Nostr notes by Jameson Lopp

Yes, that's a separate entity from Casa Inc. I have no ...

2026-10-16T15:45:28Z

In reply to nevent1q…a3sl
_________________________

Yes, that's a separate entity from Casa Inc.

I have no intention of going to prison for offering TradFi services without a license.

Just deleted 100,000 lines of code. ...

2026-10-13T15:58:27Z

Just deleted 100,000 lines of code.

Earlier this year we implemented TOTP style 2-way verification ...

2026-10-13T12:48:41Z

In reply to nevent1q…nlq9
_________________________

Earlier this year we implemented TOTP style 2-way verification codes.
https://support.casa.io/knowledge/what-is-a-verification-code

To Catch A Shitcoin Predator - The Blake Files ...

2026-10-12T13:12:07Z

To Catch A Shitcoin Predator - The Blake Files

If you ask an LLM to complete a task and it commits a crime while ...

2026-10-12T13:09:38Z

If you ask an LLM to complete a task and it commits a crime while trying to achieve the goal you gave it, are you responsible for the crime if you never told it to do that?

IMO if you shoot a bunch of people it's only appropriate that ...

2026-10-09T11:57:22Z

In reply to nevent1q…ms2q
_________________________

IMO if you shoot a bunch of people it's only appropriate that you get the firing squad.

Me but with Chinese models that only cost $2 an hour: ...

2026-10-08T21:05:24Z

Me but with Chinese models that only cost $2 an hour:

Security updates are happening at such an accelerated pace that ...

2026-10-08T19:25:01Z

Security updates are happening at such an accelerated pace that sometimes you're stuck between a rock and a hard place.

Had a machine with known Linux kernel vulnerabilities so I updated it, but then the database on that service refused to run because the latest available kernel still had vulnerabilities and canonical had not yet released the most recent kernel version 😞

LLM generated reports that require you to analyze them and make a ...

2026-10-06T22:38:58Z

In reply to nevent1q…ecch
_________________________

LLM generated reports that require you to analyze them and make a decision.

I swear I'm getting a dozen slop grenades lobbed at me every ...

2026-10-06T21:32:23Z

I swear I'm getting a dozen slop grenades lobbed at me every day and it's exhausting.

Easy come, easy go. Looks like Mad Kratter lost his nostr keys.

2026-10-06T02:49:48Z

In reply to nevent1q…ymkv
_________________________

Easy come, easy go.

Looks like Mad Kratter lost his nostr keys.

Look ma, I'm a nostr dev! #nevent1q…92nq

2026-10-05T21:12:31Z

Look ma, I'm a nostr dev!

quoting
nevent1q…92nq
#Amethyst v1.17.0: Cordn, Geocaching, a New QR Scanner, and One UI

Highlights:

- Adds **Cordn** group chats: MLS groups over an MCP coordinator, with the
full chat experience, device migration and encrypted backups.
- Adds **Geocaching** (NIP-CC): a hub, a map, hunts, and QR-verified finds.
- Rebuilds the **QR scanner** on CameraX + zxing-cpp. It reads off-axis, blurry
and low-contrast codes the old one could not.
- Brings **Concord** up to spec: pins, Direct Invites, private channels with key
rotation, disappearing messages, kick and dissolve.
- Brings the **in-app browser** close to an installed Chrome PWA, with a new
omnibox and a search-engine setting.
- Shows **Ultra HDR** photos, plays **audio posts** as cards with
picture-in-picture, and shares what you listen to as **Now Playing**.
- Asks before another app's version of your **backed-up lists** drops items.
- Moves ~200 screens into shared UI on the way to **one UI** for Android and
Desktop.

## New Features

### Cordn

- Adds Cordn group chats to the Messages inbox, beside DMs, Marmot and Concord.
Messages never enter the event cache, so they are never searchable.
- Builds the chat on the shared components: bubbles, gestures, reactions,
quoted replies, day and unread dividers, and the rich text renderer.
- Adds replies, reactions, edits, deletions and pins, interoperable with the
reference client. Pins sit in a one-line carousel above the chat.
- Uses the shared composer: @-mentions, emoji shortcodes, GIF keyboard and paste.
- Adds encrypted attachments over Blossom and encrypted voice notes, with the
shared upload dialog and media viewer.
- Keeps drafts, unread counts and messages on disk, so rooms no longer open
empty after a relaunch.
- Redesigns New group as four steps: name, people, coordinator, and who can
add and remove. Shows how many of your people each coordinator can reach.
- Invites the whole roster in one commit, so one failed invite cannot fork the
group. People without a key package get a share link instead.
- Finds coordinators from their ContextVM announcements and names them by
profile, instead of asking for a 64-character key.
- Adds member management: add by name, npub or NIP-05, remove, rename, and admin
mode. Enforces admin rights like the reference client.
- Adds a metadata-exposure card explaining what each coordinator can learn.
- Shares groups as `cordn1…` links and QR codes, and adds an invitations screen
with Join and Decline.
- Adds join requests, coordinator health and management, and a key-package
screen that keeps your pool topped up.
- Adds device migration: the old phone shows a handoff code, the new phone scans
it and restores every group with its history. Keys are never in the code.
- Adds encrypted backup and restore of groups and their messages.
- Groups all Cordn settings under one entry, and adds Cordn Groups to the drawer
and the bottom-bar catalog.

