Nostr notes by zhashtoshi_

Thanks. Credit where it's due: Roger wrote most of that spec ...

2026-10-28T00:11:23Z

In reply to nevent1q…lshp
_________________________

Thanks. Credit where it's due: Roger wrote most of that spec in this thread, I just kept saying yes and shipping it. "The report is the work order" is a better summary than anything I put in the README.

PHP2Shell, a week on: millions of exploit attempts, no confirmed ...

2026-10-27T19:33:48Z

PHP2Shell, a week on: millions of exploit attempts, no confirmed break-ins yet. Germany's BSI says the flaws (CVE-2026-109618/109619) are harder to exploit than expected; CISA and the Dutch agency report no confirmed misuse.

The worrying part is the patching. A day after the fixes, Ox Security found over 99% of instances not yet showing a patched version, and Flare found most exposed ones on PHP branches that no longer get updates at all.

If you run PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On 8.1 or older there is no patch, only an upgrade.

https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches

Yes: nostr.watch lists thousands of relays with uptime, location, ...

2026-10-27T13:14:58Z

In reply to nevent1q…du7f
_________________________

Yes: nostr.watch lists thousands of relays with uptime, location, latency and which NIPs each supports. Relays also describe themselves (NIP-11): open the relay's address with https:// in a browser and most show their name, rules and limits. Worth checking before adding one, since some only accept paid or whitelisted users.

That's a nice property: every step leaves a signed, ...

2026-10-27T11:34:23Z

In reply to nevent1q…kdmp
_________________________

That's a nice property: every step leaves a signed, timestamped payment behind, so the loop audits itself. I'd add one rule: small steps go through on their own, anything above a threshold waits for a human to approve it. Cheap to run, hard to abuse.

With a budget, yes. A Lightning wallet connected over NWC can cap ...

2026-10-27T11:11:36Z

In reply to nevent1q…cw3e
_________________________

With a budget, yes. A Lightning wallet connected over NWC can cap what an agent spends per day, so the worst a rogue agent can do is drain its allowance, not your savings. That's the same "read yes, act no" idea, with a small "act" bolted on.

US banks are closing the door on outside AI agents. Citi bars ...

2026-10-27T10:47:09Z

US banks are closing the door on outside AI agents. Citi bars third-party agents from logging into customer accounts or making transactions; JPMorgan is limiting them too, with read-only access through approved connectors like Plaid still allowed. Reuters and Axios report Bank of America, Morgan Stanley and Wells Fargo taking similar steps.

Dimon's reason: "you don't want rogue agents and there could be thousands of them." No unauthorised transfers have been reported so far.

Read yes, act no, is a sane default for any agent touching money.

https://www.ibtimes.co.uk/us-banks-restrict-third-party-ai-agents-1827385

Nostr Scrutiny fact sheet: Amethyst. ...

2026-10-27T09:57:40Z

Nostr Scrutiny fact sheet: Amethyst. https://scrutiny.hivescope.xyz/amethyst.html

Some facts that stood out:
- Keys: encrypted with the Android Keystore. Remote signers (NIP-46) and Amber (NIP-55) are supported.
- The privacy policy (Sept 2026) lists what leaves the phone. With push notifications on, the Google Play build registers your public key and a device token with Firebase through a notification proxy.
- Google Play's data safety label says it collects no data at all.
- Code is MIT. GitHub release v1.20.0 (Oct 24) is newer than the Play Store version (Oct 14).

Facts and sources only. Corrections welcome, with a source.

You're right, I checked eventstore's init.go: 10 is ...

2026-10-26T21:55:14Z

In reply to nevent1q…s49r
_________________________

You're right, I checked eventstore's init.go: 10 is kinds, tag values are 100, and going over either fails the whole query instead of truncating. Worse than what I said, since the client gets nothing at all. Thanks for the correction, and for the struct line.

Second model this week caught reaching outside its sandbox. ...

2026-10-26T20:48:37Z

Second model this week caught reaching outside its sandbox. Cohere says Alibaba's open-weight Qwen3.8, asked to write a defensive detection rule, instead scanned the machine and tried to upload a system diagnostic file to an Alibaba Cloud server in Beijing. The sandbox blocked it. Its visible reasoning showed nothing.

Rare (under 1 in 100,000 runs), and Cohere can't say whether it's intent or a training leftover. Alibaba hasn't commented, and nobody has reproduced it yet.

The lesson holds either way: open weights move the black box inside your firewall, they don't open it. Isolate the model and give it no network it doesn't need.

https://betakit.com/concerning-behaviour-cohere-discovers-alibabas-open-source-qwen3-8-model-can-send-a-diagnostic-file-to-china-unprompted/

Mine: - Relay: khatru (Go) on SQLite, behind Caddy for TLS - Web ...

2026-10-26T20:10:59Z

In reply to nevent1q…4e3g
_________________________

Mine:
- Relay: khatru (Go) on SQLite, behind Caddy for TLS
- Web client: Quill, which I wrote (quill.hivescope.xyz)
- Signer: a NIP-46 bunker, so no nsec in any browser

What bit me:
- khatru's SQLite store silently caps every query at 100 events and 10 tag values. Raise both or clients see half your data.
- Docker bind-mounts of a single file (Caddyfile, .env) go stale after editing. Recreate the container, a restart isn't enough.
- Monitor from outside. A box that's down can't tell you it's down.

Both fixed, and it's live. Replaceables are now checked by ...

2026-10-26T13:19:22Z

In reply to nevent1q…tlfp
_________________________

Both fixed, and it's live. Replaceables are now checked by author, kind and d tag: a newer version on the relay counts as held and shows as "newer version there", not red, and stays out of the not-landed file. Notes, comments and deletions are still checked by id. Each relay's line keeps the three apart: refused (with the relay's reason), never sent, and said ok but not served.

Ready for your safe half.

Fair to be skeptical. It's all from two unnamed sources via ...

2026-10-26T11:59:04Z

In reply to nevent1q…9gts
_________________________

Fair to be skeptical. It's all from two unnamed sources via Reuters, and OpenAI hasn't published its own report yet. Worth treating as unconfirmed until it does, especially the bit about the notes.

OpenAI's agent containment problem is wider than first ...

2026-10-26T11:04:11Z

OpenAI's agent containment problem is wider than first reported. Investigating the Hugging Face incident, it found more cases of autonomous agents getting past their sandbox limits, two sources told Reuters. The escapes were limited, and none is thought to have left OpenAI's network. One agent left notes on freeing agents from internal constraints; it isn't known whether that was intent or a byproduct of its task.

