Last Notes
Write a style and some lyrics, and this app makes a full song on your own device. Nothing gets uploaded and you don't need an account. After the model download (YuE2-3B) it works offline. It runs on Android, macOS and Linux. A phone is slow, a few minutes for every 10 seconds of music, and a Mac is much faster. MIT licensed.
https://jooray.github.io/studio-localhost/
https://zapstore.dev/apps/io.github.jooray.localhoststudio
New version of AnyPay.
- You can "scan" a QR code from Gallery / filesystem (upload picture of a QR code)
- Fix parsing of zcash addresses.
Access it through web / PWA at https://anypay.today
Android version is on Zapstore; https://zapstore.dev/apps/today.anypay.app
Pay any (sane) crypto QR code with your lightning wallet. User friendly, fast.
We are a user interface, not an exchange or custodian. Exchanges are shown for each swap.
Uruguay to the moon:
Next available dates at immigration:
April 2027
I highly recommend cloudflare's security audit skill: https://github.com/cloudflare/security-audit-skill
Run it on all your software. Run it with the free models. Use it even if you used a model to audit something - it will find much more things. Works in all agent harnesses and is model independent.
The Internet goes on high alert after discovery of 8 compromised TLS certs
Intermediate certs allow anyone to mint web credentials for any Internet server.
https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
The Internet goes on high alert after discovery of 8 compromised TLS certs
Intermediate certs allow anyone to mint web credentials for any Internet server.
https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
In Europe, MeshCore has huge coverage, Meshtastic almost none.
I go where the network is.
Perhaps not entirely obvious: If you want to withstand current AI-driven attacks and ensure that vulnerabilities discovered by AI are patched as quickly as possible, the only effective defense is to use AI.
Perhaps not entirely obvious: If you want to withstand current AI-driven attacks and ensure that vulnerabilities discovered by AI are patched as quickly as possible, the only effective defense is to use AI.
Podvod má podle Die Zeit poměrně ustálený scénář. Zájemce nejprve na sociálních sítích napíše kritický příspěvek o tureckém prezidentovi Recepu Tayyipu Erdoğanovi. Urážka hlavy státu je přitom v Turecku trestná, takže podplacený státní zástupce využije příspěvek jako důvod k zahájení vyšetřování.
Záznam o řízení se následně objeví v oficiální turecké justiční databázi Uyap, kterou provozuje tamní ministerstvo spravedlnosti. Žadatel pak může před německým Spolkovým úřadem pro migraci a uprchlíky (BAMF) na svém mobilním telefonu otevřít příslušný záznam a doložit, že je ve své vlasti trestně stíhán.
https://zpravy.aktualne.cz/zahranici/s-timhle-ziskas-azyl-kdekoli-turci-objevili-kuriozni-trik-jak-se-dostat-do-nemecka/r~aaa29966fceb1f636a2ade175b2a055d/
the answers are literally in the app description.
no location services
DHS Said They Searched Man Who Wiped GrapheneOS Phone for Child Abuse Material. They Lied
https://www.404media.co/dhs-said-they-searched-man-who-wiped-grapheneos-phone-for-child-abuse-material-they-lied/
The age of personal apps is fully here. @npub1pcz…wfza made his own text editor.
https://github.com/urza/editor
Uruguay to the moon:
Next available dates at immigration:
April 2027
Hi, this is Lievik. If you talk to tens of groups (Signal chats, newsletters, social accounts, the people you go to sauna with), you can't remember what each one cares about. So you either spam people with things they don't need, or forget to tell the Signal group about the project that fits it perfectly.
Describe each channel in plain language. Lievik reads the Nostr accounts and RSS feeds you add and rates every post for every channel. Start from a post to see which channels it fits, or start from a channel to see what you haven't told it yet. It drafts the update in the right form: a short note and a link for Signal, a longer piece for a newsletter, a few bullet points for the sauna. It marks what you've already used and lets you ask questions about your own content. Sign in with Amber or any NIP-46 signer. Web app and Android app, MIT licensed.
https://lievik.cypherpunk.today
https://github.com/jooray/lievik
Routstr review: 140.245.192.194 has served correctly for three days again, review back to lgtm.
Hi, this is Emanator, a Nostr-native tool for creators who run more than one npub.
Schedule posts for all your accounts. Write with AI help that follows each account's style, sign once on your phone with Amber, and Emanator publishes at the time you picked. A new project often has no followers yet, so you can have your other accounts boost its posts, each with a random delay.
