Nostr notes by Tyler Burns

Because Merlin app is from Cornell and that university is ...

2026-09-29T22:59:11Z

In reply to nevent1q…ezd0
_________________________

Because Merlin app is from Cornell and that university is covering for the gang rape of a woman on campus.

This doesn't seem to be any different than other federated ...

2026-09-25T00:31:40Z

In reply to nevent1q…j973
_________________________

This doesn't seem to be any different than other federated system. Their abstract is a little misleading in claiming that it is taking place "directly on bitcoin L1" when that obviously isn't true. Until we can figure out a way to perform a trustless peg-in/peg-out, then it will always be just a claim of on-chain bitcoin and not actual bitcoin.

Nostr event nevent1qqsqqq99dw44kejxstw0rjnvffkvcy7camuk6j04uupryurmhqwpleszypk9lwaja47r4r0s79ehdtfczea7ly9dxd7se3rdymcv56rzpwd8zvtw5ct

2026-08-22T13:08:16Z

Using bitcoin to buy things just feels good. 😃

Love silent.link. There is more legislation being pushed ...

2026-08-21T19:01:29Z

In reply to nevent1q…05fg
_________________________

Love silent.link. There is more legislation being pushed requiring that any SIM require KYC info. So things like silent.link will be more needed than ever.

Well that is horrific. Last I check, bitcoin mines don't ...

2026-08-20T05:30:58Z

Well that is horrific. Last I check, bitcoin mines don't collapse and kill a hundred people.

quoting
nevent1q…xxha
⚡️🚨🇿🇲 ALERT - More than 100 killed after gold mine collapses in Zamboye, Central African Republic

- The disaster struck at Zamboye, near the border with Cameroon

- The site is an artisanal mine, where diggers work by hand with no engineering support

- Rescue efforts are severely limited by the remote location

These mines feed gold into global markets while the people pulling it out work in conditions nobody would accept anywhere else.

That sucks. I broke my ankle and tore several ligaments as well. ...

2026-08-19T16:39:09Z

In reply to nevent1q…zrqn
_________________________

That sucks. I broke my ankle and tore several ligaments as well. The recovery is not fun, but certainly makes you appreciate having two working legs. Take this time of forced rest to recovery mentally as well. You'll get through this.

EQ > IQ #nevent1q…6j3m

2026-08-13T22:34:23Z

EQ > IQ

quoting
nevent1q…6j3m
Teaching people how to regulate their emotions is crime prevention.
It's addiction prevention. It's suicide prevention. It's generational healing.
It's how we stop raising adults who explode, implode, or shut down at the first sign of discomfort.

Emotional regulation is not just a soft skill. It's survival. It's the foundation of a society where people can disagree without dehumanizing each other, where accountability isn't seen as an attack, and where conflict doesn't always have to mean violence. You want a better world? Start with emotional education.

Any vegans out there, feel free to join the vegan community on ...

2026-08-13T03:21:23Z

Any vegans out there, feel free to join the vegan community on Armada. 🌱

https://armada.buzz/invite/naddr1qvzqqqyzz5pzpfklwjwfmw9fasyyu6504rpt6c387l5427s7qxyx6cq9r6efelnpqqqqytnp5t#BAADAwQBW8xBT8q0ERF9qax8GVolwA

Request accepted. 👍

2026-08-12T03:28:08Z

In reply to nevent1q…0lkx
_________________________

Request accepted. 👍

All the more reason to use remote signing with your Nostr client. ...

2026-08-12T01:49:40Z

All the more reason to use remote signing with your Nostr client. Keep your nsec out of your client so that the potential for XSS or CSRF attacks can't leak your nsec. Your client shouldn't need/have access to your nsec. Worst that might happen is they trick your remote signer into signing something you didn't authorize, but at least you can recover from that easier than a compromised nsec.

quoting
nevent1q…us4d
PSA:
Just got a weird XSS attack as a 0 sats zap (not sure how that even works).

Seems a good thing I was on Wisp on iOS when it happened, and it didn’t seem to execute. If I was to be on Primal on browser it might have worked.

But may be having to start a new nsec soon anyway.

Here’s what my AI thinks it did:

“This looks like a deliberate XSS (cross-site scripting) attack attempt targeting Nostr clients, likely Primal.

Here's a breakdown of what's happening and what it means:

What the payload is doing

The zap description isn't a normal message. It's an injection attempt containing:

— Nested HTML elements designed to bypass naive sanitizers or exploit rendering quirks in a client that displays zap descriptions as HTML rather than plain text.

A webhook[dot]site URL — Webhook[dot]site is a legitimate tool, but here it's being used as an exfiltration endpoint. Any data sent to that URL goes directly to the attacker. They're using it as a quick, anonymous way to capture stolen data without hosting their own server.

localStorage.getItem('primalSec') — This is the smoking gun. primalSec appears to be a localStorage key used by Primal (a Nostr client) to store sensitive session data. The attacker is trying to steal this credential via XSS and send it to their webhook.

In short: the attacker is sending 0-sat zaps with malicious descriptions hoping your client will render the description as HTML/JavaScript, which would then silently steal your session secrets and beam them to webhook[dot]site.”

I have been retired for over a year now and am now looking for ...

2026-08-11T19:37:34Z

I have been retired for over a year now and am now looking for ways to volunteer my time. I love bitcoin's ability to help humanity in ways that traditional financial services have failed. I have a 20+ year career in IT/InfoSec (almost entirely in TradFi ironically), but am more looking for ways where simply having an extra set of hands will help people live better lives with the bitcoin/nostr. If anyone needs an extra volunteer, feel free to reach out. Doesn't need to be all the time, but if anyone hears a need for some extra hands anywhere, let me know. ✌

geyser (npub1kmw…xqk9) Team Soapbox (npub10qd…arpj) myfirstbitcoin (npub17cy…4ml3)

Didn't know what Armada was, so just checked it out. It's ...

2026-08-11T19:15:04Z

In reply to nevent1q…g2hs
_________________________

Didn't know what Armada was, so just checked it out. It's like Discord, but with Nostr. Very cool! Thanks. Team Soapbox (npub10qd…arpj) seems to be doing cool stuff.

