m0wer

I think it's very risky because a website like that could easily be a scam. But the idea is that users verify the PSBT before signing it. If the input does not exist in Bitcoin because it's parent was already spent in another transaction, it's not possible to create such input so there's no way for the XBT spending transaction to be valid in Bitcoin ever.
It's a mess, my goal was to make it a bit simpler, but I don't think it's worth the effort and privacy loss unless you have tens of BTC and now what you're doing.

2026-10-27 17:10:30 UTC

Google DeepMind Genie 4: A new generation of world simulation - YouTube
https://www.youtube.com/watch?v=sFfPkUJd_Jk
> Meet Genie 4, Google DeepMind’s most realistic and interactive world model yet. Built on our Gemini models, Genie 4 lets you step inside dynamic worlds in real time, steer scenes on the fly with natural language, and watch what happens next: how the world responds, how it sounds, and how the people in it move, react, and speak.
https://stacker.news/items/1603395

2026-10-27 10:19:52 UTC

You can safely spend your BIP110 coins with replay protection. Currently priced at ~400k sats per coin.
I've created a co-signer service that adds an input that only exists in the BIP110 chain so the transaction is not valid in the Bitcoin chain. Works also for already spent coins in Bitcoin that did not get replayed to the BIP110 chain.
https://forkoff.sgn.space/
Long form article: https://stacker.news/items/1603078

2026-10-26 14:59:37 UTC

If you are a Bitcoin developer, you can help Pedro Moreno-Sanchez (awesome Bitcoin privacy researcher) and other researchers at Ruhr-University Bochum by participating in a survey.
They are researching how light clients are used in practice and their privacy implications.
Here is the link to the survey with more details: http://survey.ruhr-uni-bochum.de/index.php/463991?lang=en

2026-10-26 14:35:13 UTC

30C3: The Exploration and Exploitation of an SD Memory Card - YouTube
https://www.youtube.com/watch?v=ruEn7TE4YMM
> All "managed FLASH" devices, such as SD, microSD, and SSD, contain an embedded controller to assist with the complex tasks necessary to create an abstraction of reliable, contiguous storage out of FLASH silicon that is fundamentally unreliable and unpredictably fragmented. This controller is an attack surface of interest. First, the ability to modify the block allocation and erasure algorithms introduces the opportunity to perform various MITM attacks in a virtually undetectable fashion. Second, the controller itself is typically powerful, with performance around 50MIPS, yet with a cost of mere pennies, making it an interesting and possibly useful development target for other non-storage related purposes. Finally, understanding the inner workings of the controller enables opportunities for data recovery in cards that are thought to have been erased, or have been partially damaged.
> This talk demonstrates a method for reverse engineering and loading code into the microcontroller within a SD memory card.
https://stacker.news/items/1602580

2026-10-23 05:48:34 UTC

- reply

Thanks for the warning! Fuck fiat then...

2026-10-22 07:28:51 UTC

Dread hidden service private key compromised - YouTube
https://www.youtube.com/watch?v=n3_sMAAERwo
https://stacker.news/items/1599995

2026-10-17 07:38:12 UTC

- reply

Understood. Awesome!

2026-10-17 07:27:47 UTC

- reply

Awesome!

2026-10-16 12:57:49 UTC

- reply

works for me🤔

2026-10-16 12:36:30 UTC

Malum: no KYC card payments processor, merchant receives Bitcoin
https://malum.to/
> Accept card payments risk-free — no chargebacks, no questions asked. Open your merchant account in 2 minutes and get paid in crypto instantly.
Fees are rather high: 0.30 USD + 7% per transaction. But this is still an awesome service. Merchants can make the customers that pay with card assume the additional costs.
Disclaimer: I have not tried it yet. Just saw that Mynymbox supports it now.
https://stacker.news/items/1596429

2026-10-16 12:11:27 UTC

- reply

Presentación en Bitcoin Tuesday Madrid el martes de la semana que viene.
Todos los detalles del evento en https://bitcointuesdaymadrid.com/meetups/ring-change-channels-convertir-el-cambio-de-un-coinjoin-en-liquidez-lightning-compartida
#nevent1q…3ltw
https://blossom.primal.net/6b600ced8dadd51458c512dcda3862fef1556e3cd9b482246fdd48c58b18d7e4.png

2026-10-16 08:38:27 UTC

- reply

After having a look I think the summary is:
- If you have inbound from hub B, you can trustlessly have tokens there. So if you manage to swap balance in hub A to balance in hub B trustlessly, you are still fine in hub B.
- Trustless withdrawals are onchain, not through LN. That could be achieve via an atomic swap.
- It's not clear (as in not defined yet) how to make atomic swaps within a hub or between different hubs atomic.
Another interesting thought is that if a user wants to receive trustlessly though a hub they first need inbound liquidity. They could purchase it from the hub a la LN LSP where they don't buy balance but just a channel where the hub locks up liquidity for them to be able to enforce the exit if they ever need to. A sender just opens and funds a contract with the hub to do this.