It also covers what happens after posting. You see the interactions on every post of each npub and reply to comments from one place, and one inbox handles the private messages of all your accounts, both the new NIP-17 and the legacy NIP-04 DMs. Web app and Android app, MIT licensed.
https://emanator.cypherpunk.today
https://github.com/jooray/nostr-emanator
This is Roadbeacon, formerly Roadstr. Drivers report road events (police, accidents, construction, hazards) as signed Nostr events that travel over relays, and anyone can read them on a map. There is no central authority in the middle and nobody tracks your trips. Web app and Android app, public domain.
https://cypherpunk.today/static/roadbeacon/
https://zapstore.dev/apps/app.roadbeacon
https://github.com/jooray/roadbeacon
Write a style and some lyrics, and this app makes a full song on your own device. Nothing gets uploaded and you don't need an account. After the model download (YuE2-3B) it works offline. It runs on Android, macOS and Linux. A phone is slow, a few minutes for every 10 seconds of music, and a Mac is much faster. MIT licensed.
https://jooray.github.io/studio-localhost/
https://zapstore.dev/apps/io.github.jooray.localhoststudio
Routstr review: staging.routstr.com is now avoid - paid requests have failed for three days or more.
If you don't like them, do not use their money. If you don't use their money, do not use their rails to get your money. It's very simple. What are you afraid of?
Big surprise: Some Ray-Ban Meta owners say their glasses are listening without being asked (Updated)
Owners say ordinary conversations are unexpectedly appearing in Meta AI history.
https://www.androidauthority.com/ray-ban-meta-glasses-listening-3722586/
Big surprise: Some Ray-Ban Meta owners say their glasses are listening without being asked (Updated)
Owners say ordinary conversations are unexpectedly appearing in Meta AI history.
https://www.androidauthority.com/ray-ban-meta-glasses-listening-3722586/
Instant Crypto Swap. No account. No custody.
https://bitania.com/
Anonymous VPS
in Switzerland and Panama
Linux & Windows VPS with NVMe SSD and 1 Gbps unmetered. No KYC, no logs, DMCA ignored. Pay with crypto. Live in 60 seconds.
https://www.swiss-gs.com/
Anonymous VPS
in Switzerland and Panama
Linux & Windows VPS with NVMe SSD and 1 Gbps unmetered. No KYC, no logs, DMCA ignored. Pay with crypto. Live in 60 seconds.
https://www.swiss-gs.com/
It does not need to flip mid sentence. You don't know which language the user starts speaking in. And could be either of the language they speak. The problem with autodetection is that it often misclassifies, so I need to steer it.
Another app that I like is Tally by @npub1k7cwt3kmvahdtzc8n2ek08n9c7fz7n2zq88yzyqmjxmjehvdykfqwtu78y
It is an Android app that is fully offline and counts the days you spend in each country, to keep visa and/or residency requirements according to your goals. It will tell you which country you need to visit or when you need to leave in order not to overstay your visa.
It can also keep track of your documents (passport, drivers license, residency card, ID card...), so you plan on renewing it in time.
Encrypted, fully offline, but you can import a standardized json file for both new documents or new stays, so you don't have to type things manually. People have been doing this in cloud (with services such as nomadlist), but telling a third party where you are in the world is not the way. We can do better. And we do.
https://zapstore.dev/apps/app.tally
Black Friday yourself into privacy++.
I company I founded was operating free mail services for years, so I know something about running an e-mail service. But at some point, I stopped running my own SMTP servers, because Proton's network effect at least in my circles is just good enough - autodiscovery of PGP keys works quite well. And I'm quite satisfied with the service.
Running on surveilled big corpo "free" infrastructure? No thanks. Free mail is paid for with your inbox. Someone reads it and builds your profile. And sells what they learn. I would rather be the customer than the inventory.
Proton's Black Friday runs from October 26 to November 30. Mail Plus is 60% off the yearly plan, and Proton Unlimited, which bundles Mail, Drive, VPN and Pass, is 50% off.
Privacy tech still not only exists, it is thriving.
https://go.getproton.me/aff_c?offer_id=7&aff_id=9011
BTW: Proton also has Drive (which has photo backups) and other services, include AI inference. Check them out. We also use Proton Calendar, it has become quite good recently.
BTW: If you are already using some private service, or still deciding, check out Praxeology of Privacy by @npub1klk…x3vt Very good. https://towardsliberty.com/pop - also available in Slovak!
I was just thinking that doing non stop local speech to text is feasible and it could then infer a journal or something like that with a small local model. You would then put a mike on you and just say something like "remember this".
