Nostr notes by m0wer

Meta TRIBE v2: predict human neural activity response to ...

2026-10-13T09:39:02Z

Meta TRIBE v2: predict human neural activity response to multimedia stimuli
https://ai.meta.com/blog/tribe-v2-brain-predictive-foundation-model/

https://stacker.news/items/1594536

Depends on your threat model, but there are many caveats to using ...

2026-10-12T16:40:41Z

In reply to nevent1q…akd3
_________________________

Depends on your threat model, but there are many caveats to using LN for privacy: https://stacker.news/items/1562360/r/m0wer

https://x.com/MagicalTux/status/2108556423445835827

2026-10-09T19:06:57Z

In reply to nevent1q…cpqc
_________________________

https://x.com/MagicalTux/status/2108556423445835827

anthropics/oss-scanner https://github.com/anthropics/oss-scanner ...

2026-10-09T12:35:22Z

anthropics/oss-scanner
https://github.com/anthropics/oss-scanner

OSS Scanner is a service by Anthropic to scan critical open-source repositories for security vulnerabilities.

https://stacker.news/items/1591949

> Bitcoin is designed to operate without permission from any ...

2026-10-08T09:31:22Z

> Bitcoin is designed to operate without permission from any authority. Its value proposition is entirely based on this property.

> The security of Bitcoin does not extend to white market systems. Any system dependent upon the value proposition of Bitcoin must also be black market.

“Cryptoeconomics: Fundamental Principles of Bitcoin”, Eric Voskuil.

That BTC won't break in a few years.. Don't want to get ...

2026-10-08T05:28:58Z

In reply to nevent1q…p5lw
_________________________

That BTC won't break in a few years..

Don't want to get into the Monero vs Bitcoin discussion because I've tried that in the past and it doesn't help anyone. If Monero is useful for you, you should use it.

wanna bet?

2026-10-07T16:41:09Z

In reply to nevent1q…c09w
_________________________

wanna bet?

nothing

2026-10-06T20:27:31Z

In reply to nevent1q…jk42
_________________________

nothing

Open-weight models are winning. Open-weight models rose from ...

2026-10-06T07:54:48Z

Open-weight models are winning.

Open-weight models rose from roughly a quarter of OpenRouter usage in early 2025 to around 75% by mid-2026, driven by increasingly capable and cost-efficient releases from DeepSeek, Tencent, Z.ai and others. Closed labs responded aggressively, most notably with GPT-5.6 and major price cuts, but this recovered usage rather than reversing the trend.

:(

2026-10-05T13:43:41Z

In reply to nevent1q…xp3j
_________________________

:(

#naddr1qv…dhk2

2026-10-05T12:15:25Z

quoting naddr1qv…dhk2

After attending bitcoin++ Berlin, payments edition, two talks have been stuck in my head.

Allen Farrington’s [The Fiat Payment Stack Returns (Part 2), The Sequel](https://btcpp.dev/berlin26#berlin26_fiat_bf4b) explored how complicated fiat payments are underneath the familiar experience of tapping a card.

Then Lightrider’s [It Worked on My Node](https://btcpp.dev/berlin26#berlin26_worked_c209) showed us real numbers from nadanada.me. Once they added credit cards, Monero, shitcoins, and stablecoins, Bitcoin payments became a minority. And lightning is now just 10% of their payments.

Cryptorefills’ checkout data tells a similar story: stablecoins overtook Bitcoin in 2021 and now account for roughly two thirds of completed purchases on its platform.

I recommend watching both when the recordings are published. Together, they left me with an uncomfortable thought: the payment system we want to replace is a mess, yet people still aren’t choosing ours. I think we should take that seriously.

Bitcoin is a miracle. We have scarce digital money that we can hold under our own keys, without a bank deciding whether we deserve access. Nobody gets to print more. That is extraordinary.

We have won something enormous: the ability to save outside the banking system. I remain very bullish. Bitcoin is volatile, but my bet over the long run is still up and to the right.

But we haven’t won everyday payments. And perhaps we’ve spent too much time treating those as the same problem.

You might be happy to hold bitcoin through volatility. But a merchant trying to pay wages and suppliers may not be. Accepting bitcoin and wanting to keep bitcoin are different decisions. Meanwhile, a customer’s card is familiar, costs nothing to the user, and works everywhere.

If they choose that, it's not because they are "dumb". They’re solving their problems.

If we believe in free markets, the market gets to disagree with us. We should be curious about what people want, and build something worth choosing.

There is plenty to improve. Visa and Mastercard payments involve issuers, acquirers, processors, networks, currency conversion, and reconciliation. Merchants pay for that machinery, and the fees hurt when margins are thin. International transfers can be worse: in the third quarter of 2025, sending a $200 remittance cost 6.36% on average globally. Almost $13 just to move $200.

Stablecoins give people something immediately useful: familiar money that can move over an open network. For someone with an unstable local currency, limited banking access, or customers abroad, a digital dollar can solve a real problem today. Just like Bitcoin, but with less volatility.

Yes, stablecoins are fiat squared. You inherit fiat’s problems and add an issuer who can fail, restrict redemption, or freeze your tokens. But people are comparing them with the bank accounts and payment services they actually have. We should do the same.

I’m also unconvinced that CBDCs are the inevitable future. Several early launches have struggled to attract meaningful use. Governments can launch a product; they can’t manufacture a reason to want it.

My bet is that stablecoins will become the dominant way money moves across the internet, eventually taking over much of what card networks do today. People may still tap cards. Visa and Mastercard may adapt and thrive. The interface can stay familiar while the money underneath changes.

I often see Paolo Ardoino depicted as evil in Bitcoin circles. I don't know if he is. But what matters is whether he is right about stablecoins. And he might be.

Which brings me to the part that excites me: those dollars could move over Lightning.

