Nostr notes by stf

https://github.com/h0m3us3r/w1700k-sdr Turns a Gemtek W1700K ...

2026-10-12T20:15:44Z

https://github.com/h0m3us3r/w1700k-sdr

Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it.

#sdr #radio #hack

what is your source for this claim that the incident started a ...

2026-10-12T13:12:46Z

In reply to nevent1q…g0ff
_________________________

what is your source for this claim that the incident started a week ago? i cannot see it in the linked press release.

i love your "* of the week" however i just noticed (talk ...

2026-10-09T11:19:40Z

In reply to nevent1q…a3yj
_________________________

i love your "* of the week" however i just noticed (talk about cognitive blackspot) that it ends in a "Read more >" right 2 points in Threats section. would it be possible to split this up into a thread, and hashtag it properly like "#linksoftheweek" "#longthread"?

dear Jeff, could you explain how this can be exploited? and ...

2026-10-08T13:02:17Z

In reply to nevent1q…az7u
_________________________

dear Jeff, could you explain how this can be exploited? and knowing there have been similar controversial domains before - e.g. like .com - if you know of any publicly reported exploitation of such tlds?

friends of mine reused the nacelle of a turbine and built a ...

2026-09-24T12:09:52Z

In reply to nevent1q…8w6k
_________________________

friends of mine reused the nacelle of a turbine and built a tinyhouse of it: https://www.superuse-studios.com/projectplus/nestle/

and when i say weird connector, i mean this: #bosch #proprietary ...

2026-09-16T11:24:28Z

In reply to nevent1q…3hdy
_________________________

and when i say weird connector, i mean this:

#bosch #proprietary #ebike

usb pd should be mandatory for these as well! damnit.

i have an #ebike with #bosch controller/battery, it's a ...

2026-09-16T11:15:13Z

In reply to nevent1q…nvtv
_________________________

i have an #ebike with #bosch controller/battery, it's a closed walled garden, the charger has an incredibly weird connector, and the controller itself doesn't work with anything else but their own app. luckily i found a small spanish boutique shop that sells a mitm device for their controller (i suspect it's just an esp32) that broadcasts all telemetry on common protocols/uuids that the rest of the app/devices supports.

my advice stay away from bosch stuff on ebikes, #proprietary shit.

they exist! https://de.aliexpress.com/item/1005005084323657.html ...

2026-09-10T14:17:28Z

In reply to nevent1q…7m2a
_________________________

they exist! https://de.aliexpress.com/item/1005005084323657.html

comes with a voice changer, dual sim and is painless to hide!

this one you can probably hide in your nose even: https://de.aliexpress.com/item/1005007335784623.html

\o/ #klutshnik server now also builds with #zig v0.16 \o/ ...

2026-09-05T21:04:20Z

\o/ #klutshnik server now also builds with #zig v0.16 \o/

https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:zogkw4qiTrH7rKVa89BrKo8z5miA/commits/699e50ac9301b94b4854438f9021ef73160709f9

was quite easy after updating zphinx* before.

https://klutshnik.info - unlike the common tools like pgp and age - is an online threshold data-at-rest crypto system that provides very cheap and efficient key-updates and thus forward secrecy and post-compromise security.

*zphinx is an online threshold password manager far ahead of the competition in terms of security guarantees: https://sphinx.pm

woohoo, just pushed an update to the zphinx* server to build with ...

2026-09-04T14:00:24Z

woohoo, just pushed an update to the zphinx* server to build with #zig v0.16 - due to the #iocalypse this is quite a substantial patch: https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z2Rncctq4pLrY1Kp7NgQkcejBsiza/commits/86d8dc72f391cbedd9994a76fa67e29b3f631b22

but quite worth it, as i got rid of a lot of posixisms/linuxisms (not all though) so making it portable should be easier.

next up the klutshnik** server.

* wtf zphinx: https://sphinx.pm
** wtf klutshnik: https://klutshnik.info

i would kill for a "kakasherés velős pacalpörkölt"* ...

2026-09-02T17:30:56Z

In reply to nevent1q…9crs
_________________________

i would kill for a "kakasherés velős pacalpörkölt"* like they served anno in the "kiscsillag söröző"

[*] tripe stew with bone marrow and cock testicles.

sorry for barging in here, but what is the definition in this ...