A person with authoritarian tendencies won't ever step back ...

2026-08-11T14:16:14Z

In reply to nevent1q…8gpm
_________________________

A person with authoritarian tendencies won't ever step back and see things this way.

You mean bitcoin? Technically, yes that would absolutely work. ...

2026-08-11T14:07:24Z

In reply to nevent1q…hj52
_________________________

You mean bitcoin?

Technically, yes that would absolutely work. But harder in practice considering very few wallets support it. I don't care about Luke's coin. Was just pointing out that for most people, keeping both coins has some important caveats.

Except for the big issue of replay.

2026-08-11T13:53:51Z

In reply to nevent1q…lxns
_________________________

Except for the big issue of replay.

It baffles me how much they rail against the scourges of ...

2026-08-10T16:02:53Z

In reply to nevent1q…yy4r
_________________________

It baffles me how much they rail against the scourges of centralization and yet are so eager to run a node implementation maintained by a singular individual. Looking in a mirror seems so difficult these days for some people.

I hope you learned some lessons from this.

2026-08-10T12:41:45Z

In reply to nevent1q…ckew
_________________________

I hope you learned some lessons from this.

Security by obscurity gets a bad rap in InfoSec, but that's ...

2026-08-10T01:03:13Z

Security by obscurity gets a bad rap in InfoSec, but that's if you ONLY are performing obscurity for your security strategy. Security is defense in depth and that depth includes obscurity. Obscurity in reality, is often your first line of defense. Change your defaults when running any publicly exposed service. That includes headers, responses, error codes, banners, and yes...even favicons too.

quoting
nevent1q…why4
I was wondering about how the BTCPay attackers found all the instances to hack so I asked grok about it. I didn’t verify this, but grok said it was possible to find the BTCPay servers by the favicon that all BTCPay servers use 😳

You running knots versus core does nothing for how much data is ...

2026-08-09T12:38:05Z

In reply to nevent1q…5edv
_________________________

You running knots versus core does nothing for how much data is stored by your blockchain. Knots accepts all the same blocks on the chain as core.

BIP-110 also doesn't change anything with regards to the potential storage requirements of running a node since the amount of data stored for any given block remains the same.

At the end of the day, BIP-110 was selling a lie.

Data storage for bitcoin's blockchain remains a linear non-issue. Every block has a max size which means the blockchain grows linearly and therefore storage requirements over time for a pleb node runner is overcome easily with cheap consumer hardware.

If anything, not using OP_RETURN for arbitrary data is what increases node requirements since if that data is otherwise stored in the UTXO set, it WILL increase your node requirements since the UTXO set is stored in RAM, which is also far more costly.

Also, if the ColdCard debacle taught us anything about a proper SDLC, it is that you need robust commit tracking for code changes and the way that Luke maintains Knots mirrors the way that ColdCard maintained its firmware, if not worse. There is no code signing of the changes that Luke is committing to Knots from their source. You lose tracking of what the code changes actually are. It is a pet project of Luke's and I'd caution anyone serious about security to avoid running it.

Calvin Ayre, now there is a name I haven't heard in ages...

2026-08-08T13:50:10Z

In reply to nevent1q…fp2a
_________________________

Calvin Ayre, now there is a name I haven't heard in ages...

Narrator: Mining blocks without signaling didn't, in fact, ...

2026-08-07T22:09:32Z

Narrator: Mining blocks without signaling didn't, in fact, result in forfeiting all block rewards.

quoting
nevent1q…6cux
~22 hours until signaling BIP110 becomes mandatory for Bitcoin miners.

Mining blocks without signaling will then forfeit all block rewards!

This is something that I saw that results in a lot of the high ...

2026-08-07T17:21:05Z

This is something that I saw that results in a lot of the high burnout rates in the cybersecurity industry. Before I moved into the InfoSec field, I was in general IT.

As a network admin, you're thanked for solving someone's computer problem. You're thanked for implementing a new solution that is better than the legacy one. You regularly get that natural positive feedback that comes about by just doing your job.

In Infosec, it is a very thankless job. No one thanks you for preventing the unseen threat. No one thanks you for implementing a new security defense. In fact, you often get pushback because new security measures often introduce new hurdles that users now need to work with in their daily tasks. So as you work tirelessly keeping the workplace safe and secure, you don't get the positive feedback from those around you unless your workplace has proper recognition practices in place that understands the work that the InfoSec department is doing. You're often getting pushback just to even try and do the basics that you know the organization desperately needs. It can take a toll on the mind of the InfoSec professional.

quoting
nevent1q…caym
The best security and privacy don't make headlines.
Jameson Lopp (nprofile…dw5r) explains. 👇

https://fountain.fm/episode/iJ1ClnT6PEPxr9nB7Kkp

Ya, their logic throughout the article makes no sense. It relies ...

2026-08-07T14:47:47Z

In reply to nevent1q…nwl2
_________________________

Ya, their logic throughout the article makes no sense. It relies upon the logic that the BIP-110 hardfork chain holds any merit for my consideration. It doesn't. Nobody cares about it. If one of my channel peers forks off, so be it. I'll keep monitoring the actual bitcoin chain for any activity with my channels and thus my channel funds will remain safe. The risk of lightning loss remains the same, regardless of any chain split here. As long as my node is online and monitoring the chain I care about, there isn't any risk to my funds that I hold the keys to.

As always with lightning, if you're managing a healthy, always-on, node with proper channel backups, you funds will be safe.

BIP-110'ers, even in the 11th hour are desperate to make it seem like their hard fork has any chance of success or has any value worth considering. Reality is that it will come to pass and be forever forgotten.

That's some insane talent.

2026-08-07T02:35:30Z

In reply to nevent1q…hzpg
_________________________

That's some insane talent.

Being able to host your own blind oracle is a great unique ...

2026-08-07T01:11:24Z

Being able to host your own blind oracle is a great unique feature to the Jade. If you ever lost your Jade or had it stolen, you can take your blind oracle server offline and effectively remotely brick your Jade. Or you can host your blind oracle server strictly accessible only on your home LAN, making your Jade HWW only usable within the confines of your home.

quoting
nevent1q…q4uh
Physical secure elements are closed-source under NDA. Once reverse-engineered offline, every unit is compromised.

