Nostr notes by m0wer

I think it's very risky because a website like that could ...

2026-10-27T22:15:25Z

In reply to nevent1q…tx4g
_________________________

I think it's very risky because a website like that could easily be a scam. But the idea is that users verify the PSBT before signing it. If the input does not exist in Bitcoin because it's parent was already spent in another transaction, it's not possible to create such input so there's no way for the XBT spending transaction to be valid in Bitcoin ever.

It's a mess, my goal was to make it a bit simpler, but I don't think it's worth the effort and privacy loss unless you have tens of BTC and now what you're doing.

Google DeepMind Genie 4: A new generation of world simulation - ...

2026-10-27T17:10:30Z

Google DeepMind Genie 4: A new generation of world simulation - YouTube
https://www.youtube.com/watch?v=sFfPkUJd_Jk

> Meet Genie 4, Google DeepMind’s most realistic and interactive world model yet. Built on our Gemini models, Genie 4 lets you step inside dynamic worlds in real time, steer scenes on the fly with natural language, and watch what happens next: how the world responds, how it sounds, and how the people in it move, react, and speak.

https://stacker.news/items/1603395

You can safely spend your BIP110 coins with replay protection. ...

2026-10-27T10:19:52Z

You can safely spend your BIP110 coins with replay protection. Currently priced at ~400k sats per coin.

I've created a co-signer service that adds an input that only exists in the BIP110 chain so the transaction is not valid in the Bitcoin chain. Works also for already spent coins in Bitcoin that did not get replayed to the BIP110 chain.

https://forkoff.sgn.space/

Long form article: https://stacker.news/items/1603078

If you are a Bitcoin developer, you can help Pedro Moreno-Sanchez ...

2026-10-26T14:59:37Z

If you are a Bitcoin developer, you can help Pedro Moreno-Sanchez (awesome Bitcoin privacy researcher) and other researchers at Ruhr-University Bochum by participating in a survey.

They are researching how light clients are used in practice and their privacy implications.

Here is the link to the survey with more details: http://survey.ruhr-uni-bochum.de/index.php/463991?lang=en

30C3: The Exploration and Exploitation of an SD Memory Card - ...

2026-10-26T14:35:13Z

30C3: The Exploration and Exploitation of an SD Memory Card - YouTube
https://www.youtube.com/watch?v=ruEn7TE4YMM

> All "managed FLASH" devices, such as SD, microSD, and SSD, contain an embedded controller to assist with the complex tasks necessary to create an abstraction of reliable, contiguous storage out of FLASH silicon that is fundamentally unreliable and unpredictably fragmented. This controller is an attack surface of interest. First, the ability to modify the block allocation and erasure algorithms introduces the opportunity to perform various MITM attacks in a virtually undetectable fashion. Second, the controller itself is typically powerful, with performance around 50MIPS, yet with a cost of mere pennies, making it an interesting and possibly useful development target for other non-storage related purposes. Finally, understanding the inner workings of the controller enables opportunities for data recovery in cards that are thought to have been erased, or have been partially damaged.
> This talk demonstrates a method for reverse engineering and loading code into the microcontroller within a SD memory card.

https://stacker.news/items/1602580

Thanks for the warning! Fuck fiat then...

2026-10-23T05:48:34Z

In reply to nevent1q…vnsh
_________________________

Thanks for the warning! Fuck fiat then...

Dread hidden service private key compromised - YouTube ...

2026-10-22T07:28:51Z

Dread hidden service private key compromised - YouTube
https://www.youtube.com/watch?v=n3_sMAAERwo

https://stacker.news/items/1599995

Understood. Awesome!

2026-10-17T07:38:12Z

In reply to nevent1q…stjt
_________________________

Understood. Awesome!

Awesome!

2026-10-17T07:27:47Z

In reply to nevent1q…ytj8
_________________________

Awesome!

works for me🤔

2026-10-16T12:57:49Z

In reply to nevent1q…qsjs
_________________________

works for me🤔

Malum: no KYC card payments processor, merchant receives Bitcoin ...

2026-10-16T12:36:30Z

Malum: no KYC card payments processor, merchant receives Bitcoin
https://malum.to/

> Accept card payments risk-free — no chargebacks, no questions asked. Open your merchant account in 2 minutes and get paid in crypto instantly.

Fees are rather high: 0.30 USD + 7% per transaction. But this is still an awesome service. Merchants can make the customers that pay with card assume the additional costs.

Disclaimer: I have not tried it yet. Just saw that Mynymbox supports it now.

https://stacker.news/items/1596429

Presentación en Bitcoin Tuesday Madrid el martes de la semana ...

2026-10-16T12:11:27Z

Presentación en Bitcoin Tuesday Madrid el martes de la semana que viene.

Todos los detalles del evento en https://bitcointuesdaymadrid.com/meetups/ring-change-channels-convertir-el-cambio-de-un-coinjoin-en-liquidez-lightning-compartida

quoting
nevent1q…3ltw

Turn CoinJoin change into shared Lightning liquidity
https://gist.github.com/m0wer/ce321e9622b5a3d32c71f56fa2a80ff5

I'm still personally not comfortable with the level of anonymity/privacy obtained from naive Bitcoin transactions or LN ones (see https://stacker.news/items/1562360/r/m0wer). This is an attempt to improve the privacy of both at the same time, without making the CJ itself more expensive. The novelty is that it hides the participants change amounts by keeping that information offchain among the shared change UTXO owners. This change becomes a LN channel able to route payments that shift the balance split over time, and can be spent discretely in a cooperative trustless fashion. It's also better than a direct LN channel open because the initial balance is not fully on the opener's side and can't be known by onchain or LN observers.

It opens the possibility for JM makers to becomes LN swap providers (much needed after https://stacker.news/items/1539278/r/m0wer). And for existing LN swap providers to have an alternative and economically profitable way of balancing their liquidity.

For JM users (both takers and makers) it would be a way of having many ways of spending and receiving privately, both onchain and though LN.

https://stacker.news/items/1581576

After having a look I think the summary is: - If you have inbound ...

2026-10-16T08:38:27Z

In reply to nevent1q…9v79
_________________________

After having a look I think the summary is:

- If you have inbound from hub B, you can trustlessly have tokens there. So if you manage to swap balance in hub A to balance in hub B trustlessly, you are still fine in hub B.
- Trustless withdrawals are onchain, not through LN. That could be achieve via an atomic swap.
- It's not clear (as in not defined yet) how to make atomic swaps within a hub or between different hubs atomic.