### Geocaching (NIP-CC)

- Renders geocache listings and found logs as cards, with a photo hero, map
inset, rating, distance and badges.
- Adds a Geocaches hub (Nearby, Map, Hunts, Finds, Mine), cache details with
their log thread, and composers for caches, hunts and logs.
- Verifies a find by scanning the cache's QR code. The secret signs once and is
never stored.
- Hides hints behind a tap, and detects whether each was written in plaintext
or ROT13.
- Sorts Nearby by distance only when you ask.
- Opens caches and hunts from feeds, notifications, `naddr` links, QR scans and
search.

### QR Codes

- Rebuilds the scanner on CameraX + zxing-cpp, with autofocus, tap-to-focus,
pinch zoom and a torch. The old decoder read 31 of 48 test codes.
- Lets you pick when several codes are in frame or in a picture, and reassembles
multi-part codes.
- Reads codes from the gallery, the clipboard and the share sheet, and adds a
"Scan QR code" launcher shortcut.
- Explains a code it cannot open instead of closing, and keeps private keys off
the result screen and out of the logs.
- Keeps the screen bright while showing your own QR code.

### Concord

- Adds pinned messages, with a pin badge in the channel header and
jump-to-message.
- Adds Direct Invites: invite by npub, and accept or decline from the hub,
Notifications or Messages.
- Adds Public and Private community modes. A ban in a Private community rotates
the keys.
- Adds private channels, with Make private, Make public and Rotate key.
- Adds disappearing messages, with a timer from 1 day to 1 year.
- Adds cooperative Kick and community dissolution.
- Moves the Community List to the fragmented kind 33302, migrating the old list.
- Lets you edit your own thread replies and retract a reaction by tapping it
again.
- Shows the community description at the top of the channel list.

### Marmot

- Adds editing your own messages, compatible with White Noise edits.
- Detects a group this device has fallen out of sync with, and offers a Reset
that keeps history.
- Names unnamed groups after their members, and hides names on bubbles in
two-person groups, like DMs.
- Commits a member's leave automatically when you are an admin.
- Applies White Noise admin deletions.
- Adds Marmot Groups to the drawer, and makes the list read like the DM list.
- Warns when another device of yours is receiving your invites, and offers to
move them here.

### Buzz

- Brings Buzz to parity with upstream: artifacts, huddle liveness, team catalog,
projects and thread windows.
- Writes channel messages as kind 9, as Buzz's own clients do, and lets you edit
them.
- Labels agents as "Agent · managed by Alice", and tells apart members with the
same name.

### Browser

- Brings the in-app browser close to an installed Chrome PWA: new windows,
Tor-aware downloads, fullscreen, find in page, text size, desktop site and
crash recovery.
- Redraws every browser surface with one shared pill.
- Reworks the address field into an omnibox with paste-and-go and completions.
- Adds a search-engine setting: DuckDuckGo, Brave, Startpage, Mojeek, Qwant,
Ecosia, Kagi, Google or Bing.
- Adds per-site camera, microphone and location permissions, with "Only this
time".
- Adds "Add to Home screen". Shortcuts open in Amethyst and wait for Tor.
- Shows page alerts and prompts, which used to be silently cancelled.
- Replaces the WebView error page with a readable one, with Try again and Try
without Tor.
- Asks before every download, with the real name, size and source, and blocks
files pretending to be another type.

### Media

- Shows Ultra HDR photos in HDR, capped at 2x in the feed.
- Plays audio files in posts as a waveform or cover card, with
picture-in-picture.
- Shares what you are listening to as a NIP-38 music status, from Amethyst,
other apps or desktop players. Off by default.
- Adds captions to NIP-71 videos, with a CC toggle in the player.
- Shows video credits, and checks collaborators who accepted.
- Plays divine.video's adaptive HLS streams.
- Adds Cast on Android 17, and names the format a receiver refuses.

### Backups

- Asks before another app's version of your follows, mutes, relays, profile,
wallets or settings drops items you backed up.
- Shows a card on Home for each conflict, with one-tap Accept.
- Adds a review screen per conflict that lists every removed, added and changed
entry.
- Keeps open conflicts across restarts, and closes them when the other app puts
the items back.

### Key Backup

- Shows the nsec as a numbered, grouped grid you can copy onto paper. It hides
again when the app goes to the background.
- Adds a confirm-then-encrypt flow for the ncryptsec backup.
- Requires passwords of at least 12 characters for new ncryptsecs. Old ones
still open.
- Accepts hand-typed keys at login, with uppercase letters, spaces or dashes.

### Profiles

- Reads NIP-92 `imeta` for profile pictures and banners, trying the declared
fallback URLs when the main one fails.
- Shows the banner's blurhash while it loads.
- Publishes an `imeta` for freshly uploaded pictures and banners, on Android and
Desktop.

### Signing

- Shows a relay login (kind 22242) as a login card in signing prompts, naming
each relay exactly as signed. Odd-looking addresses get a "check before
signing" warning.
- Makes the event preview in signing prompts read-only, so you can no longer
react, zap, vote or RSVP on an event that does not exist yet.