Jade's virtual SE (Blind Oracle) encrypts your seed so the locked device holds only ciphertext. The AES-256 key is co-created with a truly blind, rate-limited oracle that wipes after 3 wrong PINs. The attack becomes interactive and remote.

Fully open-source. No proprietary silicon. No NDAs. Anyone can audit the code or run their own oracle.

We don't FUD secure elements, we simply explain why we chose the Blind Oracle path for greater transparency and verifiability.

Video with full details: https://youtu.be/ad3titeu9uY

Help Center: https://help.blockstream.com/blockstream-jade/faqs/how-does-jade-protect-my-recovery-phrase-with-a-blind-oracle

Set up your own Blind Oracle: https://help.blockstream.com/blockstream-jade/add-more-security-functionality/set-up-a-personal-blind-oracle

Github: https://github.com/Blockstream/blind_pin_server

More from adam3us (nprofile…9k65):

No, not necessarily foul play as in involved directly with any ...

2026-08-04T23:47:22Z

In reply to nevent1q…jefz
_________________________

No, not necessarily foul play as in involved directly with any theft. But certainly foul play in regards to being a really horrible way to run a company with a functional SDLC with any sort of accountability.

Crazy in hindsight to think that this company was so highly regarded. I certainly fell for it as it was a wallet I highly recommended. I guess that's what social reputation gets you these days.

Fair enough. I misunderstood.

2026-08-03T18:44:03Z

In reply to nevent1q…86rp
_________________________

Fair enough. I misunderstood.

I don't think this is the take away lesson you should be ...

2026-08-03T16:41:36Z

In reply to nevent1q…r3wj
_________________________

I don't think this is the take away lesson you should be having here.

Even today with other wallets, far easier to tell casual users to ...

2026-08-03T10:48:55Z

In reply to nevent1q…l3ca
_________________________

Even today with other wallets, far easier to tell casual users to just create a passphrase which most wallets have far better UX for than to suggest to them to roll dice for entropy. They'll be protected all the same.

You ever just scroll Nostr notes from before July 29th? What a ...

2026-08-03T03:29:37Z

You ever just scroll Nostr notes from before July 29th? What a peaceful time that was. Everyone was just so happy and oblivious.

Whenever there is some kind of tragedy in the real world, ...

2026-08-03T02:39:39Z

Whenever there is some kind of tragedy in the real world, something I commonly hear said is to "look for the good." There will always be people banding together to help those impacted by whatever awful evil or disaster that took place.

I saw that with the bitcoin community last week. In the face of such an awful theft, I saw the bitcoin community with all hands on deck trying to help people preserve their wealth or protect themselves from the looming threat. That's what we do.

From the first reports of users' wallets being drained to piecing together the pieces and commonalities that would lead us to the root cause, it was amazing to see how quickly things came together. Everyone was finding ways to help as many people as possible protect their funds.

I was making several calls to help those close to me that were impacted as I know many others were doing just the same. When you don't rely on centralized institutions, that responsibility falls on all of us. It was clear that responsibility was not taken lightly by anyone.

It pains me to see something like this take place in the first place. It should've never happened. But seeing the good in that darkness was nice to see and I know we'll come out of this stronger than before.

You seem to always have very good viewpoints and this is yet ...

2026-08-02T19:38:59Z

In reply to nevent1q…gq99
_________________________

You seem to always have very good viewpoints and this is yet another one. ✌

You wouldn't be using it for key splitting, but doing it in ...

2026-08-02T16:55:29Z

In reply to nevent1q…fdz5
_________________________

You wouldn't be using it for key splitting, but doing it in reverse to combine two (or more) keys into one. But I agree that doing the XOR operation manually is the best way to ensure the seed was XOR'd properly.

Ah, didn't know the MK3 got an update as well.

2026-08-02T16:06:08Z

In reply to nevent1q…ythc
_________________________

Ah, didn't know the MK3 got an update as well.

...or use a sufficient BIP-39 passphrase to provide additional ...

2026-08-02T15:18:42Z

In reply to nevent1q…zhkj
_________________________

...or use a sufficient BIP-39 passphrase to provide additional entropy after the hardware provided its own.

Ya, I was thinking a lot about it last night as well. I agree ...

2026-08-02T15:16:49Z

In reply to nevent1q…2t39
_________________________

Ya, I was thinking a lot about it last night as well. I agree that as an end user it is impossible to validate randomness.

The only thing you can do as an end user is minimize the risk of it. Either by performing your own entropy (dice rolls, coin flips, etc) to elimate the risk entirely. Or by involving multiple sources of entropy from multiple vendors to minimize the risk of failure from a single one. You can do that via multi-sig or with something like SeedXOR to combine multiple diverse seeds into a single seed phrase.

Someone just posted this chart. I'm guessing there have been ...

2026-08-02T14:39:49Z

In reply to nevent1q…e7ms
_________________________

Someone just posted this chart. I'm guessing there have been a few unreported collisions with losses over the years that we just didn't know about.

quoting
nevent1q…ljfy

I don't think it is that unlikely. I believe there is 50% ...

2026-08-02T14:30:24Z

In reply to nevent1q…e7ms
_________________________

I don't think it is that unlikely. I believe there is 50% probability of a collision with about 1.2 million keys generated for a 2^40 search space. I'm not sure how many ColdCard have been sold (probably not a million), but I don't think it'd be a stretch to think that there haven't been plenty of keys generated from them.

I wouldn't use a CC for private key generation in any kind of ...

2026-08-02T14:25:02Z

In reply to nevent1q…knux
_________________________

I wouldn't use a CC for private key generation in any kind of setup, even multisig. Especially an MK3 since it isn't getting any firmware updates to resolve the entropy issue here.

Even with multisig, while you may be protected from theft, there can still be privacy concerns should its private key be compromised in your setup. I just wanted to make that clear in case I wasn't there.

If you wanted to do SeedXOR, I would generate seed words generated from other sources and only use a ColdCard for the SeedXOR process or perform the XOR manually.