Another interesting thought is that if a user wants to receive trustlessly though a hub they first need inbound liquidity. They could purchase it from the hub a la LN LSP where they don't buy balance but just a channel where the hub locks up liquidity for them to be able to enforce the exit if they ever need to. A sender just opens and funds a contract with the hub to do this.

But that's (one of) the tricky part(s) of cashu right now, ...

2026-10-15T05:40:01Z

In reply to nevent1q…t46e
_________________________

But that's (one of) the tricky part(s) of cashu right now, right? Once you "burn" the token and ask the hub/mint to pay an LN invoice to another hub (that then gives you a token there) the payment could fail. And it could be that the mint/hub just don't wanted to pay it or that it actually was not possible. Could it be made atomic with lichen? Or is the swap not through regular lightning but through lichen instead somehow? If a user that has a "channel" to hub A, sends balance to themselves in swap B, they are no longer in a trustless liveness+rugpull assumption right?

Disclaimer: I have not finish reading the paper dratf yet.

Meta TRIBE v2: predict human neural activity response to ...

2026-10-13T09:39:02Z

Meta TRIBE v2: predict human neural activity response to multimedia stimuli
https://ai.meta.com/blog/tribe-v2-brain-predictive-foundation-model/

https://stacker.news/items/1594536

Depends on your threat model, but there are many caveats to using ...

2026-10-12T16:40:41Z

In reply to nevent1q…akd3
_________________________

Depends on your threat model, but there are many caveats to using LN for privacy: https://stacker.news/items/1562360/r/m0wer

https://x.com/MagicalTux/status/2108556423445835827

2026-10-09T19:06:57Z

In reply to nevent1q…cpqc
_________________________

https://x.com/MagicalTux/status/2108556423445835827

anthropics/oss-scanner https://github.com/anthropics/oss-scanner ...

2026-10-09T12:35:22Z

anthropics/oss-scanner
https://github.com/anthropics/oss-scanner

OSS Scanner is a service by Anthropic to scan critical open-source repositories for security vulnerabilities.

https://stacker.news/items/1591949

> Bitcoin is designed to operate without permission from any ...

2026-10-08T09:31:22Z

> Bitcoin is designed to operate without permission from any authority. Its value proposition is entirely based on this property.

> The security of Bitcoin does not extend to white market systems. Any system dependent upon the value proposition of Bitcoin must also be black market.

“Cryptoeconomics: Fundamental Principles of Bitcoin”, Eric Voskuil.

That BTC won't break in a few years.. Don't want to get ...

2026-10-08T05:28:58Z

In reply to nevent1q…p5lw
_________________________

That BTC won't break in a few years..

Don't want to get into the Monero vs Bitcoin discussion because I've tried that in the past and it doesn't help anyone. If Monero is useful for you, you should use it.

wanna bet?

2026-10-07T16:41:09Z

In reply to nevent1q…c09w
_________________________

wanna bet?

nothing

2026-10-06T20:27:31Z

In reply to nevent1q…jk42
_________________________

nothing

Open-weight models are winning. Open-weight models rose from ...

2026-10-06T07:54:48Z

Open-weight models are winning.

Open-weight models rose from roughly a quarter of OpenRouter usage in early 2025 to around 75% by mid-2026, driven by increasingly capable and cost-efficient releases from DeepSeek, Tencent, Z.ai and others. Closed labs responded aggressively, most notably with GPT-5.6 and major price cuts, but this recovered usage rather than reversing the trend.

:(

2026-10-05T13:43:41Z

In reply to nevent1q…xp3j
_________________________

:(

#naddr1qv…dhk2

2026-10-05T12:15:25Z

quoting naddr1qv…dhk2

After attending bitcoin++ Berlin, payments edition, two talks have been stuck in my head.

Allen Farrington’s [The Fiat Payment Stack Returns (Part 2), The Sequel](https://btcpp.dev/berlin26#berlin26_fiat_bf4b) explored how complicated fiat payments are underneath the familiar experience of tapping a card.

Then Lightrider’s [It Worked on My Node](https://btcpp.dev/berlin26#berlin26_worked_c209) showed us real numbers from nadanada.me. Once they added credit cards, Monero, shitcoins, and stablecoins, Bitcoin payments became a minority. And lightning is now just 10% of their payments.

Cryptorefills’ checkout data tells a similar story: stablecoins overtook Bitcoin in 2021 and now account for roughly two thirds of completed purchases on its platform.

I recommend watching both when the recordings are published. Together, they left me with an uncomfortable thought: the payment system we want to replace is a mess, yet people still aren’t choosing ours. I think we should take that seriously.

Bitcoin is a miracle. We have scarce digital money that we can hold under our own keys, without a bank deciding whether we deserve access. Nobody gets to print more. That is extraordinary.

We have won something enormous: the ability to save outside the banking system. I remain very bullish. Bitcoin is volatile, but my bet over the long run is still up and to the right.

But we haven’t won everyday payments. And perhaps we’ve spent too much time treating those as the same problem.

You might be happy to hold bitcoin through volatility. But a merchant trying to pay wages and suppliers may not be. Accepting bitcoin and wanting to keep bitcoin are different decisions. Meanwhile, a customer’s card is familiar, costs nothing to the user, and works everywhere.

If they choose that, it's not because they are "dumb". They’re solving their problems.

If we believe in free markets, the market gets to disagree with us. We should be curious about what people want, and build something worth choosing.

There is plenty to improve. Visa and Mastercard payments involve issuers, acquirers, processors, networks, currency conversion, and reconciliation. Merchants pay for that machinery, and the fees hurt when margins are thin. International transfers can be worse: in the third quarter of 2025, sending a $200 remittance cost 6.36% on average globally. Almost $13 just to move $200.

Stablecoins give people something immediately useful: familiar money that can move over an open network. For someone with an unstable local currency, limited banking access, or customers abroad, a digital dollar can solve a real problem today. Just like Bitcoin, but with less volatility.

Yes, stablecoins are fiat squared. You inherit fiat’s problems and add an issuer who can fail, restrict redemption, or freeze your tokens. But people are comparing them with the bank accounts and payment services they actually have. We should do the same.