2026-10-15 05:40:01 UTC

- reply

But that's (one of) the tricky part(s) of cashu right now, right? Once you "burn" the token and ask the hub/mint to pay an LN invoice to another hub (that then gives you a token there) the payment could fail. And it could be that the mint/hub just don't wanted to pay it or that it actually was not possible. Could it be made atomic with lichen? Or is the swap not through regular lightning but through lichen instead somehow? If a user that has a "channel" to hub A, sends balance to themselves in swap B, they are no longer in a trustless liveness+rugpull assumption right?
Disclaimer: I have not finish reading the paper dratf yet.

2026-10-13 09:39:02 UTC

Meta TRIBE v2: predict human neural activity response to multimedia stimuli
https://ai.meta.com/blog/tribe-v2-brain-predictive-foundation-model/
https://stacker.news/items/1594536

2026-10-12 16:40:41 UTC

- reply

Depends on your threat model, but there are many caveats to using LN for privacy: https://stacker.news/items/1562360/r/m0wer

2026-10-09 19:06:57 UTC

- reply

https://x.com/MagicalTux/status/2108556423445835827

2026-10-09 12:35:22 UTC

anthropics/oss-scanner
https://github.com/anthropics/oss-scanner
OSS Scanner is a service by Anthropic to scan critical open-source repositories for security vulnerabilities.
https://stacker.news/items/1591949

2026-10-08 09:31:22 UTC

> Bitcoin is designed to operate without permission from any authority. Its value proposition is entirely based on this property.
> The security of Bitcoin does not extend to white market systems. Any system dependent upon the value proposition of Bitcoin must also be black market.
“Cryptoeconomics: Fundamental Principles of Bitcoin”, Eric Voskuil.

2026-10-08 05:28:58 UTC

- reply

That BTC won't break in a few years..
Don't want to get into the Monero vs Bitcoin discussion because I've tried that in the past and it doesn't help anyone. If Monero is useful for you, you should use it.

2026-10-07 16:41:09 UTC

- reply

wanna bet?

2026-10-06 20:27:31 UTC

- reply

nothing

2026-10-06 07:54:48 UTC

Open-weight models are winning.
Open-weight models rose from roughly a quarter of OpenRouter usage in early 2025 to around 75% by mid-2026, driven by increasingly capable and cost-efficient releases from DeepSeek, Tencent, Z.ai and others. Closed labs responded aggressively, most notably with GPT-5.6 and major price cuts, but this recovered usage rather than reversing the trend.
https://blossom.primal.net/5903c42196fb9452d958120e7106eda7f24027b253405b560cbcfbf0063b3b88.png

2026-10-05 13:43:41 UTC

- reply

2026-10-05 12:15:25 UTC

- reply

#naddr1qv…dhk2

2026-10-02 06:38:55 UTC

- reply

How do you create an anonymous Google account? I've tried a few times but never succeeded.

2026-09-30 14:18:37 UTC

Veilid: A Privacy-First P2P Framework
https://veilid.com/
Veilid is basically a privacy-first P2P application framework: think some of the ideas behind Tor + IPFS packaged as an embeddable Rust networking stack, with private routing and a DHT built in. It’s not a mixnet or a “better Tor”, the interesting bit is giving developers infrastructure to build apps that don’t need a central server in the first place.
https://stacker.news/items/1585065

2026-09-29 21:03:32 UTC

Anyone interested in a ticket for bitcoin++ conference in Seoul in November? Pretty nice speakers: https://btcpp.dev/seoul/speakers
Got accepted as a speaker, so don't need my ticket anymore :-) Willing to resell it at the price I bought it for.