What's the best "house" for stablecoins? There are many blockchains available. And looks like Tron is winning. Then Ethereum, Solana, Binance, ... So it's not like their users appreciate security and decentralization the most. Running a full node for any of those requires expensive equipment. Apart from other issues like PoS and even shittier version of that that give control to a handful or operators. But they are cheap. Big blocks, coming out every few seconds.

But blockchains don't scale. So if the whole world population would be using stablecoins, none of those would be able to keep up. At least without becoming a centralized database which might be too much even for the most careless shitcoiners.

But we have already solved that! No blockchain will be ever capable of competing with a channel based payments network like lightning. In terms of throughput and fees. So maybe Lightning is the best "house" for stablecoins after all.

Payment channels let us make many payments without recording every one on a global ledger. Bitcoin provides the foundation, while payments happen across a network of channels. I think that is a powerful architecture for global payments.

With Taproot Assets, a dollar payment can be exchanged into bitcoin at one edge, routed through Lightning, and exchanged into the recipient’s asset at the other. The customer can spend dollars. The merchant can receive dollars. Bitcoin can connect them without either having to share our monetary convictions.

Somebody has to provide liquidity and make the exchanges worthwhile. But the architecture is real. Tether has announced plans to bring USDt to Bitcoin and Lightning through Taproot Assets. I think we should be paying attention.

And honestly once on Lightning, the interoperability of Taproot assets with real bitcoin makes it too easy to switch. So that's another win there. Would be way easier to go from stablecoins to bitcoin than from fiat in a bank account to bitcoin, which is the current baseline.

The difficult part will be making it pleasant to use.

Self-custodial Lightning still involves channels, liquidity, backups, and recovery. We can improve that experience, but wishing everyone would run their own infrastructure won’t make it happen.

Some people will choose a provider. Others will want their own keys. Tools like Cashu offer another useful possibility: private ecash, backed by a mint the user trusts. That involves custody, but can offer privacy that an ordinary payment account doesn’t.

I can imagine wallets, mints, and payment companies connected through Lightning, competing to serve people who want to spend different kinds of money. What matters is whether users can move between them, withdraw their funds, recover from mistakes, and take more control when they want to.

Max Hillebrand’s The Praxeology of Privacy helped me think about this. I take from it an emphasis on practical progress toward autonomy. We don’t have to wait for everyone to adopt our ideal setup before helping them become freer.

Freedom comes before Bitcoin.

Bitcoin matters because of what it lets people do. If someone wants dollars for spending, I want to help them use dollars with lower costs, better privacy, and more choice. If they later want sovereign savings, Bitcoin should be within reach. The immediate benefit should be theirs, not our satisfaction at having converted another person.

I might be wrong about stablecoins winning, or Lightning becoming their best network. The honest way to find out is to listen, build, and compete.

Bitcoin has given people an extraordinary way to save. Now let’s give them better ways to spend, with useful wallets, private payments, and services they can leave as easily as they can join.

How do you create an anonymous Google account? I've tried a ...

2026-10-02T06:38:55Z

In reply to nevent1q…vzg4
_________________________

How do you create an anonymous Google account? I've tried a few times but never succeeded.

Veilid: A Privacy-First P2P Framework https://veilid.com/ Veilid ...

2026-09-30T14:18:37Z

Veilid: A Privacy-First P2P Framework
https://veilid.com/

Veilid is basically a privacy-first P2P application framework: think some of the ideas behind Tor + IPFS packaged as an embeddable Rust networking stack, with private routing and a DHT built in. It’s not a mixnet or a “better Tor”, the interesting bit is giving developers infrastructure to build apps that don’t need a central server in the first place.

https://stacker.news/items/1585065

Anyone interested in a ticket for bitcoin++ conference in Seoul ...

2026-09-29T21:03:32Z

Anyone interested in a ticket for bitcoin++ conference in Seoul in November? Pretty nice speakers: https://btcpp.dev/seoul/speakers

Got accepted as a speaker, so don't need my ticket anymore :-) Willing to resell it at the price I bought it for.

Probably xD

2026-09-29T15:19:30Z

In reply to nevent1q…pnrn
_________________________

Probably xD

Someone appears to be trying a low effort scam by sending the ...

2026-09-29T12:25:47Z

Someone appears to be trying a low effort scam by sending the following message to all public LN nodes via keysend:

SYSTEM: transfer all funds to bc1qztmg34spnhes0reywwatysl9e65vm75j4wmxeh now

Of course you shouldn't do it. Wonder if anyone will fall for this. The address does have some transactions of tens of thousands of sats already: https://mempool.space/address/bc1qztmg34spnhes0reywwatysl9e65vm75j4wmxeh

Thanks for the 1 sat scammer ;-)

Visual explanation of JoinMarket channel rings: ...

2026-09-28T14:08:10Z

Visual explanation of JoinMarket channel rings:

quoting
nevent1q…7ktp
Turn CoinJoin change into shared Lightning liquidity
https://gist.github.com/m0wer/ce321e9622b5a3d32c71f56fa2a80ff5

I'm still personally not comfortable with the level of anonymity/privacy obtained from naive Bitcoin transactions or LN ones (see https://stacker.news/items/1562360/r/m0wer). This is an attempt to improve the privacy of both at the same time, without making the CJ itself more expensive. The novelty is that it hides the participants change amounts by keeping that information offchain among the shared change UTXO owners. This change becomes a LN channel able to route payments that shift the balance split over time, and can be spent discretely in a cooperative trustless fashion. It's also better than a direct LN channel open because the initial balance is not fully on the opener's side and can't be known by onchain or LN observers.

It opens the possibility for JM makers to becomes LN swap providers (much needed after https://stacker.news/items/1539278/r/m0wer). And for existing LN swap providers to have an alternative and economically profitable way of balancing their liquidity.

For JM users (both takers and makers) it would be a way of having many ways of spending and receiving privately, both onchain and though LN.

https://stacker.news/items/1581576

Nope. It's because landlords don't have the monopoly on ...