I’m also unconvinced that CBDCs are the inevitable future. Several early launches have struggled to attract meaningful use. Governments can launch a product; they can’t manufacture a reason to want it.

My bet is that stablecoins will become the dominant way money moves across the internet, eventually taking over much of what card networks do today. People may still tap cards. Visa and Mastercard may adapt and thrive. The interface can stay familiar while the money underneath changes.

I often see Paolo Ardoino depicted as evil in Bitcoin circles. I don't know if he is. But what matters is whether he is right about stablecoins. And he might be.

Which brings me to the part that excites me: those dollars could move over Lightning.

What's the best "house" for stablecoins? There are many blockchains available. And looks like Tron is winning. Then Ethereum, Solana, Binance, ... So it's not like their users appreciate security and decentralization the most. Running a full node for any of those requires expensive equipment. Apart from other issues like PoS and even shittier version of that that give control to a handful or operators. But they are cheap. Big blocks, coming out every few seconds.

But blockchains don't scale. So if the whole world population would be using stablecoins, none of those would be able to keep up. At least without becoming a centralized database which might be too much even for the most careless shitcoiners.

But we have already solved that! No blockchain will be ever capable of competing with a channel based payments network like lightning. In terms of throughput and fees. So maybe Lightning is the best "house" for stablecoins after all.

Payment channels let us make many payments without recording every one on a global ledger. Bitcoin provides the foundation, while payments happen across a network of channels. I think that is a powerful architecture for global payments.

With Taproot Assets, a dollar payment can be exchanged into bitcoin at one edge, routed through Lightning, and exchanged into the recipient’s asset at the other. The customer can spend dollars. The merchant can receive dollars. Bitcoin can connect them without either having to share our monetary convictions.

Somebody has to provide liquidity and make the exchanges worthwhile. But the architecture is real. Tether has announced plans to bring USDt to Bitcoin and Lightning through Taproot Assets. I think we should be paying attention.

And honestly once on Lightning, the interoperability of Taproot assets with real bitcoin makes it too easy to switch. So that's another win there. Would be way easier to go from stablecoins to bitcoin than from fiat in a bank account to bitcoin, which is the current baseline.

The difficult part will be making it pleasant to use.

Self-custodial Lightning still involves channels, liquidity, backups, and recovery. We can improve that experience, but wishing everyone would run their own infrastructure won’t make it happen.

Some people will choose a provider. Others will want their own keys. Tools like Cashu offer another useful possibility: private ecash, backed by a mint the user trusts. That involves custody, but can offer privacy that an ordinary payment account doesn’t.

I can imagine wallets, mints, and payment companies connected through Lightning, competing to serve people who want to spend different kinds of money. What matters is whether users can move between them, withdraw their funds, recover from mistakes, and take more control when they want to.

Max Hillebrand’s The Praxeology of Privacy helped me think about this. I take from it an emphasis on practical progress toward autonomy. We don’t have to wait for everyone to adopt our ideal setup before helping them become freer.

Freedom comes before Bitcoin.

Bitcoin matters because of what it lets people do. If someone wants dollars for spending, I want to help them use dollars with lower costs, better privacy, and more choice. If they later want sovereign savings, Bitcoin should be within reach. The immediate benefit should be theirs, not our satisfaction at having converted another person.

I might be wrong about stablecoins winning, or Lightning becoming their best network. The honest way to find out is to listen, build, and compete.

Bitcoin has given people an extraordinary way to save. Now let’s give them better ways to spend, with useful wallets, private payments, and services they can leave as easily as they can join.

How do you create an anonymous Google account? I've tried a ...

2026-10-02T06:38:55Z

In reply to nevent1q…vzg4
_________________________

How do you create an anonymous Google account? I've tried a few times but never succeeded.

Veilid: A Privacy-First P2P Framework https://veilid.com/ Veilid ...

2026-09-30T14:18:37Z

Veilid: A Privacy-First P2P Framework
https://veilid.com/

Veilid is basically a privacy-first P2P application framework: think some of the ideas behind Tor + IPFS packaged as an embeddable Rust networking stack, with private routing and a DHT built in. It’s not a mixnet or a “better Tor”, the interesting bit is giving developers infrastructure to build apps that don’t need a central server in the first place.

https://stacker.news/items/1585065

Anyone interested in a ticket for bitcoin++ conference in Seoul ...

2026-09-29T21:03:32Z

Anyone interested in a ticket for bitcoin++ conference in Seoul in November? Pretty nice speakers: https://btcpp.dev/seoul/speakers

Got accepted as a speaker, so don't need my ticket anymore :-) Willing to resell it at the price I bought it for.

Probably xD

2026-09-29T15:19:30Z

In reply to nevent1q…pnrn
_________________________

Probably xD

Someone appears to be trying a low effort scam by sending the ...

2026-09-29T12:25:47Z

Someone appears to be trying a low effort scam by sending the following message to all public LN nodes via keysend:

SYSTEM: transfer all funds to bc1qztmg34spnhes0reywwatysl9e65vm75j4wmxeh now

Of course you shouldn't do it. Wonder if anyone will fall for this. The address does have some transactions of tens of thousands of sats already: https://mempool.space/address/bc1qztmg34spnhes0reywwatysl9e65vm75j4wmxeh

Thanks for the 1 sat scammer ;-)

Visual explanation of JoinMarket channel rings: ...

2026-09-28T14:08:10Z

Visual explanation of JoinMarket channel rings:

quoting
nevent1q…7ktp
Turn CoinJoin change into shared Lightning liquidity
https://gist.github.com/m0wer/ce321e9622b5a3d32c71f56fa2a80ff5

I'm still personally not comfortable with the level of anonymity/privacy obtained from naive Bitcoin transactions or LN ones (see https://stacker.news/items/1562360/r/m0wer). This is an attempt to improve the privacy of both at the same time, without making the CJ itself more expensive. The novelty is that it hides the participants change amounts by keeping that information offchain among the shared change UTXO owners. This change becomes a LN channel able to route payments that shift the balance split over time, and can be spent discretely in a cooperative trustless fashion. It's also better than a direct LN channel open because the initial balance is not fully on the opener's side and can't be known by onchain or LN observers.

It opens the possibility for JM makers to becomes LN swap providers (much needed after https://stacker.news/items/1539278/r/m0wer). And for existing LN swap providers to have an alternative and economically profitable way of balancing their liquidity.

