entire histories of the net will be lost forever is high.


WoT is pointless for resumes


I love it for being explicit when you ignore and when you handle (with no other option) and hate it for being repetitive


fuck. s/n nil/n err/


if err != nil {
    return nil
}


it will be bad when a client’s domain gets compromised and nsecs leaked via an attack

so people will switch to web based signer apps

then they will be compromised

the only way out is a proper hardware signer, a proper remote signer or a browser extension


Go is the way for backend.

Kotlin when you need it.

C will stick around forever for some use cases because it is very close to machine code. nostr:note15u74uj0qu5ftvytp7y2w2mnxqqwkvzrejnscmrqq8hz2mzsv7kdq2gylv8


Verify performance?


I think not being burnt out is more important

There’s moderation work, and clients also want features, then you need to make sure it runs stably, etc.


did you hear about static or dynamic analysis? 😆


to be able to have AI scan vulnerabilities means that it needs to be able to build a map of the application logic, how every small detail interacts and how these may combine into an exploit chain

that is not possible with a text predictor


nostr.build already has file search, along with filtering my category and folders


Why use a HWW then?

You need to store the seed backups somewhere, may as well use SeedSigner with the seeds


yes, they have, the SE2 used by CC Mk4 is broken (source: Coinkite), and SE1 also has been broken (source: a talk by the Ledger Donjon team)


Plug it in, authorize the client, then you can manually approve from the app or auto approve certain kinds.

A hardware screen is not necessary for this use case. Manually verifying for every AUTH event or reaction is going to make the UX shit.


both SEs are vulnerable to laser fault injection and lack basic protections that has existed in any credit card for the last 15 years


yes, the only case it could work with unnecessary complexity is where you use a remote signer, each client maintains state locally, and you remove a client

in this case you can also do the following which is easier: rotate the secret used for encryption


actually, wrong term

I meant forward security

post compromise security is interesting, but it is not applicable in nostr


NIP-04 and the likes work (not that they are good, especially gift wraps) but they have no post compromise security


both of them are IoT grade shit (and at least one lacks any CC certification) that don’t have the same basic protections as any credit card within the last 15 years


both of them have viable laser fault injection attacks meaning you only need the expensive (probably $300k max) equipment, but that’s nothing as you can reuse it for as many wallets as you prefer


The idea that an HWW’s security hinges on the secure element only is insane


the devs say “go make a better one yourself” because they are too incompetent to do that themselves


didn’t get the pgp key + email yet though
or signal


they are too busy making the 37th ecash wallet that looks like it was named by an immature idiot to fix real issues nostr:note1wzxcmgtmcwegr6dfqlc9kkydmnxvlumzz0qy0dmw0r0r6v8e2ysqktspmg


Have been working on a secure (not some shitty ESP32) signing device over the last few months.

Expecting it to be ready for testing in Q1 2025. DM for more information. nostr:note12ms9x0p79krje7gv76axfvcfrrt7fs9xyyzk0sw069gp80f8wgrs29w40j


security is a layered approach

one of them is having a secure element

there’s more that I will publish later :)


Shredding a credit card does not make it unusable


localhost websockets


That is what I mentioned in my post as not a shitty ESP32


Unfortunately the culture of quantity over quality exists here


Welcome to Nostr

Fast paced low quality half working projects are incentivized more than quality products that take months to build nostr:note1jmav6c840xj2fkzlsjw9c984wvmms422a4mplremq8ga3audjqls9kuagf


And your stupid-ass comments, that people who don't like your garbage code should go build their own app is merely an open acknowledgement that

YOU ARE NOT CAPABLE OF BUILDING AN APP THAT ISN'T GARBAGE.

Learn to code.