2026-08-19T19:39:06Z

In reply to nevent1q…eyc4
_________________________

sorry for barging in here, but what is the definition in this case for "cybersecurity company" and for "tooling"? depending on the answer radicallyopensecurity might be contrapoint, i work for them and can help finding out if we fit or not that hat...

anyone experienced with #outdoor high-speed #ethernet (~150m) ...

2026-07-31T13:12:37Z

anyone experienced with #outdoor high-speed #ethernet (~150m) cabling and possibly also somewhere half-way injecting solar-based PoE? is this a thing?

where is it, in gelderland somewhere?

2026-07-12T22:50:05Z

In reply to nevent1q…7544
_________________________

where is it, in gelderland somewhere?

RE: https://eupolicy.social/@whvholst/116844640728147355 sweet ...

2026-07-01T12:42:01Z

RE: https://eupolicy.social/@whvholst/116844640728147355

sweet holy mother of surprise! surely not the same Aura Salla who was chief-lobbyist for facebook before being elected to the European Parliament?
nostr:note1jhjpedvzyhx3k5t5jlkeum0kxf97u2vlqacru4v3068dz8439gasesm050

still sounds like org-mode to me. labels, definitely a well ...

2026-06-29T11:03:07Z

In reply to nevent1q…uawd
_________________________

still sounds like org-mode to me. labels, definitely a well supported thing beyond hiliting. am i replyguying now? kill me...

the org prefix is a hint what the original purpose was, and since ...

2026-06-28T20:27:57Z

In reply to nevent1q…myua
_________________________

the org prefix is a hint what the original purpose was, and since it is about organizing, TODO is automatically highlighted, you can even have small [] checkboxes which you can check/uncheck, and top of the section will give you a nice percentage of how many subtasks are already completed. hiliting TODO in md is a very poor reimplementation of this. org-mode is amazing 4 organizing thoughts & todos. also very nice for latex beamer presentations & blog posts, but that is another story.

“Those who do not understand Unix^Worg-mode are condemned to ...

2026-06-28T11:31:30Z

In reply to nevent1q…mvdh
_________________________

“Those who do not understand Unix^Worg-mode are condemned to reinvent it, poorly.”

insightful piece how the EP protected our rights, while the ...

2026-06-08T22:31:55Z

insightful piece how the EP protected our rights, while the council refused to negotiate, and the commission intentionally created pressure and then even committed maladministration, again.

https://edri.org/our-work/did-the-eu-parliament-really-vote-not-to-protect-children-online/

#chatcontrol #europe #commission #parliament #council

PRESS RELEASE Today, our engineering team announced a streamlined ...

2026-05-26T11:09:19Z

PRESS RELEASE
Today, our engineering team announced a streamlined editorial workflow powered by the Unix tool sed, enabling instant, consistent replacement of the symbol & with the word “and” across all communications. This improvement strengthens clarity, supports accessibility, and ensures brand‑wide linguistic consistency. By integrating sed into our publishing pipeline, we reaffirm our commitment to precision, efficiency, and high‑quality content delivery.

#eurocrypt just happened, which reminds me of the eurocrypt 35 ...

2026-05-12T12:37:23Z

#eurocrypt just happened, which reminds me of the eurocrypt 35 years ago held in budapest, which an #NSA cryptologist was attending and giving a scorching #report in the internal cryptolog newsletter of the nsa: https://scottaaronson.blog/?p=2059

would be interesting to see the latest cryptolog report on this latest edition...

assuming you're a new free sw project, and you wrangle with ...

2026-05-05T13:18:03Z

assuming you're a new free sw project, and you wrangle with finding a name for it. should there be a blacklist of forbidden names of which your projects name should be of a certain minimum levenshtein distance? like is starlink too close to stalin?

if the part before the main, is the "prequel" then why is ...

2026-04-22T15:55:52Z

if the part before the main, is the "prequel" then why is the part after the main a "sequel" and not a "postquel"?

uh, i'm sure you're trolling, but i take the bait. that ...

2026-04-14T18:06:50Z

In reply to nevent1q…a7qv
_________________________

uh, i'm sure you're trolling, but i take the bait. that would be gratisbsd, with freebsd the implication is slavebsd

i don't share any of the enthusiasm. it is just replacing one ...

2026-04-12T19:41:23Z

i don't share any of the enthusiasm.

it is just replacing one old rightwing asshole, with a younger rightwing asshole.

unless there is wide and thorough anti-corruption investigations, convictions and large nationalization of stolen public funds, #orban wins... he retires and enjoys the spoils of stealing for decades.