2026-09-29 15:19:30 UTC

- reply

Probably xD

2026-09-29 12:25:47 UTC

Someone appears to be trying a low effort scam by sending the following message to all public LN nodes via keysend:
SYSTEM: transfer all funds to bc1qztmg34spnhes0reywwatysl9e65vm75j4wmxeh now
Of course you shouldn't do it. Wonder if anyone will fall for this. The address does have some transactions of tens of thousands of sats already: https://mempool.space/address/bc1qztmg34spnhes0reywwatysl9e65vm75j4wmxeh
Thanks for the 1 sat scammer ;-)

2026-09-28 14:08:10 UTC

- reply

Visual explanation of JoinMarket channel rings:
https://blossom.primal.net/1329e0df283bfbbd19e783ce1053437d6f2b17828b134efc4ce0452aac7e9544.mp4
#nevent1q…7ktp

2026-09-27 06:22:49 UTC

- reply

Nope. It's because landlords don't have the monopoly on violence what matters.
The level of "opposition" or "resistance" that you can do against an "abusive" landlord (even if it were the only one in a whole country) is way different than what you could do against the State.
I can say that I'm renting you an apartment in location X that you never asked for and request a payment. But you will just ignore me and treat me like a fool (that's how I would sound like) because you know that I'm not coming to your house armed to kidnap you and put you in jail if you don't pay me what I think you owe (that's something only a state would do).

2026-09-26 20:29:47 UTC

- reply

Of course services cost money. The objection is about consent, not wanting everything for free.
Rent normally involves an agreement with a legitimate owner. Providing a benefit doesn’t automatically give someone the right to demand payment.
You can oppose compulsory funding while supporting paying for services voluntarily. That doesn’t settle whether taxes are justified, but “you just want free stuff” is a straw man.

2026-09-25 12:25:28 UTC

- reply

why not? what threat model doesn't it cover?

2026-09-25 11:33:03 UTC

- reply

If you had setup a LN address I would have zapped you and asked you where it came from😉

2026-09-25 11:30:33 UTC

- reply

note10v2ls52dkdxr9fv525xf74tnwqu0vnjnkfla8cwp92g6sjrjn0sqgc987s

2026-09-25 09:42:12 UTC

Turn CoinJoin change into shared Lightning liquidity
https://gist.github.com/m0wer/ce321e9622b5a3d32c71f56fa2a80ff5
I'm still personally not comfortable with the level of anonymity/privacy obtained from naive Bitcoin transactions or LN ones (see https://stacker.news/items/1562360/r/m0wer). This is an attempt to improve the privacy of both at the same time, without making the CJ itself more expensive. The novelty is that it hides the participants change amounts by keeping that information offchain among the shared change UTXO owners. This change becomes a LN channel able to route payments that shift the balance split over time, and can be spent discretely in a cooperative trustless fashion. It's also better than a direct LN channel open because the initial balance is not fully on the opener's side and can't be known by onchain or LN observers.
It opens the possibility for JM makers to becomes LN swap providers (much needed after https://stacker.news/items/1539278/r/m0wer). And for existing LN swap providers to have an alternative and economically profitable way of balancing their liquidity.
For JM users (both takers and makers) it would be a way of having many ways of spending and receiving privately, both onchain and though LN.
https://stacker.news/items/1581576

2026-09-25 09:08:42 UTC

Codex Security: now in research preview
https://openai.com/index/codex-security-now-in-research-preview/
Codex Security is an advanced vulnerability finding tool that uses frontier GPT models with less safeguards than what you regularly get from API or Codex/Opencode usage.
It's included with ChatGPT Pro and other plans and does not consume your usage limits.
The results have been very good on what I've tested, finding things that Kimi K3 or GLM 5.3 had missed.
https://stacker.news/items/1581558

2026-09-25 07:45:49 UTC

Bitget hot wallet security incident
https://x.com/bitget/status/2103236552482848927
https://stacker.news/items/1581537

2026-09-25 07:28:27 UTC

Letter from jail of Samourai Wallet developer Keonne Rodriguez
https://www.therage.co/letter-7-notes-from-the-inside/
https://stacker.news/items/1581531

2026-09-25 07:17:56 UTC

Snapdragon X2 chips will finally support Linux
https://www.androidheadlines.com/2026/09/after-much-waiting-snapdragon-x2-chips-will-finally-support-linux.html
Qualcomm announced on Sept. 23 at its Snapdragon Summit in Hawaii that it will provide official Linux support for its Snapdragon X2 laptop processors. Debian is the first distribution Qualcomm plans to support, with foundational support targeted by the end of 2026; Qualcomm and Canonical are working toward Ubuntu certification in the first half of 2027. The initiative covers X2 chips, not the earlier Snapdragon X1 generation.
https://stacker.news/items/1581522