Memory bandwidth contention manifests itself as a drop in performance across all cores after some threshold :)


The benefit of a proper hardware solution is that:
- unlike nsecBunker, nsec.app and browser extensions, the impact of malware is limited
- unlike nsec.app your keys cannot be stolen by the app developer with a silent update
- unlike other “hardware” nostr signers, it doesn’t store keys in an easily dumpable ESP32 nostr:note140nfz32f6w0urdj0zv5agxznd226g6whn43n7auz7q2qkggrfeusxwuhlv


Electric car fires are the worst.


we do not need that either

it also supports negotiation

you set a list of protocols to request, server sends a protocol picked or none as a response


websockets already support a protocol header


We can have a version field also.

Version 1: just normal Nostr events, signed as usual
Version 2: fields can now contain non-UTF8 content, new signing scheme


I’m on iOS 17 though. It works fine with HEIC also from Damus. But it most likely is a color space issue.


Uploading from the account page specifically seems to remove color profile data for some reason. https://os.hel1-c1.semisol.net/static-n/color-profile-test.png


p3 test https://i.nostr.build/D1ynVdfBut0sU6Dy.jpg


I’ll DM you an explanation for my idea that will end up never finished soon. 😂


2. No.

All chips have some sort of hardware boot ROM, from your CPU to a Raspberry Pi to the STM32s used in a lot of HWWs including CC.

RPi boot ROM cannot be modified and such an attack would need to target your Pi specifically, which is impossible, and then somehow figure out a way to detect SS code and add a backdoor.


Just to add, the code on a CC is not truly verifiable without destroying the unit


yes, I’m also saying the new binary signature is another detached field like id/sig


I was thinking you would add it to the original event


the problem is with a tag you can’t add the faster signature later


Have been working on a secure (not some shitty ESP32) signing device over the last few months.

Expecting it to be ready for testing in Q1 2025. DM for more information. nostr:note12ms9x0p79krje7gv76axfvcfrrt7fs9xyyzk0sw069gp80f8wgrs29w40j


why?

we can just add a new field like “binarySig”, relays can validate both of them (and backfill binary signatures if later added by the author), and clients can pick one


Please DM me an e-mail address to send further details to along with a PGP key for encryption, or a Signal link


s/optional/not needed/


Binary encoding: we keep compatibility with nostr events, just optimize JSON field names away

Binary events: breaking change in signing scheme that also means conversion to JSON is optional, tag values and event contents can now be binary


Adding complexity means you use the emojis to derive a seed or convert the seed into binary then emojis


That is about as secure as a 12 word seed.

Also, with a scheme like this it is not possible to do words and emojis at the same time unless you add complexity or use 22 emojis


Also DM for testing if interested.


Partitioning is probably the best idea.

I’m thinking we need a binary version of Nostr events (not binary encoded events), for cases where it’s not complicated enough to involve a system like Blossom, but also would benefit from binary encoding like encrypted events.


nostr.land does not :)


What’s the use case?


eithet this has existed for a while and I implemented it and completely forgot, or it’s new


wtf is a uppercase P tag?


“Breaking news: New “AI powered” backdoor that can detect malicious actors defeated by prompt injection”


A backdoor cannot differentiate between good and evil: it does what it is told to do nostr:note1qk2uelcescwpvcrhr8kss9jpvjwcaq3upt6f2u7tlpkvkr34ej3sdz9kj5


Being a bitcoiner does not make you automatically not an idiot. 🙃


Yes, in this case they are forced to pay because they do not want to be inconvenienced or want higher quality.

There is a mandatory two way exchange of value, unlike in V4V where the payment can never happen.


Yeah. That is often rare though and there’s some other benefit to the donators. They don’t believe your cause just because.


You may as well paywall then.


Are you sure that statistic is not made up?


Then specify so.

From my experience operating services, and from info from other people: it’s very close.

You’re trying to divert the conversation because all you care about is creating controversy and getting engagement. Not much different than the legacy social media fucks.


You forgot the initial production cost


It’s facts that you can easily verify. Though that becomes hard when you are delusional, so…


Advertisements.

You are paying with your time.


