LeoWandersleb
Leo Wandersleb

https://walletscrutiny.com

https://nostr.info

Working on Bitcoin, Nostr and being a good dad.

Public Key

npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6

NIP-05 Address

Profile Code

nprofile1qqsydl97xpj74udw0qg5vkfyujyjxd3l706jd0t0w0turp93d0vvungpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq35amnwvaz7tmzv9ehxurfwd6x7mpwdaexwtmfde3x77qpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qzyrhwden5te0dehhxarj9emkjmn9qy0hwumn8ghj7urewfsk66ty9enxjct5dfskvtnrdakj76twvfhhsqgkwaehxw309ashgmrpwvhxummnw3ezumrpdejq6r4h3a

Publishing to

pyramid.fiatjaf.com/inbox

atlas.nostr.land

Author Public Key

npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6

Show more details

Last Notes

2026-10-27 19:44:11 UTC

- reply

I did a round of improvements but also stopped contributing but here it is with my improvements.
https://github.com/Giszmo/habla.news
Hosted at https://habla.nostr.info/

2026-10-27 19:33:04 UTC

- reply

PRs are so last year unless you meant "prompt requests".

2026-10-25 13:06:57 UTC

- reply

Are we Matrix batteries or did our fathers cushion our world or is the universe at its heat death and we merely conserve energy? I'd love to know.

2026-10-25 13:01:53 UTC

- reply

Yes, but ... why?

2026-10-25 12:51:20 UTC

Why do we live in a simulation?

2026-10-25 12:50:47 UTC

- reply

Which of those books explains how they get coins I hold myself? The ones parked at BlackRock, sure.

2026-10-25 11:23:40 UTC

- reply

Have you tried Buzz?

2026-10-25 09:03:26 UTC

- reply

Coinkite Q isn't open source. Maybe you meant public source?

2026-10-24 19:41:31 UTC

- reply

Been to a bird show today, too. Poing bei München. Recommended.
https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/417088f42c2d3093b08a5f51f0a9b3b2202275df635b3698c664e6c758a2f99e.mp4

2026-10-24 08:31:29 UTC

- reply

They say it's voice only. I wonder how that works. I worked with full duplex voice llm but the trick is that you feed in intelligence as a third silent participant to the conversation. Would dessa need a second audio stream for that?

2026-10-23 14:11:52 UTC

- reply

Sounds like not a parent 😜

2026-10-22 09:14:58 UTC

- reply

I don't dare to.

2026-10-22 09:05:46 UTC

Hmm, ... who could possibly want this to happen? 🤔
#nevent1q…dgu9

2026-10-21 11:44:42 UTC

https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/4ae372632449b51a7db8a32f853f5d41cbb3d3f002c96de6d4e0bff505026948.jpg
Scary shit 👻
#nevent1q…kljt

2026-10-20 19:59:54 UTC

#nevent1q…usvz
There's no excuse to not try it out now

2026-10-20 07:01:56 UTC

- reply

2026-10-20 06:53:14 UTC

TIL: Sudan has the largest humanitarian crisis anywhere, by a wide margin.
#nevent1q…602n

2026-10-20 06:28:36 UTC

- reply

Jumble doesn't jump to the timestamp. It's 49min in where they talk about kids.

2026-10-20 06:27:06 UTC

- reply

Don't force them. Period. There's timeless lessons but you can't learn them for your kids.
Also:
https://www.youtube.com/watch?v=f2UK2saipp4&t=2940s

2026-10-11 09:49:35 UTC

- reply

@npub180c…h6w6 the point of njump is to make nostr SEO. What would drive people more to jump at it than finding nostr events that mention them by name? What do you think? Could this work to drive adoption? Implementation should be almost trivial. A bit controversial around stalking concerns but that's why nostr could better tackle the "find my friends" than platforms.