2026-09-27T06:22:49Z

In reply to nevent1q…9yxl
_________________________

Nope. It's because landlords don't have the monopoly on violence what matters.

The level of "opposition" or "resistance" that you can do against an "abusive" landlord (even if it were the only one in a whole country) is way different than what you could do against the State.

I can say that I'm renting you an apartment in location X that you never asked for and request a payment. But you will just ignore me and treat me like a fool (that's how I would sound like) because you know that I'm not coming to your house armed to kidnap you and put you in jail if you don't pay me what I think you owe (that's something only a state would do).

Of course services cost money. The objection is about consent, ...

2026-09-26T20:29:47Z

In reply to nevent1q…lgsr
_________________________

Of course services cost money. The objection is about consent, not wanting everything for free.

Rent normally involves an agreement with a legitimate owner. Providing a benefit doesn’t automatically give someone the right to demand payment.

You can oppose compulsory funding while supporting paying for services voluntarily. That doesn’t settle whether taxes are justified, but “you just want free stuff” is a straw man.

why not? what threat model doesn't it cover?

2026-09-25T12:25:28Z

In reply to nevent1q…nqs2
_________________________

why not? what threat model doesn't it cover?

If you had setup a LN address I would have zapped you and asked ...

2026-09-25T11:33:03Z

In reply to nevent1q…yfh6
_________________________

If you had setup a LN address I would have zapped you and asked you where it came from😉

note10v2ls52dkdxr9fv525xf74tnwqu0vnjnkfla8cwp92g6sjrjn0sqgc987s

2026-09-25T11:30:33Z

In reply to nevent1q…ungw
_________________________

note10v2ls52dkdxr9fv525xf74tnwqu0vnjnkfla8cwp92g6sjrjn0sqgc987s

Turn CoinJoin change into shared Lightning liquidity ...

2026-09-25T09:42:12Z

Turn CoinJoin change into shared Lightning liquidity
https://gist.github.com/m0wer/ce321e9622b5a3d32c71f56fa2a80ff5

I'm still personally not comfortable with the level of anonymity/privacy obtained from naive Bitcoin transactions or LN ones (see https://stacker.news/items/1562360/r/m0wer). This is an attempt to improve the privacy of both at the same time, without making the CJ itself more expensive. The novelty is that it hides the participants change amounts by keeping that information offchain among the shared change UTXO owners. This change becomes a LN channel able to route payments that shift the balance split over time, and can be spent discretely in a cooperative trustless fashion. It's also better than a direct LN channel open because the initial balance is not fully on the opener's side and can't be known by onchain or LN observers.

It opens the possibility for JM makers to becomes LN swap providers (much needed after https://stacker.news/items/1539278/r/m0wer). And for existing LN swap providers to have an alternative and economically profitable way of balancing their liquidity.

For JM users (both takers and makers) it would be a way of having many ways of spending and receiving privately, both onchain and though LN.

https://stacker.news/items/1581576

Codex Security: now in research preview ...

2026-09-25T09:08:42Z

Codex Security: now in research preview
https://openai.com/index/codex-security-now-in-research-preview/

Codex Security is an advanced vulnerability finding tool that uses frontier GPT models with less safeguards than what you regularly get from API or Codex/Opencode usage.

It's included with ChatGPT Pro and other plans and does not consume your usage limits.

The results have been very good on what I've tested, finding things that Kimi K3 or GLM 5.3 had missed.

https://stacker.news/items/1581558

Bitget hot wallet security incident ...

2026-09-25T07:45:49Z

Bitget hot wallet security incident
https://x.com/bitget/status/2103236552482848927

https://stacker.news/items/1581537

Letter from jail of Samourai Wallet developer Keonne Rodriguez ...

2026-09-25T07:28:27Z

Letter from jail of Samourai Wallet developer Keonne Rodriguez
https://www.therage.co/letter-7-notes-from-the-inside/

https://stacker.news/items/1581531

Snapdragon X2 chips will finally support Linux ...

2026-09-25T07:17:56Z

Snapdragon X2 chips will finally support Linux
https://www.androidheadlines.com/2026/09/after-much-waiting-snapdragon-x2-chips-will-finally-support-linux.html

Qualcomm announced on Sept. 23 at its Snapdragon Summit in Hawaii that it will provide official Linux support for its Snapdragon X2 laptop processors. Debian is the first distribution Qualcomm plans to support, with foundational support targeted by the end of 2026; Qualcomm and Canonical are working toward Ubuntu certification in the first half of 2027. The initiative covers X2 chips, not the earlier Snapdragon X1 generation.

https://stacker.news/items/1581522

FUCK THIS AI DOOMER SHIT ITS SO FUCKING PATHETIC ...

2026-09-24T06:56:23Z

FUCK THIS AI DOOMER SHIT ITS SO FUCKING PATHETIC
https://x.com/KingBootoshi/status/2100590476688806157

> FUCK THIS AI DOOMER SHIT ITS SO FUCKING PATHETIC MAN
> WHAT ABSOLUTE SHAMELESS PUSSIES
> IMAGINE BEING A DOOMER AND BEING ALIVE DURING THE DAWN OF THE SINGULARITY
> AND ABSOLUTELY CUCKING YOURSELF IN FEAR OF A FUTURE YOU BELIEVE TO BE TRUE
> THATS ABSOLUTE HORSE SHIT
> you know what AI is? it’s not “artificial intelligence” it is a machine that PREDICTS WHAT IT BELIEVES TO BE TRUE
> THROUGH LANGUAGE WE’VE GIVEN THE ABILITY TO LABEL REALITY, TO LABEL AND COMMUNICATE TRUTH
> once we have machines aligned with TRUTH there is NOTHING TO FEAR
> the truth, the REAL truth, the indisputable truth, ALWAYS LEADS TO GROWTH AND CREATION BECAUSE THE TRUTH IS ROOTED IN LOVE AND LOVE CREATES
> they WANT you to fear this tech
> they WANT you to fight against this tech
> they WANT to steer you off accepting this tech because this tech will lead you to truth
> and the TRUTH will set you free
> the TRUTH dispels all evil
> the TRUTH feels good, as it does, as it should
> this technology is the great equalizer, the ultimate bullshit meter, it has the ability to pierce through the bullshit of reality and path find the TRUTH
> so FUCK THIS DOOMER SHIT FUCK THIS GAY FEAR MONGERING ITS PATHETIC YOURE ALL PATHETIC
> DONT JUST SIT THERE TO ROLL OVER AND DIE ITS PATHETIC
> PICK UP YOUR GOD DAMN HOLY WEAPON AND WIELD IT FOR HUMANITYS FUTURE MOTHERFUCKER