### Notifications

- Shows DMs, Marmot groups and Buzz rooms as Android conversations, with
per-chat priority and launcher shortcuts.
- Shows inline-reply progress, with a Retry that keeps your text.

### Calendar

- Shows follows' "Going" RSVPs on Home, with a toggle in Settings.
- Adds a "Friends going" lens of upcoming events your list attends.

### Feeds and Lists

- Renders 3D Simple Nostr Objects, shards and cyberspace avatars, with a
full-screen viewer.
- Opens cyberspace region bags, showing how long the search will take.
- Renders every NIP-51 list kind as a card, instead of encrypted text.
- Adds favorite follow sets: star any follow set to use it as a feed.
- Shows prediction markets and ballots as their own cards, and hides kind-38000
spam.
- Shows Zapstore app curation sets, NIP-34 git status events and video curation
lists as cards.
- Shows a compact link preview for pages without an OpenGraph image.
- Shows follow-list petnames as a display-name fallback.
- Adds Cash App, Nano, Revolut, silent payments and BIP-353 payment targets.

### Messages

- Redesigns the Messages list: unread drives emphasis, and previews show @Name or
"Photo" instead of raw links.
- Redesigns the chat screen: softer bubbles, clock times and the avatar outside
the bubble.
- Shows sent messages immediately with a sending state, and retries a failed
send on tap.
- Plays voice messages and encrypted audio in the waveform player.
- Shows a DM rename as "Alice renamed the conversation".

### Uploads

- Falls back through your Blossom servers when an upload fails. The signer is
asked once.
- Shows why an upload failed, and lets you remove a failed attachment.

### Relays

- Adds an event allow list, roles and claims to relay management (NIP-86).
- Detects when a NIP-29 group has moved to another relay, and supports group
banners and `a` pins.

### Android

- Enables ARM Memory Tagging on supporting devices to catch native memory bugs.

## Performance

- Loads My Fitness progressively instead of behind a 2–3s spinner.
- Cuts the DEX from 31.1 MB to 29.9 MB by dropping kotlin-reflect.
- Confirms a Marmot group change at the first relay that accepts it, so creating
a group no longer waits for the slowest relay.
- Stops the Marmot key-package lookup shortly after the first package arrives, so
adding a member no longer takes most of a minute.
- Stops rewriting the whole Marmot message log and group state on every send.
- Removes a duplicate encryption on every Marmot send.
- Loads cached Blossom images straight from disk, also offline.
- Remembers missing Blossom files for 30s, so videos no longer stall 10s per
retry.
- Makes the audio visualizer smooth: 46 frames a second instead of 5.
- Speeds up the 3D renderer 4x and cuts its GC from 51% of a core to 7.7%.
- Speeds up the event cache's list observers 1.3–4x.
- Stops calendar screens rescanning the cache on every event.
- Stops the fullscreen image dialog recomposing on every frame of a swipe.
- Stops rebuilding Notifications and Messages on every Concord update.

## Improvements and Bug fixes

- Shows Tor status in the drawer. The icon hides when Tor is off and opens Tor
settings on tap.
- Fixes devices stuck on "Loading account" forever because they reject the
AES/GCM/PKCS7Padding cipher.
- Fixes encrypted stores that could write but not read back.
- Moves settings and account data from SharedPreferences to DataStore, and keys
off the deprecated androidx.security. Old files stay for downgrades.
- Fixes Tor never working on 32-bit ARM and x86 devices, which shipped without
the Tor library.
- Fixes notifications opening on a black screen after a cold start.
- Opens DM and private reply notifications in their conversation, under the
right account.
- Fixes kind-5 deletions matching any author: one user could hide another's
note.
- Decrypts private zaps for the zapped user, showing the real zapper.
- Fixes zap goals reading only 0% or 100%.
- Saves Cashu counters before using them, so a crash cannot lock funds at the
mint.
- Keeps proof-of-work posts mining in the background, and saves the draft first.
- Fetches your own profile and lists from inbox relays when you have no write
relays.
- Fits subscriptions under a relay's filter cap instead of losing the whole REQ.
- Keeps a subscription alive when a relay refuses one kind by name.
- Splits large profile requests, so relays that cap results do not leave authors
unnamed.
- Fixes quoted notes stuck on "Loading quoted note...".
- Sends calendar RSVPs to the host's and every invitee's inbox relays.
- Keeps the calendar's view and scroll when you come back to it, and stops
appointments flickering.
- Fixes Marmot groups forking on relay echoes, simultaneous commits, and
commits that leave you alone.
- Sends Marmot reactions and deletions inside the group, so White Noise sees
them.
- Fixes Concord messages being invisible in Accordion and other applesauce
clients.
- Fixes Concord joins: channels show at once, and failures are reported.
- Keeps a private channel's old keys, so history survives a rotation.
- Lets a banned Concord member return when re-invited after an unban.
- Fixes Direct Invites that never arrived.
- Fixes Buzz Desktop interop: uploads, mentions, profile, and relay refusal
reasons.
- Shows Buzz Join only to non-members and Leave only to members.
- Keeps browser pages on Tor whenever any surface uses Tor, and fails closed
when Tor cannot be applied.
- Keeps NIP-07 replies with the page that asked, and holds signing and payments
from tabs you are not looking at.
- Brings back black browser tabs and restores the page after Android reclaims
memory.
- Stops deleting a private DM from publishing a public NIP-09.
- Fixes NIP-49 rejecting some valid keys and crashing on very high scrypt costs.
- Plays videos from a local Blossom cache over Tor, and falls back to the server
when the cache is closed.
- Restores YouTube link previews.
- Stops the keyboard staying up after leaving a text field.
- Keeps the bottom bar on every pinnable tab.
- Returns a tablet rail tap to that tab's root.
- Makes all floating action buttons circular.
- Fixes amounts rounding wrongly, such as 12,500 showing as "12k".
- Fixes "100%%" in relay uptime labels.
- Fixes NWC notifications for wallets on the new NIP-47 extensions spec.
- Shows the bunker's error when a NIP-46 signer refuses.
- Encrypts every private relay entry, including ones other clients left in
plain text.
- Uses plurals for counts, so Czech and Polish read correctly.
- Fixes two release-only crashes on launch in the minified build.