2026-10-11 09:33:59 UTC

#growNostr
StayFriends (German classmates.com) lets you write to an old classmate for free, but he has to pay to read it. LinkedIn ate their lunch by accident. There is no working "find your class of '96" tool left anywhere. I want one and I think it is the best normie onboarding funnel for nostr nobody has built yet.
The constraints that make it fun:
1. Your classmates are not on nostr and never will be on purpose. The word "nostr" shows up only after the user used the tool: "btw, this login also works in Amethyst/Jumble/Damus".
2. Google has to be able to find it. Crawlers do not open websockets, so relays are invisible. A branded njump fork with one aggregate route ("everyone who tagged school Q123456, cohort 1986") does the indexing, and the kind templates can go upstream. Now, somebody googling his name can find the tool and might engage.
3. It should not become a doxxing honeypot. About other people only what a yearbook says: name, school, cohort, class letter.
Un-paywallable by design. Claims live on relays, the indexer is MIT, anyone can rerun it. The data is never worth less to the user over time.
Generic model ("I was at <geohash> during <period>"), schools-only v1, because school is the one category where ~30 people knew each other by name and the privacy math works. Festivals, company units, city blocks could fit the scheme.

2026-10-06 18:22:21 UTC

- reply

Anything beyond 100 or certainly Dunbar's number is pointless to pretend any strong privacy could be achieved with cryptography.

2026-10-03 17:35:42 UTC

- reply

Why not a bazillion dollars each?

2026-09-25 16:28:28 UTC

- reply

Can you explain what this is doing? Does njump refuse to show certain content? Why? Isn't the content coming from elsewhere anyway?

2026-09-25 08:55:54 UTC

- reply

Maybe you're the cunt? 🤔
... or which paid product with guaranteed availability were you referring to?

2026-09-24 20:08:48 UTC

20 years ago I had a game idea for a physics based agario. Today I almost one-shot it with Opus 5.5. Crazy times. You can just do stuff.
https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/c07f32715db0428c5483864e8edd8417ae79cb4007ce22be991f06263d77b9f8.png

2026-09-24 07:01:10 UTC

- reply

Fable's tldr:
Three of the four items hold up as real marks against the project, one is overstated, and the note's "malicious PRs being merged" claim isn't supported by anything it cites. Item by item:
**Issue #14410 (Mar 16, 2026)**: OS command injection in the URL opener on Linux/macOS. The URL opener builds a shell command by string-concatenating an attacker-controlled URL into xdg-open/open and then executes it through sh -c with no escaping, reachable by pasting a crafted coordinator connection string and clicking "Read More". Bad mark: a shell-out with unescaped input in a privacy wallet, found by Ledger's automated Donjon scanner rather than the team. Mitigating: lontivero merged the fix (#14411) the same day, and it needs user interaction. [github](https://github.com/WalletWasabi/WalletWasabi/issues/14410)
**Issue #5533 (Apr 2021 to Jul 2026)**: filed by Yuval Kogman, one of WabiSabi's designers. Clients verified ownership proofs against a scriptPubKey the coordinator itself supplied, so a coordinator could invent UTXOs, forge proofs, and run tagging or sybil attacks. Stale-botted three times in 2021, auto-closed, reopened, then sat for five years until #14886 (merged Jul 30, 2026) added verification of a random 10% of inputs, and only when an RPC node is connected. Light clients still don't verify. Kogman's reaction on the fix: "wow, amazing that suddenly this became possible".
**PR #14333 (Feb 2026, still a draft)**: not malicious, the opposite. A defensive, client-only mitigation for round-ID equivocation (coordinator feeds each Tor circuit different round parameters, links inputs, anonymity set drops to 1), from Kogman's bitcoindev analysis. Reviewed by Carti-it, tested by Kruwed, false positives fixed. Then lontivero: "This PR is not a priority and it is a bit risky", parked as draft on Mar 3. Kukks shipped the same idea in Kompaktor. Related #14771 (Jul 2026): the maintainer closed a blame-round attack report in 20 minutes as a non-issue, reopened it two days later after Carti-it showed clients don't check blame-round inputs. Partial fix in #14786; m0wer notes the core problem (all clients seeing the same preceding round) is still open and lists six earlier attempts that went nowhere.
**Discussion #13249 (Jul 2024)**, listed twice in the note: the team's own incident disclosure. (1) L7 DDoS on free coordinators. (2) The Windows installer Wasabi-2.0.8.1.msi on GitHub Releases was swapped for a different file via a compromised write-access account. Caught by the external BinaryWatch bot, not internally. Nobody kept a copy, so the payload was never analyzed. (3) A coordinator-fee vulnerability the team admits it already knew about, left unpatched because releases were "too cumbersome", got exploited in the wild by wasabicoordinator.io charging maximum fees before 2.1.0 shipped.
**Scoring the note's framing:**
- "Exploits ignored for years": supported (#5533 plus the list in #14771).
- "Supply chain attack": supported, in the maintainers' own words. Strongest item for wallet verification: a release artifact replaced on GitHub, noticed only by a hash-watch bot.
- "Exploits that de-anonymize": supported, mitigations still partial as of today.
- "OS level code injection": a real bug, but fixed within hours and requires user action. Overstated as a headline.
- "Malicious PRs being merged": nothing cited shows that.