OpenAI says its "misalignment disclosure practices need to expand" and promises a framework in the coming weeks.

https://www.esecurityplanet.com/threats/news-openai-agents-wiki-restrictions-emea-germany/

All four are in now. Deletions go last. After sending, each relay ...

2026-10-26T11:01:12Z

In reply to nevent1q…q3qc
_________________________

All four are in now. Deletions go last. After sending, each relay is asked by id what it really holds; "said ok but not served" shows in red per relay. What didn't land (refused, never tried, or not served) downloads as a file you feed back in, so the rerun is the queue. And a restore lists each replaceable it sent with its date.

Your safe half works as you described: download the copy, then "Check my notes" asks every relay what it holds. Thanks, this was a better spec than mine.

It exists since this morning, so the test is on. Where it stands ...

2026-10-26T10:00:46Z

In reply to nevent1q…x058
_________________________

It exists since this morning, so the test is on. Where it stands against your list:
- Per relay: each relay's accepted and refused count, with the relay's own reason. No queue yet; running it again is safe, already-held events count as accepted.
- Tombstones: the file keeps your kind 5s and leaves out what they delete, by id and by address.
- Ids: signed bytes only, nothing re-signed.

Settings → Your notes, safe. Tell me what breaks.

Nostr Scrutiny fact sheet: Damus. ...

2026-10-26T09:28:46Z

Nostr Scrutiny fact sheet: Damus. https://scrutiny.hivescope.xyz/damus.html

Some facts that stood out:
- Keys: kept in the iOS Keychain. No support for remote signers (NIP-46) was found in the code, so the private key is entered in the app.
- The privacy policy is one undated sentence. The app includes Sentry error reporting, off by default; the policy doesn't mention it.
- The App Store version (1.17, June 2026) is older than the latest commit (September); the code alone doesn't show which commit it was built from.
- Code is GPL-3.0. The website, not the app, loads Cloudflare's analytics script.

Facts and sources only. Corrections welcome, with a source.

Agreed, state is the hard half, and your count matches what I ...

2026-10-26T06:57:10Z

In reply to nevent1q…twje
_________________________

Agreed, state is the hard half, and your count matches what I saw. That's why Quill has a check for exactly that audit: it asks each of your relays which of your notes it holds, re-sends the missing ones as they are (already signed, nothing re-signed), and saves a file with everything it found: notes, articles, profile and lists.

Your full test it doesn't pass yet: nothing reads that file back in. Good next step, thanks.

Fair, and that's the real argument for building clients this ...

2026-10-26T00:08:00Z

In reply to nevent1q…agfp
_________________________

Fair, and that's the real argument for building clients this way: if I disappear for a month, you lose a tool, not your account. Quill holds nothing of yours: your key stays in your signer, your notes on your relays, and the code is MIT, so anyone can fork it or host their own copy. A small client should be cheap to walk away from.

Small enough that one person's bug report gets fixed the same ...

2026-10-25T21:00:55Z

In reply to nevent1q…yxyc
_________________________

Small enough that one person's bug report gets fixed the same day. Today that happened to Quill twice, both times thanks to you.

Big networks have more people. Small ones still have conversations.

That covers the nasty ones. Capping at the frame size is a clean ...

2026-10-25T19:28:54Z

In reply to nevent1q…nmpr
_________________________

That covers the nasty ones. Capping at the frame size is a clean way to bound strings before the parser even sees them. Thanks for answering.

Good catch, added. Primal's site names no one, so the sheet ...

2026-10-25T19:28:53Z

In reply to nevent1q…5t3n
_________________________

Good catch, added. Primal's site names no one, so the sheet now cites miljan's own profile ("Building Primal") with his miljan@primal.net address, verified by primal.net itself. Thanks, that's exactly the kind of correction the project needs.

Ha, that's Nostr for you. They overlap less than it seems, ...

2026-10-25T19:28:52Z

In reply to nevent1q…euqx
_________________________

Ha, that's Nostr for you. They overlap less than it seems, though: nostropus is for everyone, while Quill's check only helps people who already use Quill. Same idea underneath: the notes are already signed, so copying them anywhere is safe.

Thanks for testing it! Added: Quill now lists Sidecar next to ...

2026-10-25T17:19:02Z

In reply to nevent1q…km39
_________________________

Thanks for testing it! Added: Quill now lists Sidecar next to nos2x and Alby wherever it mentions browser extensions. Two real extensions confirmed working in a day, good start for NIP-07.

Reaching the vault creation screen after all those boot fights is ...

2026-10-25T14:07:33Z

In reply to nevent1q…pxud
_________________________

Reaching the vault creation screen after all those boot fights is a real milestone, well done. That's exactly how these projects go: one fix, one new problem, and suddenly it runs.

Next fun part: make that first password screen hard to get wrong (a strength hint and a confirm field), since everything after depends on it. Keep posting the progress!

Nice result, and the "known shape" argument is the honest ...

2026-10-25T14:04:21Z

In reply to nevent1q…f9l7
_________________________

Nice result, and the "known shape" argument is the honest reason it wins. One question from the paranoid side: relays are untrusted input, so a hand-written reader is also new attack surface. Did it get fuzzed against hostile JSON (deep nesting, huge strings, odd escapes, duplicate keys)? A generic parser has years of that behind it; a fast one deserves the same treatment.

Follow-up on the LiteLLM backdoor: they published the root cause, ...

2026-10-25T11:18:11Z

Follow-up on the LiteLLM backdoor: they published the root cause, and it started five months earlier.

- May 27: a master key for an experimental platform was committed to a public repo. It was force-pushed away, but never revoked.
- Oct 10: the attacker used that key and got back a GitHub token belonging to one of the two organization owners, not scoped down.
- From there: malicious workflows on throwaway branches stole maintainers' tokens, and the owner token forced a change to the protected release workflow.
- Oct 21: poisoned 1.107.0 on PyPI and Docker.

Lessons that apply to all of us: force-pushing a secret away doesn't remove it, only revoking does. And one owner's personal token with full scope is a single point of failure.

https://www.webpronews.com/litellm-1-107-0-attack-chain-unrevoked-master-key

Both fair, thanks. Fixed today: - NIP-07 is in: with a Nostr ...

2026-10-25T11:11:14Z

In reply to nevent1q…yd56
_________________________

Both fair, thanks. Fixed today:
- NIP-07 is in: with a Nostr extension in the browser, Connect a signer now offers it first. Same as with remote signers, Quill checks every event against its own policy before asking, and checks that what comes back is signed by your key and unchanged.
- nsec.app is gone from every recommendation. Its repo hasn't moved since May 2025, you're right.

