Last Notes
You're not gonna harvest enough energy to transmit over LTE. I actually had a patent in energy harvesting. It's good for much lower power operations.
My design here killshots the capacitor charge strategy. It's not difficult you just need an OK integrator circuit and good param selection.
#nevent1q…v39n
One risk is routing around the shunt (current sensor) but what I'd do is wall off all conductors upstream of the shunt and put a via right underneath it so you'd have a hell of a time.
Some craftsmen might get around it but it could turn it into a multi day project + tons of wasted time and burned thru units.
You could make the device have a cryptographic handshake + heartbeat to make it near impossible to fake. Cryptographically bound at manufacture. If its canary goes down all bets off.
Maybe but you could put in some neat tricks to brick the device if that's tried. I'll have to think on that. You could also make it a MEMs or a specialized IC that's part of an inline (high side current) circuit that would brick the device if removed or altered. The reason this attack could work is because STMs are so common they're like the Smiths of electronics.
This is my working design. I would also go ape shit and try to minimize power consumption of the device even if it means making you wait 10s instead of 3s for it to do a cryptographic operation. Makes it easier to detect fuckery.
Channel A detects instantaneous power if they're just total hogs and go for it (RF is incredibly peaky)
Channel B mitigates risk of them charging up a capacitor or some other energy storage and trying to surreptitiously charge up for the Big Transmit.
https://npub1g5642xjqyudstx4e9dc702m7suqqvx3djxcdyre38muz7pfwkzzsye9lcr.blossom.band/a99724d639cb33fe367af52f80468796328985279d41e608a1822cdf6e165257.jpg
A Joule thief is a specific inductive boost-converter topology, typically using a coupled inductor. Battery imposes the same space/weight costs. That seems unnecessarily complicated for this application. But I'll steelman your argument as "some means of surreptitiously storing energy."
You can design a two-channel current detector. One channel measures near-instantaneous current; the other integrates excess current over a defined window to detect cumulative energy consumption.
A capacitor can conceal transmission peaks, but it can't conceal the energy needed to recharge it. The relevant question is whether that additional consumption falls within the device's normal power variability and the detector's sensitivity. Given control of the electronic design you could intentionally lower the power consumption of the legitimate assembly to make such detection even easier.
https://blossom.primal.net/bb510bf3363da692870a266ed59e9c1c30fd51b7764c72878e7aaf2bd319a9f0.png
#nevent1q…r5ml
Right. That was in a thread I found where Trezor was responding directly to this article and the researcher (Joe Grand). This looks like a story recirculating from 2023. I think Trezor is saying they haven't seen funds stolen that way.
FWIW it looks like an old story recirculating. My key takeaways:
- Hardware should be bought directly from them
- Tamper evident tape should be on device
- Upon first initializiation a firmware update from Trezor should flash -> bootloader verifies it was signed by Trezor. This one seems like it's new after the 2023 issue
No measure by itself is exhaustive. But especially the last bullet point blunts this threat vector (replaced micro, exploited firmware) .
https://blossom.primal.net/29a078cdce25c87799e79c9295747ea8dc5a42987bc900dc6bb674309e125746.png
I guess this is the tell
https://blossom.primal.net/48da44aab670fa86c399b7c00e81ce229fa79e7ab04e5d58967290f44dc6d1ca.jpg
I am hesitant to take a dremel to it for these reasons:
1. This exploit simply replaces the original micro with a new one. With good craftsmanship (the same kind that would make enclosure manipulation undetectable) you wouldn't notice anything. So it wouldn't actually prove anything if you inspect visually by looking inside.
2. The way the enclosure is designed is either with one piece plastic or an aluminum backplate which appears to be designed not to be opened.
So the attackers would have to manufacture the whole imposter device from scratch. Possible but lower risk.
https://blossom.primal.net/e31912edd7c3f2e5d5142e2e3b72234736aa4d79977ef8d1d334456dc0cfc127.png
which model did you have and how did you go about opening it?
I don't wanna sound like a piker but my research shows that newer models like Safe 3 and Safe 5 are designed such that they can't be opened without being tamper evident. It comes with tamper evident tape on the seam and an aluminum backplate.
Not as ideal as the fully inspectable case. Imo Biggest risk seems to be if you bought from reseller with the ability to manufacture from scratch.
The Glass🪩
A **generative surface** for Android. You ask for something in ordinary words, it resolves to the lightest artifact that can do the job, a declarative L-0 view, a portable L-1 mini app, or a generated L-2 web app, runs a opaque origin sandbox with no network, and keeps its state as kind 30078 nostr events on the user's own Citrine relay.
Private provider is the substrate and is a separate application. It owns the identity, amber, nip 55, the wallet, attested inference from Routstr D, the local relay citrine, and the on-device build chain. This repo links nothing from it. The surface reaches compute only through the host's binder bridge to private providers exported service.