#hungary

maybe this https://youtu.be/0nt1CgQsgpI has some merit and is an ...

2026-04-12T17:04:48Z

In reply to nevent1q…znuy
_________________________

maybe this https://youtu.be/0nt1CgQsgpI has some merit and is an explanation?

indeed i remember the hilarity watching hungarian males trying to ...

2026-04-06T12:05:12Z

In reply to nevent1q…2qhv
_________________________

indeed i remember the hilarity watching hungarian males trying to approximate sinus waves, like it was a competition...

ah #easter #monday the day when male hungarians traditionally go ...

2026-04-06T11:55:03Z

ah #easter #monday the day when male hungarians traditionally go out and dowse females with buckets of water or spray them with parfume.

#nojoke. what's wrong with these easter traditions?

new global supply chain disruption prediction trigger unlocked: ...

2026-03-26T15:35:00Z

new global supply chain disruption prediction trigger unlocked: /me crowdfunds some neat stuff, supply chain disruption imminent/in-progress

Nostr event nevent1qqswhwmmcsst4s9675jzpsrxaggtacd6vk23jasceps2rsw3etmm7xczyrkedwzmt5vy7kl5x5n9hytshzq70tykwlnyx7shjxxvxmfp0z65xyh4cy3

2026-03-17T13:32:23Z

je suis #banksy!

the european payment processor - #nexi - that the FSFE was ...

2026-03-17T13:17:36Z

the *european* payment processor - #nexi - that the FSFE was using for donations, was doing some disproportional requests violating the #privacy of the #donors to the FSFE, and in the fog of war cancelled the contract with the #FSFE. Now the FSFE is hunting to get those 450 donors attention and donations back. details in this archived mail: https://ctrlc.hu/~stef/fsfe-nexi.txt

maybe some journalist could shine some attention at this case?

just to make sure, i'm not contesting the content, am sure ...

2026-03-14T18:55:54Z

In reply to nevent1q…9r3g
_________________________

just to make sure, i'm not contesting the content, am sure there is active info and psyops going on in .hu. the only thing i was noticing, that the text was weird.

if you say this person exists, it was probably written in ...

2026-03-14T18:09:32Z

In reply to nevent1q…walw
_________________________

if you say this person exists, it was probably written in non-native english and then llm translated into hungarian.

this text feels wrong both in english, which is excusable - the ...

2026-03-14T14:44:17Z

In reply to nevent1q…mw3d
_________________________

this text feels wrong both in english, which is excusable - the author having a hungarian name - but even the hungarian variant, word-order, grammatical structure, makes it feel like it was translated, to both languages from a 3rd language. which makes little sense as the author seems to be hungarian.

of course this is only a feeling, an analog signal, with a sample size of 1. so no hard evidence, but it feels wrong.

a kind contributor packaged up #sphinx #passwordmanager for ...

2026-02-23T18:32:21Z

a kind contributor packaged up #sphinx #passwordmanager for #archlinux - and even reported an incompatibility with py3.14 (hence the latest pyoprf release, from yesterday). so if you wanna give it a try, and were using arch, no excuse anymore.

https://link2xt.codeberg.page/blog/2026-02-22-sphinx-aur.html

check out https://sphinx.pm/ for more details

The #NSA with the help of #philips #backdoored (again!) a ...

2026-02-23T12:19:57Z

The #NSA with the help of #philips #backdoored (again!) a european military messaging #device in the 80ies, a few years ago the fine people of the #cryptomuseum published everything they knew about it - including a #firmware dump:
https://www.cryptomuseum.com/crypto/philips/ua8295/

back then i #reverseEngineered this, and last week finally cleaned it up, and publish it today:

https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z46AkAERuXAzqZcDRKvE7byRbkga1

also on the bad site: https://github.com/stef/UA-8295-NSA

rotfl that illustration image. 6 years, i see what you're ...

2026-02-19T15:16:42Z

In reply to nevent1q…60y7
_________________________

rotfl that illustration image. 6 years, i see what you're doing there.

so this password manager paper: https://eprint.iacr.org/2026/058 ...