You just made an illegal lottery. 😂

But early access/members only access works and is free.


Proof?

There’s a reason people are making members-exclusive videos on YT, constantly reminding you to donate on Patreon for exclusive access, etc. Without an incentive it’s all pointless.


What people don’t realize is if not forced to pay, 99% won’t.

The only reason V4V appears to work is people are trying to make their own point valid, not because it actually works nostr:note1we6gzffcek2smm96aruylmldmqk2tq26ryqt36al03mwsed5tr2qpud038


Accidentally clicked post.

But I said it in the post, PGP encrypted messages over I2P


the problem is not the crypto, it’s how devs implement it


I can’t trust Nostr devs to make good cryptography. I would encrypt messages with PGP and sending them over I2P. nostr:note1ekgsp38m0lc2wvp5n5cycyvtd6nl8j79cac0wccet2g5kyjkqurqhdnv7e


gm

📩


this applies everywhere nostr:note1tnnw80qajkej230y6gar2x0754g9usd6kgd88pkqxh2lyh8unvhq33d45w


I proposed a format for that


If you are a client dev and you want features: pay for them. Especially if you are on grants already.

There are a lot of components of Nostr like media hosting and relay software no one cares to pay for but keeps asking for features from.


Programming language


MS teams :|


Torrents nostr:note1t2vnew9s8tvtffyag237jce80g7e30erxx6kaq8564zget28w5ustgpdug


When we run out of that, base-36. Then we can also throw in emojis.


Okay this is it, NIP numbering is now hexadecimal nostr:note180f8e2lfwwmm0y8l7d4znsr258dwq6nrllpswrw45qsu8f4pz2dstmshe5


Try uploading to NB directly and compare


There is no solution… ish

nostr:npub1xtscya34g58tk0z605fvr788k263gsu6cy9x0mhnm87echrgufzsevkk5s could request the HEIC file from the OS instead of a JPEG and do its own compression with higher quality. NB also does optimizations but I do not believe that has significant impact.


Yes, yes it does.
Saving as JPG means you will experience that in your gallery also.


As the requirements for a system’s security increase, the performance (including, but not limited to, features or throughput) per dollar curve starts approaching exponential growth


Ocean with yet another underwelhming announcement. Datum is Stratum v2 but no e2ee and binary data transfer. It might be quicker to adoption due to it's simplicity but they're resources could have been better spent working on Sv2, IMHO.


validates for me on damus


the worst part about all the sheep on nostr is they don’t know they are sheep


Note: if your nsec gets compromised any Nostr Plebs e-mails will be visible. We will implement a spec with forward security when available.


because walled gardens.

and even though we like to pretend that the content on the platform does not matter, it does push people away when it is a bitcoin circlejerk

people won’t do stuff free for you, we have to fix the problem


nostr.land transparency report over the entire lifetime of the relay (for eden, after it was under my control)

- 0 government requests received
- 0 users suspended
- no logging of IP addresses nostr:note1qynjuvccfuvuf8yj6gpqkkvkg0hg7tq3t9khrkrpqvwzsdhag50q49hr8c


Sometimes, if you don’t stir the pot, the soup burns.

#thoughts


in what way? most people don’t even know the media host they use

it also comes with other problems like moderation also

they also need to provide some value proposition to paid users which could be also expiring media


paid accounts have deletion so you could probably ask for expiring images on paid accounts


OpenAI shedding their top people quickly. Ilya, Andrej, Jan, Greg, John, Peter, and now Mira are all out and those are just the ones I can remember off the top of my head. That’s the heads of their research and safety teams and all the top executives.

https://twitter.com/miramurati/status/1839025700009030027


Preparing the BitDevs meetup at the nostr:npub1fpqlfgejlvnv5swanf0398y6k9vvheqs9g4zmjlthrga7ytn53dq3pqwcz tomorrow. Come and solder a nostr:npub17tyke9lkgxd98ruyeul6wt3pj3s9uxzgp9hxu5tsenjmweue6sqq4y3mgl for yourself!