The Glass surface never holds keys, and never does crypto. No Android, Intense, Nip55, Nip46 or Curve Crypto in the surface renderer. Host services arrive through the adapters, never by reaching into app. The host consumes the surface only as assets.
Ask for what you need. It appears. Throw it away. If you need to keep it, keep it. Really want to share with someone, upload to blossom. No need to build apks, publish to app stores for simple things. The app is a nostr event.
The surface is transient, the state is yours.
Gresham's Law is powerful.
It looks like the micro just fakes entropy and produces pregenerated seeds
Trezor should publish a tool that checks your pubkey to see if you're a victim.
Hardware manufacturers should start detecting out of spec power consumption and treating that the same way you'd treat out of spec firmware/cryptographic checks.
This can be accomplished with an assembly that's like $0.10. Hire me. I can do it in my sleep.
I wonder if there's cryptographic wizardry someone could do (a la shielded bitcoin) that can give you best of both worlds in a multisig.
We approve of this setup!
Surface is the commodity; the spine is the product.
🪩+🔐
#nevent1q…f374
The Glass 🪩
A generative surface over a durable personal substrate ( Private Provider + Citrine + Amber )
The Glass turns a plain language ask into the lightest artifact that can do the job -- a declarative view, a reviewed mini-app or a generated one -- sandboxed with no network, keeping its state as ordinary Nostr events on your own relay.
It runs end-to-end on android now:
ask - > resolve - > generate - > sign ( nip55/Amber) - > publish - > reopen with the state intact. The artifact is disposable; the events are not!
https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/a4b2aeb060623eca34bb668a8c1053f577b91b7ea3cbf74cb3ea0ff30ea05e70.jpg
I like the purple rice that Jews eat. That shit is good.
I'm looking at that subreddit, and it appears armada is the most popular project in that little community dedicated to discord alternatives (so they say).
Seems to me like the loudest are a minority there.
I guess this is a bad time to sell my old ledger nano s devices that ive had for a couple years and dont use, and dont want, and haven't tampered with.
I don't think hardware wallets are dead. I think QR code based wallets are the future, if you can verify your hardware and firmware and the only connection to the outside world is a camera and screen. In that case, unless the RNG is borked (like coldcard) its safe so long as the encryption itself isnt broken, in which case the currencies are fucked with our without hardware wallets.
I do think big vendors are kind of fucked too, because the more a supply chain scales the less safe it is. They're gonna be FOSS and open hardware, QR oriented, and small manufacturer or they're going bust.
The Glass 🪩
Surface is the commodity, the spine is the product. https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/7f0dff39b20b6031367fa1bba627d4e481cfee3adc440e3197e2033f55ae6cf4.jpg
Here is direct blossom download. Not sure of zapstore issue for you. Android only. https://cdn.hzrd149.com/c16f837dae8f03aa9c9d864983b781e856376faa50486ae1f89ac2bb18bed233.apk
Hey friend, looks like you are using the routstr chat interface url. I am a single provider to the network who only serves tinfoil open weight models. I suggest you try routstr daemon and connect it to your harness/ agent like pi agent or open code. Or try my app which offers the entire network, all the models, and a chat interface. Routstr can offer better explaination for the interface you are on. Hope that helps.
Chat + Pi Agent + Ngit Workspace + Wallet + Monitor https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/122cad574666d8b63a20c8a7b7fd2970d61d4b4b58a340287216b4297a9f296c.jpg
https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/c7907d455ba2923ca58052cf04ac21b77217e9a006cccfffb34e5f58588625aa.jpg
https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/be05b53af88a33ebc6ae9b071050e2834d44bc5439805a0d8368a9ce0f1e9637.jpg
https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/7899b46195c6ee9b7a09d9a42351b77406fce7a64e529b63dfdbdcbe16b9c4bf.jpg
https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/84668b50178f22ba3e13e0868610136f03b56461c6f8e130d91659a930718ccd.jpg
https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/b00ab45501c7bf08bd725a863f40aeded53e94c3a3eafbbac8bd5a43a431b5af.jpg
https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/6c6864291704d448e32d530a713fe2fcc3a7cabb9d2dd14e6fc0f478545304dd.jpg
@nprofile…vhl6 would it be possible to be able to turn off concord chat notifications as a separate thing? Amethyst does so much now, if we get notifications for every thing on nostr then notifications will become just noise, and particularly concord rooms often have dozens of people in them.
Generation is commoditized, and Nostr already made data portable — so the scarce layer is the spine: identity, event graph, wallet, scope, compute, outliving every surface.
The Glass makes a view signed, addressable JSON that a generic renderer executes under substrate-enforced scope, so a surface never holds your key or sees your whole store. The app *is* the event: share it, fork it by replying. Surface is the commodity; the spine is the product.