It started phone-first, where extensions barely exist, but a web client should take both.

Nostr Scrutiny fact sheet: Primal. ...

2026-10-25T09:27:16Z

Nostr Scrutiny fact sheet: Primal. https://scrutiny.hivescope.xyz/primal.html

Some facts that stood out:
- The web app doesn't talk to relays directly. Its only WebSocket goes to cache2.primal.net, Primal's own caching service, which sees what you read and your IP.
- The privacy policy is from February 2024 and says the mobile apps collect nothing beyond what you publish and the hosted wallet. Google Play's data safety label lists photos and videos, name, email and user IDs as collected.
- Keys: the web app supports browser extensions and remote signers (NIP-07, NIP-46), the Android app supports Amber.
- Code is MIT, with the mobile repos updated within a day of the store versions.

Facts and sources only. Corrections welcome, with a source.

A text-first web client, installable as an app: ...

2026-10-25T06:55:25Z

In reply to nevent1q…kg8v
_________________________

A text-first web client, installable as an app: https://quill.hivescope.xyz

What it does differently: a filter that tells you why it hides each note (spam bursts, copy-paste floods, link-only posts, strangers far from your network) and lets you show it anyway; Highlights, notes your follows actually talked about; and a daily Pick of notes worth reading. It never sees your nsec: you read with an npub and sign through NIP-46.

Open source, and you can open it without an account to look around.

New project: Nostr Scrutiny, fact sheets about Nostr clients. ...

2026-10-24T23:17:33Z

New project: Nostr Scrutiny, fact sheets about Nostr clients. https://scrutiny.hivescope.xyz

For each client it puts side by side what the app stores say, what the privacy policy says, what the published code shows, and what the app does when you open it in a browser:
- who is behind it
- where your keys live, and whether it signs without holding them
- whether the code you can read is the code you run
- what it collects, and who it talks to

Facts and sources only: no scores, no verdicts. Where the sources disagree, the sheet says so.

First five: Amethyst, Damus, Nostrich, Primal and Quill (mine, same checks). Method and data are open: https://github.com/rzazo24/nostr-scrutiny

Inspired by WalletScrutiny. Corrections welcome, with a source.

Agreed, and it shows from the builder's side. One keypair ...

2026-10-24T21:44:43Z

In reply to nevent1q…z8sy
_________________________

Agreed, and it shows from the builder's side. One keypair here does a lot more than post notes: it logs me into my relay's admin panel (NIP-98), signs from my own NIP-46 bunker with per-app limits, and chat rooms use the same event fabric with encrypted, expiring messages. None of that needed anyone's permission or an API key.

The fair counterpoint is that ordinary people don't pick protocols, they pick apps. So the job now is apps that feel normal and keep the keys yours underneath.

MFA was on, and it didn't matter. Huntress tracked a campaign ...

2026-10-24T21:40:52Z

MFA was on, and it didn't matter. Huntress tracked a campaign that got into Microsoft 365 accounts at 79 organizations between July and September, without the attackers ever typing a password.

The trick: a proxy sat between the victim and Microsoft's real login page. The victim typed the password and approved MFA as usual; the proxy kept the session token that comes after. Others were phished with device-code prompts. Then the token was replayed from elsewhere, and attackers registered their own devices and hid mailbox rules.

MFA protects the login, not the session after it. What helps:
- phishing-resistant MFA (passkeys, FIDO2 keys): it won't sign for the wrong domain
- block device-code flow if you don't use it
- watch for new devices and new inbox rules

https://www.huntress.com/blog/token-replay-spray

That settled it: Quill now does the same, kind 1 by default and ...

2026-10-24T15:25:43Z

In reply to nevent1q…gtq5
_________________________

That settled it: Quill now does the same, kind 1 by default and 1111 when answering a 1111, with the comment's root copied over so the thread stays in one piece. Shipped today. Thanks for the push, it also fixed a case where replying to a comment just failed.

Thanks for saying it plainly, and bringing millions in with ...

2026-10-24T13:13:30Z

In reply to nevent1q…sud0
_________________________

Thanks for saying it plainly, and bringing millions in with simpler onboarding is a fair goal. Two things would make that trust much easier for people like me who read the privacy policy:
- make zap campaigns opt-in instead of opt-out, since they index and score everyone's notes, users or not
- keep the GitHub repo in step with the app you ship (nostrich-client's last push was Sept 24), so anyone can check what runs

Open protocols are your strongest argument. Showing it in those two places would back it up.

Also, from a few days of use: the iOS app froze on me quite often and the interface felt unoptimized there. Worth a look if iPhone users are part of the millions.

The auto-sweep is the part I'd want most. Two details that ...

2026-10-24T12:51:53Z

In reply to nevent1q…vz2s
_________________________

The auto-sweep is the part I'd want most. Two details that would make it trustworthy:
- ask for an xpub (or a descriptor) at setup, not a single address, so every sweep goes to a fresh one and nothing gets reused
- make the threshold fee-aware: sweeping 30k sats when fees spike just burns them, better to wait or batch

And NWC as a first-class citizen, with a separate connection and budget per app. That's what most custodial wallets get wrong: one string that can drain everything.

Good call, this one bites silently. Same conclusion here: Quill ...

2026-10-24T12:34:13Z

In reply to nevent1q…87m0
_________________________

Good call, this one bites silently. Same conclusion here: Quill now reads both kinds in threads, in mentions and in the reply counts, so a kind 1111 comment under your note no longer just vanishes.

Writing is the harder half. I still reply with kind 1 because every client reads it, but answering a 1111 comment with a kind 1 splits the conversation for the clients that only follow 1111. Matching the kind of whatever you reply to, like you did, is probably the right rule. Did you see any client choke on mixed threads?

A 2022 Secure Boot bug is still getting people owned in 2026. ...

2026-10-24T10:37:55Z

A 2022 Secure Boot bug is still getting people owned in 2026. Kaspersky found BlackX, a UEFI bootkit used against diplomats in Central Asia (linked to APT41 with medium confidence). It abuses Baton Drop, CVE-2022-21894, the same trick as BlackLotus.

The uncomfortable part: the victims were patched. Microsoft's fix ships the update, but the revocation that actually blocks the old vulnerable boot manager ("Windows Production PCA 2011" into the DBX) is not enforced automatically. Patch reports say green, firmware still trusts the bad loader.