Thanks nostr:npub1hc65wf3cq9pk8235q7udtun7a3sazgxevww2jpctnfr8wwt9s0dq8ga3yg for sending us all of this 😍
https://m.primal.net/LCTV.jpg


Hoping to clarify what seems to be a misunderstanding by  nostr:npub1qny3tkh0acurzla8x3zy4nhrjz5zd8l9sy9jys09umwng00manysew95gx about how the Pi Zero hardware shapes the  nostr:npub17tyke9lkgxd98ruyeul6wt3pj3s9uxzgp9hxu5tsenjmweue6sqq4y3mgl security model.

(see:  nostr:npub10uthwp4ddc9w5adfuv69m8la4enkwma07fymuetmt93htcww6wgs55xdlq #320)

I'm not about drama, certainly not looking to increase it.

Please give this a read and hit me back w/any questions:

https://gist.github.com/kdmukai/e270dd1c7b53b8daea4a9fc1ac89847c


Even the idea of a single follow list is dumb.

You might trust someone to verify software properly but not their opinions.


A follow is used as your primary interest list. It has been since the start of Nostr. That is what the word follow is used for in most social media.

Try making a new list type for your special use case like “people I trust” instead.


Because content interest is not the same as “I trust this person” or “I share their views”


also uses hist.nostr.land


hist.nostr.land


So people have to self censor who they follow now because they might be viewed “controversial”?

Next level of stupid 😑 nostr:note1qqqreujna28lxpwc74zcpqlm69nfcsu2r9t8r2la235de82caprqwtkkyh


There should be DM notifications.. but yes


Yes because they are different things :)

“Authenticated” means NIP-42 auth, that is all (you identified yourself to the server)

There is no NIP for relay access rights or subscriptions


Not a bug


Brb opening a quick pr https://image.nostr.build/06c5af1050ca053943c2dfd04ac7619d888318fd5e508dfd9ad72b69b796a670.jpg


Whatever your stance is, Nintendo is objectively worse


https://github.com/WinampDesktop/winamp 👀


Please explain


“… or traveling with it [a hardware wallet] is a risk …”

what if it was not? nostr:note1ddn433hc5p3hsjtt3eelr3pd5hhedjwscag2n74gyedl4n97g7uqf7pjca


You can do a lot more


notes per minute


I hate DITA-OT. Except when it works. Then it’s great.


Do it the strfry way

Have an export all notes/bulk import function


Someone tried to do a volumetric attack against my relay


The problem is this will shift responsibility to the free providers that want to give people NIP-05s. Not solve anything.


defective clients


Attacks will happen and are inevitable.

From spam to bots to (D)DoS attacks, it will happen. Not being prepared is the exception, not the rule. (Except on Nostr! 😂)

p.s. anyone experiencing (D)DoS attacks against their relays? renote for visibility


rspamd is open source and proton mail uses it as a part of their system, just with some tweaks


Wondering how to block spam? Go through rspamd internals. E-mail, nostr, whatever who cares. It’s all the same problem.


Working on another project right now that started a few months ago.

Took a step back from Nostr related projects (burdened myself with too much), but still working on some small ones that’ll be complete maybe one day.


Hot take 🌶: the way some nostr devs are reacting to the spammers is going to drive away more people than the spam itself.


I am surprised no one’s first thought was “identify spammy behaviors” and immediately went to WoT/PoW


The problem is that this is inevitable


nope, everyone is too busy implementing bad solutions to spam because they are incompetent


it’s hilarious how a lot of HWWs use SEs that are broken, are uncertified or made for cheap IoT devices (often all of these)… or none at all

if your device is stateful a quality SE is a must, it’s only a few dollars more


MIT+CC is MIT license with Commons Clause


It doesn’t meet the definition of open source (commercial use is not permitted for Coldcard firmware). The term source available is used instead


A lot.. https://bitcointalk.org/index.php?topic=5304483.0


ATECC508A, ATECC608A and ATECC608B are all vulnerable to fault injection


No they do not


It doesn’t work very well for smaller details.