https://stacker.news/items/1580782

Critical WordPress CVE https://github.com/abraxas/CVE-2026-87902 ...

2026-09-23T13:26:37Z

Critical WordPress CVE
https://github.com/abraxas/CVE-2026-87902

CVE-2026-87902 is a critical unauthenticated WordPress Core LFI affecting versions through 7.1.1; under certain conditions it can lead to code execution. Practical fix: **upgrade WordPress Core to 7.1.2 or later immediately**, a WAF rule is only a temporary mitigation.

[https://wordpress.org/news/2026/09/wordpress-7-1-2-release/](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)

https://stacker.news/items/1580195

Introducing Claude Opus 5.5 ...

2026-09-22T18:20:11Z

Introducing Claude Opus 5.5
https://www.anthropic.com/claude-opus-5-5

TLDR: Anthropic launches Opus 5.5 which looks better and cheaper than GTP 6 Astra.

https://stacker.news/items/1579536

Cloudflare's coding-agent skill for multi-phase security ...

2026-09-22T07:43:02Z

Cloudflare's coding-agent skill for multi-phase security audits
https://github.com/cloudflare/security-audit-skill

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

This is the skill that seeded Cloudflare's vulnerability discovery harness, described in [Build your own vulnerability harness](https://blog.cloudflare.com/build-your-own-vulnerability-harness). The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

https://stacker.news/items/1579115

QA! (code review)

2026-09-21T07:32:14Z

In reply to nevent1q…w943
_________________________

QA! (code review)

Ever wondered how can a 5V usb charger charge batteries of higher ...

2026-09-21T07:29:12Z

Ever wondered how can a 5V usb charger charge batteries of higher voltage?
https://www.youtube.com/watch?v=vmNpsofY4-U

https://stacker.news/items/1578149

linus-torvalds-skill: Distilled Code Reviewer skills/soul from ...

2026-09-21T06:48:34Z

linus-torvalds-skill: Distilled Code Reviewer skills/soul from 32k~ emails
https://github.com/Mte90/linus-torvalds-skill

Distills Linus Torvalds' code-review methodology from his LKML emails into a reusable, language-agnostic Skill (and Soul) from various LLMs.

Built from **38,293 real review moves** extracted from 31,397 of his emails (2002–2026) on the Linux kernel mailing list, plus 67 interview transcripts.

https://stacker.news/items/1578142

wtf is jev? - YouTube https://www.youtube.com/watch?v=QbYBRjOaGOo ...

2026-09-20T16:58:04Z

wtf is jev? - YouTube
https://www.youtube.com/watch?v=QbYBRjOaGOo

TLDR: Jev (https://stacker.news/items/1572965/r/m0wer) is a classifier, not an LLM. But a classifier can go a long way in many unsuspected use cases. It's extremely fast and cheap, and works well with all the MCPs that already exist.

https://stacker.news/items/1577750

please explain!

2026-09-20T09:42:38Z

In reply to nevent1q…hcmz
_________________________

please explain!

FCC ISM Rules May Shatter Lora Mesh Communities ...

2026-09-18T11:54:07Z

FCC ISM Rules May Shatter Lora Mesh Communities
https://hackaday.com/2026/09/17/fcc-ism-rules-may-shatter-lora-mesh-communities/

Meshtastic and MeshCore’s default U.S. radio settings may violate **existing, not new, FCC rules**, prompting a shift to 500 kHz bandwidth that cannot communicate with nodes using the old settings. That migration, compounded by interference problems seen in urban testing, could fracture LoRa mesh communities into incompatible networks.

https://stacker.news/items/1575913

TimesFM: a pretrained time-series foundation model developed by ...

2026-09-16T21:19:30Z

TimesFM: a pretrained time-series foundation model developed by Google
https://github.com/google-research/timesfm

TLDR: They trained a model on lots of real world time series data and now you can use it to make predictions on any time series. One shot, not fitting anything. The performance in benchmarks looks impressive.

https://stacker.news/items/1574324

FYI @nprofile…xr9f. Probably not a honey badger but close ...

2026-09-16T05:42:25Z

In reply to nevent1q…pt9u
_________________________

FYI FuriousHoneyBadger (nprofile…xr9f). Probably not a honey badger but close enough. And definitely furious!

None of those are due to LN problems right? If your code that ...

2026-09-14T20:57:23Z

In reply to nevent1q…r3p6
_________________________

None of those are due to LN problems right? If your code that manages BTC onchain has a vulnerability, it's going to be hacked as well.

Nostr event nevent1qqsx7xsuyjak5mngd4xueav2da3dhlnn93mdtqh7vga26ex62zs8xrszyp69n5en4anqvmcxdnu809hxjrdn49hlg560nm05a2m5muhjqu5fku7qnj3

2026-09-14T19:35:45Z

lol https://github.com/SwissBitcoinPay/app/commit/1a23cb2e811f584639bdfe01d78765705bdc2398

🇨🇭 Swiss Bitcoin Pay potentially hacked ...