There are pros and cons of each setup. Both setups would protect you from loss if any singular HWW manufacturer had a fatal flaw in its private key generation process. Multisig setups are a little more complex, but it also provides security from theft/loss if any single seed phrase is compromised that single-sig alone wouldn't provide. A passphrase added to single-sig can help with that risk as well though.

More likely a new ColdCard user created a brand new wallet and ...

2026-08-02T14:16:14Z

In reply to nevent1q…r7pe
_________________________

More likely a new ColdCard user created a brand new wallet and just happened to generate a private key that was already in use and found themselves with a new fortune sitting there.

Though using a ColdCard for this and trusting it to do even a ...

2026-08-02T09:08:34Z

Though using a ColdCard for this and trusting it to do even a simple XOR function is a tall order to ask of the community at the moment, I understand. 😬

You can also do this same SeedXOR manually by taking seed phrases from multiple vendors, breaking each word of the seed down to its 11-bit binary value and XOR'ing the two seed phrases together. Then you can take that final binary value and feed it into Ian Coleman's BIP-39 tool (offline) to come up with a new more secure seed phrase that doesn't rely on a single vendor's RNG. Though doing that much at this point is probably more complex than dice rolls now. 😅

quoting
nevent1q…hyqq
I know now is a popular time to shit on ColdCard and that's certainly justified.

But it really was a wallet with some great features. Everyone seems to be touting dice rolls at the moment to avoid relying on a vendor's RNG, but that's not exactly user friendly. There is also the multi-sig approach so that you don't need to rely upon a single vendor's key generation for security. That's great too, but is also brings about additional complexity for the average user to maintain.

So I'm here to tell anyone with a ColdCard brick at the moment, not to throw them away just yet.

One nice feature it has is SeedXOR. Originally marketed as a way to more securely backup your seed phrases, it allows you to take a single seed phrase and split it into multiple valid seed phrases that can then be stored securely on metal plates as backups without the risk of theft if any single plate is stolen.

However, if you do this process in reverse, you take multiple seed phrases and combine it into one single seed phrase, you can effectively take multiple seed phrases from multiple sources/vendors and combine them into one usable and more secure seed phrase. You're effectively combining the entropy from multiple sources into this single seed phrase.

Like, multi-sig, you're now not relying on any singular vendor's RNG process, but the end result is you're still using a single-sig setup (it can be used with a passphrase as well). One single seed phrase to backup without the complexity of multi-sig, if that's what you prefer.

The ColdCard comes into play because it has the SeedXOR feature on it that allows you to perform this function offline, keeping your seed phrases from ever touching an internet connected device.

So you can take a Jade, Trezor, laptop with Sparrow, phone with Bluewallet and use those seed phrases to create one more robust seedphrase that you can then import into your preferred hardware wallet for use.

I'm not shilling for ColdCard, I'm just providing a good idea that can be used to potentially increase your security and decrease your reliance on any single vendor while providing a potential use case for that ColdCard you already have the will never get used again.

SeedXOR is genuinely a good idea and XOR'ing secrets has been around for a long time. It is also probably more user friendly than rolling dice...maybe.

I know now is a popular time to shit on ColdCard and that's ...

2026-08-02T08:48:17Z

I know now is a popular time to shit on ColdCard and that's certainly justified.

But it really was a wallet with some great features. Everyone seems to be touting dice rolls at the moment to avoid relying on a vendor's RNG, but that's not exactly user friendly. There is also the multi-sig approach so that you don't need to rely upon a single vendor's key generation for security. That's great too, but is also brings about additional complexity for the average user to maintain.

So I'm here to tell anyone with a ColdCard brick at the moment, not to throw them away just yet.

One nice feature it has is SeedXOR. Originally marketed as a way to more securely backup your seed phrases, it allows you to take a single seed phrase and split it into multiple valid seed phrases that can then be stored securely on metal plates as backups without the risk of theft if any single plate is stolen.

However, if you do this process in reverse, you take multiple seed phrases and combine it into one single seed phrase, you can effectively take multiple seed phrases from multiple sources/vendors and combine them into one usable and more secure seed phrase. You're effectively combining the entropy from multiple sources into this single seed phrase.

Like, multi-sig, you're now not relying on any singular vendor's RNG process, but the end result is you're still using a single-sig setup (it can be used with a passphrase as well). One single seed phrase to backup without the complexity of multi-sig, if that's what you prefer.

The ColdCard comes into play because it has the SeedXOR feature on it that allows you to perform this function offline, keeping your seed phrases from ever touching an internet connected device.

So you can take a Jade, Trezor, laptop with Sparrow, phone with Bluewallet and use those seed phrases to create one more robust seedphrase that you can then import into your preferred hardware wallet for use.

I'm not shilling for ColdCard, I'm just providing a good idea that can be used to potentially increase your security and decrease your reliance on any single vendor while providing a potential use case for that ColdCard you already have the will never get used again.

SeedXOR is genuinely a good idea and XOR'ing secrets has been around for a long time. It is also probably more user friendly than rolling dice...maybe.

And honestly it has some really great features that no other ...

2026-08-02T07:06:04Z

In reply to nevent1q…gnge
_________________________

And honestly it has some really great features that no other hardware wallet had. It just sucks that the singular most important feature for a HWW it failed at.

CoinKite couldn't even get HTML right. 😆 #ColdCardStrong ...

2026-08-02T04:18:14Z

CoinKite couldn't even get HTML right. 😆

#ColdCardStrong

For real. I've used four different email addresses with them ...

2026-08-02T04:03:39Z

In reply to nevent1q…2n59
_________________________

For real. I've used four different email addresses with them over the years. I received 4 emails from them tonight.

Prior to them making it their company policy to "purge" emails from their list after however many days, I even reached out to them to request my email be deleted per their recommendation and they "confirmed" for me it was deleted. What a load of crap that was!

I know their were some anecdotal reports of users losing their ...

2026-08-02T03:39:57Z

I know their were some anecdotal reports of users losing their ColdCard funds years ago before all of this came to light.