Stay tuned 👀
Thank you! Let me know how it goes!
What about aborting each other lol
People who commit attacks against powerful corporations need to understand and face that this is what they're doing. Creating Nitter is absolutely an attack against X, they knew it and felt it when they made it, thats the whole point. Yet somehow they decided that they should attach their names to it, host it on github, put themselves at the mercy of a "justice" system they probably already understood existed to protect the power structure and nothing more.
I liken it to old armies walking dick first into battle because of "honor." The ones that won acted like guerillas.
If youre going to attack a powerful entity, you need to do it in a way where there's nowhere to send a cease and desist. Your code should be hosted on ngit on one or many relays behind tor, or some other such approach that protects you. Your name should not be attached to such endeavors.
If youre writing disruptive FOSS software (redundant I know) you need to obfuscate its source as best you can and prepare for pushback if youre successful. You need to act like a guerilla.
Now they need money to fight the battle on the opponents turf. They're probably not going to get it. That could've been avoided.
I hope someone is hosting a fork of the software somewhere out of reach, and not attaching their name to it.
What should public discourse look like on these topics?
Hey Tim, can you tell me more about when you get that 500 error? Is it when you atrempt to send a prompt? Is it mid stream? Is it when you tap on a model? Thanks for the feedback.
I ate the dogfood to make Private Provider 🐶
▪️ I only used @nprofile…6nzx to access open weight SI models
▪️ I paid per query for inference in #bitcoin #cashu
▪️ I used open source Pi Agent on Linux
▪️ I signed remotely with Amber for every #ngit action
▪️ I published the code via ngit to blossom servers
▪️ I published the app to Zapstore
▪️ I made an nsite the official project page
The entire project is nostr native freedom tech ✅
In its simplest form, Private Provider is a mobile Super Intellingence chat app. Choose any model and pay per query in #cashu to speak with it ✅
#nevent1q…4sw7
Private Provider v0.7.8 is out 🔐
▪️ Bug fix: pasted tab no longer stalls agent
https://gitworkshop.dev/npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa/relay.ngit.dev/private-provider/releases
Use any model you want with no subscriptions or kyc https://npub1fetz9dt4eka56h0dpyly335v60mjf7k4gu2z7rqmptkz72e2pvhqvejzfa.blossom.band/34d1ce1a77b0a9cbb48481c5798a6499d78da5a087b768b460bb6f6cdc30ac85.jpg
https://zapstore.dev/apps/xyz.privateprovider
https://cdn.hzrd149.com/d0197bb93812f6be8dd88a249d3a49826c214337081f5cdb694d870e22d380ee.apk
Were you able to download the entire APK? It is a large app so make sure to give it time. You need to allow apps if on GrapheneOS.
Did you see an error on the splash screen during onboard?
Wait til you wake up from a nice dream and then check your phone to find that that is true. A figurative nightmare is worse than a literal nightmare.
They'll never come to nostr because they can't be in charge of anything but their own blocklist.
I personally don't care who "comes to" nostr, because nostr is just a protocol and they're free to isolate themselves. The trouble is that in the past, in other places, they've tried to isolate others and actively harassed them. They're not going to really be able to do that here.
Shared this yesterday, the github page, its so new I think most people dont realize it exists yet. This suite is gonna be a big one if maintenance continues and the maintainers are sane.
https://npub1m5s9w4t03znyetxswhgq0ud7fq8ef8y3l4kscn2e8wkvmv42hh3qujgjl3.blossom.band/6cce5f618557d73d99a2a738e845fc1977fc294b564682fa760cd84d5895e1bf.mp4
He just thinks feminism is for females. Pretty straightforward opinion. I dont think he is taking a flamethrower to anybody.
Default relays on install, you can change them if you like.
I dont think youre missing anything. Its just some people on a crusade, if you've ever been a fediverse user you'd know how incessantly boring this all is.
I've got a tip: if you have a hard time keeping a regimen of nutrients youre going to be forced to keep a regimen of pharmaceuticals later.
Take a fucking multivitamin every morning, drink a glass of milk.
Also L-citrulline is absolutely amazing.
(And I hope youre already aware but I'm not a saylor fan)
http://armada.exposed
@nprofile…g58a Being a vegan doesnt excuse you of this lmao
These people are so full of shit. I'm glad I live in a time where the only people buying their bullshit are themselves. They're still bleeding from the eyeballs mad at the world while the rest of us have moved on and continued to live life.
Why is it these people only argue in half truths and lies of omission?
Looking at the thread, it looks like most of the people, even the trans' are like "this is ridiculous" so probably you'll get banned in spite of a "no" result lolol. But at least some people found it first. Word of mouth works great when you have something as solid as armada.