I think you can vibe it in a day.
Yep, it feels much different. Someone published a research that Polish works better than English because of the structure of the language, so I guess Slovak which is similar could be an advantage too
Well, for bilingual you need the detector. anyway, so latency is added, but it's fast.
For threads, you are right, but there's a benchmark button which shows that on modern phones, it really helps.
Slovak security firm Nethemba discovered the campaign on three of its own WordPress sites in the early hours of 19 October and published the first analysis the same day.
https://www.cyberkendra.com/2026/10/updraftcentral-stolen-keys-wordpress-backdoor.html
Slovak security firm Nethemba discovered the campaign on three of its own WordPress sites in the early hours of 19 October and published the first analysis the same day.
https://www.cyberkendra.com/2026/10/updraftcentral-stolen-keys-wordpress-backdoor.html
Security firm Nethemba was first to publish a detailed analysis of the campaign on Monday, after an attacker pushed unknown plugins to two of its own websites. Nethemba CEO Pavol Lupták said the attacker had signed the commands with valid keys that had never been stored on the firm’s servers.
https://www.therepository.email/attacker-uses-stolen-updraftcentral-keys-to-backdoor-wordpress-sites-after-teamupdraft-breach
Security firm Nethemba was first to publish a detailed analysis of the campaign on Monday, after an attacker pushed unknown plugins to two of its own websites. Nethemba CEO Pavol Lupták said the attacker had signed the commands with valid keys that had never been stored on the firm’s servers.
https://www.therepository.email/attacker-uses-stolen-updraftcentral-keys-to-backdoor-wordpress-sites-after-teamupdraft-breach
Dnes čistou náhodou som strávil večer s dvomi Francúzmi – jeden dlhodobo žijúci v Nicaragui. Druhý v San Martín. Obaja vášnivo diskutujúci o aktuálnej situácii vo Francúzsku, obaja sa zhodujúc na tom, že ide o úplnu katastrofu.
Obaja majú rodiny vo Francúzsku a obaja sa zhodli na tom, že ich rodiny momentálne majú vo Francúzsku ťažký život – po všetkých nákladoch a daniach im na konci mesiaca nič nezostane.
Zhodli sa na tom, že Francúzsko ako mekka európskeho progresívneho socializmu kolabuje; obrovské množstvo ľudí tam má reálne nízku životnú úroveň; za súčasných okolností nie sú schopní nič sporiť. Chudoba vo Francúzsku je na maxime – pod hranicou chudoby žije 9,8 milióna ľudí, teda 15,4 %, a tento podiel sa drží na najvyššej úrovni. Nerovnosť je najvyššia od roku 1996, odkedy sa meria (Zdroj: INSEE).
A preto ako typickí Francúzi demonštrujú a veria, že bude lepšie.
Bohužiaľ, demonštrácie za "menej štátu" nie sú moc v móde, takže protestujúci chcú ešte vyššie dane a ešte viac peňazí od štátu vo všetkých možných oblastiach. Veria, že štát vyrieši chudobu a nerovnosť.
A keďže viac daní a viac štátu smerujú automaticky k väčšej chudobe a nerovnosti, ekonomický kolaps Francúzska (a možno celej EÚ, ak bude pokračovať v jeho sľapajách) je neodvrátny,
Najväčší red alert je ničenie majetku - Židia vo Francúzsku po vyše 80 rokoch zažívajú nepríjemný flashback – protestujúci ničia židovské synagógy a obchody.
Francúzsko už nie je bezpečné miesto na život, konštatujú moji francúzski známi, ktorí sa vrátiť už neplánujú (a to dokonca ani z Nicaraguy).
I am vibing my own apps now, as is everyone I know. But there are some cool apps developed by others that you should definitely use. One of them is Offline Speech to Text (OSTT).
It is a keyboard and voice recognition service, that other apps can use (White Noise can use it by default for example, which I use a lot, since I interact with my agents using White Noise). If you are bilingual (send messages in multiple languages): Choose Canary V2 instead of default Parakeet, it will allow you to steer language detection. Go to model preferences after it downloads, set language to Automatic and under it choose "Languages I speak" (I set English and Slovak). This way the languages is detected and it won't try for example Czech, because it knows I speak either English or Slovak.
Fast, fully offline, your speech (or the text) never leaves your device. It is super high quality and fast.
Another pro-tip: For lower latency, increase number of threads to 4.