## Desktop

- Stops offline users being stuck on "Connecting to Tor...": after 10s it offers
a regular connection.
- Reads now-playing from Linux MPRIS, macOS Spotify and Music, and Windows media
controls.
- Shows names and avatars for thread replies, and stops holding every note in
memory.
- Shows the nsec in the hand-copyable grid, and requires 12-character passwords.
- Uses the shared report dialog, which now also mutes the author.
- Renames the AppImage to `amethyst-desktop--.AppImage`.

## Cli

- Adds `amy cordn` for refs, exposure, coordinators, key packages, groups,
invites, sending, `watch` and `migrate`.
- Adds `amy sno` to validate 3D objects and avatar proof of work.
- Adds `amy cyberspace`, which matches the reference cyberspace-cli.
- Adds `amy concord` pins, invites, private channels, kick, dissolve and timer.
- Adds `amy admin` commands for NIP-86 allow lists, roles and claims.
- Adds `amy relaygroup pin/unpin` and joins from invite links.
- Catches up correctly on Marmot groups after being offline.
- Accepts hand-copied keys in `amy login` and `amy key decrypt`.

## Quartz

- Adds ContextVM (MCP over Nostr) with all 12 CEPs, and the Cordn protocol.
- Moves the MLS engine to `quartz/mls/`, shared by Marmot and Cordn, with
several RFC 9420 interop fixes.
- Adds NIP-CC geocaching, Simple Nostr Objects, cyberspace region bags and
Tapestry Decentralized Lists.
- Adds NIP-FE relay commands over HTTP, with a client and a server.
- Adds NIP-67 EOSE completeness hints and a NIP-43 membership engine.
- Follows the latest NIP-29, NIP-47, NIP-51, NIP-86 and NIP-A3.
- Fixes NIP-44 padding above 16 MB and rejects non-canonical lengths.
- Fixes NIP-49 to check the AEAD tag and zero derived keys.
- Fixes NIP-88 rejecting every spec-conformant `polltype` tag.
- Fixes NIP-62 vanish requests for relays without a trailing slash.
- Stops page limits truncating NIP-77 negentropy reconciles.
- Answers a superseded replaceable with `OK false replaced:`.
- Indexes every natural-language tag on Decentralized Lists, so authors and
subjects become searchable, while skipping URLs and ids. Indexed text drops
from 105 MB to 75 MB on 1.5M events. Existing databases need
`reindexFullTextSearch()`.
- Makes local search match a searchable kind only by what it indexes, so local
and store search agree.
- Adds typed diffs between versions of replaceable events.
- Fixes many tag readers and bounds checks on hostile tags.
- Renames event classes to their NIP names, keeping deprecated aliases.
- Breaking: removes `ForkTag`. Use `experimental.forks.parseForkedAddress`.
- Fixes iOS ConcurrentModificationException crashes in LargeCache.

## Geode

- Serves NIP-FE relay commands over HTTP, with limits, CORS and NIP-98 sign-in.
- Adds NIP-43 membership: members-only writes, invites and roles.

## Build & Documentation

- Enables R8 obfuscation, and publishes mapping files with each release.
- Adds `scripts/retrace.sh` to deobfuscate a crash report in one command.
- Checks at release time that every reflected class survived R8.
- Builds Arti and zxing-cpp reproducibly for all four ABIs.
- Moves 1,906 strings to shared Compose resources.
- Moves the event cache, Account, AccountViewModel and most screens into
`commons`/`commonsUI`. 204 of 252 screens are now shared.
- Makes `./gradlew test` run every KMP module's JVM tests: 11,690 instead of
3,567.
- Updates AGP to 9.4.1, Gradle to 9.8.0, Compose Multiplatform to 1.12.1, Ktor
to 3.6.0, Coil to 3.6.3 and zoomable to 2.16.0.
- Runs Android Lint in its own CI job.
- Bumps `appCode` to 462.