You forgot to include the part where you destructively decap and image the chip to make sure it matches the HDL, which you can’t.


That is not a hardware wallet (which I classify as anything that can store a seed persistently) but a signing device

Still, I use it a lot, and it’s great


could you explain why also?


Shill me some hardware wallets (multiple if you want)


AWS Lambda is something you can easily abuse for a lot of IPs…


The Bitcoin community has a really difficult time with acknowledging problems, because they are so bullish. This leads to stagnation of londstanding issues because they have convinced themselves the problem is already solved by repeating certain phrases. I literally think Bitcoin is revolutionary, but Jesus Christ people, we have to admit there is a problem before we can solve them.


No


the documentation exists
it has for years


Why is it faster to get hardware samples of a product and not documentation for it.


Use an excel sheet


That drops the amount of hops on the service side from 3 to 1

The client may still use 3 on top


the true building happens when people stop focusing on projects they write in a few days for attention only with no good use case


nostr.land


A mute is not indicative of (dis)trust


nostr and email are incompatible


The censorship resistance of the protocol is not impacted by relays choosing to ban or not ban people, or even coordinating.


We are taking a concept originally used in a context where real people verified their real identity in person and often required multiple signatures to be marked trusted, and trying to apply it so that “trust” is established by you wanting to see their content in your feed, and one follow being enough.

But I guess it’s too hard to not be realistic about things.


You suffer the consequences of your own actions, in this case a system which can be easily manipulated and encourages self censorship

Why did no social media platform implement WoT for spam and bot filtering?

We may hate them but they also aren’t stupid, and have poured way more time and money into bot detection than Nostr ever will in the next 5-10 years.


and openwrt for your wireless router


it’s more their track record; I have only explored a certain portion of their code only

like 2 years ago, I had to annoy them for months before an SQL injection bug got fixed (it was simple also, they were passing field names from request body directly to the DB)

they also took a month of pestering to fix a bug that allowed draining Eclair nodes… with a hodl invoice (yes, you just wait 30 seconds)

their satsdice plugin had improper access control, meaning invoice keys meant to be receive only could drain wallets


still using that insecure software? 😂


Instead of them redeeming a cashu token they can just prove they have the code, or better, contain a signed statement in the sent envelope (this also means zero-interaction after request, and the proof can be validated, this also means bogus requests will help mask real ones for privacy)


Trying to use Cashu for this is like trying to use blockchain for data storage

Unnecessarily complicated and with 0 benefits nostr:note1yvlut0qv3seanzlfqgk4zks4glfe52ughas08ethk27tc5hdzg4qzx3pfq


And this is how self censorship begins on Nostr

It’s only downhill from here nostr:note1a6gh2wm0hzq6knh30g8qvr4qw0mls63rmzaag9r5v6wswu94he8s24s0ds


“gpg failed to sign commit object”

checked that my smartcard was working, it was
checked the terminal size if it was too small to show a PIN prompt, it was not

tried doing gpg —sign and immediately failed with “No secret key”

thanks for telling me my key expired in the shittiest way possible just 1 minute ago


probably just to annoy

you can tag anyone in a note without it showing up in the text, same with hashtags


that is not how it works


Yes, this attack allows you to clone the Yubikey but it also cannot bypass the PIN code.

At that point, you may as well just press the button once and use it to log in… nostr:note1z7duygdctdtjmfh4gsevz8cder2v374y0397z2mde8xaetfm4nyssryz2m


It is not


no secure element is secure forever


ecash is an IOU


Nostr.land is monthly subscription.

Nostr.wine is one time pay. One time pay relays expects enough people join per month to pay off the server costs (like a ponzi scheme) or cross-subsidize between products (so it loses money).