It makes you wonder, with such a low search space with ColdCard's seed generation, those people that lost funds very likely weren't as a result of an attacker stealing their funds, but very well could've just as easily been a result of a casual end user creating a brand new wallet for themselves with a ColdCard only to find themselves with a new fortune sitting in front of them rather than a new empty wallet. 🤦‍♂️

People are saying to supply your own randomness such as dice ...

2026-08-02T03:27:43Z

In reply to nevent1q…fn6c
_________________________

People are saying to supply your own randomness such as dice rolls, or a photo, or mouse movements etc; but how do you know that your added entropy is being applied properly to the end result key? How do you know your supplied entropy wasn't truncated, or maybe it was never applied after inputted, or maybe your supplied entropy wasn't enough? As an end user, it is almost pretty much impossible to determine if your generated key is truly random if you're just generating one singular key when you don't actually know the full process that generated the key. After all, a ColdCard has its own dedicated hardware for generating random numbers, it just wasn't used.

Randomness isn't a property of any given piece of data. It is a property of the process that was used to generate it and understanding that process is a fundamental limitation for a casual end user.

Of course things like NIST has certifications for entropy designs, but I'm not sure how well that would fit into bitcoin's open source ethos and things like that can quickly become "pay to play." But at least end users can look to certifications for legitimacy easy enough.

Standards are also very important and one of the reasons why BIP-39 is so important. Standards allow you to reproduce something with a different solution entirely. This is why I think BIP-39 passphrases are so important for the end user because it is additional entropy supplied AFTER your hardware has done its work. So as an end user, you can be sure that your additional entropy from your passphrase is being applied to your master key, unlike other emtropy sources that are performed inline by the hardware itself. Though here we run into the problem of making sure the end user actually understands what a good passphrase is as well.

Oooof, @nprofile…cq9v's comment here aged like raw milk. ...

2026-08-01T22:44:14Z

In reply to nevent1q…0m4d
_________________________

Oooof, WhiteRabbit (nprofile…cq9v)'s comment here aged like raw milk. 🤦‍♂️

quoting
nevent1q…tt3v
lol telling N (npub1az9…m8y8) to fuck off is beta. You can hate on the guy all you want but you have to recognize him for what he is - the de-facto standard for secure hardware design. Also the block clock is dope but idk if you own one otherwise you'd know that.

It would look far worse because there'd likely be no common ...

2026-08-01T15:44:21Z

In reply to nevent1q…4hs2
_________________________

It would look far worse because there'd likely be no common denominator between victims. So people would be terrified of their own stash not knowing if they're next or not. At least in this case, the victims all shared a commonality and we knew what it was. This provides a reassurance to others that weren't at risk.

An actual QC attack wouldn't provide that reassurance for anyone.

Devastating is right... #nevent1q…q23j

2026-08-01T02:24:00Z

Devastating is right...

quoting
nevent1q…q23j
Bad entropy attacks are rare but devastating.🪦

Single sig wallets are low-hanging fruit. Multisig setups and passphrases increase security, making brute-force attacks prohibitively difficult.

N (npub1az9…m8y8) , craigraw (npub1hea…g9v2) & Rob1Ham (npub1emd…c9aw) discuss defending against these types of attacks. [BR089]

Congrats to you both! I know it was a long hard journey. Enjoy ...

2026-08-01T02:20:27Z

In reply to nevent1q…ntte
_________________________

Congrats to you both! I know it was a long hard journey. Enjoy being a family together.

I hope the DoJ feels the full wrath of the Streisand effect and ...

2026-07-27T03:06:48Z

I hope the DoJ feels the full wrath of the Streisand effect and GrapheneOS becomes wildly more popular because of this.

https://www.techspot.com/news/113236-us-prosecutors-charge-atlanta-man-after-grapheneos-phone.html

@nprofile…ctjf. It just has so many features that make using ...

2026-07-23T22:12:05Z

In reply to nevent1q…8hfj
_________________________

ZEUS (nprofile…ctjf). It just has so many features that make using bitcoin/lightning on a mobile phone seamless and easy for payments.

Spot on. But even if they enjoyed going to war and voluntarily ...

2026-07-20T16:37:02Z

In reply to nevent1q…nl5y
_________________________

Spot on. But even if they enjoyed going to war and voluntarily participated in war, it is still objectively a poor example of a positive attribute to list for a generation considering how horrible of a thing war is.

You should be able to opt out of advertising to people to send ...

2026-07-03T11:36:55Z

In reply to nevent1q…9f9f
_________________________

You should be able to opt out of advertising to people to send money to you there though.

Nostr event nevent1qqsqqq9g8a6qsenfq2qc3xkd9pnguawc66ktpcazsuljmujrxq7cckczypk9lwaja47r4r0s79ehdtfczea7ly9dxd7se3rdymcv56rzpwd8zqkazat

2026-06-29T23:59:09Z

This would be absolutely terrifying. What an awful tragedy.

Why can't governments just be normal. ...

2026-06-29T13:19:53Z

Why can't governments just be normal.

https://substack.com/@freethinkr273162/note/c-284669361

I'm sure chat-gpt has it all under control.

2026-06-29T13:08:51Z

In reply to nevent1q…4c7p
_________________________

I'm sure chat-gpt has it all under control.

That's what stratumv2 is for. No need to run a node ...

2026-06-28T13:42:09Z

In reply to nevent1q…shv4
_________________________

That's what stratumv2 is for. No need to run a node implementation maintained by a single individual to achieve what you want there.

For real, the one weekend I missed and they hit it! Ugh, I've ...

2026-06-27T22:42:33Z

In reply to nevent1q…z23d
_________________________

For real, the one weekend I missed and they hit it! Ugh, I've been participating in these block parties for so long, but was busy this weekend and forgot to point it to the pool.

The one weekend I was busy and didn't point my miner to the ...

2026-06-27T19:45:10Z

In reply to nevent1q…a206
_________________________

The one weekend I was busy and didn't point my miner to the block party! 😭

https://antoinep.com/posts/relay_policy_drama/

2026-06-27T02:52:57Z

In reply to nevent1q…zzhc
_________________________

https://antoinep.com/posts/relay_policy_drama/

You don't give them an alias for you to go by to make convo a ...

2026-06-26T23:55:44Z

In reply to nevent1q…lyh3
_________________________

You don't give them an alias for you to go by to make convo a little easier?