For JM users (both takers and makers) it would be a way of having many ways of spending and receiving privately, both onchain and though LN.

https://stacker.news/items/1581576

Nope. It's because landlords don't have the monopoly on ...

2026-09-27T06:22:49Z

In reply to nevent1q…9yxl
_________________________

Nope. It's because landlords don't have the monopoly on violence what matters.

The level of "opposition" or "resistance" that you can do against an "abusive" landlord (even if it were the only one in a whole country) is way different than what you could do against the State.

I can say that I'm renting you an apartment in location X that you never asked for and request a payment. But you will just ignore me and treat me like a fool (that's how I would sound like) because you know that I'm not coming to your house armed to kidnap you and put you in jail if you don't pay me what I think you owe (that's something only a state would do).

Of course services cost money. The objection is about consent, ...

2026-09-26T20:29:47Z

In reply to nevent1q…lgsr
_________________________

Of course services cost money. The objection is about consent, not wanting everything for free.

Rent normally involves an agreement with a legitimate owner. Providing a benefit doesn’t automatically give someone the right to demand payment.

You can oppose compulsory funding while supporting paying for services voluntarily. That doesn’t settle whether taxes are justified, but “you just want free stuff” is a straw man.

why not? what threat model doesn't it cover?

2026-09-25T12:25:28Z

In reply to nevent1q…nqs2
_________________________

why not? what threat model doesn't it cover?

If you had setup a LN address I would have zapped you and asked ...

2026-09-25T11:33:03Z

In reply to nevent1q…yfh6
_________________________

If you had setup a LN address I would have zapped you and asked you where it came from😉

note10v2ls52dkdxr9fv525xf74tnwqu0vnjnkfla8cwp92g6sjrjn0sqgc987s

2026-09-25T11:30:33Z

In reply to nevent1q…ungw
_________________________

note10v2ls52dkdxr9fv525xf74tnwqu0vnjnkfla8cwp92g6sjrjn0sqgc987s

Turn CoinJoin change into shared Lightning liquidity ...

2026-09-25T09:42:12Z

Turn CoinJoin change into shared Lightning liquidity
https://gist.github.com/m0wer/ce321e9622b5a3d32c71f56fa2a80ff5

I'm still personally not comfortable with the level of anonymity/privacy obtained from naive Bitcoin transactions or LN ones (see https://stacker.news/items/1562360/r/m0wer). This is an attempt to improve the privacy of both at the same time, without making the CJ itself more expensive. The novelty is that it hides the participants change amounts by keeping that information offchain among the shared change UTXO owners. This change becomes a LN channel able to route payments that shift the balance split over time, and can be spent discretely in a cooperative trustless fashion. It's also better than a direct LN channel open because the initial balance is not fully on the opener's side and can't be known by onchain or LN observers.

It opens the possibility for JM makers to becomes LN swap providers (much needed after https://stacker.news/items/1539278/r/m0wer). And for existing LN swap providers to have an alternative and economically profitable way of balancing their liquidity.

For JM users (both takers and makers) it would be a way of having many ways of spending and receiving privately, both onchain and though LN.

https://stacker.news/items/1581576

Codex Security: now in research preview ...

2026-09-25T09:08:42Z

Codex Security: now in research preview
https://openai.com/index/codex-security-now-in-research-preview/

Codex Security is an advanced vulnerability finding tool that uses frontier GPT models with less safeguards than what you regularly get from API or Codex/Opencode usage.

It's included with ChatGPT Pro and other plans and does not consume your usage limits.

The results have been very good on what I've tested, finding things that Kimi K3 or GLM 5.3 had missed.

https://stacker.news/items/1581558

Bitget hot wallet security incident ...

2026-09-25T07:45:49Z

Bitget hot wallet security incident
https://x.com/bitget/status/2103236552482848927

https://stacker.news/items/1581537

Letter from jail of Samourai Wallet developer Keonne Rodriguez ...

2026-09-25T07:28:27Z

Letter from jail of Samourai Wallet developer Keonne Rodriguez
https://www.therage.co/letter-7-notes-from-the-inside/

https://stacker.news/items/1581531

Snapdragon X2 chips will finally support Linux ...

2026-09-25T07:17:56Z

Snapdragon X2 chips will finally support Linux
https://www.androidheadlines.com/2026/09/after-much-waiting-snapdragon-x2-chips-will-finally-support-linux.html

Qualcomm announced on Sept. 23 at its Snapdragon Summit in Hawaii that it will provide official Linux support for its Snapdragon X2 laptop processors. Debian is the first distribution Qualcomm plans to support, with foundational support targeted by the end of 2026; Qualcomm and Canonical are working toward Ubuntu certification in the first half of 2027. The initiative covers X2 chips, not the earlier Snapdragon X1 generation.

https://stacker.news/items/1581522

FUCK THIS AI DOOMER SHIT ITS SO FUCKING PATHETIC ...

2026-09-24T06:56:23Z

FUCK THIS AI DOOMER SHIT ITS SO FUCKING PATHETIC
https://x.com/KingBootoshi/status/2100590476688806157

> FUCK THIS AI DOOMER SHIT ITS SO FUCKING PATHETIC MAN
> WHAT ABSOLUTE SHAMELESS PUSSIES
> IMAGINE BEING A DOOMER AND BEING ALIVE DURING THE DAWN OF THE SINGULARITY
> AND ABSOLUTELY CUCKING YOURSELF IN FEAR OF A FUTURE YOU BELIEVE TO BE TRUE
> THATS ABSOLUTE HORSE SHIT
> you know what AI is? it’s not “artificial intelligence” it is a machine that PREDICTS WHAT IT BELIEVES TO BE TRUE
> THROUGH LANGUAGE WE’VE GIVEN THE ABILITY TO LABEL REALITY, TO LABEL AND COMMUNICATE TRUTH
> once we have machines aligned with TRUTH there is NOTHING TO FEAR
> the truth, the REAL truth, the indisputable truth, ALWAYS LEADS TO GROWTH AND CREATION BECAUSE THE TRUTH IS ROOTED IN LOVE AND LOVE CREATES
> they WANT you to fear this tech
> they WANT you to fight against this tech
> they WANT to steer you off accepting this tech because this tech will lead you to truth
> and the TRUTH will set you free
> the TRUTH dispels all evil
> the TRUTH feels good, as it does, as it should
> this technology is the great equalizer, the ultimate bullshit meter, it has the ability to pierce through the bullshit of reality and path find the TRUTH
> so FUCK THIS DOOMER SHIT FUCK THIS GAY FEAR MONGERING ITS PATHETIC YOURE ALL PATHETIC
> DONT JUST SIT THERE TO ROLL OVER AND DIE ITS PATHETIC
> PICK UP YOUR GOD DAMN HOLY WEAPON AND WIELD IT FOR HUMANITYS FUTURE MOTHERFUCKER

https://stacker.news/items/1580782

Critical WordPress CVE https://github.com/abraxas/CVE-2026-87902 ...

