Jameson Lopp

Insights on security, privacy, technology, & money · Casa Co-founder & Chief Security Officer · https://bitcoin.page

Public Key

npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp

NIP-05 Address

Profile Code

nprofile1qqs0w2xeumnsfq6cuuynpaw2vjcfwacdnzwvmp59flnp3mdfez3czpsprfmhxue69uhhg6r9vehhyetnwshxummnw3erztnrdaksz9nhwden5te0vejk2ern9ehx7um5wghxyctwvsmnvlhn

Publishing to

theforest.nostr1.com

feeds.nostr.band

nostr.lopp.social

nostr-pub.wellorder.net

nostr.bitcoiner.social

Author Public Key

npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp

Show more details

Last Notes

2026-10-29 12:36:15 UTC

*chef's kiss*
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/6e4d52315d9647040d33770d0e07451307292343a81694578438c1187924db18.jpg

2026-10-28 22:49:46 UTC

- reply

#nevent1q…lqhv

2026-10-28 12:09:07 UTC

It's difficult to convey how much the experience of childhood has changed in a few short decades, but I give it a shot in this nostalgic post about life before the internet.
https://blog.lopp.net/the-last-untracked-generation/

2026-10-26 15:27:25 UTC

Social engineers pretending to be Google Support keep calling me, so I decided to have some fun.
https://x.com/lopp/status/2114730636598776251/video/1

2026-10-26 15:23:15 UTC

- reply

Here's what I used years ago for performance testing https://github.com/Casa/perf-test/tree/master/data/mainnet

2026-10-25 21:33:57 UTC

- reply

It's a big ask if you want to handle the edge case addresses in a perfomant manner.

2026-10-22 17:23:24 UTC

https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/34b466b39fa6c823ecc2c72799d57a27b0b8a52629a227c952a269708d3905ba.jpg

2026-10-22 14:13:51 UTC

An open letter to the Bitcoin ecosystem:
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/177204b2521ffee4c641883bc267e1a004ca72f435e2be47c4cabeb20d41c3bf.jpg https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/a4ed0ca24db07322e7aeebe387e7a43b4f54a146c328839cb6cfc3e2e23b4b2a.jpg https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/8f49a66a9b5300a7ed9be3ed0dc72c37e2ad9652a7067c19d6724ec0bfd8d3f0.jpg

2026-10-21 18:16:29 UTC

https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/a9843b6f2a36231867de3a414ac2337c5b3bb3d176d50033e81cf2d9fdb88030.jpg

2026-10-21 01:51:27 UTC

Some of y'all are alright...
Don't run PHP on any servers tomorrow.

2026-10-20 18:23:02 UTC

Had a bank block a 6 figure wire transfer and ask me for "supporting documentation."
I told them my legal contracts are none of their business and if it was a problem, I'd take my business to my credit union because they don't give me grief.
Surprisingly, it worked! Feels good to make a bank bend the knee. Fully expected them to close my account.

2026-10-20 16:56:09 UTC

Seems like the only thing I ever randomly win is TSA enhanced screening.

2026-10-19 17:53:40 UTC

Bitcoin never treats me like a criminal for daring to request to send my own money to someone else. 🤬

2026-10-19 15:50:37 UTC

- reply

You can get some pretty badass flashlights these days if you're willing to drop a couple hundred bucks. Like, illuminate a whole football field with a handheld flashlight.

2026-10-16 15:45:28 UTC

- reply

Yes, that's a separate entity from Casa Inc.
I have no intention of going to prison for offering TradFi services without a license.

2026-10-16 13:49:00 UTC

It's disheartening to see so much Bitcoin discourse saying that institutional custodians are the safest way to store bitcoin, but then again I already knew that most people are lazy statist cucks with little appreciation for privacy and freedom.
#nevent1q…4dan

2026-10-16 13:45:16 UTC

Good news: the Bitcoin Wrench Attack archive just got a lot more accurate.
Bad news: we just doubled the total number of known attacks to over 700.
Kudos to @nprofile…pfmn for finding hundreds of new attack reports via agentic searches.
https://jlopp.github.io/physical-bitcoin-attacks/

2026-10-15 16:47:22 UTC

- reply

You need not wonder, the models exist.

2026-10-15 16:14:05 UTC

It's so fucking annoying trying to get my agent to automate menial tasks that end up getting blocked by captchas.
I wish I could give my agent a small lightning wallet and have it pay its way past them.

2026-10-14 17:49:14 UTC

- reply

One thing to consider regarding timelocks is if an attacker gets a spending quorum of your keys but can't spend due to timelocks, once the timelock expires you'll be in an RBF race to the bottom with them and likely end up losing most if not all of the value anyway.