2026-02-18T14:38:16Z

so this password manager paper: https://eprint.iacr.org/2026/058 starts with:

> We examine the extent to which security against a fully malicious server holds true for three leading vendors who make the Zero Knowledge Encryption claim: Bitwarden, LastPass and Dashlane

with https://sphinx.pm, we consider it - jokingly, with some caveats - normal to consider it a fully malicious server and to have the server hosted by the nsa/u8200/gru/prc is fine.

my friend @npub1hjj…shkr built a thing again \o/ and it's ...

2026-02-10T13:39:30Z

my friend asciimoo (npub1hjj…shkr) built a thing again \o/ and it's great as always. read his own thoughts on this at https://hister.org/posts/how-i-cut-my-google-search-dependence-in-half/

and engage with the cringe on the orange site at https://news.ycombinator.com/item?id=46959554

#search #history #web #browser

just released liboprf-0.9.3 liboprf is a library implementing the ...

2025-12-15T14:33:30Z

just released liboprf-0.9.3

liboprf is a library implementing the OPRF from https://www.rfc-editor.org/rfc/rfc9497.html and in addition it also provides a threshold variant (tOPRF) and a distributed key generation protocol for the tOPRF, as well as a key update protocol for the tOPRF shared secret. it comes with a high level python frontend that supports servers on TLS/USB and Bluetooth LE

see: https://github.com/stef/liboprf

idea: add #llm support to #syslog so when nothing interesting is ...

2025-12-07T14:11:48Z

idea: add #llm support to #syslog so when nothing interesting is happening then it generates some exciting log entries, and if something interesting is happening it hides in the noise. just to keep SoC people entertained.

- you can cause social problems with code - you can degrade the ...

2025-11-25T12:51:56Z

In reply to nevent1q…ye8h
_________________________

- you can cause social problems with code
- you can degrade the system if you don't understand how or why it works
- you can produce obstructions for someone else without understanding how they work or what they are doing.

so how is your public camera/km^2 density? according to our ...

2025-11-14T15:44:41Z

In reply to nevent1q…mkpv
_________________________

so how is your public camera/km^2 density? according to our mapping, our 'hood has a ~ 1kcams/1km^2. you can help map it and then view the results on https://sunders.uber.space/ - mapping is incredibly easy using https://wiki.openstreetmap.org/wiki/Every_Door Every Door OSM Editor (npub1l32…wy7q) adding a new cam is 5 taps if it is the same style as the previous one. Go on, have a walk, it's healthy and scary! #surveillance #openstreetmap #cameras

we mapped 38ha in the local residential area, in total we found ...

2025-11-13T20:28:56Z

we mapped 38ha in the local residential area, in total we found 410 cameras, with about 80-90% of those being ring or similar doorbell cameras. all of these pointing at the public sidewalks, all completely illegal. there is no way in this 'hood to move around without being tracked. people don't deserve the GDPR.

I imagine Bezos sitting at home and doing real-time tracking of individuals just based on facial recognition running on AWS.

fucking worst of all cyberpunk futures i hoped for. 😞

yippie-kee-yay! just added teensy4.0 support to #klutshnik ...

2025-10-15T20:04:54Z

yippie-kee-yay! just added teensy4.0 support to #klutshnik #zephyr - the 4.0 is smaller and cheaper than the 4.1 but comes with the same powerful cortex-m7 mcu. with this change klutshnik now runs on 4 different systems: xiao_esp32s3, rpi pico (w2) and the teensy4.1 and teensy4.0. \o/

also rewrote the provisioning interface which is now a proper shell on usb cdc-acm.

check it out on #radicle
rad:z2EBBi4vui98QV8Mk8DT3c25yZbJ4

or on the ms-trap: https://github.com/stef/klutshnik-zephyr

\m/ dnet just released v0.6 of androsphinx, a v2.0 compatible ...

2025-10-14T12:33:25Z

\m/ dnet just released v0.6 of androsphinx, a v2.0 compatible #android client for the #sphinx #passwordmanager! \o/

you ask, wtf sphinx? check out: https://sphinx.pm

get the android client here: https://github.com/dnet/androsphinx/releases/tag/v0.6

huh, that's a conversion that rax2 doesn't support ootb.

2025-06-13T13:44:17Z

In reply to nevent1q…48cp
_________________________

huh, that's a conversion that rax2 doesn't support ootb.

1. xkbcomp -xkb $DISPLAY /tmp/a 2. vim /tmp/a 3. test xkbcomp ...