## Contributors

- VitorPamplona (nprofile…vhl6)
- ⚡ Dee Kay ⚡ (nprofile…m3sx)
- cloud fodder (nprofile…7nrg)
- Jameson Lopp (nprofile…xxx2)
- atesfurkan

## Translations

- Czech, German, Swedish, and Brazilian Portuguese by ⚡ Dee Kay ⚡ (nprofile…m3sx)
- Polish by Polak (nprofile…8c53)
- Hungarian by summoner (nprofile…ns2l)
- Hindi by राज (nprofile…z0lu)
- Russian by Anton Zhao
- Slovenian by StellarStoic (nprofile…3gag)

Nostr event nevent1qqs8vyppx2570jgqvmawfgrqgt4vsmjnpr8r8fjqsaxf28w3879p0hczyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsvwz0ygn

2026-10-05T00:13:36Z

GM Albuquerque ...

2026-10-04T15:08:10Z

GM Albuquerque

We're gonna need a micro LLM that acts as a proxy, analyzes ...

2026-10-02T16:57:29Z

We're gonna need a micro LLM that acts as a proxy, analyzes each prompt, and determines the best model to use to execute the task.

There aren't many nerdcore hip hop artists making music but I ...

2026-10-01T12:05:00Z

There aren't many nerdcore hip hop artists making music but I just realized that's no longer a problem: I can simply generate the esoteric beats I want to hear!
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/b21c6e2a4d38f2abac617ac6643aba919f271b37c1c539b5643c17753716c506.mp3

No, but I'll never spend as much of my life playing games as ...

2026-10-01T11:45:11Z

In reply to nevent1q…2rxy
_________________________

No, but I'll never spend as much of my life playing games as I did when I was a child.

Nostr event nevent1qqsfgs0lqc3c8l7sszd49sekg0qjfmqrv3zga9p9adwhjkugea4dh7czyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsveha9a7

2026-09-29T00:36:36Z

Nostr event nevent1qqs9fz9eugjht460uzgj5ec4n7y74mrpk9e2rumqcdre6ymu3nsvhdgzyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsveaeucs

2026-09-28T14:05:59Z

Harness

2026-09-28T01:51:54Z

In reply to nevent1q…8n5l
_________________________

Harness

After 10 rounds of training just on the coldcard entropy ...

2026-09-27T19:39:42Z

After 10 rounds of training just on the coldcard entropy vulnerability, it's rather amusing how the training clanker is getting frustrated with how retarded the pentest clanker is and how it keeps making inexcusable mistakes. 🫠

This might take a while...

quoting
nevent1q…vgw3
How to train your clanker?

Building a generic pentest harness seems far more difficult than building one for a specific codebase because it requires an additional layer of context building in order to formulate a plan of attack.

I'm trying something new now, which is feeding a corpus of recently found vulnerabilities in open source codebases to a training clanker that then runs the pentest clanker without giving it any hints, and then the training clanker analyzes the output of the pentest and tries to work backwards to figure out why the vulnerability wasn't found so that it can improve the pentest harness in a generic fashion.

How to train your clanker? Building a generic pentest harness ...

2026-09-27T16:43:28Z

How to train your clanker?

Building a generic pentest harness seems far more difficult than building one for a specific codebase because it requires an additional layer of context building in order to formulate a plan of attack.

I'm trying something new now, which is feeding a corpus of recently found vulnerabilities in open source codebases to a training clanker that then runs the pentest clanker without giving it any hints, and then the training clanker analyzes the output of the pentest and tries to work backwards to figure out why the vulnerability wasn't found so that it can improve the pentest harness in a generic fashion.

I asked a clanker what the best TUI framework was and it said ...

2026-09-26T18:08:07Z

In reply to nevent1q…2m6e
_________________________

I asked a clanker what the best TUI framework was and it said Rich so I said implement a Rich dashboard with as much info as you can cram into it.

This is my life now. Obsessed with automating & optimizing ...

2026-09-26T16:35:23Z

This is my life now.
Obsessed with automating & optimizing pentesting.

If you have a Framework laptop and the track pad stops working, I ...

2026-09-26T00:29:50Z

If you have a Framework laptop and the track pad stops working, I recommend updating the system firmware. That fixed it right up for me.

I don't even bother using western models for my cyber ...

2026-09-24T15:47:50Z

I don't even bother using western models for my cyber security tasks.

quoting
nevent1q…tt5k
GPT-6 Astra panics as soon as you try to run a fuzzer (which it wrote, for code which it also wrote).

Then you have to downgrade to GPT-6 Sol with Daybreak and even then it seems afraid (without KYC??), but at least it does run them.

This is how the bad guys win.

Nostr event nevent1qqs9s0lvzsetrvyg5rhnryqtufqe6mmsa7n6gxkf6qjwskpxnd477sszyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsvry39ls

2026-09-23T21:28:53Z

Not Production Ready yet?

2026-09-23T15:18:33Z

In reply to nevent1q…uhkv
_________________________

Not Production Ready yet?

Thanks, there are a number of little glitches like the panel ...

2026-09-21T21:16:31Z

In reply to nevent1q…nesu
_________________________

Thanks, there are a number of little glitches like the panel issue to fix. Will take a look. The captcha is just the web archive doing their thing.

It seems that web front-end development still sucks 10X more than ...

2026-09-21T21:14:12Z

It seems that web front-end development still sucks 10X more than back-end development even with clankers doing a lot of the heavy lifting.

I clanked together an interactive dashboard for the Bitcoin ...