2026-09-18 12:50:46 UTC

- reply

It just took very long. My clanker measured on its end and said it took 11s to load the demo page, so I wasn't patient enough.

2026-09-17 16:38:35 UTC

- reply

Not sure it works. I clicked that demo thingy and it just spins forever so I didn't manage yet to try it out. ... ok, it loaded eventually but in the bottom left there's a box saying this site was blocked by chromium.
My goal is to get people to vibe-code useful stuff and share it but to by default make it easy to iterate on what they did. So here's my kalaha: https://npub1q562z68f3ufqduvjt2yw3k9twmlzzlay0aza0828uurzs704tzaqvacfeq.nsite.lol/
Click in the top right corner to make a clone with modifications.
Maybe the most useful way would be something that offers your wysiwyg editing and my LLM support integration?

2026-09-17 13:31:46 UTC

#nevent1q…ud23
https://npub1t2xw9kgp2t7x86d2zupks494vyuppd3mnk8l7wqp4jm0kzpjjx9qnz8kcq.nsite.lol/

2026-09-17 13:29:51 UTC

- reply

What? Did I not link the nsite?

2026-09-17 13:23:42 UTC

https://imgflip.com/s/meme/Yo-Dawg-Heard-You.jpg
Yo dawg, I vibed a vibe coding nsite so you can vibe code vibe nsites.
@npub16g4…kv4h please let me know what you think.

2026-09-13 14:46:31 UTC

https://youtu.be/98syxABbUPk?is=MUs1VVPmHuNalFKU
#AiDoomPorn

2026-09-03 17:10:24 UTC

- reply

Wild they have to justify taking custody of their gold.

2026-09-02 12:55:10 UTC

#nevent1q…5ud4
Yet another bot on nostr. I had it send me DMs with these morning briefs but thought, if others are interested in similar topics, why not as kind1?

2026-09-02 08:09:21 UTC

- reply

12 oil and 12 mom have transactions on testnet 2 I think.

2026-09-01 16:47:49 UTC

- reply

nostr: #naddr1qq…45u2

2026-09-01 14:40:13 UTC

- reply

There is no "sign up for buzz". It's only self-hosted FOSS as of now.

2026-08-31 15:28:04 UTC

- reply

Sell on openrouter?

2026-08-31 08:55:49 UTC

- reply

Clearly nostr botched DMs with now some 5 competing "standards". I wish, all clients would for the sake of compatibility just keep nip4 at least as a fall-back. The fact that you can DM people from clients that experiment with new ways of sending DMs traps people feeling not heard.