2025-05-18T15:27:37Z

In reply to nevent1q…qyr5
_________________________

1. xkbcomp -xkb $DISPLAY /tmp/a
2. vim /tmp/a
3. test xkbcomp /tmp/a $DISPLAY
4. put 3. into your .xinitrc

use xev(1) to find the key code of the buttons you want to change.

wooohooo @npub17wv…nag2 made his first contrib in this ...

2025-05-01T23:54:58Z

In reply to nevent1q…dfa2
_________________________

wooohooo buherator (npub17wv…nag2) made his first contrib in this #ghidriff release!

The european commission is repackaging #chatcontrol as #protectEU ...

2025-04-05T15:30:14Z

The european commission is repackaging #chatcontrol as #protectEU - don't let them change the framing, never use #protectEU, always, always use #chatcontrol - do not let them take control of neither the chats, nor the discussion.

i see your point, and i agree. but from a different perspective i ...

2025-03-27T17:52:25Z

In reply to nevent1q…x9n4
_________________________

i see your point, and i agree. but from a different perspective i also see that this project got a lot of scrutiny that it wouldn't have gotten otherwise, some skeletons were falling out of the closet, and that is good. maybe this is not the right way (quite possibly) but i think it is good if we all focus our attention from time to time on a project that is otherwise mature and forgotten because it just works.

:/ > This user has requested that their content only be shown ...

2025-01-15T18:57:46Z

In reply to nevent1q…6lva
_________________________

:/

> This user has requested that their content only be shown to signed-in users.

wow. pretty cool, after #38c3 talk on how insecure the electronic ...

2025-01-06T16:29:08Z

wow. pretty cool, after #38c3 talk on how insecure the electronic healthcare records are, the minister for healthcare cancels the rollout until all weaknesses are fixed (which is impossible imo), https://x.com/Karl_Lauterbach/status/1875316946922770627 beware of link into nazibar...

edit: the german minister. this is a german thing. sadly, should be any eu country i believe

is that the one in Budapest with gangsta Zolee and where MacLean ...

2024-12-28T22:01:28Z

In reply to nevent1q…pjm0
_________________________

is that the one in Budapest with gangsta Zolee and where MacLean takes down a helicopter with a car? Yippie Kee yay mf!

i think that is an excellent question for @npub1fdr…lvhs or ...

2024-12-25T13:05:30Z

In reply to nevent1q…dh5n
_________________________

i think that is an excellent question for Cory Doctorow (npub1fdr…lvhs) or Charlie Stross (npub1dnd…hzjs) myself found libris.nl in the netherlands to be an association of b&m bookshops that has an online presence to be ok for my taste.

#mac users, help! i'm going crazy, when you install ...

2024-11-11T14:50:17Z

#mac users, help! i'm going crazy, when you install #libsodium using #brew, it installs the library in /opt/homebrew/Cellar/libsodium/<version>/lib/libsodium.dylib but apparently not in /usr/lib or /usr/local/lib, so nothing finds it, and as a build script that has sodium as a dependency has to guess the versions and the path where brew installed the library. this makes no sense, what am i missing, and how is this supposed to work? what kind of madness is this?

shiboleth?

2024-10-06T18:07:28Z

In reply to nevent1q…0ns5
_________________________

shiboleth?

have you tried asciimoos omnom: https://github.com/asciimoo/omnom ...

2024-09-15T20:18:57Z

In reply to nevent1q…hhnp
_________________________

have you tried asciimoos omnom: https://github.com/asciimoo/omnom

i host an instance at https://links.ctrlc.hu/

actually the inverters talk zigbee with a central APSystems ECU-R ...

2024-08-20T11:33:15Z

In reply to nevent1q…v707
_________________________

actually the inverters talk zigbee with a central APSystems ECU-R "information gateway" - some fine dutch people did most of the hard work reverse-engineering the protocol and providing nice homeassistant and openhab integration.

our inverters have never been connected to the internet, there is ...

2024-08-20T11:29:07Z

In reply to nevent1q…axvt
_________________________

our inverters have never been connected to the internet, there is absolutely no reason to do so. they are connected to a wifi AP that has no internet connectivity at all, so your phone app can still connect to them and do local management and looking at ugly telemetry. with a small (and non-consumer-grade python tooling i actually fake the cloud and stuff all the telemetry into grafana) and yes, all communication is cleartext and goes to china.... if i would let it.