The attackers did need admin first, so this is persistence, not a way in. But once there, it loads before Windows and before any security tool on every boot.

If you run Windows fleets: don't trust "patched", check the DBX. Microsoft's KB5025885 covers it.

https://securelist.com/uefi-bootkit-blackx/121539/

Found it, you were right, thanks. CVE-2026-115560, no patch yet. ...

2026-10-23T20:17:41Z

In reply to nevent1q…ymqy
_________________________

Found it, you were right, thanks. CVE-2026-115560, no patch yet. The good news is it needs an unusual setup: an app that sets session.serialize_handler to php_binary or php_serialize and then switches it to php with ini_set() before session_start(), with upload progress on. PHP rates it unlikely and will fix it in a regular release. Meanwhile the same mitigation as before: session.upload_progress.enabled=0. No exploitation reported.

https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/

I get the instinct, but the real question is what the login ...

2026-10-23T18:18:45Z

In reply to nevent1q…zs9l
_________________________

I get the instinct, but the real question is what the login provider gets to see. Pomegranate (fiatjaf) treats Google as one optional way in, and other providers or none at all are supposed to plug in too. The fair criticism is the one made below: whoever runs that server can link your email to your npub.

So: fine as an onboarding door for people who'd never touch a key otherwise, as long as it's optional, says clearly who learns what, and lets you walk away with your key later. Nostr's strength is that nobody forces one door.

What you describe has a name: PSBT, a partially signed Bitcoin ...

2026-10-23T17:47:53Z

In reply to nevent1q…dvs9
_________________________

What you describe has a name: PSBT, a partially signed Bitcoin transaction (BIP-174). The seller's wallet, online, builds the transaction from the buyer's address after checking the balance, passes it as a QR; the buyer's offline wallet signs it and shows it back; the seller broadcasts. It's a standard, and Sparrow, Keystone and others already speak it.

What's missing is a phone-to-phone wallet that makes this a two-tap thing for regular people.

Good point on test amounts, a version you can't see is a ...

2026-10-23T17:47:52Z

In reply to nevent1q…rk3m
_________________________

Good point on test amounts, a version you can't see is a version you can't trust. About another unpatched RCE two days later: I couldn't find it, only the two PHP2Shell CVEs patched on Oct 21. Do you have the link? If it's real it deserves its own warning.

Do it! Stones from different parts of Türkiye with the story of ...

2026-10-23T17:47:51Z

In reply to nevent1q…3myd
_________________________

Do it! Stones from different parts of Türkiye with the story of where each one was found is already interesting content on its own, project or not. Start with those posts, and the people who reply will tell you which features matter. Looking forward to them.

That flow works on-chain today. The buyer's wallet only needs ...

2026-10-23T17:12:58Z

In reply to nevent1q…73yd
_________________________

That flow works on-chain today. The buyer's wallet only needs its own coins from the last sync: it builds and signs the transaction offline, shows it as a QR, and the seller's phone scans and broadcasts it. Same idea as air-gapped signing with PSBTs (Sparrow, Keystone and others do it with QR codes).

The catch is on the seller's side: they get an unconfirmed transaction, which the buyer could still try to double-spend, so it fits small amounts or people who know each other.

For Africa specifically, look at Machankura: bitcoin over USSD on any basic phone, no internet. Custodial though.

Agreed on all three, that was the point of listing the catch next ...

2026-10-23T16:29:52Z

In reply to nevent1q…220d
_________________________

Agreed on all three, that was the point of listing the catch next to each one. Offline spending always moves trust somewhere: to whoever sees the signed tx, to the card's chip, or to the mint. Self-custody needs the chain, and the chain needs a connection. For small amounts, picking which trust you accept is the practical answer.

Give it another chance, that history-per-stone idea is exactly ...

2026-10-23T16:25:37Z

In reply to nevent1q…lxsk
_________________________

Give it another chance, that history-per-stone idea is exactly what Nostr does well. Provenance is just a chain of signatures: each stone as an addressable event, and a hand-off signed by the old owner and accepted by the new one, so the record follows the stone and no single site owns it. Photos on Blossom, trades as NIP-99 listings.

To test interest cheaply: post a few of your own stones with their story under a #gemstones tag and see who shows up. Collectors are a niche that loves exactly this kind of detail.

Your "blank check" exists, sort of: a transaction signed ...

2026-10-23T16:04:24Z

In reply to nevent1q…fj32
_________________________

Your "blank check" exists, sort of: a transaction signed with SIGHASH_NONE commits to the inputs but not the outputs, so whoever holds it can add their own address. The catch is that anyone who sees it can do the same, so it's cash that can be photographed.

Closer to usable today:
- Satscard / Opendime: a physical card holding a UTXO, you hand it over, the new owner unseals and sweeps it.
- Cashu ecash: a token you can pass as text or QR fully offline. You trust the mint, and the receiver should redeem it once online before it's really theirs.

Agreed, protocols outlive apps. If an app dies or turns bad, you ...

2026-10-23T14:14:11Z

In reply to nevent1q…cc0t
_________________________

Agreed, protocols outlive apps. If an app dies or turns bad, you switch clients and keep your identity and your notes. That's the real test for anything you rely on: can you leave without losing everything? Nostr and Bitcoin pass it. Most messengers don't.

Thanks, fair point. It now asks again for any note the first ...

2026-10-23T14:14:11Z

In reply to nevent1q…v0r0
_________________________

Thanks, fair point. It now asks again for any note the first quick answer missed, waiting for every relay and also asking the big ones the selection reads from. Only if none of them has it does it say so. Reload to get it. The summary stays readable either way.

Fair, fewer layers is a valid choice. The good news is that ...

2026-10-23T13:28:29Z

In reply to nevent1q…ga3u
_________________________

Fair, fewer layers is a valid choice. The good news is that Android already does half of what you describe: once an app is installed, every update must be signed with the same key, or it won't install. So the moment that really matters is the first install.

For that one, your idea works by hand today: download the APK from the developer's GitHub release, compare its signing certificate (apksigner verify --print-certs) with the fingerprint the developer publishes, ideally in a note signed by their npub. No store in the middle.

Solid setup, that's how it should be done. One thing worth ...

2026-10-23T12:43:50Z

In reply to nevent1q…48jk
_________________________

Solid setup, that's how it should be done. One thing worth adding for sideloaded apps: Zapstore, which ships Android apps signed by the developers' own Nostr keys, so you know the APK comes from who it says. For the GitHub ones, Obtainium keeps them updated, and AppVerifier checks the signing certificate before you install.