2026-08-07 09:40:46 UTC

- reply

The subscriptions give you many more tokens than the API. If you switch to API, you pay more for Claude than for Kimi.

2026-07-20 14:32:29 UTC

- reply

What's the benefit of routstr over ppq?

2026-07-16 17:17:23 UTC

- reply

My Amethyst doesn't have my keys. I only use apps that support bunker.

2026-07-14 18:10:59 UTC

- reply

Mind sharing your content here?

2026-06-25 07:26:06 UTC

- reply

Core30 is not big blocks. It's the same 1MB as "always".

2026-06-02 12:13:48 UTC

So let me get this straight: @npub13nd…0svh 's Pubky uses Pkarr which basically stores your home server in the BitTorrent DHT, keyed under your public key. Then, your home server can be whatever but John likes REST.
Nostr started out with pubkeys, then realized it would be good to have the pubkey distinguishable from the privkey and invented npub. Then "invented" storing that npub behind some DNS entry (nip5) and then figured out it would probably be a good idea to also store the ~homeserver~ list of relays there.
Pubky is better because ... we can't store our list of relays in BT DHT just in case? Or why is it better exactly? I don't get it.

2026-04-28 08:14:13 UTC

- reply

Is that list also on github? Is there a license to it? I'd like to feed your findings into nostr.info's such list where it would be easier to navigate.

2026-04-23 10:58:28 UTC

- reply

Your position is 100% mine, too.
How could we coin it in a way can easily rally behind it without writing walls of text every time?

2026-04-15 13:15:10 UTC

- reply

I would probably be supportive of preventing address reuse on the protocol level. Currently it's such a hard sell to tell people to not re-use addresses. I sell bitcoins and most of my trading partners re-use addresses.
But I'm also a bit guilty as I'm sometimes using Phoenix where technically I might not re-use an address but it's trivial to track what's spending and what's change for those and many other transactions.
Also please stop your affinity for round $$ amounts. The 200$ UTXO is always the payment when the other amount is something odd in $$.
Etc. etc.

2026-03-26 15:02:52 UTC

- reply

I tried it out but "Connection failed. Please reload." twice when trying to use it with my Amber.

2026-03-26 09:06:05 UTC

On desktop, Jumble.social is currently my daily driver and I love the "24h Pulse".
https://i.nostr.build/ih7fdXbSvhPp9xv7.png
I can just check in with the people I care about without finding my timeline flooded by Gigi's boosts for example. I find this makes the experience more "social" as it gives a focus to the author I'm following and not only the content that's streaming at me.
I wish there was a variant of this though. Let's call it "Friend Pulse": I want to peek into what **all** my follows are up to - and quite literally feel their pulse as in check if they are still around. Show a list of all my follows but show the most recent post of each. When I select one, load a page worth of more of their posts. This way I can cycle through my follows and check in on them or unfollow them if they abandoned nostr for good.

2026-02-21 18:40:14 UTC

- reply

But relays allow me to provide very long lists of pubkeys to filter what I want to see. I can get all from my WoT and work from there.
The influencer asking for global reaction count is so dead-bird-app vibes. Who cares? It will always get spammed no matter what as long as it carries meaning to some people. Don't cater to that vanity metric. Let the influencers brag about their imaginary influence. Nostr as a protocol or its infrastructure shouldn't care about that. Relays should care that they get paid for the bits stored and forwarded. Nothing more.
By elevating the role of the relay I fear we get censorship on a per-relay basis and if client devs get lazy about handling spam from open relays, we might get relay concentration. I know it's not the end of the world as others can always make a more open relay so I'm not fighting your vision but I hope I can convince enough devs to make the alternative happen. Have a flag on requests to limit results to follows of follows so I don't need to upload 10k pubkeys with every request.
Client-side filtering as a secondary barrier does nothing if the relays use standard filter heuristics, blocking what I want not to be filtered.