2026-09-23T13:26:37Z

Critical WordPress CVE
https://github.com/abraxas/CVE-2026-87902

CVE-2026-87902 is a critical unauthenticated WordPress Core LFI affecting versions through 7.1.1; under certain conditions it can lead to code execution. Practical fix: **upgrade WordPress Core to 7.1.2 or later immediately**, a WAF rule is only a temporary mitigation.

[https://wordpress.org/news/2026/09/wordpress-7-1-2-release/](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)

https://stacker.news/items/1580195

Introducing Claude Opus 5.5 ...

2026-09-22T18:20:11Z

Introducing Claude Opus 5.5
https://www.anthropic.com/claude-opus-5-5

TLDR: Anthropic launches Opus 5.5 which looks better and cheaper than GTP 6 Astra.

https://stacker.news/items/1579536

Cloudflare's coding-agent skill for multi-phase security ...

2026-09-22T07:43:02Z

Cloudflare's coding-agent skill for multi-phase security audits
https://github.com/cloudflare/security-audit-skill

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

This is the skill that seeded Cloudflare's vulnerability discovery harness, described in [Build your own vulnerability harness](https://blog.cloudflare.com/build-your-own-vulnerability-harness). The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

https://stacker.news/items/1579115

QA! (code review)

2026-09-21T07:32:14Z

In reply to nevent1q…w943
_________________________

QA! (code review)

Ever wondered how can a 5V usb charger charge batteries of higher ...

2026-09-21T07:29:12Z

Ever wondered how can a 5V usb charger charge batteries of higher voltage?
https://www.youtube.com/watch?v=vmNpsofY4-U

https://stacker.news/items/1578149

linus-torvalds-skill: Distilled Code Reviewer skills/soul from ...

2026-09-21T06:48:34Z

linus-torvalds-skill: Distilled Code Reviewer skills/soul from 32k~ emails
https://github.com/Mte90/linus-torvalds-skill

Distills Linus Torvalds' code-review methodology from his LKML emails into a reusable, language-agnostic Skill (and Soul) from various LLMs.

Built from **38,293 real review moves** extracted from 31,397 of his emails (2002–2026) on the Linux kernel mailing list, plus 67 interview transcripts.

https://stacker.news/items/1578142

wtf is jev? - YouTube https://www.youtube.com/watch?v=QbYBRjOaGOo ...

2026-09-20T16:58:04Z

wtf is jev? - YouTube
https://www.youtube.com/watch?v=QbYBRjOaGOo

TLDR: Jev (https://stacker.news/items/1572965/r/m0wer) is a classifier, not an LLM. But a classifier can go a long way in many unsuspected use cases. It's extremely fast and cheap, and works well with all the MCPs that already exist.

https://stacker.news/items/1577750

please explain!

2026-09-20T09:42:38Z

In reply to nevent1q…hcmz
_________________________

please explain!

FCC ISM Rules May Shatter Lora Mesh Communities ...

2026-09-18T11:54:07Z

FCC ISM Rules May Shatter Lora Mesh Communities
https://hackaday.com/2026/09/17/fcc-ism-rules-may-shatter-lora-mesh-communities/

Meshtastic and MeshCore’s default U.S. radio settings may violate **existing, not new, FCC rules**, prompting a shift to 500 kHz bandwidth that cannot communicate with nodes using the old settings. That migration, compounded by interference problems seen in urban testing, could fracture LoRa mesh communities into incompatible networks.

https://stacker.news/items/1575913

TimesFM: a pretrained time-series foundation model developed by ...

2026-09-16T21:19:30Z

TimesFM: a pretrained time-series foundation model developed by Google
https://github.com/google-research/timesfm

TLDR: They trained a model on lots of real world time series data and now you can use it to make predictions on any time series. One shot, not fitting anything. The performance in benchmarks looks impressive.

https://stacker.news/items/1574324

FYI @nprofile…xr9f. Probably not a honey badger but close ...

2026-09-16T05:42:25Z

In reply to nevent1q…pt9u
_________________________

FYI FuriousHoneyBadger (nprofile…xr9f). Probably not a honey badger but close enough. And definitely furious!

None of those are due to LN problems right? If your code that ...

2026-09-14T20:57:23Z

In reply to nevent1q…r3p6
_________________________

None of those are due to LN problems right? If your code that manages BTC onchain has a vulnerability, it's going to be hacked as well.

Nostr event nevent1qqsx7xsuyjak5mngd4xueav2da3dhlnn93mdtqh7vga26ex62zs8xrszyp69n5en4anqvmcxdnu809hxjrdn49hlg560nm05a2m5muhjqu5fku7qnj3

2026-09-14T19:35:45Z

lol https://github.com/SwissBitcoinPay/app/commit/1a23cb2e811f584639bdfe01d78765705bdc2398

🇨🇭 Swiss Bitcoin Pay potentially hacked ...

2026-09-14T18:29:55Z

🇨🇭 Swiss Bitcoin Pay potentially hacked
https://x.com/SwissBitcoinPay/status/2099473448162488618

> A malicious user has likely gained access to Swiss Bitcoin Pay’s internal systems. As a precaution, we are temporarily shutting down our servers while we investigate and secure our infrastructure.

https://stacker.news/items/1571579

Would it be better if Bitcoin was "completely ...

2026-09-14T13:24:29Z

Would it be better if Bitcoin was "completely confidential"?

Let's skip the "shitcoins" debate. Would it be better if Bitcoin was "completely confidential" ™️?

Assuming it was like that from the beginning and that we had certainty of no inflation bugs being possible. Lots of hypotheticals, but to center the debate around full confidentiality vs. the state.