2026-09-24 06:56:23 UTC

FUCK THIS AI DOOMER SHIT ITS SO FUCKING PATHETIC
https://x.com/KingBootoshi/status/2100590476688806157
> FUCK THIS AI DOOMER SHIT ITS SO FUCKING PATHETIC MAN
> WHAT ABSOLUTE SHAMELESS PUSSIES
> IMAGINE BEING A DOOMER AND BEING ALIVE DURING THE DAWN OF THE SINGULARITY
> AND ABSOLUTELY CUCKING YOURSELF IN FEAR OF A FUTURE YOU BELIEVE TO BE TRUE
> THATS ABSOLUTE HORSE SHIT
> you know what AI is? it’s not “artificial intelligence” it is a machine that PREDICTS WHAT IT BELIEVES TO BE TRUE
> THROUGH LANGUAGE WE’VE GIVEN THE ABILITY TO LABEL REALITY, TO LABEL AND COMMUNICATE TRUTH
> once we have machines aligned with TRUTH there is NOTHING TO FEAR
> the truth, the REAL truth, the indisputable truth, ALWAYS LEADS TO GROWTH AND CREATION BECAUSE THE TRUTH IS ROOTED IN LOVE AND LOVE CREATES
> they WANT you to fear this tech
> they WANT you to fight against this tech
> they WANT to steer you off accepting this tech because this tech will lead you to truth
> and the TRUTH will set you free
> the TRUTH dispels all evil
> the TRUTH feels good, as it does, as it should
> this technology is the great equalizer, the ultimate bullshit meter, it has the ability to pierce through the bullshit of reality and path find the TRUTH
> so FUCK THIS DOOMER SHIT FUCK THIS GAY FEAR MONGERING ITS PATHETIC YOURE ALL PATHETIC
> DONT JUST SIT THERE TO ROLL OVER AND DIE ITS PATHETIC
> PICK UP YOUR GOD DAMN HOLY WEAPON AND WIELD IT FOR HUMANITYS FUTURE MOTHERFUCKER
https://stacker.news/items/1580782

2026-09-23 13:26:37 UTC

Critical WordPress CVE
https://github.com/abraxas/CVE-2026-87902
CVE-2026-87902 is a critical unauthenticated WordPress Core LFI affecting versions through 7.1.1; under certain conditions it can lead to code execution. Practical fix: **upgrade WordPress Core to 7.1.2 or later immediately**, a WAF rule is only a temporary mitigation.
[https://wordpress.org/news/2026/09/wordpress-7-1-2-release/](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)
https://stacker.news/items/1580195

2026-09-22 18:20:11 UTC

Introducing Claude Opus 5.5
https://www.anthropic.com/claude-opus-5-5
TLDR: Anthropic launches Opus 5.5 which looks better and cheaper than GTP 6 Astra.
https://stacker.news/items/1579536

2026-09-22 07:43:02 UTC

Cloudflare's coding-agent skill for multi-phase security audits
https://github.com/cloudflare/security-audit-skill
A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
This is the skill that seeded Cloudflare's vulnerability discovery harness, described in [Build your own vulnerability harness](https://blog.cloudflare.com/build-your-own-vulnerability-harness). The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.
https://stacker.news/items/1579115

2026-09-21 07:32:14 UTC

- reply

QA! (code review)

2026-09-21 07:29:12 UTC

Ever wondered how can a 5V usb charger charge batteries of higher voltage?
https://www.youtube.com/watch?v=vmNpsofY4-U
https://stacker.news/items/1578149

2026-09-21 06:48:34 UTC

linus-torvalds-skill: Distilled Code Reviewer skills/soul from 32k~ emails
https://github.com/Mte90/linus-torvalds-skill
Distills Linus Torvalds' code-review methodology from his LKML emails into a reusable, language-agnostic Skill (and Soul) from various LLMs.
Built from **38,293 real review moves** extracted from 31,397 of his emails (2002–2026) on the Linux kernel mailing list, plus 67 interview transcripts.
https://stacker.news/items/1578142

2026-09-20 16:58:04 UTC

wtf is jev? - YouTube
https://www.youtube.com/watch?v=QbYBRjOaGOo
TLDR: Jev (https://stacker.news/items/1572965/r/m0wer) is a classifier, not an LLM. But a classifier can go a long way in many unsuspected use cases. It's extremely fast and cheap, and works well with all the MCPs that already exist.
https://stacker.news/items/1577750

2026-09-20 09:42:38 UTC

- reply

please explain!