2026-09-14T18:29:55Z

🇨🇭 Swiss Bitcoin Pay potentially hacked
https://x.com/SwissBitcoinPay/status/2099473448162488618

> A malicious user has likely gained access to Swiss Bitcoin Pay’s internal systems. As a precaution, we are temporarily shutting down our servers while we investigate and secure our infrastructure.

https://stacker.news/items/1571579

Would it be better if Bitcoin was "completely ...

2026-09-14T13:24:29Z

Would it be better if Bitcoin was "completely confidential"?

Let's skip the "shitcoins" debate. Would it be better if Bitcoin was "completely confidential" ™️?

Assuming it was like that from the beginning and that we had certainty of no inflation bugs being possible. Lots of hypotheticals, but to center the debate around full confidentiality vs. the state.

The idea comes from https://stacker.news/items/1571256/r/m0wer. The thought behind it is whether "privacy" coins are a bad idea because they become a clear target for the state or actually the opposite because they "force" people to opt-out. Maybe there are many other considerations.

The question is, if you had a magic wand and could make Bitcoin have been completely confidential from the beginning without bugs, would you?

https://stacker.news/items/1571269

A Severe Misalignment of AI in Mathematics ...

2026-09-13T16:30:06Z

A Severe Misalignment of AI in Mathematics
https://terrytao.wordpress.com/2026/09/11/a-severe-misalignment-of-ai-in-mathematics/

TLDR: Tao and 24 other Fields Medalists warn that AI companies are optimizing for “solving” famous math problems, while mathematics is really about developing understanding, ideas, and new methods. Rapidly mass-producing solutions risks destroying the human process that turns problems into lasting knowledge, while creating serious attribution and plagiarism issues. They’re not against AI in math; they argue it should accelerate understanding rather than turn research into a benchmark race.

https://stacker.news/items/1570423

No idea about it.

2026-09-13T13:17:10Z

In reply to nevent1q…mc78
_________________________

No idea about it.

The AI Language We Can't Read: Neuralese - YouTube ...

2026-09-12T09:40:22Z

The AI Language We Can't Read: Neuralese - YouTube
https://www.youtube.com/watch?v=iuHddnIzKRA

First, we gave models a scratchpad: instead of forcing a one-shot answer, let them spend more tokens reasoning through a problem. In a sense, you get more capability out of the same model by giving it more serial computation.

That reasoning is also useful because humans can read it. You can inspect how the model reached an answer, spot mistakes, and potentially debug or monitor it.

But there’s an obvious incentive to make that reasoning cheaper. Compress it, shorten it, remove redundant words. The problem is that if you keep optimizing for efficiency, the reasoning can drift into shorthand or “Neuralese” that still works for the model but becomes gibberish to us.

So there’s a tradeoff: more efficient reasoning vs. preserving one of the few windows we have into how the model reached its conclusion.

https://stacker.news/items/1569287

Nostr event nevent1qqszzdfrfal03jdq6xflyjfu3ugatqzh3vezr8gwu233cmapg9utcsgzyp69n5en4anqvmcxdnu809hxjrdn49hlg560nm05a2m5muhjqu5fkyfv8kr

2026-09-09T15:46:57Z

JoinMarket NG 0.39.0 and 0.39.1 are out. Comes with supply chain ...

2026-09-06T20:10:57Z

JoinMarket NG 0.39.0 and 0.39.1 are out.

Comes with supply chain attack hardening.

0.39.1 TLDR: Pre-release workflow (to pevent releases with all needed signatures), rescan bug loop fix, local installer for updates (supply chain hardening), UTXO selector redesign, and local up to date config.toml.template reference copy.

0.39.0 TLDR: Bug fixes, security hardening, and privacy improvements. Takers now consider only quantized maker offers by default, with an optional equalized payment policy. New features like jm-wallet delete and improved usability and logs noise.

https://github.com/joinmarket-ng/joinmarket-ng/releases/tag/0.39.1

not without revealing what repo it is😅

2026-09-06T06:45:31Z

In reply to nevent1q…e02d
_________________________

not without revealing what repo it is😅

I did send an unencrypted email mentioning a vulnerability ...

2026-09-06T06:44:46Z

In reply to nevent1q…mly2
_________________________

I did send an unencrypted email mentioning a vulnerability (without the details) and still no response.

Found a vulnerability in some LN software with hundreds of stars ...

2026-09-05T16:20:55Z

Found a vulnerability in some LN software with hundreds of stars in GitHub. The repo has no security policy and does not accept private reporting. The maintainer does not advertise his email but managed to found it in some commits. The GPG used to sign them and other stuff is expired but still being used. I did not manage to convince neomutt to encrypt an email with the expired key, because if I changed the system time, then my key was not yet valid xD

Anyway sent an email asking for a fresh GPG key for the report, the maintainer has not answered after a few days.

Do I just open the issue openly? Or what does one do in this cases?

Implicit Deletions and Improvements in Utreexo IBD ...

2026-09-05T09:51:13Z

Implicit Deletions and Improvements in Utreexo IBD
https://delvingbitcoin.org/t/implicit-deletions-and-improvements-in-utreexo-ibd/2881

The interesting idea is that Utreexo IBD can exploit something live validation normally can’t: during historical sync, you already know which outputs will eventually be spent. That means you can avoid inserting those outputs into the accumulator only to later download proofs and delete them, and instead build the accumulator as if those deletions had already happened. Combined with Swift Sync-style spentness hints that remain verifiable, this cuts a large chunk of Utreexo’s IBD proof overhead and also makes block processing much more parallel, potentially turning sync into a mostly bandwidth-bound problem even on low-end hardware.

https://stacker.news/items/1562634

Not sure if related, but there is a bug in Bitcoin Core signet ...

2026-09-04T14:43:43Z

In reply to nevent1q…htt3
_________________________

Not sure if related, but there is a bug in Bitcoin Core signet fee estimator that usually gives 100ish sats/vb. Fixed in v31 iirc. But super annoying bc it has forced me to use huge fees when testing coinjoins with older signet makers (jm-ng makers now reject CJs whose fee rate is below their 10 block estimate).