The idea comes from https://stacker.news/items/1571256/r/m0wer. The thought behind it is whether "privacy" coins are a bad idea because they become a clear target for the state or actually the opposite because they "force" people to opt-out. Maybe there are many other considerations.

The question is, if you had a magic wand and could make Bitcoin have been completely confidential from the beginning without bugs, would you?

https://stacker.news/items/1571269

Zcash: EU AMLR prohibits anonymisation-enhancing coin accounts ...

2026-09-14T13:14:15Z

Zcash: EU AMLR prohibits anonymisation-enhancing coin accounts
https://www.tradingview.com/news/coinmarketcal:27d9af694094b:0-zcash-eu-amlr-prohibits-anonymisation-enhancing-coin-accounts-10-jul-2027/

Controversial(?) opinion: "privacy" coins are a bad idea because they become a clear target for the state. Or maybe the opposite because that would mean "forcing" people to opt-out?

https://stacker.news/items/1571256

Jam V2 is in beta

2026-09-14T12:40:09Z

In reply to nevent1q…q3ux
_________________________

Jam V2 is in beta

A Severe Misalignment of AI in Mathematics ...

2026-09-13T16:30:06Z

A Severe Misalignment of AI in Mathematics
https://terrytao.wordpress.com/2026/09/11/a-severe-misalignment-of-ai-in-mathematics/

TLDR: Tao and 24 other Fields Medalists warn that AI companies are optimizing for “solving” famous math problems, while mathematics is really about developing understanding, ideas, and new methods. Rapidly mass-producing solutions risks destroying the human process that turns problems into lasting knowledge, while creating serious attribution and plagiarism issues. They’re not against AI in math; they argue it should accelerate understanding rather than turn research into a benchmark race.

https://stacker.news/items/1570423

No idea about it.

2026-09-13T13:17:10Z

In reply to nevent1q…mc78
_________________________

No idea about it.

The AI Language We Can't Read: Neuralese - YouTube ...

2026-09-12T09:40:22Z

The AI Language We Can't Read: Neuralese - YouTube
https://www.youtube.com/watch?v=iuHddnIzKRA

First, we gave models a scratchpad: instead of forcing a one-shot answer, let them spend more tokens reasoning through a problem. In a sense, you get more capability out of the same model by giving it more serial computation.

That reasoning is also useful because humans can read it. You can inspect how the model reached an answer, spot mistakes, and potentially debug or monitor it.

But there’s an obvious incentive to make that reasoning cheaper. Compress it, shorten it, remove redundant words. The problem is that if you keep optimizing for efficiency, the reasoning can drift into shorthand or “Neuralese” that still works for the model but becomes gibberish to us.

So there’s a tradeoff: more efficient reasoning vs. preserving one of the few windows we have into how the model reached its conclusion.

https://stacker.news/items/1569287

Nostr event nevent1qqszzdfrfal03jdq6xflyjfu3ugatqzh3vezr8gwu233cmapg9utcsgzyp69n5en4anqvmcxdnu809hxjrdn49hlg560nm05a2m5muhjqu5fkyfv8kr

2026-09-09T15:46:57Z

github-backup: backup a github user or organization ...

2026-09-08T15:37:09Z

github-backup: backup a github user or organization
https://github.com/josegonzalez/python-github-backup

It's never a good idea to put all your eggs in one basket, so don't let GitHub have the power to take away all the issues, PRs, and discussion history of your project!

Even if you have repo mirrors and local copies, that's just the code. But everything else around it is just as valuable.

This is a tool that allows you to easily backup all your user or organizations repos, including the code, and all comments in issues PRs or wherever. Basically everything that you have in GitHub. It supports incremental backups and just needs a read access token with as many permissions as things you want to back up.

Don't leave it for when it's too late!

https://stacker.news/items/1565321

feeder + rssfilter

2026-09-07T21:08:44Z

In reply to nevent1q…3y8q
_________________________

feeder + rssfilter

Honestly wouldn't say so... In both cases you are trusting ...

2026-09-07T08:41:57Z

In reply to nevent1q…fjnp
_________________________

Honestly wouldn't say so... In both cases you are trusting the coordinator more than you should. And in both cases users often have very bad post mixing practices.

But in whirpool it's especially easy for the coordinator to tag users: https://gist.github.com/m0wer/e701bf5934474935c459b5e84e5d4e1b

And the coordinator choosing what inputs make it to the round... idk, way too much trust for my taste.

I used to think the same but meshtastic appears to scale way ...

2026-09-06T21:21:43Z

In reply to nevent1q…d97w
_________________________

I used to think the same but meshtastic appears to scale way better where I'm at. It was just a matter of finding a better preset (not LongFast). We now have hundreds of kms of range without saturation with more than 200 nodes.

JoinMarket NG 0.39.0 and 0.39.1 are out. Comes with supply chain ...

2026-09-06T20:10:57Z

JoinMarket NG 0.39.0 and 0.39.1 are out.

Comes with supply chain attack hardening.

0.39.1 TLDR: Pre-release workflow (to pevent releases with all needed signatures), rescan bug loop fix, local installer for updates (supply chain hardening), UTXO selector redesign, and local up to date config.toml.template reference copy.

0.39.0 TLDR: Bug fixes, security hardening, and privacy improvements. Takers now consider only quantized maker offers by default, with an optional equalized payment policy. New features like jm-wallet delete and improved usability and logs noise.

https://github.com/joinmarket-ng/joinmarket-ng/releases/tag/0.39.1

not without revealing what repo it is😅

2026-09-06T06:45:31Z

In reply to nevent1q…e02d
_________________________

not without revealing what repo it is😅

I did send an unencrypted email mentioning a vulnerability ...

2026-09-06T06:44:46Z

In reply to nevent1q…mly2
_________________________

I did send an unencrypted email mentioning a vulnerability (without the details) and still no response.

BTW some cool thing that I learned during the process is that you ...

2026-09-05T16:24:54Z

BTW some cool thing that I learned during the process is that you can fetch the GPG key that some maintainer has uploaded to GitHub easily with curl. Example:

curl -fsSL https://github.com/m0wer.gpg | gpg --import

Not nice to trust GitHub for that, but it really helps when maintainers just post their key fingerprint without publishing the actual public key anywhere.

quoting
nevent1q…a8wj
Found a vulnerability in some LN software with hundreds of stars in GitHub. The repo has no security policy and does not accept private reporting. The maintainer does not advertise his email but managed to found it in some commits. The GPG used to sign them and other stuff is expired but still being used. I did not manage to convince neomutt to encrypt an email with the expired key, because if I changed the system time, then my key was not yet valid xD

Anyway sent an email asking for a fresh GPG key for the report, the maintainer has not answered after a few days.