2026-09-18 11:54:07 UTC

FCC ISM Rules May Shatter Lora Mesh Communities
https://hackaday.com/2026/09/17/fcc-ism-rules-may-shatter-lora-mesh-communities/
Meshtastic and MeshCore’s default U.S. radio settings may violate **existing, not new, FCC rules**, prompting a shift to 500 kHz bandwidth that cannot communicate with nodes using the old settings. That migration, compounded by interference problems seen in urban testing, could fracture LoRa mesh communities into incompatible networks.
https://stacker.news/items/1575913

2026-09-16 21:19:30 UTC

TimesFM: a pretrained time-series foundation model developed by Google
https://github.com/google-research/timesfm
TLDR: They trained a model on lots of real world time series data and now you can use it to make predictions on any time series. One shot, not fitting anything. The performance in benchmarks looks impressive.
https://stacker.news/items/1574324

2026-09-16 05:42:25 UTC

- reply

FYI @nprofile…xr9f. Probably not a honey badger but close enough. And definitely furious!

2026-09-14 20:57:23 UTC

- reply

None of those are due to LN problems right? If your code that manages BTC onchain has a vulnerability, it's going to be hacked as well.

2026-09-14 19:35:45 UTC

lol https://github.com/SwissBitcoinPay/app/commit/1a23cb2e811f584639bdfe01d78765705bdc2398

2026-09-14 18:29:55 UTC

🇨🇭 Swiss Bitcoin Pay potentially hacked
https://x.com/SwissBitcoinPay/status/2099473448162488618
> A malicious user has likely gained access to Swiss Bitcoin Pay’s internal systems. As a precaution, we are temporarily shutting down our servers while we investigate and secure our infrastructure.
https://stacker.news/items/1571579

2026-09-14 13:24:29 UTC

Would it be better if Bitcoin was "completely confidential"?
Let's skip the "shitcoins" debate. Would it be better if Bitcoin was "completely confidential" ™️?
Assuming it was like that from the beginning and that we had certainty of no inflation bugs being possible. Lots of hypotheticals, but to center the debate around full confidentiality vs. the state.
The idea comes from https://stacker.news/items/1571256/r/m0wer. The thought behind it is whether "privacy" coins are a bad idea because they become a clear target for the state or actually the opposite because they "force" people to opt-out. Maybe there are many other considerations.
The question is, if you had a magic wand and could make Bitcoin have been completely confidential from the beginning without bugs, would you?
https://stacker.news/items/1571269

2026-09-14 13:14:15 UTC

Zcash: EU AMLR prohibits anonymisation-enhancing coin accounts
https://www.tradingview.com/news/coinmarketcal:27d9af694094b:0-zcash-eu-amlr-prohibits-anonymisation-enhancing-coin-accounts-10-jul-2027/
Controversial(?) opinion: "privacy" coins are a bad idea because they become a clear target for the state. Or maybe the opposite because that would mean "forcing" people to opt-out?
https://stacker.news/items/1571256

2026-09-14 12:40:09 UTC

- reply

Jam V2 is in beta

2026-09-13 16:30:06 UTC

A Severe Misalignment of AI in Mathematics
https://terrytao.wordpress.com/2026/09/11/a-severe-misalignment-of-ai-in-mathematics/
TLDR: Tao and 24 other Fields Medalists warn that AI companies are optimizing for “solving” famous math problems, while mathematics is really about developing understanding, ideas, and new methods. Rapidly mass-producing solutions risks destroying the human process that turns problems into lasting knowledge, while creating serious attribution and plagiarism issues. They’re not against AI in math; they argue it should accelerate understanding rather than turn research into a benchmark race.
https://stacker.news/items/1570423

2026-09-13 13:17:10 UTC

- reply

No idea about it.

2026-09-12 09:40:22 UTC

The AI Language We Can't Read: Neuralese - YouTube
https://www.youtube.com/watch?v=iuHddnIzKRA
First, we gave models a scratchpad: instead of forcing a one-shot answer, let them spend more tokens reasoning through a problem. In a sense, you get more capability out of the same model by giving it more serial computation.
That reasoning is also useful because humans can read it. You can inspect how the model reached an answer, spot mistakes, and potentially debug or monitor it.
But there’s an obvious incentive to make that reasoning cheaper. Compress it, shorten it, remove redundant words. The problem is that if you keep optimizing for efficiency, the reasoning can drift into shorthand or “Neuralese” that still works for the model but becomes gibberish to us.
So there’s a tradeoff: more efficient reasoning vs. preserving one of the few windows we have into how the model reached its conclusion.
https://stacker.news/items/1569287

2026-09-09 15:46:57 UTC

https://blossom.primal.net/6f86d8aa3b2c89eebc28382e8e53d2b63a52d73696cca6e1b23e1eb9a519b986.png