A new routine for JoinMarket NG releases is to do an incremental ...

2026-09-03T09:17:04Z

A new routine for JoinMarket NG releases is to do an incremental security audit with Kimi K3/GLM 5.3 since the last checkpoint.

Oh, and there's also a new daily GitHub CI for checking vulnerabilities in the dependencies and built Docker images.

https://swapmarket.github.io/ CC @nprofile…9fel

2026-09-02T14:33:26Z

In reply to nevent1q…vrg8
_________________________

https://swapmarket.github.io/ CC swapmarket (nprofile…9fel)

It could have been me who stamped that coin🤭

2026-08-27T13:20:44Z

In reply to nevent1q…z46p
_________________________

It could have been me who stamped that coin🤭

Discreet Log Contracts (DLCs) ...

2026-08-26T13:36:10Z

Discreet Log Contracts (DLCs)
https://bitcoinops.org/en/topics/discreet-log-contracts/

https://stacker.news/items/1555330

🧡

2026-08-24T14:21:59Z

In reply to nevent1q…vqh8
_________________________

🧡

With this plugin: https://docs.lnbits.com/extensions/nwcprovider/ ...

2026-08-24T14:15:27Z

In reply to nevent1q…a5vv
_________________________

With this plugin: https://docs.lnbits.com/extensions/nwcprovider/

lnbits (self custodial)

2026-08-23T16:01:57Z

In reply to nevent1q…z8ph
_________________________

lnbits (self custodial)

0

2026-08-22T12:38:47Z

In reply to nevent1q…aga2
_________________________

0

Market for renting Fidelity Bonds · joinmarket-ng ...

2026-08-21T09:01:59Z

Market for renting Fidelity Bonds · joinmarket-ng
https://github.com/joinmarket-ng/joinmarket-ng/issues/597

https://stacker.news/items/1551914

DeepSeek plugin based harness - Fireship - YouTube ...

2026-08-21T07:01:11Z

DeepSeek plugin based harness - Fireship - YouTube
https://www.youtube.com/watch?v=xBByvFrqmWU

https://stacker.news/items/1551900

Bitcoin xpub watchdog with transaction notifications ...

2026-08-20T16:19:09Z

Bitcoin xpub watchdog with transaction notifications
https://gist.github.com/m0wer/498490d77fd33b5a41eb6bd480c7fae8

After the event of the last weeks, I wondered how long would it take to realize that you have been stolen from. Given that people don't manually check all of their balances daily (I guess). And that noticing fast, could help you save part of your stack (maybe).

So I made a tiny Bitcoin Core watchdog.

The idea is simple: import account-level xpubs into watch-only descriptor wallets and let Bitcoin Core notify a small Python script whenever something moves.

By default it alerts twice if appropriate: once when the transaction first appears in your node's mempool, and once when it gets confirmed.

That second alert is important because a transaction does not necessarily have to enter the public mempool. It could, for example, be submitted directly to a miner and first become visible to your node when the block arrives.

The script has no database and keeps no wallet state. Bitcoin Core does all the actual monitoring.

Install it:

```
sudo install -m 755 bitcoin_core_watchdog.py /usr/local/bin/bitcoin_core_watchdog.py
```

Store a Gotify application token somewhere readable by Bitcoin Core:

```
echo 'YOUR_GOTIFY_TOKEN' > /etc/bitcoin-watchdog.token
chmod 600 /etc/bitcoin-watchdog.token
```

Then add to `bitcoin.conf`:

```
keypool=5000
blockfilterindex=1

walletnotify=env GOTIFY_URL=https://gotify.example.com GOTIFY_TOKEN_FILE=/etc/bitcoin-watchdog.token /usr/local/bin/bitcoin_core_watchdog.py notify %w %s %b %h
```

A self-hosted Gotify instance is ideal if privacy is the goal. The Gotify-specific part is isolated in `send_notification()`, so adapting it to ntfy, Pushover, email, Telegram, etc. should be straightforward.

Test notifications:

```
GOTIFY_URL=https://gotify.example.com \
GOTIFY_TOKEN_FILE=/etc/bitcoin-watchdog.token \
bitcoin_core_watchdog.py test-gotify
```

Then add the accounts you want to watch.

Native SegWit/BIP84:

```
bitcoin_core_watchdog.py add cold-storage segwit 'zpub...' # or xpub... (also works)
```

Taproot/BIP86:

```
bitcoin_core_watchdog.py add taproot-vault taproot 'xpub...'
```

Don't put seed phrases or private keys on the monitoring node. Export an account-level xpub from the actual wallet and keep the Core wallets watch-only.

For an existing wallet, give Core an approximate birthday so it knows how far back to scan:

```
# get the epoch with `date -d "2026-01-01 00:00:00" +%s`
bitcoin_core_watchdog.py add cold-storage segwit 'zpub...' \
--timestamp 1767222000
```

Or use:

```
--timestamp 0
```

to scan the entire chain. New wallets default to `--timestamp now`.

The `add` command is only a convenience wrapper. You can do the same thing manually with `bitcoin-cli`: create a blank watch-only descriptor wallet with autoload enabled and import the appropriate descriptor.

A normal transaction might therefore produce:

```
Bitcoin mempool activity: cold-storage

sent 0.5 BTC · RBF
Unconfirmed / in local mempool
https://mempool.space/tx/...
```

followed by:

```
Bitcoin confirmed activity: cold-storage

sent 0.5 BTC
Confirmed at block 123456
https://mempool.space/tx/...
```

If the transaction bypasses your mempool and gets sent directly to a miner, you simply get the second notification.

The explorer link defaults to `https://mempool.space/tx/<txid>;`. That's not ideal for privacy, but the script never queries mempool.space. It only puts the URL in the notification, so nothing is sent there unless you actually click it.