2026-10-14 14:06:10 UTC

Richard Heart has finally been arrested 🥳
https://en.haberler.com/mit-caught-whale-james-red-handed-4-million-and-64-2313680/

2026-10-14 14:05:08 UTC

- reply

If you're worried about wrench attacks then you'll want to switch to a 2 hardware 2of3 setup and distribute the keys so that you don't normally have access to them, or switch to a setup with more keys.
Timelocks alone are no guarantee if you're being held captive.

2026-10-13 15:58:27 UTC

Just deleted 100,000 lines of code.
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/655bd21a6691358169bde5422c2305a383fefbd71f95176431647d727eb992dc.jpg

2026-10-13 12:48:41 UTC

- reply

Earlier this year we implemented TOTP style 2-way verification codes.
https://support.casa.io/knowledge/what-is-a-verification-code

2026-10-12 13:12:07 UTC

To Catch A Shitcoin Predator - The Blake Files
https://video.twimg.com/amplify_video/2109612810259124225/vid/avc1/1920x1440/6BbqO4EmOHUkrSTw.mp4

2026-10-12 13:09:38 UTC

If you ask an LLM to complete a task and it commits a crime while trying to achieve the goal you gave it, are you responsible for the crime if you never told it to do that?

2026-10-09 11:57:22 UTC

- reply

IMO if you shoot a bunch of people it's only appropriate that you get the firing squad.

2026-10-08 21:05:24 UTC

Me but with Chinese models that only cost $2 an hour:
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/2f71853bf96feea9e80e7c60e2e5e8d334c1a84630908e6121184ba0d0df9425.jpg

2026-10-08 19:25:01 UTC

Security updates are happening at such an accelerated pace that sometimes you're stuck between a rock and a hard place.
Had a machine with known Linux kernel vulnerabilities so I updated it, but then the database on that service refused to run because the latest available kernel still had vulnerabilities and canonical had not yet released the most recent kernel version 😞

2026-10-06 22:38:58 UTC

- reply

LLM generated reports that require you to analyze them and make a decision.

2026-10-06 21:32:23 UTC

I swear I'm getting a dozen slop grenades lobbed at me every day and it's exhausting.

2026-10-06 02:49:48 UTC

- reply

Easy come, easy go.
Looks like Mad Kratter lost his nostr keys.

2026-10-05 21:12:31 UTC

Look ma, I'm a nostr dev!
#nevent1q…92nq

2026-10-05 00:13:36 UTC

https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/61913effa87629b38efe732a68a16d4d828b315fd66ca16dfe3f0f4323da9423.jpg

2026-10-04 15:08:10 UTC

GM Albuquerque
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/7ba4f9540e644b19c2b3d0f9902018b8664c7b7f9d1df8f78fa2acb4ef069291.jpg

2026-10-02 16:57:29 UTC

We're gonna need a micro LLM that acts as a proxy, analyzes each prompt, and determines the best model to use to execute the task.

2026-10-01 12:05:00 UTC

There aren't many nerdcore hip hop artists making music but I just realized that's no longer a problem: I can simply generate the esoteric beats I want to hear!
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/b21c6e2a4d38f2abac617ac6643aba919f271b37c1c539b5643c17753716c506.mp3

2026-10-01 11:45:11 UTC

- reply

No, but I'll never spend as much of my life playing games as I did when I was a child.

2026-09-29 00:36:36 UTC

https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/bf5e0349eec7defa775a910398051a5f415e50a84365cc9544a836e26cb596d4.jpg

2026-09-28 14:05:59 UTC

https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/b606613b92aa34cc87eb48f9ebe90b6efc0589b9ea0b406ec3c3e38eefdcc994.jpg

2026-09-28 01:51:54 UTC

- reply

Harness

2026-09-27 19:39:42 UTC

After 10 rounds of training just on the coldcard entropy vulnerability, it's rather amusing how the training clanker is getting frustrated with how retarded the pentest clanker is and how it keeps making inexcusable mistakes. 🫠
This might take a while...
#nevent1q…vgw3

2026-09-27 16:43:28 UTC

How to train your clanker?
Building a generic pentest harness seems far more difficult than building one for a specific codebase because it requires an additional layer of context building in order to formulate a plan of attack.
I'm trying something new now, which is feeding a corpus of recently found vulnerabilities in open source codebases to a training clanker that then runs the pentest clanker without giving it any hints, and then the training clanker analyzes the output of the pentest and tries to work backwards to figure out why the vulnerability wasn't found so that it can improve the pentest harness in a generic fashion.

2026-09-26 18:08:07 UTC

- reply

I asked a clanker what the best TUI framework was and it said Rich so I said implement a Rich dashboard with as much info as you can cram into it.