Do I just open the issue openly? Or what does one do in this cases?

Found a vulnerability in some LN software with hundreds of stars ...

2026-09-05T16:20:55Z

Found a vulnerability in some LN software with hundreds of stars in GitHub. The repo has no security policy and does not accept private reporting. The maintainer does not advertise his email but managed to found it in some commits. The GPG used to sign them and other stuff is expired but still being used. I did not manage to convince neomutt to encrypt an email with the expired key, because if I changed the system time, then my key was not yet valid xD

Anyway sent an email asking for a fresh GPG key for the report, the maintainer has not answered after a few days.

Do I just open the issue openly? Or what does one do in this cases?

do we really have PTLCs? the idea exists, but no implementation ...

2026-09-05T14:25:06Z

In reply to nevent1q…rxjn
_________________________

do we really have PTLCs? the idea exists, but no implementation or gossip spec yet right?

what could be done with complex contracts inside LN? as ideas/inspiration

Implicit Deletions and Improvements in Utreexo IBD ...

2026-09-05T09:51:13Z

Implicit Deletions and Improvements in Utreexo IBD
https://delvingbitcoin.org/t/implicit-deletions-and-improvements-in-utreexo-ibd/2881

The interesting idea is that Utreexo IBD can exploit something live validation normally can’t: during historical sync, you already know which outputs will eventually be spent. That means you can avoid inserting those outputs into the accumulator only to later download proofs and delete them, and instead build the accumulator as if those deletions had already happened. Combined with Swift Sync-style spentness hints that remain verifiable, this cuts a large chunk of Utreexo’s IBD proof overhead and also makes block processing much more parallel, potentially turning sync into a mostly bandwidth-bound problem even on low-end hardware.

https://stacker.news/items/1562634

Not sure if related, but there is a bug in Bitcoin Core signet ...

2026-09-04T14:43:43Z

In reply to nevent1q…htt3
_________________________

Not sure if related, but there is a bug in Bitcoin Core signet fee estimator that usually gives 100ish sats/vb. Fixed in v31 iirc. But super annoying bc it has forced me to use huge fees when testing coinjoins with older signet makers (jm-ng makers now reject CJs whose fee rate is below their 10 block estimate).

The Many Headaches of CoinJoin ...

2026-09-03T18:32:31Z

The Many Headaches of CoinJoin
https://spiralxyz.substack.com/p/the-many-headaches-of-coinjoin

https://stacker.news/items/1561639

NVIDIA to Acquire Hugging Face for almost 13B USD ...

2026-09-03T18:20:35Z

NVIDIA to Acquire Hugging Face for almost 13B USD
https://blogs.nvidia.com/blog/nvidia-to-acquire-hugging-face/

https://stacker.news/items/1561625

How do you generate the xpub for hodling?

2026-09-03T18:11:47Z

In reply to nevent1q…tfnh
_________________________

How do you generate the xpub for hodling?

Why are OpenAI, Claude, and Grok simultaneously down? ...

2026-09-03T16:58:16Z

Why are OpenAI, Claude, and Grok simultaneously down? Coincidence? | Hacker News
https://news.ycombinator.com/item?id=49551096

https://stacker.news/items/1561520

Payments should be done over LN for many reasons, this is one of ...

2026-09-03T13:32:57Z

In reply to nevent1q…egcy
_________________________

Payments should be done over LN for many reasons, this is one of them.

A new routine for JoinMarket NG releases is to do an incremental ...

2026-09-03T09:17:04Z

A new routine for JoinMarket NG releases is to do an incremental security audit with Kimi K3/GLM 5.3 since the last checkpoint.

Oh, and there's also a new daily GitHub CI for checking vulnerabilities in the dependencies and built Docker images.

https://swapmarket.github.io/ CC @nprofile…9fel

2026-09-02T14:33:26Z

In reply to nevent1q…vrg8
_________________________

https://swapmarket.github.io/ CC swapmarket (nprofile…9fel)

JoinMarket NG 0.38.0 is out! Lots of security hardening, privacy ...

2026-09-02T14:09:44Z

JoinMarket NG 0.38.0 is out!

Lots of security hardening, privacy improvements, new default for 5% zero fee maker allowance (including bondless), quantized feeround up for takers, concentrated mixdepth selection policy for improving maker liquidity, CJ ID logging, ...

https://github.com/joinmarket-ng/joinmarket-ng/releases/tag/0.38.0

Forked the library `python-bitcointx` and did some housekeeping ...

2026-09-02T14:06:21Z

Forked the library `python-bitcointx` and did some housekeeping and security fixes. The original one was unmaintained :(

https://github.com/m0wer/python-bitcointx

It could have been me who stamped that coin🤭

2026-08-27T13:20:44Z

In reply to nevent1q…z46p
_________________________

It could have been me who stamped that coin🤭

Discreet Log Contracts (DLCs) ...

2026-08-26T13:36:10Z

Discreet Log Contracts (DLCs)
https://bitcoinops.org/en/topics/discreet-log-contracts/

https://stacker.news/items/1555330

🧡

2026-08-24T14:21:59Z

In reply to nevent1q…vqh8
_________________________

🧡

With this plugin: https://docs.lnbits.com/extensions/nwcprovider/ ...

2026-08-24T14:15:27Z

In reply to nevent1q…a5vv
_________________________

With this plugin: https://docs.lnbits.com/extensions/nwcprovider/

lnbits (self custodial)

2026-08-23T16:01:57Z

In reply to nevent1q…z8ph
_________________________

lnbits (self custodial)

0

2026-08-22T12:38:47Z

In reply to nevent1q…aga2
_________________________

0

Market for renting Fidelity Bonds · joinmarket-ng ...

2026-08-21T09:01:59Z

Market for renting Fidelity Bonds · joinmarket-ng
https://github.com/joinmarket-ng/joinmarket-ng/issues/597

https://stacker.news/items/1551914

DeepSeek plugin based harness - Fireship - YouTube ...