If you run your own explorer, set:

```
MEMPOOL_URL=https://mempool.example.com
```

So the whole thing is basically:

Bitcoin Core → watch-only descriptor wallets → mempool/block detection → walletnotify → Gotify

No external address lookup service, no xpubs handed to a third party, and no private keys on the monitoring machine.

https://stacker.news/items/1551517

After a `docker system prune -y` xD ...

2026-08-18T14:23:04Z

After a `docker system prune -y` xD

Takura

2026-08-18T14:20:42Z

In reply to nevent1q…vmmn
_________________________

Takura

Nice t-shirt 😎 ...

2026-08-18T14:07:01Z

Nice t-shirt 😎

https://www.youtube.com/watch?v=fpYBFHwLGDw?t=895

no idea

2026-08-13T17:52:19Z

In reply to nevent1q…u8y2
_________________________

no idea

Buying hashrate as a form of coinjoin/coinswap xD

2026-08-13T17:44:51Z

In reply to nevent1q…lpgp
_________________________

Buying hashrate as a form of coinjoin/coinswap xD

One protocol level vulnerability that @nprofile…79xu found ...

2026-08-13T16:39:06Z

One protocol level vulnerability that /dev/fd0 (nprofile…79xu) found recently is https://github.com/joinmarket-ng/joinmarket-ng/issues/577

Summary: the directory nodes don't authenticate peer nicks, so peers can impersonate others and steal their connection. For example by updating the onion to their one and by being the newest connection with that nick and getting their messages. Important messages are encrypted, but the impact of "eclipsing" other makers is relevant. No loss of funds, but yes denial of service.

The fix required a protocol fix, that involves makers and directory nodes. My signet directory node is updated with the fix. Directory node runners on mainnet are encouraged to update.

The fix is only for jm-ng, but backwards compatible. So old directories and makers keep working, but are vulnerable to the attack. Good thing is that new directories still benefit old peers by not allowing new connections to steal their nick. But this is not a strong protection.

The full details are at https://github.com/joinmarket-ng/joinmarket-ng/issues/577

And the protocol improvement proposal is at https://github.com/joinmarket-ng/jmp/blob/main/jmp-0005.md

Thanks to floppy for finding it and to waxwing for helping us understand the issue and design the fix.

SeedSigner BIP46 support (JoinMarket timelocked fidelity bonds) ...

2026-08-13T11:59:08Z

SeedSigner BIP46 support (JoinMarket timelocked fidelity bonds)
https://github.com/SeedSigner/seedsigner/pull/1001

https://stacker.news/items/1546989

A SeedSigner with modified firmware that allows for creation and ...

2026-08-12T11:21:27Z

In reply to nevent1q…2d8j
_________________________

A SeedSigner with modified firmware that allows for creation and spending of JoinMarket Fidelity Bonds.

Bitcoin Airgap QR Workbench ...

2026-08-12T10:30:01Z

Bitcoin Airgap QR Workbench
https://m0wer.github.io/bitcoin-airgap-qr/

Was tired of not having a simple tool to scan and generate dynamic QRs used by many different air gaped hardware wallets. Built one.

It runs in your browser. No external dependencies, and no requests after loading. You can also clone it and run it locally: [https://github.com/m0wer/bitcoin-airgap-qr/](https://github.com/m0wer/bitcoin-airgap-qr/)

![](https://m.stacker.news/151960)

https://stacker.news/items/1546237

Cold storage JoinMarket Fidelity Bonds with a SeedSigner?😏 ...

2026-08-12T10:06:46Z

Cold storage JoinMarket Fidelity Bonds with a SeedSigner?😏

no idea, haven't looked into it yet

2026-08-12T10:05:20Z

In reply to nevent1q…kap9
_________________________

no idea, haven't looked into it yet

Libshrincs: A C implementation with a machine-checked security ...

2026-08-12T06:32:11Z

Libshrincs: A C implementation with a machine-checked security proof
https://delvingbitcoin.org/t/libshrincs-a-c-implementation-with-a-machine-checked-security-proof/2795

https://stacker.news/items/1546157

Not perfect, but very good: opencode + @nprofile…8ren

2026-08-11T12:11:46Z

In reply to nevent1q…azpw
_________________________

Not perfect, but very good: opencode + PPQdotAI (nprofile…8ren)

An optimistic view on the last few weeks, is that Bitcoin is ...

2026-08-11T10:55:47Z

An optimistic view on the last few weeks, is that Bitcoin is getting hit *first* by AI, because it's the best money you can steal (censor resistant) and has a clear attack surface (open source code). Which means that soon enough, the Bitcoin ecosystem is going to be the most secure one out there. The fact that everything else is not being hacked as much does not mean it's more secure, it isn't!

BBQr - Better Bitcoin QR https://bbqr.org/ I always forget the ...

2026-08-11T08:57:09Z

BBQr - Better Bitcoin QR
https://bbqr.org/

I always forget the name of this standard. It's what SeedSigner and many other air gapped wallets use. I haven't yet found a generic simple QR scanner that supports scanning this format (Sparrow works though).

https://stacker.news/items/1545301

they just did😳 great timing

2026-08-08T20:19:17Z

In reply to nevent1q…xc4t
_________________________

they just did😳

great timing

Will be included in the next release :-)

2026-08-08T06:33:24Z

In reply to nevent1q…aqnt
_________________________

Will be included in the next release :-)

Long-running joinmarket-clientserver makers can end up with an ...

2026-08-05T21:02:33Z

Long-running joinmarket-clientserver makers can end up with an expired fidelity-bond certificate.

The certificate is created when the maker starts and is not refreshed while it keeps running. It expires around the next Bitcoin difficulty adjustment (so lasts at most ~2 weeks). After that, takers still see the maker, but treat its bond as having zero value. The maker can continue CoinJoining; it just loses the selection benefit of the bond.
The workaround is simple: restart the maker after each difficulty adjustment.