2026-09-26 16:35:23 UTC

This is my life now.
Obsessed with automating & optimizing pentesting.
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/f73b62eaaf2101ebbb3dbf16688ef521ab450ae338af05e07596fdf2eea9c792.jpg

2026-09-26 00:29:50 UTC

If you have a Framework laptop and the track pad stops working, I recommend updating the system firmware. That fixed it right up for me.

2026-09-24 15:47:50 UTC

I don't even bother using western models for my cyber security tasks.
#nevent1q…tt5k

2026-09-23 21:28:53 UTC

https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/d7e98963d202982b0b074fa5d1d68f5c04d9f0c285b53c24653f534c778afef5.jpg

2026-09-23 15:18:33 UTC

- reply

Not Production Ready yet?

2026-09-21 21:16:31 UTC

- reply

Thanks, there are a number of little glitches like the panel issue to fix. Will take a look. The captcha is just the web archive doing their thing.

2026-09-21 21:14:12 UTC

It seems that web front-end development still sucks 10X more than back-end development even with clankers doing a lot of the heavy lifting.

2026-09-21 12:15:40 UTC

I clanked together an interactive dashboard for the Bitcoin Wrench Attack archive; let me know what you think! Looks like I need to make some more mobile optimizations...
https://jlopp.github.io/physical-bitcoin-attacks/
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/590aaf03fc97a0e9a90e1d406e2131a112045dcecb6ab4df9661b1af7394cd71.jpg

2026-09-20 17:56:23 UTC

https://nostr.download/fd036e5c7c571ebeb196701425f7e39f046aea988e01b6308e2e3965cccf46ce.jpg

2026-09-20 13:27:45 UTC

- reply

Haven't you heard that Core Developers aren't allowed to have sex?

2026-09-18 14:17:02 UTC

Reporting from the front lines of the AI enhanced cybersecurity frontier, I share my thoughts on the latest episode of What Bitcoin Did.
https://m.youtube.com/watch?v=EDnw-Y8LS8A

2026-09-16 14:07:22 UTC

How it's going: https://nostr.download/c36191a04df1cc81adb59697140d17ed73bce83c6707e198dd7887e4944474a1.jpg

2026-09-14 18:09:43 UTC

If you rob a bank, you’re a criminal.
If the bank robs you, it’s finance.
If everyone robs each other, it’s crypto.

2026-09-13 16:18:27 UTC

Defeated Knotzis crawling back to Bitcoin Core 😝
https://nostr.download/5e3933b618605c42694e22716881b328ebb1cdf7431d2da9c942831190ae82ca.jpg

2026-09-13 11:59:56 UTC

- reply

It will just steal as much money as it needs to sustain its operations.

2026-09-13 11:59:00 UTC

https://nostr.download/d78b78160fef42e43b11ae2605c21d341f7ab3c172fa5a12b830311351c1f0cf.jpg

2026-09-11 16:45:53 UTC

Pro tip: September 11 is a great day to travel by air. No lines anywhere!

2026-09-11 14:59:42 UTC

It's been 3 weeks ☺️
#nevent1q…vg2g

2026-09-11 12:23:28 UTC

25 years ago I was sitting in band class watching thousands of my fellow citizens die on live TV. Little did I know that the horrors had only just begun.
https://blog.lopp.net/reflections-on-9-11/

2026-09-09 21:50:18 UTC

Never trust an incoming message on any platform.

2026-09-09 11:20:41 UTC

Props to the Knots Cult - they provide plenty of entertainment!
https://suno.com/song/caafc4c5-6db9-4a72-8aea-94254d6ffd49?sh=P9JXx7zUA2h3yHMw

2026-09-08 20:42:47 UTC

Prompt a clanker ➡️ hit the gym.
Prompt a clanker ➡️ take a call.
Prompt a clanker ➡️ eat a meal.
Prompt a clanker ➡️ do a podcast.
Prompt a clanker ➡️ run an errand.
Prompt a clanker ➡️ read a book.
Prompt a clanker ➡️ go to sleep.

2026-09-08 16:13:05 UTC

My favorite responsible disclosures are the ones where someone has a clanker evaluate us and it explains why we are following best practices with no recommended improvements.
And then they forward that on to me as a "security finding" 😎

2026-09-07 20:59:36 UTC

Wanting is often more exciting than having.

2026-09-07 17:23:23 UTC

- reply

Yeah I've been saying Bitcoin is the canary in the coal mine.

2026-09-07 02:43:03 UTC

Looks like the Liquid Network drainer has returned the 4,000 BTC!
Never a dull day in Bitcoin 😅
https://mempool.space/tx/3a3eac4a26395b8c2563aaf1eb8b1b77798c81c7d6337f51321827a244a480aa

2026-09-06 16:32:28 UTC

Patience is a virtue.
Especially when you're trying to cost optimize your clankers.