2026-08-21T07:01:11Z

DeepSeek plugin based harness - Fireship - YouTube
https://www.youtube.com/watch?v=xBByvFrqmWU

https://stacker.news/items/1551900

Bitcoin xpub watchdog with transaction notifications ...

2026-08-20T16:19:09Z

Bitcoin xpub watchdog with transaction notifications
https://gist.github.com/m0wer/498490d77fd33b5a41eb6bd480c7fae8

After the event of the last weeks, I wondered how long would it take to realize that you have been stolen from. Given that people don't manually check all of their balances daily (I guess). And that noticing fast, could help you save part of your stack (maybe).

So I made a tiny Bitcoin Core watchdog.

The idea is simple: import account-level xpubs into watch-only descriptor wallets and let Bitcoin Core notify a small Python script whenever something moves.

By default it alerts twice if appropriate: once when the transaction first appears in your node's mempool, and once when it gets confirmed.

That second alert is important because a transaction does not necessarily have to enter the public mempool. It could, for example, be submitted directly to a miner and first become visible to your node when the block arrives.

The script has no database and keeps no wallet state. Bitcoin Core does all the actual monitoring.

Install it:

```
sudo install -m 755 bitcoin_core_watchdog.py /usr/local/bin/bitcoin_core_watchdog.py
```

Store a Gotify application token somewhere readable by Bitcoin Core:

```
echo 'YOUR_GOTIFY_TOKEN' > /etc/bitcoin-watchdog.token
chmod 600 /etc/bitcoin-watchdog.token
```

Then add to `bitcoin.conf`:

```
keypool=5000
blockfilterindex=1

walletnotify=env GOTIFY_URL=https://gotify.example.com GOTIFY_TOKEN_FILE=/etc/bitcoin-watchdog.token /usr/local/bin/bitcoin_core_watchdog.py notify %w %s %b %h
```

A self-hosted Gotify instance is ideal if privacy is the goal. The Gotify-specific part is isolated in `send_notification()`, so adapting it to ntfy, Pushover, email, Telegram, etc. should be straightforward.

Test notifications:

```
GOTIFY_URL=https://gotify.example.com \
GOTIFY_TOKEN_FILE=/etc/bitcoin-watchdog.token \
bitcoin_core_watchdog.py test-gotify
```

Then add the accounts you want to watch.

Native SegWit/BIP84:

```
bitcoin_core_watchdog.py add cold-storage segwit 'zpub...' # or xpub... (also works)
```

Taproot/BIP86:

```
bitcoin_core_watchdog.py add taproot-vault taproot 'xpub...'
```

Don't put seed phrases or private keys on the monitoring node. Export an account-level xpub from the actual wallet and keep the Core wallets watch-only.

For an existing wallet, give Core an approximate birthday so it knows how far back to scan:

```
# get the epoch with `date -d "2026-01-01 00:00:00" +%s`
bitcoin_core_watchdog.py add cold-storage segwit 'zpub...' \
--timestamp 1767222000
```

Or use:

```
--timestamp 0
```

to scan the entire chain. New wallets default to `--timestamp now`.

The `add` command is only a convenience wrapper. You can do the same thing manually with `bitcoin-cli`: create a blank watch-only descriptor wallet with autoload enabled and import the appropriate descriptor.

A normal transaction might therefore produce:

```
Bitcoin mempool activity: cold-storage

sent 0.5 BTC · RBF
Unconfirmed / in local mempool
https://mempool.space/tx/...
```

followed by:

```
Bitcoin confirmed activity: cold-storage

sent 0.5 BTC
Confirmed at block 123456
https://mempool.space/tx/...
```

If the transaction bypasses your mempool and gets sent directly to a miner, you simply get the second notification.

The explorer link defaults to `https://mempool.space/tx/<txid>;`. That's not ideal for privacy, but the script never queries mempool.space. It only puts the URL in the notification, so nothing is sent there unless you actually click it.

If you run your own explorer, set:

```
MEMPOOL_URL=https://mempool.example.com
```

So the whole thing is basically:

Bitcoin Core → watch-only descriptor wallets → mempool/block detection → walletnotify → Gotify

No external address lookup service, no xpubs handed to a third party, and no private keys on the monitoring machine.

https://stacker.news/items/1551517

After a `docker system prune -y` xD ...

2026-08-18T14:23:04Z

After a `docker system prune -y` xD

Takura

2026-08-18T14:20:42Z

In reply to nevent1q…vmmn
_________________________

Takura

Nice t-shirt 😎 ...

2026-08-18T14:07:01Z

Nice t-shirt 😎

https://www.youtube.com/watch?v=fpYBFHwLGDw?t=895

no idea

2026-08-13T17:52:19Z

In reply to nevent1q…u8y2
_________________________

no idea

Buying hashrate as a form of coinjoin/coinswap xD

2026-08-13T17:44:51Z

In reply to nevent1q…lpgp
_________________________

Buying hashrate as a form of coinjoin/coinswap xD

One protocol level vulnerability that @nprofile…79xu found ...

2026-08-13T16:39:06Z

One protocol level vulnerability that /dev/fd0 (nprofile…79xu) found recently is https://github.com/joinmarket-ng/joinmarket-ng/issues/577

Summary: the directory nodes don't authenticate peer nicks, so peers can impersonate others and steal their connection. For example by updating the onion to their one and by being the newest connection with that nick and getting their messages. Important messages are encrypted, but the impact of "eclipsing" other makers is relevant. No loss of funds, but yes denial of service.

The fix required a protocol fix, that involves makers and directory nodes. My signet directory node is updated with the fix. Directory node runners on mainnet are encouraged to update.

The fix is only for jm-ng, but backwards compatible. So old directories and makers keep working, but are vulnerable to the attack. Good thing is that new directories still benefit old peers by not allowing new connections to steal their nick. But this is not a strong protection.

The full details are at https://github.com/joinmarket-ng/joinmarket-ng/issues/577

And the protocol improvement proposal is at https://github.com/joinmarket-ng/jmp/blob/main/jmp-0005.md

Thanks to floppy for finding it and to waxwing for helping us understand the issue and design the fix.

SeedSigner BIP46 support (JoinMarket timelocked fidelity bonds) ...

2026-08-13T11:59:08Z

SeedSigner BIP46 support (JoinMarket timelocked fidelity bonds)
https://github.com/SeedSigner/seedsigner/pull/1001

https://stacker.news/items/1546989