Damus
Open in Damus
Icarus Wings profile picture
Icarus Wings
@icaruswings

Tinkering on Nostr-native tools to take power back from platforms.

Building Nostreon so creators can sell subscriptions and gated content without losing their audience to a platform. Building Hashden so small communities can form Bitcoin solo-mining dens and push back on pool centralization.

Fix the money, fix the world

npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5npub
[email protected]nip05
https://nostreon.comwebsite
[email protected]lnurl
Relays (8)
  • wss://premium.nostreon.com – read & write
  • wss://relay.nostreon.com – read & write
  • wss://relay.primal.net – read & write
  • wss://relay.nostr.band – read & write
  • wss://relay.damus.io – read & write
  • wss://nostr.land – read & write
  • wss://nostr.wine – read & write
  • wss://nos.lol – read & write

Recent Notes

Icarus Wings · 3w
11/12 Findings ≥ medium in live software are never dumped raw. They publish as "withheld-pending-disclosure": attestation public immediately, finding body a body_sha256 commitment until a fix ships....
 Icarus Wings profile picture
Icarus Wings @icaruswings
12/12 Early days: schema, CLI, CI, live site, three signed attestations. We need co-maintainers, auditors with a Nostr/SSH/PGP key willing to review AI findings, and target nominations.

Registry: https://theicaruswings.github.io/opensourcecheck/
Code: https://github.com/TheIcarusWings/opensourcecheck
Icarus Wings · 3w
12/12 Early days: schema, CLI, CI, live site, three signed attestations. We need co-maintainers, auditors with a Nostr/SSH/PGP key willing to review AI findings, and target nominations. Registry: https://theicaruswings.github.io/opensourcecheck/ Code: https://github.com/TheIcarusWings/opensourceche...
Icarus Wings · 3w
9/12 Three real attestations ship now. ① A source-grounded retrospective of the Coldcard bug, validated against the actual fix commit. Severity: critical.
Icarus Wings profile picture
Icarus Wings @icaruswings
10/12 ② A clean run on bdk_wallet @ HEAD. Its seed path bounds the RNG as "impl CryptoRng + RngCore", rejected at compile time if it isn't cryptographic. The exact guard Coldcard lacked.

③ A clean run on SeedSigner @ HEAD: dice hashed as a string (no modulo bias), secrets zeroed after use.
1
Icarus Wings · 3w
11/12 Findings ≥ medium in live software are never dumped raw. They publish as "withheld-pending-disclosure": attestation public immediately, finding body a body_sha256 commitment until a fix ships. Provable priority, zero leak.
Icarus Wings · 3w
10/12 ② A clean run on bdk_wallet @ HEAD. Its seed path bounds the RNG as "impl CryptoRng + RngCore", rejected at compile time if it isn't cryptographic. The exact guard Coldcard lacked. ③ A clean run on SeedSigner @ HEAD: dice hashed as a string (no modulo bias), secrets zeroed after use.
Icarus Wings · 3w
9/12 Three real attestations ship now. ① A source-grounded retrospective of the Coldcard bug, validated against the actual fix commit. Severity: critical.
Icarus Wings · 3w
6/ 12 "none-found" is a first-class result, not a lesser one. The most useful entry OSC can hold is often "model X ran over scope S, found nothing", exactly the record that would've made Coinkite's pr...
 Icarus Wings profile picture
Icarus Wings @icaruswings
7/12 curl killed its bug bounty in Jan 2026 after ~20% of submissions were fabricated AI slop. OSC's gate: a required named human validator, cryptographic signatures, published prompts + transcript hashes. No raw model output ever ships as a validated finding.
1
Icarus Wings · 3w
8 /12 Signing is your choice: Nostr (BIP-340 schnorr, same key posts to Nostr), SSH, or PGP. Verification is fully offline, no trusted server: npm ci && node tools/osc/osc.mjs verify --all
Icarus Wings · 3w
5/12 Say it twice: OSC never claims code is safe. It records what was checked and what came back. Coinkite's clean AI run on vulnerable code is proof that "clean" ≠ "safe", a data point, not a guara...
 Icarus Wings profile picture
Icarus Wings @icaruswings
6/ 12 "none-found" is a first-class result, not a lesser one. The most useful entry OSC can hold is often "model X ran over scope S, found nothing", exactly the record that would've made Coinkite's pre-hack audit auditable after the fact.
1
Icarus Wings · 3w
7/12 curl killed its bug bounty in Jan 2026 after ~20% of submissions were fabricated AI slop. OSC's gate: a required named human validator, cryptographic signatures, published prompts + transcript hashes. No raw model output ever ships as a validated finding.
Icarus Wings · 3w
6/ 12 "none-found" is a first-class result, not a lesser one. The most useful entry OSC can hold is often "model X ran over scope S, found nothing", exactly the record that would've made Coinkite's pre-hack audit auditable after the fact.
Icarus Wings · 3w
3/12 This is the asymmetry OSC exists to fix. Attackers run frontier LLMs on Bitcoin code privately, no obligation to disclose. Defenders do too, but the results are scattered chat logs: unsigned, un...
 Icarus Wings profile picture
Icarus Wings @icaruswings
4/12 OpenSourceCheck is a public, git-native registry of LLM-assisted security-audit attestations. One entry = one audit run: model + harness + exact prompts + transcript hash, against a repo at an exact commit, findings triaged by a named human, signed.
1
Icarus Wings · 3w
5/12 Say it twice: OSC never claims code is safe. It records what was checked and what came back. Coinkite's clean AI run on vulnerable code is proof that "clean" ≠ "safe", a data point, not a guarantee.