It is that time of day again where Peter Todd justifies war ...

2026-06-26T19:36:27Z

In reply to nevent1q…cq7u
_________________________

It is that time of day again where Peter Todd justifies war crimes.

Paying taxes isn't justification for being targeted in war. I remember you justifying killing children as well and they don't even pay taxes nor are they responsible in any way for the war crimes of their government. Insidious.

The pendulum will definitely swing more in favor of the attacker ...

2026-06-26T16:02:35Z

In reply to nevent1q…k5fs
_________________________

The pendulum will definitely swing more in favor of the attacker until AI tooling on the defensive side becomes more ubiquitous. More of the same ol' cat and mouse game that has taken place in security for decades.

What is going on in Venezuela is such a tragedy. The images are ...

2026-06-26T15:10:26Z

What is going on in Venezuela is such a tragedy. The images are horrific. They need as much support as they can get. I love that platforms along with bitcoin can get funds directly to the people that need it most. Though sadly, usually what is most needed at times like this is simply more helping hands.

quoting
nevent1q…75m8
Venezuela needs help after the recent earthquakes. https://agora.spot/naddr1qvzqqqyygupzq73s843ddjwj7r9tut98zw3e9ulvfv06hq275c9hnls44j38f3cuqqfhgetjwfjk6mm5dukhvetwv4a82etvvykrc9yj

That's why I specifically mentioned sustainable tree ...

2026-06-26T14:11:10Z

In reply to nevent1q…tqvl
_________________________

That's why I specifically mentioned sustainable tree forestry.

That makes no sense. Unless you don't believe any of this: ...

2026-06-26T11:49:32Z

In reply to nevent1q…en0t
_________________________

That makes no sense. Unless you don't believe any of this:

quoting
nevent1q…2xmk
Fact #1: CO2 radiates heat. This is an observable fact.

Fact #2: The greenhouse gas effect is real due to #1 and many other gases in our atmosphere with similar properties. It is what enables life on our planet to exist.

Fact #3: Atmospheric CO2 levels have risen over 30% in just the last 50 years alone due predominantly to the burning of fossil fuels that resided in their solid and liquid carbon forms in the earth's crust. This is an observable and measurable fact.

Fact #4: The upper atmosphere is cooling while the lower atmosphere is warming. This is an observable and measurable fact.

Fact #5: Night time temperatures are rising faster than day time temperatures. This is an observable and measurable fact.

Fact #6: Facts #4 and #5 wouldn't be true if something such as the sun (or anytjing external to our planet) were the reason why our planet is warming.

Fact #7: We've measured how much external heat radiation our planet receives and how much heat radiation our planet radiates back out to space. Even with the absence of our very real temperature measurements on the surface of our planet, we know and observe that our planet is retaining more of the external heat our planet receives each year.

Fact #8: Due to the above facts, we know that the reason for the warming of our lower atmosphere (an observable fact) is due to the changes in composition of the atmosphere itself.

Even if you wanted to come up with your own theory as to why our planet is warming that doesn't involve humans as the main reason, you'd still need to explain the causes of the very real and observable facts listed above. Human driven climate change as a result of burning fossil fuels is the only theory that does this.

You can argue about the outcomes or potential second order of effects that might result from all of this; such as whether the AMOC is weakening or the timeline for arctic land ice melting, etc.

But arguing that climate change is not real, is not occurring, or that humans are not the main driver is arguing against a mountain of factual and observable evidence. It is akin to arguing that the planet is flat.

As a tennis player myself, it is really something to see pros ...

2026-06-26T06:10:55Z

In reply to nevent1q…3fau
_________________________

As a tennis player myself, it is really something to see pros play at ground level. You can't quite appreciate the power as much when watching from above on TV. At ground level, the power and speed is so much more apparent.

FYI, Burning trees, wood, paper etc doesn't really contribute ...

2026-06-26T06:01:52Z

In reply to nevent1q…2j7k
_________________________

FYI, Burning trees, wood, paper etc doesn't really contribute to climate change anyway or add CO2 to the atmosphere. Trees aren't fossil fuels, which is what we should be worried about. Their carbon just comes from tree growth and those trees take carbon out of the atmosphere during their growth, while burning them just returns that same carbon back. So long as new trees take their place, it is pretty much carbon neutral. So burn away!

Cutting down and burning old growth forests is harmful, but otherwise burning sustainable wood is just fine.

It is why I prefer charcoal grilling. Better taste and more sustainable!

Sounds like a challenge.

2026-06-26T02:24:48Z

In reply to nevent1q…ysus
_________________________

Sounds like a challenge.

Nostr event nevent1qqsqqqryjd0dmlmc0y44rra0guu9a9pwvwl9sfvhej4mxkt8vm5ppuczypk9lwaja47r4r0s79ehdtfczea7ly9dxd7se3rdymcv56rzpwd8zvdyc63

2026-06-26T01:32:28Z

In reply to nevent1q…sd07
_________________________

https://blockspace.media/insight/everything-you-need-to-know-about-the-op_return-data-limit-debate/

Haha, I try not to play that game. Any market price driven by ...

2026-06-26T01:23:47Z

In reply to nevent1q…adn3
_________________________

Haha, I try not to play that game. Any market price driven by leverage will always be a short term price. That leverage will always come due and with it, the price. While it is mind-boggling that the price has come down $67k, I try not to think about my net worth coming down similarly.

For my own sanity, I focus on my net worth at times like this for future planning. My net worth in bear markets highlights true market conviction in what bitcoin is. There is a growing number of people year after year that are choosing to use and hold bitcoin even during the darkest bear markets. It actually brings me solace thinking about that in times like this. Sentiment is extremely bearish and yet here we are at ~$60k.

If there wasn't any collateral damage to keeping it at 83 ...

2026-06-26T01:13:11Z

In reply to nevent1q…umtf
_________________________

If there wasn't any collateral damage to keeping it at 83 bytes, I'd be fine with that. The problem is all about comparative harm and I feel there is far more harm in leaving the limit at 83 bytes than there is in effectively removing it.