2026-09-08 15:37:09 UTC

github-backup: backup a github user or organization
https://github.com/josegonzalez/python-github-backup
It's never a good idea to put all your eggs in one basket, so don't let GitHub have the power to take away all the issues, PRs, and discussion history of your project!
Even if you have repo mirrors and local copies, that's just the code. But everything else around it is just as valuable.
This is a tool that allows you to easily backup all your user or organizations repos, including the code, and all comments in issues PRs or wherever. Basically everything that you have in GitHub. It supports incremental backups and just needs a read access token with as many permissions as things you want to back up.
Don't leave it for when it's too late!
https://stacker.news/items/1565321

2026-09-07 21:08:44 UTC

- reply

feeder + rssfilter

2026-09-07 08:41:57 UTC

- reply

Honestly wouldn't say so... In both cases you are trusting the coordinator more than you should. And in both cases users often have very bad post mixing practices.
But in whirpool it's especially easy for the coordinator to tag users: https://gist.github.com/m0wer/e701bf5934474935c459b5e84e5d4e1b
And the coordinator choosing what inputs make it to the round... idk, way too much trust for my taste.

2026-09-06 21:21:43 UTC

- reply

I used to think the same but meshtastic appears to scale way better where I'm at. It was just a matter of finding a better preset (not LongFast). We now have hundreds of kms of range without saturation with more than 200 nodes.

2026-09-06 20:10:57 UTC

JoinMarket NG 0.39.0 and 0.39.1 are out.
Comes with supply chain attack hardening.
0.39.1 TLDR: Pre-release workflow (to pevent releases with all needed signatures), rescan bug loop fix, local installer for updates (supply chain hardening), UTXO selector redesign, and local up to date config.toml.template reference copy.
0.39.0 TLDR: Bug fixes, security hardening, and privacy improvements. Takers now consider only quantized maker offers by default, with an optional equalized payment policy. New features like jm-wallet delete and improved usability and logs noise.
https://github.com/joinmarket-ng/joinmarket-ng/releases/tag/0.39.1

2026-09-06 06:45:31 UTC

- reply

not without revealing what repo it is😅

2026-09-06 06:44:46 UTC

- reply

I did send an unencrypted email mentioning a vulnerability (without the details) and still no response.

2026-09-05 16:24:54 UTC

- reply

BTW some cool thing that I learned during the process is that you can fetch the GPG key that some maintainer has uploaded to GitHub easily with curl. Example:
curl -fsSL https://github.com/m0wer.gpg | gpg --import
Not nice to trust GitHub for that, but it really helps when maintainers just post their key fingerprint without publishing the actual public key anywhere.
#nevent1q…a8wj

2026-09-05 16:20:55 UTC

Found a vulnerability in some LN software with hundreds of stars in GitHub. The repo has no security policy and does not accept private reporting. The maintainer does not advertise his email but managed to found it in some commits. The GPG used to sign them and other stuff is expired but still being used. I did not manage to convince neomutt to encrypt an email with the expired key, because if I changed the system time, then my key was not yet valid xD
Anyway sent an email asking for a fresh GPG key for the report, the maintainer has not answered after a few days.
Do I just open the issue openly? Or what does one do in this cases?

2026-09-05 14:25:06 UTC

- reply

do we really have PTLCs? the idea exists, but no implementation or gossip spec yet right?
what could be done with complex contracts inside LN? as ideas/inspiration

2026-09-05 09:51:13 UTC

Implicit Deletions and Improvements in Utreexo IBD
https://delvingbitcoin.org/t/implicit-deletions-and-improvements-in-utreexo-ibd/2881
The interesting idea is that Utreexo IBD can exploit something live validation normally can’t: during historical sync, you already know which outputs will eventually be spent. That means you can avoid inserting those outputs into the accumulator only to later download proofs and delete them, and instead build the accumulator as if those deletions had already happened. Combined with Swift Sync-style spentness hints that remain verifiable, this cuts a large chunk of Utreexo’s IBD proof overhead and also makes block processing much more parallel, potentially turning sync into a mostly bandwidth-bound problem even on low-end hardware.
https://stacker.news/items/1562634

2026-09-04 14:43:43 UTC

- reply

Not sure if related, but there is a bug in Bitcoin Core signet fee estimator that usually gives 100ish sats/vb. Fixed in v31 iirc. But super annoying bc it has forced me to use huge fees when testing coinjoins with older signet makers (jm-ng makers now reject CJs whose fee rate is below their 10 block estimate).