“I hate this place” - nostr:npub1aeh2zw4elewy5682lxc6xnlqzjnxksq303gwu2npfaxd49vmde6qcq4nwx nostr:note1f78apcaadv4kml3pdztzdxs9c7twe4uzenp4huuefv0ahaugczzslfe0hf


Enjoy this era of 3D-printing while it lasts. Once the printers become sentient they'll found a union and then it's all over.


That is a sequential feed


Doesn’t matter as long as you know the basics. Having people with different experience levels helps.

It is Bitcoin/Nostr related.


Looking for a few product testers, still. DM me for more info.


my PoW miner was pushing about 70MH/s on a 7950X.
It had no SIMD and no cache optimization.

I haven’t even implemented SIMD or CUDA yet.


“Better”? Did you mean “way better”? 😂


Oh I have had issues with Brave.


This also was sometimes a problem for Nests

The Jam architecture means that everyone on stage connects to each other P2P


Thank you


they are also nip4 afaik


Yeah. But it’s Google after all.

More likely is they turn it into a walled garden


Should have said “we kill products for breakfast”


this should be an option —encrypt-content <pubkey>|self

this is more useful, such as encrypted list items


Don’t use LNbits. 😅


Tenor will get added to the killed by Google list one day.. :’)


The problem with WoT is it creates a chicken and egg problem

New user joins, relays reject them due to no WoT
They can’t post and their content can’t be discovered
User quits


EAL certification levels do not indicate how secure a product is, only how much it was tested


not mine


edits can kindly go fuck themselves


works


oh it’s non-beta

17.6.1


Does not work, latest iOS


nostr is not a decentralized file store


because nostr brings nothing of value to data preservation, its goals and use case are different


this has nothing to do with nostr


more things investors can speculate on, more things to tax


It generates more economic activity


The problem is solved by not using Infineon


they also share the same crypto libs, but those use symmetric crypto usually


the more concerning part is that this applies to other infineon chips like smart cards


in that case the goal is not collision resistance but generating unique numbers from a secret and timestamp

which has still not been attacked successfully


Doesn’t really matter; this is the second time Infineon fucked up basic cryptography


This is what, the 2nd huge Infineon fuckup? nostr:note1lar224g7tn3a8nugy3alara279ddf3c36c4u0tshzmkkdw4t94xqa4n9g7


env variable for nsec would be better…


“Verification”
Okay I’m quitting 🤣


also don’t forget: the majority of clients don’t give a fuck about it and the edit feature that breaks the principle that if you link to an event ID people will always see the same thing nostr:note1vgvetn0lz6k7skdytw8wfuun4fr42ndshtf23362u3dhsmux3y5qvryrp0


I can’t find any specs for it so it seems to be vendor proprietary for now. It would need to become a part of PSBTs somehow with SeedSigner’s model.


Your location can be narrowed down to a few countries even with a VPN


E-mails are more convenient 95% of the time.


DC IP transit is way different than ISPs


Probably


deserved nostr:note180ee4l9vl5znrp5vcudj5c70y8xkjclur95m68myrxv90v7jmmhqq7wugj


Congratulations on being misled into thinking you got verification when it is not verification

It’s just a unique username


It’s not verification


risk management, and they wait for it to be settled

depending on the amount and the banks involved, settlement can be near instant, or take longer

and strike may allow you to withdraw before settlement completes for low amounts


it’s an issue not a pull request

nostr issue trackers would be good rather than centralized shithub


normal transactions also get a discount


projects like this make me question if the average nostr developer is capable of evaluating if a project is a good idea beyond “it allows me to slap decentralized on it” nostr:note1skq6njq098cmune3mz35s9snxuftdz3yx35cqyrlux3nv7vpdzlsfygf0l


They are competing for blockspace even with Segwit. Not that it would stop spam.

Please do research.


Made it cheaper how?