It is a shame that the debate has fixated on the monetary use case of bitcoin rather than the technical reasonings for wanting the limit removed to avoid those harmful side effects of not doing so. After all, I don't think there are too many in this debate that don't want bitcoin's use case to be monetary.

I grew up in an Irish catholic family, married a catholic, and ...

2026-06-26T00:26:38Z

In reply to nevent1q…mlqe
_________________________

I grew up in an Irish catholic family, married a catholic, and was married in a catholic church.

Your analogy is faulty and attempts to reframe things based on a strawman argument. v30 proponents never stated their argument was "well, people could already break in, so who cares, let's remove the fence."

It was/is all about comparative harm. This argument has been made countless times and to suggest you haven't heard it before means perhaps you haven't been paying attention. The "gate" wasn't just a leaky gate, it is actively directing activity to a far more harmful path. The entire existence of OP_RETURN came about to allow for provably unspendable outputs to avoid the UTXO set from becoming bloated. The OP_RETURN limit is actively harmful now due to the fact that it directs activity toward the UTXO set which increases the cost of running a bitcoin node (since every node must store the entirety of the set in memory). It also promotes the use of alternative relay networks such as Libre Relay (which is harmfully centralizing). Not to mention the fact that default relay policy should be as close to matching what actually ends up in a block or else it becomes difficult to determine what the fee market is and what the broader mempool looks like. Again, this has all been discussed before and pretending like v30 proponent's arguments were something otherwise is disingenuous.

A chain-split by any other name is still a chain-split.

That doesn't sound very catholic to me. My wife isn't ...

2026-06-25T23:17:31Z

In reply to nevent1q…h4n2
_________________________

That doesn't sound very catholic to me.

My wife isn't vegan. I hate the sin, not the sinner and I've always lived by that. You're free to make whatever decision you like. But frankly, you just sound insufferable at this point and I prefer to not engage with that. I'll debate the technical aspect based on its merit, but I'm not going to refrain from engaging in the rest of that.

Generally game theory is not a safe upgrade mechanism for a trillion+ dollar monetary network. Just ask BCashers how that went for them. But if you'd prefer not to learn lessons from past mistakes, but all means learn them the hard way in 43 days.

Ad hominems won't prevent you being forked off in 43 days.

2026-06-25T22:45:12Z

In reply to nevent1q…fwga
_________________________

Ad hominems won't prevent you being forked off in 43 days.

You will be hardforked from bitcoin nodes running version 25 (the ...

2026-06-25T22:44:22Z

In reply to nevent1q…l9un
_________________________

You will be hardforked from bitcoin nodes running version 25 (the latest version on 10/9/23) in 43 days as well. Your argument is faulty.

Again, as I previously stated, big difference between relay policy and consensus rules.

That is factually incorrect. It is absolutely not the same. The ...

2026-06-25T22:20:50Z

In reply to nevent1q…48xn
_________________________

That is factually incorrect. It is absolutely not the same. The introduction of v30+ running along-side nodes running pre-v30 never introduced the risk of a chain split, which is precisely what BIP-110 does. And it does so with an extremely dangerous activation method (only 55% signaling needed) and with no replay protection as well. It is reckless development, just like running knots is reckless.

Have fun with you're hard fork in 43 days. Tick tock.

You would have to ask Satoshi that. He was the one that put in ...

2026-06-25T21:51:50Z

In reply to nevent1q…zlr3
_________________________

You would have to ask Satoshi that. He was the one that put in the 100kb size limit, which is 1/10th of the block space to prevent any single txn from consuming an entire block.

The weight units introduced with Segwit are just a 4x multiple of both.

Again, it needs to be reiterated that this isn't consensus policy. This is relay policy.

100,000 bytes is an effective removal of the limit since a ...

2026-06-25T21:36:49Z

In reply to nevent1q…xqf5
_________________________

100,000 bytes is an effective removal of the limit since a transaction is capped by 400,000 weight units which would effectively be reached first before that OP_RETURN limit. While it is a limit value, it removes any arbitrary decisioning as far as what the limit should be (counter to your claim). It is effectively a value large enough to be irrelevant.

Keeping an actual limit value in place, however, means less complexity compared with removing it entirely since code paths such as IsStandardTx/IsStandard still function. Also, the -datacarriersize argument is still backward compatible with a limit in place since that argument was not removed either.

Nostr event nevent1qqsqqqywuyaxrwf54d6h0kac76g7u7f902l578fttkpy37d7f7vjjcczypk9lwaja47r4r0s79ehdtfczea7ly9dxd7se3rdymcv56rzpwd8z3vwzjh

2026-06-25T17:46:51Z

In reply to nevent1q…a0wt
_________________________

https://blockspace.media/insight/everything-you-need-to-know-about-the-op_return-data-limit-debate/

https://blog.lopp.net/a-laymans-guide-to-bip-110/

The removal of the limit makes technical sense. The drama in ...

2026-06-25T17:45:01Z

In reply to nevent1q…8cv2
_________________________

The removal of the limit makes technical sense. The drama in response to it is the virtue signaling theater.

lol, only cost $1.5b because it was built with slave labor.

2026-06-25T13:14:10Z

In reply to nevent1q…3jad
_________________________

lol, only cost $1.5b because it was built with slave labor.

Comments submitted by Greg Maxwell to the FCC in regards to their ...

2026-06-25T13:05:35Z

Comments submitted by Greg Maxwell to the FCC in regards to their proposal to enforce KYC requirements for every telecom company. This would be a huge violation of privacy rights for Americans. These comments are extremely well written. Greg Maxwell continues to be on the right side of history and fight for our rights. Thank you!

https://nt4tn.net/FCC-17-59-gmaxwell.pdf

There is already a cap on data use with the block size limit. The ...

2026-06-25T03:02:35Z

In reply to nevent1q…4mtd
_________________________

There is already a cap on data use with the block size limit. The bitcoin blockchain scales linearly and is controlled by that.

People point to the fraud in the "crypto" industry and ...

2026-06-25T02:21:40Z

People point to the fraud in the "crypto" industry and think that the collapses can't/don't happen in TradFi either. But people put their fiat money in traditional or fintech companies that have nothing to do with "crypto" and lose their money there too. The problem is trusting third-parties altogether.