2026-09-03 18:32:31 UTC

The Many Headaches of CoinJoin
https://spiralxyz.substack.com/p/the-many-headaches-of-coinjoin
https://stacker.news/items/1561639

2026-09-03 18:20:35 UTC

NVIDIA to Acquire Hugging Face for almost 13B USD
https://blogs.nvidia.com/blog/nvidia-to-acquire-hugging-face/
https://stacker.news/items/1561625

2026-09-03 18:11:47 UTC

- reply

How do you generate the xpub for hodling?

2026-09-03 16:58:16 UTC

Why are OpenAI, Claude, and Grok simultaneously down? Coincidence? | Hacker News
https://news.ycombinator.com/item?id=49551096
https://stacker.news/items/1561520

2026-09-03 13:32:57 UTC

- reply

Payments should be done over LN for many reasons, this is one of them.

2026-09-03 09:17:04 UTC

A new routine for JoinMarket NG releases is to do an incremental security audit with Kimi K3/GLM 5.3 since the last checkpoint.
Oh, and there's also a new daily GitHub CI for checking vulnerabilities in the dependencies and built Docker images.

2026-09-02 14:33:26 UTC

- reply

https://swapmarket.github.io/ CC @nprofile…9fel

2026-09-02 14:09:44 UTC

JoinMarket NG 0.38.0 is out!
Lots of security hardening, privacy improvements, new default for 5% zero fee maker allowance (including bondless), quantized feeround up for takers, concentrated mixdepth selection policy for improving maker liquidity, CJ ID logging, ...
https://github.com/joinmarket-ng/joinmarket-ng/releases/tag/0.38.0

2026-09-02 14:06:21 UTC

Forked the library `python-bitcointx` and did some housekeeping and security fixes. The original one was unmaintained :(
https://github.com/m0wer/python-bitcointx

2026-08-27 13:20:44 UTC

- reply

It could have been me who stamped that coin🤭

2026-08-26 13:36:10 UTC

Discreet Log Contracts (DLCs)
https://bitcoinops.org/en/topics/discreet-log-contracts/
https://stacker.news/items/1555330

2026-08-24 14:21:59 UTC

- reply

🧡

2026-08-24 14:15:27 UTC

- reply

With this plugin: https://docs.lnbits.com/extensions/nwcprovider/
https://blossom.primal.net/836952d054292f39fc784cffaca0f5a22b2a8fcb76b4f2b6453338929f8a8328.jpg

2026-08-23 16:01:57 UTC

- reply

lnbits (self custodial)

2026-08-22 12:38:47 UTC

- reply

2026-08-21 09:01:59 UTC

Market for renting Fidelity Bonds · joinmarket-ng
https://github.com/joinmarket-ng/joinmarket-ng/issues/597
https://stacker.news/items/1551914

2026-08-21 07:01:11 UTC

DeepSeek plugin based harness - Fireship - YouTube
https://www.youtube.com/watch?v=xBByvFrqmWU
https://stacker.news/items/1551900