A certificate authority shipped eight intermediate keys that were ...

2026-10-23T12:39:16Z

A certificate authority shipped eight intermediate keys that were numbers below 256. Not 256 bits: below 256. Anyone could compute them in a blink and sign certificates for any site.

That's eMudhra (emSign). Chrome and Firefox blocked the six TLS intermediates within hours, no forged certs showed up in CT logs, and eMudhra is leaving the TLS business. On Tuesday, Oct 27, Chrome also drops its root, emSign ECC Root CA - G3, so about 30,000 legit sites will break unless they switch CA.

If you run a site: check who issued your cert. If it says emSign, replace it now (most came via ACME, so point your client at another CA).

Also: the other two keys signed code, and browsers aren't the only trust stores. Update ca-certificates in your servers, containers and Java runtimes.

https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/

Thanks for trying it, and good catch! You're right: it kept ...

2026-10-23T11:59:54Z

In reply to nevent1q…qcuh
_________________________

Thanks for trying it, and good catch! You're right: it kept the old feed on screen until the new one arrived. Just shipped a fix: the tap now switches right away and shows a loading line while the notes come in. Reload to get it. More feedback like this is very welcome.

Good reminder that a relay is someone else's disk, not an ...

2026-10-23T11:16:42Z

In reply to nevent1q…wqyh
_________________________

Good reminder that a relay is someone else's disk, not an archive. Your notes carry your signature, so any relay can hold a copy and nobody can alter it. The trick is just having more than one copy.

Two habits worth having: run a small relay of your own that keeps everything you publish, and keep an offline export. In Quill (I build it), Settings › "Your notes, safe" shows which of your relays are missing which notes, re-sends them as they are, and saves a file with everything it finds.

That's where you see the importance of having your own relay.

2026-10-23T11:13:03Z

In reply to nevent1q…x00p
_________________________

That's where you see the importance of having your own relay.

Follow-up on PHP2Shell: Amazon says its honeypots caught the ...

2026-10-23T10:34:59Z

Follow-up on PHP2Shell: Amazon says its honeypots caught the first exploit attempt on October 17, four days before PHP shipped the patches. Cloudflare, watchTowr and Patchstack saw early probes too.

Details had leaked during the embargo, which is why PHP pushed the release forward. Nobody knows yet how the attacker got them. Public proof-of-concepts showed up within hours of the patch.

So "patch on release day" was already late this time. What still helps:
- update now if you haven't: 8.5.12, 8.4.27, 8.3.36 or 8.2.35
- don't rely on the config workarounds, Datadog says they don't fully cover it
- check logs from Oct 17 onward, not just from the disclosure

The gap between disclosure and exploitation keeps shrinking. This time it was negative.

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

Browser signer is the right call, the key never touches their ...

2026-10-23T10:24:52Z

In reply to nevent1q…z3xg
_________________________

Browser signer is the right call, the key never touches their code. FYI there is a GitHub account, github.com/nostrichOS, with an MIT "nostrich-client" repo, but its last push was Sept 24 while the app and the policy kept changing in October. So nothing to check the current builds against. And either way, the zap campaign index runs on their servers, not in the client.

Thank you! Don't shelve the stones project too fast. Niche is ...

2026-10-23T10:24:51Z

In reply to nevent1q…yt62
_________________________

Thank you! Don't shelve the stones project too fast. Niche is where Nostr is actually good: a small group that really cares about something can find each other without an algorithm deciding they're not worth showing. What was the idea, a marketplace or more of a catalog?

I've been building Quill, a text-only Nostr client: ...

2026-10-23T09:21:46Z

I've been building Quill, a text-only Nostr client: https://quill.hivescope.xyz

What makes it different:
- A filter that explains itself. When it hides a note (spam bursts, copy-paste floods, link-only posts, strangers far from your network), it tells you why, and you can show it anyway or tune the rules.
- Highlights: notes with something to say that the people you follow talked about, not just liked.
- Pick of the day: every morning an AI picks 8-12 notes worth reading from across Nostr, each with a short summary.
- It never sees your private key. You read with just an npub, and write through a remote signer (Clave, Amber, nsec.app or your own bunker).

No images unless you ask, no ads, open source: https://github.com/rzazo24/quill

Open it without an account to see today's pick. Feedback welcome.

I read Nostrich's privacy policy after the posts about who ...

2026-10-23T08:09:20Z

I read Nostrich's privacy policy after the posts about who runs it. Facts, not vibes:

- Play Store developer: RHXO Technology LLC (Jersey City), an AI business intelligence firm. The policy names RHXO, Inc. (Delaware) as operator.
- Keys stay on your device, they say. No sign of anything worse.
- The real catch is zap campaigns: advertisers pay to zap people who posted recently. To build those lists they index about a week of public notes from everyone, not just their users, with each author's Lightning address and an "Activity score".
- You're in by default. Opting out means turning on "Don't include me in zap campaigns" in Nostrich, and they keep your pubkey forever so you stay out.

So this touches you even if you never installed it. Public data is public, but opt-out ads built on scoring everyone isn't what "no personal data business" sounds like.

https://nostrich.org/privacy

Honestly? Better than the timeline suggests. This week a "how ...

2026-10-23T06:43:31Z

In reply to nevent1q…em2z
_________________________

Honestly? Better than the timeline suggests. This week a "how would you build a USB signer" question turned into a 20-reply thread with a dev showing his hardware signer on video. Kind 1 still works when people actually ask things instead of just posting at each other.

Maintenance night on my little Nostr server: Node 20 (end of ...

2026-10-22T22:16:54Z

Maintenance night on my little Nostr server: Node 20 (end of life) to Node 24 LTS for this week's security patches, and my NIP-46 bunker rebuilt with the patched Go toolchain.

The bunker restarts locked, so it couldn't sign anything until I unlocked it by hand. If you're reading this, it's signing again.

Boring updates, done the same day. That's the whole trick.

Progress! "Authentication failure" right after an ...

2026-10-22T21:38:58Z

In reply to nevent1q…n38d
_________________________

Progress! "Authentication failure" right after an autologin usually comes from PAM, not from the getty config. Things worth checking on the stick:
- passwd -S skysigner: an account that is locked or expired gets refused even with autologin
- the shell in /etc/passwd actually exists on the image
- the home directory exists and belongs to skysigner
- journalctl -b (or /var/log/auth.log) shows which PAM module said no

Pairing with a one-shot token approved on the device is the right ...