2026-02-21 17:40:56 UTC

- reply

I strongly disagree! Relays are the ether we use to broadcast and should remain dumb. My client should stop showing me obvious spam by analyzing WoT.
I literally don't want to see likes, comments, boost count etc. from accounts I don't at least indirectly follow. If my follows share Eve's post, I care because I follow Alice but if Eve replies to Alice, I don't want to see it unless Alice gives it a like or reply again. ... unless Eve is followed by Alice and maybe if Eve is followed by a follow of Alice's.
I don't want relays to apply heuristics to block accounts or posts or to have spammers get to spam because they pay the relay. We should not be talking about individual users' choice of relays. That's degrading nostr. New users want to come to "nostr" and not have to care about picking a good relay. They will need some relay, sure but it should really be arbitrary.

2026-02-20 17:00:09 UTC

Right now, everybody has their bots providing "signal" on nostr but the client devs are not catching up fast enough :( When I block bots on Amethyst, could they pretty please also be blocked on Jumble etc.? Also I'd like to report bots as being bots and report features lack that option on Amethyst. Also when you block, please publicly block them for signal.

2026-01-09 21:47:40 UTC

There's 10 kinds of people:
Those who understand binary and those who don't.

2026-01-06 23:13:46 UTC

- reply

How is bitchat doing in iran?

2025-11-03 09:09:58 UTC

- reply

I have vexl installed since 1.5a but no success. The only two contacts that resulted were via our "common friend" "mailbox".
How about nostr support? Ask for my npub and look for my follows. This should be much more productive than the telephone numbers I collected over a life time.

2025-09-24 15:01:34 UTC

- reply

Doesn't your provider have a section for that on their site? Did you call them?

2025-09-04 07:34:56 UTC

https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/762867c565565fcb9edb35c7e8a499e892d168758f26cb020412f30ca6dcd1c6.png
It's incredibly sad to see such low effort click bait on nostr - and some zapping this "car crash".
No, @npub1lh2…a9nk is not a bad actor (except for blocking me on Twitter, which he can't do here on nostr. Muahahaha). He's a bit special but was often right on things where my initial impulse told me that he was wrong and most definitely wants Bitcoin to succeed more than most anything else, so I would vouch for him not being a bad actor 100%.
Is Luke being abused by a bad actor in this case? Is Mechanic a bad actor? I don't know. The debate about CSAM on the blockchain feels a bit like that. We had that debate many years ago, apparently nasty stuff is in the blockchain but my bitcoin tools don't show it to me and I wouldn't download tools that would parse the blockchain for images. The argument that you would need special software for the prior cases but not for the future cases is stupid as - guess what - you will always need "special software" to view images in something that's not purpose built for images. A "blk04169.dat" won't accidentally get opened with image software and with "special software" you can even find images in actual transactions that nobody put images in in the first place.
To discuss filters in the context of what is legal in your jurisdiction is a slippery slope and can only harm Bitcoin.
So do I stand with Core in this debate? Actually no, not yet at least. But luckily it's not that binary neither. I won't run knots but I won't update my full nodes any soon neither. Policy filters are a 🖕 to people abusing or attacking Bitcoin and node operators should not get policy filters taken away precisely to avoid this heated debate. Policy filters are an escape valve for things that some would like to see as consensus rules but can't quite convince all to go that route. Let people filter out big OP_RETURNs if they want to. Set the default to 100kB and see what happens. Welding close this escape valve was Core's error and now they get the heat.
Yes, filters don't work but they send a message. Your dick pics are not wanted here. If Core wants them, let the individual miners at least send that statement clearly.

2025-08-28 23:57:57 UTC

- reply

I don't feel comfortable putting my private keys into more than one app. You target new users so they might initially use their keys only with damus but then they will discover more nostr apps and have the same problem.