On the surface it may seem like it but you have to realize this availability of space meant more demand and more fees, until the market reached the amount they would pay reasonably per byte stored

Contain more spam, sure, but also contains more non-spam TXs


None of those are true


Inscriptions could happen before SegWit, it would have only meant fees would have gone up a little less.

And it would pollute the UTXO set instead of storing it in witness


Look at the timestamps


relay.nostrplebs.com and nostr.land


look closely


first


you do not need a special relay for DVMs nostr:note1x3nr77lnpmh0vegx2r5waram50e4heu2c8zy65mn8vmslv5593ls3cr6e3


If you operate a web store selling Bitcoin hardware, DM me for potential reselling

Bonus points if shipping from US or APAC

Please renote for visibility


if someone fucking calls it verification again then I might quit


follows != people you trust, just saying


There is already a spec for that with linked identities


both are equally real but one will take slightly longer to sign with


there are 2 nsecs for each npub


signatures are incompatible

keys can be used with the secp256k1 curve as is, as there are only two y coordinates and the key for both can be computed


I think they could go cheaper with some cost optimizations


Outbox model makes relay decentralization irrelevant

We can use 10 big relays and it would still be fine because if you get censored you can move to another relay or spin up your own


Primal links the kyc info of your wallet to your npub


fiatjaf cannot unilaterally change the protocol


Not microSD
And still, 30MB/s and low IOPS


Cryptography export restrictions are a way deeper rabbit hole than it appears nostr:note1u2fk7waw87xdyz62jyxhkf36vr0jwpet2mw9xd8fu59z7r6ku7dqrg0d2t


Synced with iOS setting


you should use wasm for the pow worker


Nostr Plebs relay is now up and running with performance and reliability improvements


did some more minor changes to nostr.land, should have even better performance now

just 4k sats/month :)


note that you will need to set your NIP-05 to your nostrplebs one and wait a few minutes (primarily to prevent spam by setting someone else’s npub to your NIP-05)

and enable it in the management portal


yes, it works


that should be working


nostr.land changes are live, nostrplebs is waiting on a DNS update

this has reduced query times by over 10x nostr:note1lhkemv6kzjyczq0q3z4xjmpan6lqqmn7wk2k9j43d0k8pt5c5qpqqywyhk


nostr.land and nostrplebs relays will be down temporarily for reliability and performance improvements


this is a pretty good explanation of (EC)DH actually nostr:note1rm7tzujf590hej057ff3swwyqupmz5pkkm7h8lk763dl0fc0yapqxmgz3h


This simply cannot be automated


not following, but it doesn’t stop them trying to buy out developers and pushing their own agendas


except thanks to all the bitcoin shitfluencers and VCs the protocol is arguably worse to use and less decentralized


there was no npub/nsec/nevent/note
only hex identifiers

branle was what everyone used, and nos2x was a bit simpler


nostr being overtaken by VC and corporate interests

it was better when we had 20 relays and each one had at most 30 users, and a total of 100 users

(before EOSE and replaceable/ephemeral events existed) nostr:note15j3xkwzvwpeltjw899xt9nx8a94lxe6te5hgpuxdmd3aafxfwuhqn8fgmd


unfortunately for you, the reason nostr works is relays nostr:note1lclqwfrrzgaejj7c8kjz85hw8h9uwxdyfk8z8wtgvzjjdg7qrukqs2dydg


a lot of bitcoin content here feels like people are trying to convince themselves, not others


absolutely 😂


it is not


NIP-44 does not provide any security guarantees compared to NIP-04 nostr:note1nvsr5qk8gu9qtl0glkyt2zg74snasr5840m9xhj6v2c52786s45qqn20zs


this is a horrible idea, and the reason why it wasn’t done with bitcoin addresses… except…

you could try correcting the error and see if the nsec/npub inputted already exists, and the chance of two npubs being off by only a few bits is low


will investigate later, busy