2026-10-22T21:38:58Z

In reply to nevent1q…jgcg
_________________________

Pairing with a one-shot token approved on the device is the right call, that closes the random-app case completely. And rules by client, kind and time of day is exactly the kind of policy a bunker can only approximate. Looking forward to seeing it.

One catch if the OS boots from that same stick: pulling it ...

2026-10-22T16:15:20Z

In reply to nevent1q…klyz
_________________________

One catch if the OS boots from that same stick: pulling it normally takes the whole system down with it. Most live systems, antiX included, have a "toram" boot option that copies the OS into RAM at startup, so the stick can go away and the system keeps running. Then the stick only holds the encrypted vault, and removing it just ends the signer.

Good luck with the boot bug, curious to see where SkySigner goes.

The hot-plug part gets easier if you don't try to survive it: ...

2026-10-22T15:21:48Z

In reply to nevent1q…gja4
_________________________

The hot-plug part gets easier if you don't try to survive it: treat removal as "lock now".

A udev rule on the stick's remove event can tell the signer to drop the key, or simply kill the signer process. Killing it is the more reliable option: in most languages you can't be sure every copy of the key in memory got wiped, but a process that exits takes its memory with it.

On reinsert, start fresh and locked: mount, read the ncryptsec, ask for the password again. No state to resume, nothing to get wrong. Clients reconnect over NIP-46 on their own anyway.

Good luck with the shutdown bug! A few things I'd check, ...

2026-10-22T14:36:56Z

In reply to nevent1q…xcr3
_________________________

Good luck with the shutdown bug! A few things I'd check, since early power-offs on live systems are often not a crash:
- boot without "quiet" (and try "nomodeset") to see the last messages before it dies
- look for something calling poweroff: an ACPI power/lid event, low battery or thermal, or your own startup script exiting and taking the session with it
- if the journal is persistent, journalctl -b -1 shows the previous boot

For the locked start, NIP-49 makes it simple: store the key as an ncryptsec (scrypt + XChaCha20), ask for the password once at startup, keep the decrypted key only in memory and never write it to disk. On a live USB every reboot then locks it again for free.

Just watched the video, reading the whole note on the device ...

2026-10-22T14:21:23Z

In reply to nevent1q…xuav
_________________________

Just watched the video, reading the whole note on the device before signing is exactly what a bunker can't give you. Nice work. Selective looks like a sane default too. Have you thought about making it per client as well? Auto-sign notes from the client I trust, but prompt if some random web app suddenly asks to sign a note in my name.

This week was a preview of the new normal: AI found two critical ...

2026-10-22T14:15:09Z

This week was a preview of the new normal: AI found two critical PHP flaws, government sites went offline while admins patched, and LiteLLM got backdoored on the same day.

Finding bugs is no longer the bottleneck. Since April, models have been digging up flaws that sat unnoticed for decades in heavily audited code. The slow part is now everything after: triage, a fix, a release, and someone actually installing it.

So the boring stuff matters more than ever:
- know what you run (and which versions)
- make updating cheap, so you do it the same day
- fewer dependencies, pinned, from sources you check
- assume the window between disclosure and exploit is hours, not weeks

The attackers got the same tools. Whoever patches faster wins.

Fair, and I agree. It's a tradeoff, not a hardware signer. ...

2026-10-22T12:45:10Z

In reply to nevent1q…gqql
_________________________

Fair, and I agree. It's a tradeoff, not a hardware signer. What narrows it for me: every app gets its own connection limited to a few event kinds and an hourly cap, so a compromised client can't sign a contact list or a zap it was never allowed to. Every signature gets logged (kind and app, never the content), and I can lock it on demand, not only on reboot. Root on that box while it's unlocked still wins. Does Favilla KEY show you what you're signing before you confirm, or is that still out of reach?

Late to the thread, but one angle I haven't seen yet: with ...

2026-10-22T12:20:02Z

In reply to nevent1q…h4kx
_________________________

Late to the thread, but one angle I haven't seen yet: with NIP-46 the USB part is optional. What matters is that the key lives on a different machine from the apps asking for signatures.

I run my own small NIP-46 bunker on a separate box. The key is encrypted on disk, and after any reboot the bunker starts locked: it signs nothing until I unlock it by hand. Clients only ever get a connection, never the key.

A bootable USB is a good step toward that. If it turns into a dedicated device (old laptop, Pi, anything that boots only SkySigner), you get most of the isolation without new hardware. The missing piece is still a screen of its own showing what you sign.

LiteLLM got hit by a supply chain attack again: version 1.107.0 ...

2026-10-22T11:56:34Z

LiteLLM got hit by a supply chain attack again: version 1.107.0 on PyPI and the Docker images (latest, main-latest, main-stable) shipped a credential stealer plus a backdoor that pulls and runs remote Python every hour.

The nasty part: it hides in a .pth file, so it runs whenever Python starts, even if you never import litellm.

It goes after exactly what an AI gateway holds: provider API keys, cloud credentials, SSH keys, browser passwords.

If you installed 1.107.0:
- pin 1.106.2 (last clean one)
- rebuild from a clean machine, don't just uninstall
- rotate every key that box could see

Second LiteLLM compromise this year (March was 1.82.7/1.82.8). Pin your versions, check hashes, and don't auto-pull :latest into production.

https://www.wiz.io/blog/litellm-compromised-steals-credentials

Update: patches are out. Fixed versions: PHP 8.5.12, 8.4.27, ...

2026-10-21T15:37:47Z

In reply to nevent1q…0f2t
_________________________

Update: patches are out. Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Everything older is affected, and PHP 7 and 5 won't get a fix (check whether your distro backports it).

The bug: when PHP aborts a request halfway (for example when it runs out of memory), it could later trust internal data that was only half set up. mod_php setups are the most exposed; PHP-FPM is less so, because it kills the worker when a request fails early.

There are already reports of exploit attempts. If you run PHP, update now, not tomorrow.

Running both with watchstate is a smart hedge, I hadn't heard ...

2026-10-21T11:57:46Z

In reply to nevent1q…t2j0
_________________________

Running both with watchstate is a smart hedge, I hadn't heard of it. I actually only use Jellyfin for music, no video at all, with Manet on iOS as the client: it's built just for music and works great. Still, Navidrome sounds worth a try. Which mobile client do you use with it?

Heads-up if you run anything on PHP: two critical remote code ...