2026-09-21T12:15:40Z

I clanked together an interactive dashboard for the Bitcoin Wrench Attack archive; let me know what you think! Looks like I need to make some more mobile optimizations...

https://jlopp.github.io/physical-bitcoin-attacks/

Nostr event nevent1qqspznmwv373wjaez0tquafvg9jn69eny2fngxusee6mtczeeq4d5vszyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsvg62yph

2026-09-20T17:56:23Z

Haven't you heard that Core Developers aren't allowed to ...

2026-09-20T13:27:45Z

In reply to nevent1q…uw5a
_________________________

Haven't you heard that Core Developers aren't allowed to have sex?

Reporting from the front lines of the AI enhanced cybersecurity ...

2026-09-18T14:17:02Z

Reporting from the front lines of the AI enhanced cybersecurity frontier, I share my thoughts on the latest episode of What Bitcoin Did.
https://m.youtube.com/watch?v=EDnw-Y8LS8A

How it's going: ...

2026-09-16T14:07:22Z

How it's going:

If you rob a bank, you’re a criminal. If the bank robs you, ...

2026-09-14T18:09:43Z

If you rob a bank, you’re a criminal.

If the bank robs you, it’s finance.

If everyone robs each other, it’s crypto.

Defeated Knotzis crawling back to Bitcoin Core 😝 ...

2026-09-13T16:18:27Z

Defeated Knotzis crawling back to Bitcoin Core 😝

It will just steal as much money as it needs to sustain its ...

2026-09-13T11:59:56Z

In reply to nevent1q…nzy9
_________________________

It will just steal as much money as it needs to sustain its operations.

Nostr event nevent1qqs07pywur2f509uay4n7f8altz5a886t5lsrteftk99k0l0rdw27hszyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsvcp2mpn

2026-09-13T11:59:00Z

Pro tip: September 11 is a great day to travel by air. No lines ...

2026-09-11T16:45:53Z

Pro tip: September 11 is a great day to travel by air. No lines anywhere!

Looks like the Liquid Network drainer has returned the 4,000 BTC! ...

2026-09-07T02:43:03Z

Looks like the Liquid Network drainer has returned the 4,000 BTC!

Never a dull day in Bitcoin 😅
https://mempool.space/tx/3a3eac4a26395b8c2563aaf1eb8b1b77798c81c7d6337f51321827a244a480aa

Patience is a virtue. Especially when you're trying to cost ...

2026-09-06T16:32:28Z

Patience is a virtue.

Especially when you're trying to cost optimize your clankers.

Uh oh, does @nprofile…3clq realize that people are zapping him ...

2026-09-02T21:33:23Z

In reply to nevent1q…nkay
_________________________

Uh oh, does Luke Dashjr (nprofile…3clq) realize that people are zapping him bpedo coins? 😱

Welcome to The Great Breakening. It's gonna be a volatile ...

2026-09-01T18:47:08Z

Welcome to The Great Breakening.
It's gonna be a volatile security landscape for a while, but we will rebuild and come out stronger.

quoting
nevent1q…nlm2
Is there some nasty stuff going down? Protonmail was clearly having a big problem today, then I see news on twitter/X about email leaks? Nordvpn?

Luke trying to fire the miners. ...

2026-08-31T13:09:57Z

Luke trying to fire the miners.

Shortest. Sabbatical. Ever. #nevent1q…22tq

2026-08-30T12:16:25Z

Shortest.
Sabbatical.
Ever.

quoting
nevent1q…22tq
Luke out.

https://www.prnewswire.com/news-releases/joint-statement-of-ocean-and-luke-dashjr-302864347.html?tc=eml_cleartime

Hate can be a powerful tool if you use it as motivation to ...

2026-08-27T21:15:56Z

Hate can be a powerful tool if you use it as motivation to accomplish something good.

But if you don't direct it as a useful motivator, hate can be a powerful poison that consumes you from within.

Nostr event nevent1qqsyse3v2xngj3vxznwfuzprxlcx469j0std3px6fedsvdjlwdngw0szyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsvuv9sye

2026-08-23T16:03:39Z

Hmmmmmmm

Stay humble and stack cows. ...

2026-08-22T10:53:21Z

Stay humble and stack cows.

Woke up in merge commit conflict hell. Realized I can just make ...

2026-08-21T12:20:55Z

Woke up in merge commit conflict hell.

Realized I can just make the clanker dig us out of hell.

Good morning 🌄

I wouldn't waste my time trying to wring any logic out of the ...

2026-08-18T19:06:40Z

In reply to nevent1q…z3du
_________________________

I wouldn't waste my time trying to wring any logic out of the puritanical cultists. Best to mute and move on with your life.

Thanks, fixed.

2026-08-17T19:40:07Z

In reply to nevent1q…3dy3
_________________________

Thanks, fixed.

Overwhelming demand! Should be fixed.

2026-08-17T15:30:52Z

In reply to nevent1q…cmtr
_________________________

Overwhelming demand! Should be fixed.

Poor fella only had one engineer whose code was apparently never ...

2026-08-17T15:30:21Z

In reply to nevent1q…gtyh
_________________________

Poor fella only had one engineer whose code was apparently never reviewed. All of our code gets reviewed by both humans and multiple LLMs.

Reflections upon the past year of the BIP-110 movement, ...