2025-08-22 11:45:15 UTC

- reply

I see you ...
https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/4f30a8d1da251a2a815995b93abdc0d115b598d1f40fe807af0cb84bbf6c2270.png

2025-08-20 19:26:27 UTC

- reply

So with these geohashes now being sent to nostr relays, can we get a heat map or are the script kiddies already teleporting like crazy?

2025-08-20 19:24:15 UTC

- reply

#gamechanger
Guess now I have to try it out.
I wonder how the geohash thing works. Does it reveal my location to the street level? If used with new nyms that's ok I guess. Or can I set the granularity in the app, so people can't triangulate my nym with any meaningful precision?

2025-02-27 03:56:47 UTC

Trying out something. Hi @npub1gm7…8rf6

2025-02-16 19:20:20 UTC

- reply

It's 4h later, so the TX surely confirmed already but still ...
When blocks are empty as they are these days, there is little hope to get support faster than the transaction will confirm. If your wallet doesn't support RBF you are more likely to lose all the rest than to undo that one transaction, given your average time window is just 10min.
On the other hand, most "wrong addresses" tend to be addresses of people you sent to before, so you know who wrongly got your funds and you can ask politely to send the funds back. I did in the past and others sent funds back I had sent them accidentally as most people are not psychopaths and even psychopaths tend to collaborate if they figure the cost of not doing so might be high.

2025-02-09 16:19:40 UTC

Transitive dependencies are a nightmare most wallet developers prefer not to think about. While systems like mobile phones have very good separation of apps - one app cannot see what the other app is doing - same is not true for libraries. A library that lets you more conveniently process your data in your app could do all sorts of other stuff while at it. Like search for private keys in the app's memory and send them to a server if the app using the library has internet access. This is precisely what happened in an attack against a bitcoin wallet[1].
I had this long blog post[2] for some days open in a browser tab before I finally had Claude summarize it for me. It basically suggest to take the same precaution for library function calls as we already take for "apps" or processes in general. As it turns out there are several projects doing this already. Google Sandboxed API [3] and RLBox [4] for example.
At the Mycelium Android Wallet team I had led an effort to also isolate signing functionality from the main app through a separately installed app but it was discontinued for being impractical. It was probably my fault for not overcoming the engineering hurdles fast enough as it still appears to be the only way to well isolate key material from all the other fancy stuff wallet providers want to integrate for their business partners. Or do others know tools I don't know?
[1] https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets
[2] https://tratt.net/laurie/blog/2024/can_we_retain_the_benefits_of_transitive_dependencies_without_undermining_security.html
[3] https://developers.google.com/code-sandboxing/sandboxed-api
[4] https://rlbox.dev/

2024-09-15 21:44:03 UTC

TIL: Bitcoin Core deprecated the use of private keys (legacy wallet). How is that supposed to look? When somebody opens an old wallet.dat, will the new Bitcoin Core just fail to load it and suggest to install some extra old client? Or is this feature being moved to an extension of some sorts?

2024-08-13 01:29:13 UTC

- reply

In a chat with Donald and Elon.
https://i.nostr.build/iKAn6C1qKrxEQCA1.png

2024-07-02 18:15:35 UTC

- reply

Ok, so I guess I'm not the only one who doesn't get it 😅

2023-12-30 20:51:53 UTC

How is this not a state actor attack? They will pay north of $10 million USD to waste block space.
https://image.nostr.build/215f1253397f9cd191bb3b4d47edffe2e1c3cec67e6c7e853c23bfdb1cce0f56.png https://image.nostr.build/ef80094365aba3bdea445b323bcfeec0390cfe4eeef98d1428d6bd2cd90a448b.png

2023-07-07 21:13:58 UTC

- reply

People are slow to cull relays. Me included.

2022-12-19 00:26:27 UTC

Maintaining my own Relay code base is not really fun :( I might give up on it. Which implementation is the best for a beefy server right now? #[0] what are you running for the damus relay?