this is a good moment to share two tools some may find useful right now:

* AirgapOS: a minimal (and audited) OS for offline secrets management used by several well known orgs in crypto you would all know: git.distrust.co/public/airgap

* Keyfork: tool for generating a BIP39 seed and sharding it - can also derive for different crypto algos (and supports dice and even tarot cards as a source of entropy). Comes packaged with AirgapOS, also audited: git.distrust.co/public/keyfork

Both of these tools are built using StageX (stagex.tools), which is a full source bootstrapped and deterministic distro.

For the truly paranoid, we also wrote an entire guide for offline key management: trove.distrust.co based on above tools with some opinionated steps.

having audited tons of high risk orgs, and being on calls with companies daily, i always find it shocking at the level of security maintained internally vs the level of security companies communicate externally. most companies still run their security programs in a negligent manner, and worse yet don’t actually care about security. the most important goal for them is to appear secure. expert security theatre, and this is part of what motivates me to bring new levels of transparency to how software systems are built

who here knows about TEEs. trying to see something

what’s new on nostr? heard some buzz about a nice new piece of software 🐝

Hiatus, shmiatus, back attitus.

It’s highly likely this has already happened and is being suppressed, but deepfakes will be used to circumvent account recovery mechanisms. Companies need to act now to implement stronger protection measures.