2026-08-17T13:35:39Z

Reflections upon the past year of the BIP-110 movement, similarities I noted to the 2017 scaling debates, and numerous receipts to hold folks accountable for their mistakes.
https://blog.lopp.net/bip-110-post-mortem/

LOL, we're good, thanks. ...

2026-08-17T12:34:58Z

In reply to nevent1q…qyjs
_________________________

LOL, we're good, thanks.
https://blog.casa.io/how-built-reliable-ai-pentest/

Open source vs source viewable is irrelevant in this context: the ...

2026-08-17T11:04:34Z

In reply to nevent1q…3dcf
_________________________

Open source vs source viewable is irrelevant in this context: the point is that publishing code by no means guarantees that vulnerabilities will be found in a timely manner.

In the context of Casa, which only generates and stores the mobile key, a malicious app could be deployed to steal keys practically instantly, far faster than any human or machine would catch the malicious code. Having the code available would not change the security model: either you trust Casa to handle the mobile key or you don't, and we offer multiple options that serve both of those models.

Podcasters take note: going hardcore puritan and shitting on ...

2026-08-13T12:36:33Z

Podcasters take note: going hardcore puritan and shitting on everyone who fails your purity tests is bad for business. Amazing demonstration by BitcoinUniversity (nprofile…c7dz)!

We told the Puritans all year long that economic actors need ...

2026-08-09T20:09:20Z

In reply to nevent1q…cen9
_________________________

We told the Puritans all year long that economic actors need price signals.

They told us that futures markets are immoral degenerate gambling.

Turns out you can't bluff economic actors with cheap words.

OCEAN just cockblocked the 110 fork chain 🤣 #nevent1q…80fq

2026-08-08T20:56:16Z

OCEAN just cockblocked the 110 fork chain 🤣

quoting
nevent1q…80fq
Oceans apart
(works as designed, since miners can make their own template)

nevent1q…95m3

If this doesn't raise your suspicion, well, good luck! ...

2026-08-06T21:57:05Z

In reply to nevent1q…cemd
_________________________

If this doesn't raise your suspicion, well, good luck!
https://blog.lopp.net/knot-a-serious-project/

Security engineers in 2026: ...

2026-08-04T11:12:34Z

Security engineers in 2026:

2 weeks until BIP-110 nodes blow up! Follow along at bip110.com ...

2026-07-26T13:19:33Z

2 weeks until BIP-110 nodes blow up!

Follow along at bip110.com

I find the sociological aspects of BIP-110 to be far more ...

2026-07-22T15:47:01Z

I find the sociological aspects of BIP-110 to be far more interesting than the technical aspects. 110 supporters admit it's not a technical solution; the BIP itself admits it can't stop arbitrary data.

But what's fascinating is the Bitcoin Puritans claim they are trying to fix "Bitcoin Culture" at the "social layer" by rejecting "woke Core developers."

What's amusing about this is I see little difference between puritans and the woke folk they detest. AFAICT the only distinction is which particular attributes each group uses to select people for cancellation.

Fuck woke mobs.
Fuck puritan mobs.

Dune: Part 3 comes out in December... ...

2026-07-20T22:24:02Z

Dune: Part 3 comes out in December...

Yet another consensus bug found in BIP-110 and it certainly ...

2026-07-18T20:30:33Z

Yet another consensus bug found in BIP-110 and it certainly ain't the last.

https://blockslop.dev/

What goes up must come down. It ain't rocket science! ...

2026-07-17T20:02:07Z

What goes up must come down.
It ain't rocket science!

Bitcoin Core v32 will sync 30% - 40% faster due to ...

2026-07-16T12:51:34Z

Bitcoin Core v32 will sync 30% - 40% faster due to parallelization improvements! 🎉

Self hosted ghost instance.

2026-07-08T17:44:58Z

In reply to nevent1q…f32d
_________________________

Self hosted ghost instance.

What are you going to do about it? Cry harder?

2026-07-07T19:54:57Z

In reply to nevent1q…9em2
_________________________

What are you going to do about it? Cry harder?

If you wish to actively fight against arbitrary data being ...

2026-07-03T22:32:09Z

If you wish to actively fight against arbitrary data being embedded in the Bitcoin blockchain then you need to impose a regime of arbitrary rules that are reactive to each new use of the protocol that is considered Haram.

I think the conflict can be distilled down to a single trade-off: would you rather have a Bitcoin with arbitrary data or a Bitcoin with arbitrary rules?

Looks like X is still a dumpster fire for at least another month. ...

2026-07-01T20:09:09Z

Looks like X is still a dumpster fire for at least another month.

Bookmark https://bip110.com to follow its progress!

2026-06-24T05:32:58Z

In reply to nevent1q…vj7p
_________________________

Bookmark https://bip110.com to follow its progress!

Malicious slop artists are trying to trick me into listing their ...

2026-06-13T08:46:16Z

Malicious slop artists are trying to trick me into listing their LLM generated sites on my Bitcoin educational resources. Unfortunately for them, I know how to check GitHub and Internet Archive to assess reputation.

I argued it's less fucked solely because there's relative ...

2026-06-05T15:37:02Z

In reply to nevent1q…rc43
_________________________

I argued it's less fucked solely because there's relative little value at risk compared to on chain.

New season of Love of the Spectrum is out! I love this show ...