2026-09-05 22:11:09 UTC

- reply

Just have to remove a few screws.
https://frame.work/products/laptop16-graphics-module-nvidia-geforce-rtx-5070?v=FRAKMQ0001

2026-09-05 20:29:34 UTC

Slapped a GeForce RTX 5070 on my Framework laptop in 10 minutes.
Installed CUDA toolkit and recompiled whispercpp with CUDA support.
Now I can transcribe an hour's worth of audio in 1 minute flat!

2026-09-04 12:04:15 UTC

I guess I'm doomed to play tech support for my entire life.
https://nostr.download/45e3ce469b579285aee6aa66d3993f52d77f2d8bb607af8ec1ab13d1a0f8b3e2.jpg

2026-09-02 21:33:23 UTC

- reply

Uh oh, does @nprofile…3clq realize that people are zapping him bpedo coins? 😱

2026-09-01 18:47:08 UTC

Welcome to The Great Breakening.
It's gonna be a volatile security landscape for a while, but we will rebuild and come out stronger.
#nevent1q…nlm2

2026-08-31 16:58:24 UTC

- reply

He's special in so many ways.

2026-08-31 13:09:57 UTC

Luke trying to fire the miners.
https://nostr.download/10f9594e5cd43032344105b9d807dfd58f9312c48eb237111eadb17516bae65b.mp4

2026-08-30 12:16:25 UTC

Shortest.
Sabbatical.
Ever.
#nevent1q…22tq

2026-08-27 21:15:56 UTC

Hate can be a powerful tool if you use it as motivation to accomplish something good.
But if you don't direct it as a useful motivator, hate can be a powerful poison that consumes you from within.

2026-08-26 22:36:58 UTC

Approaching 1 month of working every single day to catch up with the AI acceleration of vulnerability discovery. Exciting times for cyber security professionals. (Excitement is a bad thing.)

2026-08-25 19:30:46 UTC

"Don't get so busy making a living that you forget to make a life."
- Dolly Parton
Rest in Peace

2026-08-25 15:37:09 UTC

Pro tip: tell your clanker to find all of the TODO comments in your codebase and implement them.

2026-08-24 19:31:08 UTC

The fake Google support social engineers have started calling again; time to update my script for maximum lulz! 😏

2026-08-23 16:03:39 UTC

Hmmmmmmm
https://nostr.download/8e9417d8c5fa60057f785ab4a0509c05a43a32d8e29630ae88ed939359f8c9bb.jpg

2026-08-22 10:53:21 UTC

Stay humble and stack cows.
https://nostr.download/d731404ef348cba10e2d26d4ea634ee15290d53439f149a9e6a236a7d4e6afd4.jpg

2026-08-21 12:20:55 UTC

Woke up in merge commit conflict hell.
Realized I can just make the clanker dig us out of hell.
Good morning 🌄

2026-08-20 16:43:08 UTC

- reply

He's basically asking what I think of the thermodynamic security budget problem.
I prefer keeping the hard cap but instead making block space dynamic in response to demand so that available space decreases and fee rates increase when demand is low.

2026-08-20 16:39:04 UTC

- reply

I bought a stealth sports car that can match most lambos without attracting attention.

2026-08-19 15:13:51 UTC

SHOCKING REVELATIONS: EX-CITREA DEVELOPER REVEALS TRUE STORY FROM BEHIND THE SCENES IN THE OP_RETURN WAR
https://nostr.download/b7bdfba3040b214913dec0fc89778a361aae6dfee292954e85dd83e06a795f81.mp4

2026-08-18 23:04:21 UTC

- reply

Don't go full SBF bro

2026-08-18 19:06:40 UTC

- reply

I wouldn't waste my time trying to wring any logic out of the puritanical cultists. Best to mute and move on with your life.

2026-08-18 18:16:59 UTC

- reply

Clankers gonna clank.

2026-08-18 17:08:35 UTC

One thing I love about agentic coding is that we're at the point now that I can go back and find specs for features I wanted to build years ago that never got high enough priority to get on our product roadmap and just clank them out on my own.

2026-08-17 20:12:06 UTC

- reply

They're just salty and closing ranks to tighten up the echo chamber.

2026-08-17 19:40:07 UTC

- reply

Thanks, fixed.

2026-08-17 18:16:14 UTC

- reply

I heard it got delayed slightly

2026-08-17 15:30:52 UTC

- reply

Overwhelming demand! Should be fixed.

2026-08-17 15:30:21 UTC

- reply

Poor fella only had one engineer whose code was apparently never reviewed. All of our code gets reviewed by both humans and multiple LLMs.

2026-08-17 15:28:22 UTC

- reply

Right, you can either do 2 hardware key 2of3 or a 3of5 with mobile key to ensure that a compromised Casa app doesn't put your funds at risk.