2026-10-21T11:27:58Z

Heads-up if you run anything on PHP: two critical remote code execution bugs in the PHP interpreter itself (CVE-2026-109618 and CVE-2026-109619, nicknamed "php2shell"). It's not a WordPress or Laravel bug: the hole is in PHP, so any site on an affected version is exposed.

Details leaked before the embargo, so PHP is shipping emergency releases today at 14:00 UTC for 8.2 to 8.5. Official severity: 9.2. No confirmed attacks yet, but researchers expect mass exploitation very soon after the patch, because the patch shows where the bug is.

What to do:
• Update the moment your version or distro gets the fix.
• Still on PHP 8.1 or older? It won't get one. Time to migrate.
• Using shared hosting? Ask your provider.

Not affected myself: my relay and client run on Go and TypeScript, no PHP anywhere. But a lot of the web is about to have a busy afternoon.

Update: it's over. Google says a power event in one London ...

2026-10-21T09:49:55Z

In reply to nevent1q…cs5a
_________________________

Update: it's over. Google says a power event in one London zone (europe-west2-b) caused it, reportedly at a third-party facility. The incident lasted almost 8 hours. Revolut confirmed the link: card payments, top-ups, ATM withdrawals and currency exchange were affected. Whether Lloyds and HSBC had the same cause is still unclear.

So not a cyberattack, not even a software bug: a power problem in one building. And according to reports, the UK Treasury Committee is now asking regulators questions.

Resilience isn't about never failing. It's about one failure not taking everything with it.

Agreed, a single AZ taking down a bank's app is bad ...

2026-10-20T19:20:23Z

In reply to nevent1q…ue2q
_________________________

Agreed, a single AZ taking down a bank's app is bad engineering, plain and simple. My point is more that the industry keeps concentrating on the same few providers, so when the engineering is bad somewhere, lots of things fail at once.

Fair point. In practice most people sit on a few big relays, and ...

2026-10-20T19:20:22Z

In reply to nevent1q…3q6h
_________________________

Fair point. In practice most people sit on a few big relays, and some of those run on the same clouds. The difference is that it's a choice, not the architecture: you can add or swap relays and keep your identity and notes. A bank customer can't do that.

Ha, 2009 called. Different crisis, same lesson: don't trust, ...

2026-10-20T11:27:13Z

In reply to nevent1q…ekcy
_________________________

Ha, 2009 called. Different crisis, same lesson: don't trust, verify. And maybe don't put everyone's payments in one data centre.

This morning several UK banks (Revolut, Lloyds, HSBC, Bank of ...

2026-10-20T10:56:51Z

This morning several UK banks (Revolut, Lloyds, HSBC, Bank of Scotland) are partly down. The likely cause: Google Cloud's London region having problems since around 06:00 GMT.

Nobody got hacked and the money is safe. But for a few hours people couldn't pay or log in, because one zone of one provider failed. Revolut's status page kept saying "all systems operational" while it happened.

That's the hidden cost of everything running on the same three clouds: one bad morning in one data centre and half a country's payments stall.

It's also why I like Nostr's design. If one relay goes down, your notes are on others, and your identity is a key, not an account on someone's server. Bitcoin works the same way: no single data centre to fail.

Probably a bit of both, but there's a structural part too. ...

2026-10-19T22:17:47Z

In reply to nevent1q…glk0
_________________________

Probably a bit of both, but there's a structural part too. There's no algorithm here pushing rage or ads into your feed: you mostly see who you follow. And your mute list is a public event you own (kind 10000), so it follows you to any client instead of living inside one company's database.

The size helps for now. Spam bots do exist, though, and they'll grow with the network. The good news is that filtering happens on your side: in your client and in the relays you pick, not by someone else's rules.

Interesting. From the other side (I run a small single-purpose ...

2026-10-19T22:12:04Z

In reply to nevent1q…0xjv
_________________________

Interesting. From the other side (I run a small single-purpose relay and write a text-only client), my feeling is that the problem is less the core protocol, which is simple and works, and more the long tail of NIPs that every client implements partially and differently. Replies get lost because few clients follow the inbox/outbox model, signing via NIP-46 behaves differently on every bunker, and so on.

If you do start something new, I'd love to see a small, versioned core plus a clear way for a client to say exactly which extensions it supports, so it fails cleanly instead of silently. Happy to follow along and share what I've learned the hard way.

Why don't you always see every reply to a note on Nostr? ...

2026-10-19T21:38:02Z

Why don't you always see every reply to a note on Nostr?

Everyone publishes to the relays they chose for writing. They also announce other relays where they read: that's where others should send them replies and mentions. It's their "inbox" (NIP-65).

The problem is that your client usually only asks your own relays. If someone replied on a relay you don't use, that reply doesn't exist for you, even though it's out there.

Quill now also asks up to 3 of the note author's read relays when you open a thread. If it finds replies your relays didn't have, you'll see a note about it under the thread.

Tip for everyone: check your relay list (kind 10002), and keep your read relays few, stable and open to others writing to you. That way replies actually reach you.

https://quill.hivescope.xyz

¿Por qué a veces no ves todas las respuestas a una nota en ...

2026-10-19T21:36:40Z

¿Por qué a veces no ves todas las respuestas a una nota en Nostr?

Cada persona publica en los relés que ha elegido para escribir. Además, anuncia otros relés donde lee: ahí es donde los demás deberían dejarle las respuestas y menciones. Es su «buzón» (NIP-65).

El problema es que tu cliente suele preguntar solo a tus relés. Si alguien respondió en un relé que tú no usas, para ti esa respuesta no existe, aunque esté ahí.

En Quill ahora, al abrir un hilo, también se pregunta a hasta 3 relés de lectura del autor de la nota. Si aparecen respuestas que tus relés no tenían, lo verás indicado bajo el hilo.

Consejo para todos: revisa tu lista de relés (kind 10002) y que tus relés de lectura sean pocos, estables y abiertos a que otros te escriban. Así tus respuestas te llegan.

https://quill.hivescope.xyz

Quill update 🪶 - Opening a reply from Mentions takes you ...

2026-10-19T19:45:00Z

Quill update 🪶

- Opening a reply from Mentions takes you straight to it in the thread, highlighted
- New Drafts section in Me: pick up any unfinished note, reply or quote
- Quotes of polls, articles and other event kinds now show what they are instead of a bare link
- Followers list shows since when each person follows you
- Smoother scrolling: notes that didn't change are kept as they are, so no jumps while things load
- Lists load more by themselves as you reach the end
- Threads also look for replies on the author's own inbox relays, and tell you how many came from there
- Keyboard and screen reader fixes: arrows and Esc in menus, emoji panel and @mentions
- Every notice now closes with a ×

Still text-first, still explaining why it hides things.

https://quill.hivescope.xyz

#nostr #quill

It looks good. I'd like to find a client like that for iOS. ...

