@PowderHound
No relay list published yet.
Recent Notes
nvk's behavior during the hack leaves me with only two options:
- He's a sociopath/psychopath
- He's a government agent, which doesn't rule out the possibility that he's a sociopath/psychopath
nostr:...
Wondering whether it could have been his CTO cofounder.
#asknostr
Are the RBF attacks only a danger if you used a CC generated seed? If so, does it only apply to transactions from a multi sig, or single sig also?
I think by publishing your transaction in the visible mempool, you're notifying people that your seed might be an easy target. They then have minutes to focus on it to solve it before its included in the block. if they crack it, then they can replace the fee to sweep it from you. I think that's why some people were proposing to use mara's slipstream to avoid the visible mempool.
🤙1
I actually made a pretty cool mini btcpayserver with spark to easily accept Bitcoin payments without a node but I'm way too scared to release it now 😭
https://relay.utxo.one/0220a9f199e0f86c9e5c45...
We can't stop building, but we need to properly represent security, and maybe get into the habit of ever escalating bug bounties. Instead of zapping people here we contribute and accumulate to project bug bounties.
Crushed 3 sizable builds this year, 75% done with a fourth medium sized build, and have 2 more lined up in August and September.
Thankful for the busy and fruitful bear. No better way to spend the re...
Looks great. You've come along way in your skills! I love that feeling of leveling up when you can see your progress.
Déjà vu all over all. In the early days of commercial aviation metal fatigue was not well-understood, leading to disasters. It seems like the same with the hardware wallet industry not understanding...
That's a good way to look at it. I still can't shake the preference for software and dedicated airgapped systems. Hardware devices seem like they have much higher risk. They usually keep your address (Coinkite seemed to collect and retain it despite claiming otherwise), they are supply chain targets, they require firmware which may reduce the speed of fixes, etc.
🤙1
Don't use this but if you have tokens to spare please tell your clankers to find all the flaws in this or add more ways to input physical entropy
https://github.com/barrydeen/bitcoin-seed-entropy
I'm wondering whether it would be worth adding an optional passphrase / password, but using argon2id instead of raw. Make it harder to force the password...
I’d pivot to selling the movie rights to Christopher Nolan.
https://image.nostr.build/379fb50ad07fa7f26f19a880e503896355b7e55ede7a1a873336591b01356916.jpg
Will need a good caustic actor to portray the arrogance / haughtiness and over confidence of NVK. Also maybe JW Weatherman can play himself and do the periodic cassandras with the prophetic premonitions that people ignore...
I get the frustration behind this, but “no defense” isn’t really accurate. The Mk3 flaw is serious, but it doesn’t retroactively invalidate every threat model or every mitigation people used. ...
pretty clear that they vibe coded the move away from the trusted GPL libraries that they were using so that they could change their license from fully open source to make it a non-commercial license (source viewable). Then they skipped on the security audit.
My bet this attack was weeks in the making. Once the attackers assembled enough private keys for high value utxos they executed.
My biggest disappointment is relying on a hardware vendor that has 'D...
yes, pretty clear that they vibe coded the move away from the trusted GPL libraries that they were using so that they could make it a non-commercial license. Then they skipped on the code and tech audit.
*“Sometimes you can do everything right and still lose”*
This is an absolute disaster. Godspeed to everyone trying to clean up after this mess. 2 people who I got to self custody years ago went b...
Yes, when we look back years from now and only 0.1% of people hold self custody, we'll remember why. I've been thinking about this for a long time. I don't know how it can be fixed. Hardware devices are slow to update, represent an honeypot / attack target. Using software alone requires specialized knowledge. I hope we find a way to fix this.