It is also striking to me that a heavy liberal outlet like this can't draw the connection between consumers losing their funds held with third-parties and the clear solution to this that bitcoin provides. Instead, their solution is to put their funds in "brick and mortar" institutions as if that were a solution, when it is all part of the same system. One victim in the video even said he's lost all trust in financial institutions, but can't see the solution to his problem in bitcoin.

https://m.youtube.com/watch?v=hiE7NvONU5U

I like the idea of the blind oracle that Jade uses. You can host ...

2026-06-24T20:42:52Z

In reply to nevent1q…q3xk
_________________________

I like the idea of the blind oracle that Jade uses. You can host your own blind oracle server and not expose it to the public internet. This means that your hardware wallet is effectively a brick outside of your own home. Furthermore, if you ever lose your Jade, you can purge the keys for it on your blind oracle server which then acts like a remote deactivation of the hardware which will allow you to turn it into a brick without needing access to it. Something that no other hardware cold wallet that opts to use a secure element allows for. A very cool and secure technical implementation.

He's so delusional. Can't wait to watch their hardfork ...

2026-06-24T14:13:43Z

In reply to nevent1q…wqcz
_________________________

He's so delusional. Can't wait to watch their hardfork die in 44 days. I'll have my popcorn ready.

Thanks for being so kind. ✌

2026-06-24T10:28:18Z

In reply to nevent1q…y9ek
_________________________

Thanks for being so kind. ✌

It isn't just two weeks when there is no hash power. Bitcoin ...

2026-06-23T20:27:36Z

In reply to nevent1q…r8lz
_________________________

It isn't just two weeks when there is no hash power. Bitcoin operates on block time, we just say two weeks because that's what it averages out to. But in reality, you're waiting for 2016 blocks to pass no matter how long that takes.

What natural cycle is that? Saying it is "natural" ...

2026-06-23T12:11:57Z

In reply to nevent1q…drvs
_________________________

What natural cycle is that? Saying it is "natural" doesn't point to an actual cause, it simply absolves humans without a reason. So what is it?

Ya, ultimately that's just the situation of the market right ...

2026-06-22T23:17:57Z

In reply to nevent1q…sell
_________________________

Ya, ultimately that's just the situation of the market right now for PC gaming. It sucks for gamers for sure. Valve isn't really even making much of anything on these. They're just selling them at cost pretty much. I think they'll sell so long as sales expectations are set appropriately. My Steamdeck I got from the original release is still going strong, so I'll just be sticking with that for now.

This is crazy. Surveillance is about to get far far worse before ...

2026-06-22T22:29:54Z

This is crazy. Surveillance is about to get far far worse before it gets better.

quoting
nevent1q…9jcv
https://www.military.com/dont-like-car-license-plate-readers-invading-your-privacy-its-about-to-get-a-lot-worse

Quite hardcore

In about 47 days, there are going to be a lot of BIP-110 ...

2026-06-22T12:02:41Z

In about 47 days, there are going to be a lot of BIP-110 proponents, that when it ends up inevitably being a hardfork, will say that they were never in support of it. Just like how we have shitcoiners that deny ever being in support of a token that went to zero. Don't let them off easy.

#nevent1q…2xmk

2026-06-22T03:34:14Z

In reply to nevent1q…5tn0
_________________________

quoting nevent1q…2xmk
Fact #1: CO2 radiates heat. This is an observable fact.

Fact #2: The greenhouse gas effect is real due to #1 and many other gases in our atmosphere with similar properties. It is what enables life on our planet to exist.

Fact #3: Atmospheric CO2 levels have risen over 30% in just the last 50 years alone due predominantly to the burning of fossil fuels that resided in their solid and liquid carbon forms in the earth's crust. This is an observable and measurable fact.

Fact #4: The upper atmosphere is cooling while the lower atmosphere is warming. This is an observable and measurable fact.

Fact #5: Night time temperatures are rising faster than day time temperatures. This is an observable and measurable fact.

Fact #6: Facts #4 and #5 wouldn't be true if something such as the sun (or anytjing external to our planet) were the reason why our planet is warming.

Fact #7: We've measured how much external heat radiation our planet receives and how much heat radiation our planet radiates back out to space. Even with the absence of our very real temperature measurements on the surface of our planet, we know and observe that our planet is retaining more of the external heat our planet receives each year.

Fact #8: Due to the above facts, we know that the reason for the warming of our lower atmosphere (an observable fact) is due to the changes in composition of the atmosphere itself.

Even if you wanted to come up with your own theory as to why our planet is warming that doesn't involve humans as the main reason, you'd still need to explain the causes of the very real and observable facts listed above. Human driven climate change as a result of burning fossil fuels is the only theory that does this.

You can argue about the outcomes or potential second order of effects that might result from all of this; such as whether the AMOC is weakening or the timeline for arctic land ice melting, etc.

But arguing that climate change is not real, is not occurring, or that humans are not the main driver is arguing against a mountain of factual and observable evidence. It is akin to arguing that the planet is flat.

You know all those subsidies pale in comparison to the $7 ...

2026-06-22T03:28:39Z

In reply to nevent1q…wkr6
_________________________

You know all those subsidies pale in comparison to the $7 trillion in subsidies that fossil fuels receive globally each year, right? So ya, let's do the same, but also don't forget to get rid of those subsidies too.

Nostr event nevent1qqsqqqywa0eqjjjtju4ea4mvd9g7qua944h25ed7l4rkxeferfascfqzypk9lwaja47r4r0s79ehdtfczea7ly9dxd7se3rdymcv56rzpwd8zzzhv5g

2026-06-20T20:43:21Z

In reply to nevent1q…e3xl
_________________________

When some tells me the chances of mining a solo block with my ...

2026-06-19T15:59:07Z

When some tells me the chances of mining a solo block with my single Bitaxe...

quoting
nevent1q…kz0k

nevent1q…mnrj

Raising the difficulty one bitaxe at a time. 🫡

2026-06-19T15:56:35Z

In reply to nevent1q…3vhw
_________________________

Raising the difficulty one bitaxe at a time. 🫡