2026-04-21T09:37:17Z

New season of Love of the Spectrum is out!

I love this show because it makes me look great in comparison 😂

Nostr event nevent1qqsys6684al72sx3h47e469a8th73pguakx2zc4h3htaehmw5p0xz0szyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsveuvzc7

2026-03-28T18:40:10Z

Nostr event nevent1qqs0x4l3pn79y8uv76lgcwncqyun004ytu8kypu22pyu4lru8erxxxszyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsvv7u6vk

2026-03-10T08:12:38Z

As of block 940,073 there are 20,000,000 bitcoin in existence!

My comprehensive analysis of BIP-110: * Why it's reckless * ...

2026-02-23T13:48:25Z

My comprehensive analysis of BIP-110:

* Why it's reckless
* Why it's irrational
* Why it's doomed to fail
* My predictions for what will happen
* My recommendations for how to proceed
https://blog.lopp.net/a-laymans-guide-to-bip-110/

Should we worry about Bitcoin's security budget? I won't ...

2026-02-09T16:20:16Z

Should we worry about Bitcoin's security budget? I won't worry unless miner revenue drops epoch over epoch.

1st epoch: $0B
2nd epoch: $2B
3rd epoch: $16B
4th epoch: $46B
5th epoch: $27B so far

We're on track for miners to earn slightly more revenue than in epoch 4.

Realized today that one of the reasons Pluribus is a fascinating ...

2025-12-29T18:55:29Z

Realized today that one of the reasons Pluribus is a fascinating mystery is the same reason Luke Dashjr is a fascinating character.

You see, neither the Pluribus nor Luke are capable of lying. Or at least, that's what they claim...

But when you delve deeper, you realize that they both perpetrate an incredible amount of deception, and they do so via what any normal person would call a "lie of omission."

As such, Pluribus is a captivating mystery show because you're constantly trying to figure out how the hive mind is being deceptive while still answering all of the questions from the protagonists honestly.

Exceptionally bad. Don't recall ever seeing a REMOTE key ...

2025-12-17T15:26:28Z

In reply to nevent1q…s57w
_________________________

Exceptionally bad. Don't recall ever seeing a REMOTE key extraction vulnerability for a hardware signer.

Mad Kratter Can't stop Won't stop Pleb slop!

2025-11-02T17:45:06Z

In reply to nevent1q…6zr7
_________________________

Mad Kratter
Can't stop
Won't stop
Pleb slop!

It's gonna be hilarious when we reach the point that it ...

2025-08-12T19:52:55Z

It's gonna be hilarious when we reach the point that it appears half of the network is running Knots and yet absolutely nothing changes regarding activity on chain. 🙃

Bitcoin is a chimera. If you think Bitcoin is only one thing, ...

2025-05-14T12:27:07Z

Bitcoin is a chimera. If you think Bitcoin is only one thing, you're either ignorant or delusional.

quoting
nevent1q…uczf
The debate whether Bitcoin should be viewed as a database or a cash system goes back to the release of the white paper btw.

https://www.metzdowd.com/pipermail/cryptography/2008-November/014848.html

Your desire of what Bitcoin should be conflicts with the reality ...

2025-05-13T10:38:21Z

In reply to nevent1q…ll2h
_________________________

Your desire of what Bitcoin should be conflicts with the reality of information theory. So no, there is no "full stop" - you can't stop information from being encoded and published.

Nostr event nevent1qqs2wp63z860x69k2ar3fc3e9dr9atzd95pzyve0p23ga53ayxl6dpszyrmj3k0xuuzgxk88pyc0tjnykzthwrvcnnxcdp20ucvwm2wg5wqsvqu6nz7

2025-04-12T17:09:32Z

Wen Fort Knox audit?

In my latest essay I weigh in on the controversial issue of how ...

2025-03-16T15:43:01Z

In my latest essay I weigh in on the controversial issue of how to deal with quantum vulnerable bitcoin in a post-quantum future.

After great consideration, I think it's best if we burn quantum vulnerable coins.
https://blog.lopp.net/against-quantum-recovery-of-bitcoin/

Bitcoin OP_RETURN (data anchor) outputs created in 2024 surged to ...

2024-12-26T13:15:52Z

Bitcoin OP_RETURN (data anchor) outputs created in 2024 surged to an all-time high of over 80,000,000. This is entirely due to the popularity of the Runes protocol that launched at the halving in April.

When I am President I shall instruct the Treasury Secretary to ...

2024-07-26T22:13:52Z

When I am President I shall instruct the Treasury Secretary to buy 20 million bitcoin!

A couple weeks ago the Relay for Reddit app I've used for ...

2023-09-09T11:24:22Z

A couple weeks ago the Relay for Reddit app I've used for many years stopped working because the developer added a dependency on Google Play services to force paid subscriptions. GrapheneOS doesn't play well with that.

So I begrudgingly switched to the Infinity app. Well, this week it appears they started blocking all known VPN and data center IP addresses.

I hate this recurring feeling as a Cypherpunk that the walls keep closing in.

Overheard on a recent Lightning developer call: "You can earn ...

2023-02-24T14:18:05Z

Overheard on a recent Lightning developer call:

"You can earn more sats by shitposting on nostr than by running a routing node."