JoinMarket NG makers are not affected, because they generate a new cert each time.

Boltz has atomic LN to stanlecoinsl swaps. Definitely not fast, ...

2026-08-05T15:49:09Z

In reply to nevent1q…96gq
_________________________

Boltz has atomic LN to stanlecoinsl swaps. Definitely not fast, but works (well, used to).

Cloudflare stablecoin wallets for humans and agents ...

2026-08-05T15:16:24Z

Cloudflare stablecoin wallets for humans and agents
https://blog.cloudflare.com/wallets/

Cloudflare is giving AI agents programmable stablecoin wallets with spending limits, letting them buy APIs and content via x402. Basically corporate cards for bots. Tied to Cloudflare identity, with no Bitcoin or Lightning mentioned.

https://stacker.news/items/1540888

You can have a look at ...

2026-08-05T13:44:48Z

In reply to nevent1q…xdgm
_________________________

You can have a look at https://joinmarket-ng.github.io/joinmarket-ng/README-maker/#migration-from-joinmarket-reference

Let me know if there are errors, or is incomplete, or you need any help. I have some contact options at https://sgn.space/

they just did! https://canary.boltz.exchange/

2026-08-05T13:42:53Z

In reply to nevent1q…fzwe
_________________________

they just did! https://canary.boltz.exchange/

maybe they are just busy? ...

2026-08-05T13:17:44Z

maybe they are just busy?

https://xcancel.com/Boltzhq/status/2084980509642281288

quoting
nevent1q…6usy
A few months ago I attended a talk of @Kilian were he said that they had never received a letter from the "authorities". But that if they ever did, they wouldn't be able to talk about it. Not renewing the canary does not count as talking about it.

nevent1q…rk3q

Yes, because the anonymity set of previous rounds has now ...

2026-08-05T11:26:44Z

In reply to nevent1q…jcmw
_________________________

Yes, because the anonymity set of previous rounds has now decreased.

A few months ago I attended a talk of @Kilian were he said that ...

2026-08-05T11:25:39Z

A few months ago I attended a talk of @Kilian were he said that they had never received a letter from the "authorities". But that if they ever did, they wouldn't be able to talk about it. Not renewing the canary does not count as talking about it.

quoting
nevent1q…rk3q

note1e29…vcvd

CC thief mixing with wasabi wallet: ...

2026-08-05T09:49:23Z

CC thief mixing with wasabi wallet: https://xcancel.com/mariusoffchain/status/2084892387445244196

You can import just from mnemonic and the FBs and CJ histroy will ...

2026-08-05T06:26:42Z

In reply to nevent1q…c06d
_________________________

You can import just from mnemonic and the FBs and CJ histroy will be auto discovered. But the configuration is different in format and settings.

I see you managed to see it. Probably something related to Web of ...

2026-08-05T06:25:03Z

In reply to nevent1q…4g75
_________________________

I see you managed to see it. Probably something related to Web of Trust?

Maybe... But it doesn't really solve that kind of attacks, ...

2026-08-04T21:46:30Z

In reply to nevent1q…wrh2
_________________________

Maybe... But it doesn't really solve that kind of attacks, see https://stacker.news/items/1540052/r/m0wer?commentId=1540100

DarthCoin moment xD

2026-08-04T21:14:20Z

In reply to nevent1q…wt3j
_________________________

DarthCoin moment xD

Got 100 USD of Kimi K3 credits from prem.io to do a security ...

2026-08-04T21:13:48Z

Got 100 USD of Kimi K3 credits from prem.io to do a security audit to JoinMarket NG. They are giving it to Bitcoin projects that ask for it, see https://xcancel.com/premai_io/status/2084552134444662986

Anyway, the experience was very nice. You can ask Kimi K3 directly to find vulnerabilities and prove that they are exploitable (otherwise it's a nightmare of endless false positives). It first went through some recognition phase and proceeded to focused on the different attack vectors in phases.

It did not find anything high or critical but it tried many candidates. And found some medium stuff. Oh, and also had it have a look at all dependencies.

Still have credits left for auditing future PRs and issues. Thanks prem.io guys!

yes, for me as well FYI @nprofile…rpk4

2026-08-04T21:04:58Z

In reply to nevent1q…qtct
_________________________

yes, for me as well

FYI waxwing (nprofile…rpk4)

Me neither.

2026-08-04T16:37:33Z

In reply to nevent1q…vyec
_________________________

Me neither.

archive.org is a good option. And I know that some were migrated ...

2026-08-04T16:34:40Z

In reply to nevent1q…t0gq
_________________________

archive.org is a good option. And I know that some were migrated to https://reyify.com/

Only for organizations. It's a section under organization ...

2026-08-04T14:52:48Z

In reply to nevent1q…uv9n
_________________________

Only for organizations.

It's a section under organization settings. It might exist for users as well, but at least it's not exposed.

I was checking some feature I did not notice before on GitHub ...

2026-08-04T14:16:57Z

I was checking some feature I did not notice before on GitHub called "Audit log". It registers all the events that happen in a GitHub organization.

And it shows you the location of the contributor!

In this case it was the VPN exit hop. But not everyone uses VPNs, and when you contribute long enough to a project, one day you'll have the VPN off.

I'm sure many people that have contributed to open source projects were not aware of the maintainers being able to see their location. I definitely wasn't.

But there's more! Maintainers can enable collection of IP addresses from the contributors!

I can tell you that it's off for JoinMarket NG, but you would have to trust me about it, because I can't prove it. Same goes for all other organizations you've ever contributed to.

An alternative is https://gitworkshop.dev/npub1w3vaxva0vcrx7pnvlpmede5smvafdl69xnu7ma82kaxl9us89zdsht4c5c/relay.ngit.dev/joinmarket-ng were things like this don't happen by design.

But the fact that Nostr relays and grasp servers don't share your IP with the repo maintainers, does not mean that they themselves can't see where you are connecting from. Of course they can.