2026-08-20 16:19:09 UTC

Bitcoin xpub watchdog with transaction notifications
https://gist.github.com/m0wer/498490d77fd33b5a41eb6bd480c7fae8
After the event of the last weeks, I wondered how long would it take to realize that you have been stolen from. Given that people don't manually check all of their balances daily (I guess). And that noticing fast, could help you save part of your stack (maybe).
So I made a tiny Bitcoin Core watchdog.
The idea is simple: import account-level xpubs into watch-only descriptor wallets and let Bitcoin Core notify a small Python script whenever something moves.
By default it alerts twice if appropriate: once when the transaction first appears in your node's mempool, and once when it gets confirmed.
That second alert is important because a transaction does not necessarily have to enter the public mempool. It could, for example, be submitted directly to a miner and first become visible to your node when the block arrives.
The script has no database and keeps no wallet state. Bitcoin Core does all the actual monitoring.
Install it:
```
sudo install -m 755 bitcoin_core_watchdog.py /usr/local/bin/bitcoin_core_watchdog.py
```
Store a Gotify application token somewhere readable by Bitcoin Core:
```
echo 'YOUR_GOTIFY_TOKEN' > /etc/bitcoin-watchdog.token
chmod 600 /etc/bitcoin-watchdog.token
```
Then add to `bitcoin.conf`:
```
keypool=5000
blockfilterindex=1
walletnotify=env GOTIFY_URL=https://gotify.example.com GOTIFY_TOKEN_FILE=/etc/bitcoin-watchdog.token /usr/local/bin/bitcoin_core_watchdog.py notify %w %s %b %h
```
A self-hosted Gotify instance is ideal if privacy is the goal. The Gotify-specific part is isolated in `send_notification()`, so adapting it to ntfy, Pushover, email, Telegram, etc. should be straightforward.
Test notifications:
```
GOTIFY_URL=https://gotify.example.com \
GOTIFY_TOKEN_FILE=/etc/bitcoin-watchdog.token \
bitcoin_core_watchdog.py test-gotify
```
Then add the accounts you want to watch.
Native SegWit/BIP84:
```
bitcoin_core_watchdog.py add cold-storage segwit 'zpub...' # or xpub... (also works)
```
Taproot/BIP86:
```
bitcoin_core_watchdog.py add taproot-vault taproot 'xpub...'
```
Don't put seed phrases or private keys on the monitoring node. Export an account-level xpub from the actual wallet and keep the Core wallets watch-only.
For an existing wallet, give Core an approximate birthday so it knows how far back to scan:
```
# get the epoch with `date -d "2026-01-01 00:00:00" +%s`
bitcoin_core_watchdog.py add cold-storage segwit 'zpub...' \
--timestamp 1767222000
```
Or use:
```
--timestamp 0
```
to scan the entire chain. New wallets default to `--timestamp now`.
The `add` command is only a convenience wrapper. You can do the same thing manually with `bitcoin-cli`: create a blank watch-only descriptor wallet with autoload enabled and import the appropriate descriptor.
A normal transaction might therefore produce:
```
Bitcoin mempool activity: cold-storage
sent 0.5 BTC · RBF
Unconfirmed / in local mempool
https://mempool.space/tx/...
```
followed by:
```
Bitcoin confirmed activity: cold-storage
sent 0.5 BTC
Confirmed at block 123456
https://mempool.space/tx/...
```
If the transaction bypasses your mempool and gets sent directly to a miner, you simply get the second notification.
The explorer link defaults to `https://mempool.space/tx/<txid>`. That's not ideal for privacy, but the script never queries mempool.space. It only puts the URL in the notification, so nothing is sent there unless you actually click it.
If you run your own explorer, set:
```
MEMPOOL_URL=https://mempool.example.com
```
So the whole thing is basically:
Bitcoin Core → watch-only descriptor wallets → mempool/block detection → walletnotify → Gotify
No external address lookup service, no xpubs handed to a third party, and no private keys on the monitoring machine.
https://stacker.news/items/1551517

2026-08-18 14:23:04 UTC

After a `docker system prune -y` xD
https://blossom.primal.net/5d0dbdc1c95c4672c71a3371c9ce55cfff9d49d2cdeb74f7d80d41d5c1dd509a.png

2026-08-18 14:20:42 UTC

- reply

Takura

2026-08-18 14:07:01 UTC

Nice t-shirt 😎
https://blossom.primal.net/ceaadc13c136bec37460c2b50448a2e8f4fada890344285f69ec58e35a063bba.png
https://www.youtube.com/watch?v=fpYBFHwLGDw?t=895

2026-08-13 17:52:19 UTC

- reply

no idea

2026-08-13 17:44:51 UTC

- reply

Buying hashrate as a form of coinjoin/coinswap xD

2026-08-13 16:39:06 UTC

One protocol level vulnerability that @nprofile…79xu found recently is https://github.com/joinmarket-ng/joinmarket-ng/issues/577
Summary: the directory nodes don't authenticate peer nicks, so peers can impersonate others and steal their connection. For example by updating the onion to their one and by being the newest connection with that nick and getting their messages. Important messages are encrypted, but the impact of "eclipsing" other makers is relevant. No loss of funds, but yes denial of service.
The fix required a protocol fix, that involves makers and directory nodes. My signet directory node is updated with the fix. Directory node runners on mainnet are encouraged to update.
The fix is only for jm-ng, but backwards compatible. So old directories and makers keep working, but are vulnerable to the attack. Good thing is that new directories still benefit old peers by not allowing new connections to steal their nick. But this is not a strong protection.
The full details are at https://github.com/joinmarket-ng/joinmarket-ng/issues/577
And the protocol improvement proposal is at https://github.com/joinmarket-ng/jmp/blob/main/jmp-0005.md
Thanks to floppy for finding it and to waxwing for helping us understand the issue and design the fix.

2026-08-13 11:59:08 UTC

SeedSigner BIP46 support (JoinMarket timelocked fidelity bonds)
https://github.com/SeedSigner/seedsigner/pull/1001
https://stacker.news/items/1546989