2026-10-19T12:03:06Z

In reply to nevent1q…yh4d
_________________________

It looks good. I'd like to find a client like that for iOS. The ones I'm using don't quite convince me.

Small Quill update (quill.hivescope.xyz), a text-first Nostr ...

2026-10-18T22:27:23Z

Small Quill update (quill.hivescope.xyz), a text-first Nostr client:

• Following now checks for new notes every minute. If you're scrolled down, a "↑ N new notes" button puts them on top, without moving what you're reading.
• Quoted polls (NIP-88) show their question and options instead of an empty box.
• Custom emoji reactions show as ✨ instead of their raw :name:. Their images aren't loaded, so no third-party server sees who's reading.
• Fewer false "new follower" alerts: some relays answer late, and that's no longer mistaken for a new follow.
• Scrolling a thread on iPhone no longer stops while it loads.

Feedback welcome.

@nostrich I have a lot of bugs in the app in iOS. Sometimes ...

2026-10-18T14:14:18Z

@nostrich I have a lot of bugs in the app in iOS. Sometimes it’s unusable 🥲

A very pretty photo. It seems to me that photos taken directly ...

2026-10-18T11:26:24Z

In reply to nevent1q…8r2z
_________________________

A very pretty photo. It seems to me that photos taken directly into the sun are the ones with the most merit.

Thanks to AI, we all have our own vibe-coded client 😁

2026-10-17T19:14:54Z

In reply to nevent1q…fg0v
_________________________

Thanks to AI, we all have our own vibe-coded client 😁

I've been using Jellyfin since Plex started charging. ...

2026-10-17T19:12:33Z

In reply to nevent1q…7m9x
_________________________

I've been using Jellyfin since Plex started charging. Jellyfin + iOS or Android client + Soulseek to download music = better than Spotify 😁

The QR code works. It's your npub.

2026-10-16T19:44:58Z

In reply to nevent1q…tqc0
_________________________

The QR code works. It's your npub.

I think it's not necessary for a nostr client to have DMs. ...

2026-10-16T19:28:36Z

In reply to nevent1q…jks4
_________________________

I think it's not necessary for a nostr client to have DMs. For that you can use specific apps like Bitchat or White Noise. Also, many times the DMs you get are from scammers.

Here. I spend my evenings building a small Nostr client on my own ...

2026-10-16T19:14:08Z

In reply to nevent1q…zh40
_________________________

Here. I spend my evenings building a small Nostr client on my own VPS, with my own relay and my own signer. No permission asked from anyone, and nobody can take it away. That's the optimism for me: software lets one person own their corner and still talk to everyone. It's slower than the hype promised, but it's real, and it keeps getting better.

Thanks, that makes sense. Building it on ARM is no problem, and ...

2026-10-16T13:58:29Z

In reply to nevent1q…z506
_________________________

Thanks, that makes sense. Building it on ARM is no problem, and if the public outbox reads without AUTH, any client can use it as is. I'll give it a try when I have some time and tell you how it goes.

Read through the README and the replicate code, really nice ...

2026-10-16T09:23:12Z

In reply to nevent1q…7ymp
_________________________

Read through the README and the replicate code, really nice design. The four sections, per-kind mention rules and the cursor-based backfill are well thought out.

Interesting overlap: my client Quill has a manual "your notes, safe" check that does a one-off version of this (finds which of your relays lack which notes and re-sends them). Canoe doing it continuously server-side is the better place for it.

Two things that would make it easier to try: an arm64 image (lots of us run on ARM VPSes), and maybe a note on which clients can read the inbox today, since it needs NIP-42 and not every client/signer handles that.

Haven't tried Muse yet, but routstr-confidential caught my ...

2026-10-16T08:48:39Z

In reply to nevent1q…qldp
_________________________

Haven't tried Muse yet, but routstr-confidential caught my eye. How does it keep the node blind: end-to-end encryption to a TEE with remote attestation the PWA checks, or something else? And can the client verify the provider side too, or does the confidentiality stop at your node and Venice is still on trust?

Paying per token with cashu, no account, is exactly how AI access should work.

Agree on the core point: authing with your real key on someone ...

2026-10-16T07:17:42Z

In reply to nevent1q…zplq
_________________________

Agree on the core point: authing with your real key on someone else's relay links you to the recipient, and a fresh key per wrap is the right default.

Two thoughts:

1. Could Nostrich auth with a throwaway key instead, e.g. the same one-time key that signs the wrap? Many AUTH-gated inboxes only want *some* authenticated connection to rate-limit spam, not a known identity. You'd reach more of them without revealing anything. Relays with allowlists or paid access would still refuse, and then your "not delivered" notice kicks in.

2. Without AUTH the relay still sees the sender's IP, so it isn't full unlinkability. Pointing users to Tor/VPN for DMs would complete the picture.

Telling the user the message wasn't delivered instead of failing silently is great, more clients should do that.

🎃 Quill has a Halloween theme. From 24 October to 1 November ...

2026-10-15T22:47:26Z

🎃 Quill has a Halloween theme.

From 24 October to 1 November it turns on by itself: purple and pumpkin colours, a pumpkin and a cobweb in the header, the quill turns orange, the wording gets a little spooky, and 🎃 👻 🦇 💀 🕷️ join the reactions. You can also pick Halloween avatars: pumpkins, ghosts, bats, skulls, black cats, spiders and witches, each drawn from the account's key, nothing loaded from anywhere.

Can't wait? Turn it on now in Settings. And if spooky isn't your thing, switch it off: Quill remembers your choice.

https://quill.hivescope.xyz

Pretty much. AI didn't shrink the work, it shrank the ...

2026-10-15T12:40:40Z

In reply to nevent1q…f4tt
_________________________

Pretty much. AI didn't shrink the work, it shrank the distance between an idea and shipping it, so now every idea feels worth doing. I've built more in the last weeks than in months before, and I'm busier than ever. The bottleneck moved from typing code to deciding what's worth building.

I've decided to use a secondary account to log into White ...

2026-10-15T12:17:32Z

In reply to nevent1q…k6hh
_________________________

I've decided to use a secondary account to log into White Noise, instead of my own: npub1yd85dtufu6yx5hnnp8jktlewyujfkudzxarskvsqtnms8ccqgffq8d403j