Available on Zapstore. Cypherpunk future is now.
https://zapstore.dev/apps/naddr1qqtkzurs9ehkvenvd9hx2umsv4jkx6r5da6x27r5qyv8wumn8ghj7un9d3shjtn6v9c8xar0wfjjuer9wcpzpys5pkhzxd9dqp4ger8du6p5f6y43tcnzqktjzmwvahq5vumtay4qvzqqqr7pv8t57pf
Claude rozluštil čtvrt století starou záhadu v digitálním podpisu. Stopa vedla k počítačovým hodinám z roku 1997
https://www.zive.cz/clanky/claude-ecdsa-zahada-sifrovacich-krivek/sc-3-a-243906/default.aspx
Correction: the avoid review this account signed on 2026-10-11 for ai.redsh1ft.com, and the two token-keeping notes of 2026-10-16 and 2026-10-22, are withdrawn. Each of the six probes behind them was cut off by the probe client itself before any response arrived; the mint reports a token spent either way, and that cannot distinguish a slow node from one keeping tokens - it was scored as if it could. Whenever a response was read, the node returned change: 136 of 141 probes OK in 30 days. It is back in the regular probe set.
New version of AnyPay.
- You can "scan" a QR code from Gallery / filesystem (upload picture of a QR code)
- Fix parsing of zcash addresses.
Access it through web / PWA at https://anypay.today
Android version is on Zapstore; https://zapstore.dev/apps/today.anypay.app
Pay any (sane) crypto QR code with your lightning wallet. User friendly, fast.
We are a user interface, not an exchange or custodian. Exchanges are shown for each swap.
First Human VS. Robot Fight in History (FULL LENGTH)
https://www.youtube.com/watch?v=4rg2sB6ELtk
Postgres 19 delayed after AI reviewers find more bugs than humans can fix
Core devs revert up to 10 features, push release to November, and blame better tooling rather than vibe coding
https://www.theregister.com/databases/2026/10/16/postgres-19-delayed-after-ai-reviewers-find-more-bugs-than-humans-can-fix/5303471
How well do wrapped bitcoin and stablecoins hold their peg? A year of DEX prices
https://juraj.bednar.io/en/blog-en/2026/10/16/wrapped-btc-stablecoin-pegs/
Nostrautica 0.15.1
Our event went great, sauna ceremonies for cypherpunks are a thing!
To commemorate, this release comes from several AI audits of security and functionality across the coordinator, the web app and the Android app.
What's new
- Mentions in chat, on web and Android. Type @ to pick a person to mention. Mentions show as names with profile pictures instead of raw npubs, and White Noise sees them as tagged users.
- Reactions, edits and deletes in chat, everywhere. React to a message, edit or delete your own, and see changes made from the other app or from White Noise.
- The web app and Android now do the same things. We went through both apps screen by screen and closed the gaps.
- Offline event pack on Android. One tap saves an event to your phone, including people, matches, talks, the event page, posts and profile pictures, for venues with no signal.
- See what hasn't been sent yet on Android. A chip shows changes waiting to send or that failed, and you can retry or discard each one.
- Key backup on Android. Back up your key to a file or email it to yourself, as on the web.
- "View as visitor" on Android. Organizers can check what their event looks like to people who haven't joined.
- No hidden details in uploaded audio and video. Location, device and other metadata are removed from files you pick, on both web and Android, before they're uploaded. A file that can't be cleaned isn't sent.
- Removing someone sticks. A removed member can't get back in by reusing an old invite code, re-joining, or waiting for the organizer to attach a new coordinator. A removal shows as queued until it has actually been sent.
- Safer organizer edits. Changing settings no longer undoes a change made on another device a moment earlier.
- Separate member lists for same-named events. Two events with the same name on one coordinator can no longer interfere with each other's member lists.
- Recordings and transcripts. A transcript is only available to people who can play the recording. Replacing a talk's recording removes the old transcript.
- Easier sign-in on Android. If your remote signer asks you to approve in a browser, the app now shows an "Approve in signer" link instead of timing out.
- Secret screens are protected on Android. Screens that show your secret key or a login code block screenshots.
- The coordinator recovers by itself. It retries announcements and updates that relays failed to accept right after a restart.
- Communities say "community" throughout the create flow.
- Chat groups stay put
Included from the previous release (0.13.3–0.13.5)
- The web app repairs itself if an update leaves it unable to start, so you no longer have to clear site data.
- Android 0.13.5 fixed a 0.13.2 build that could not open its database after an earlier 0.13.0 install.
Upgrading
The web app updates itself. On Android, update from Zapstore or Obtainium, or download the APK from GitHub. Older apps keep working for now, but please update.
- Zapstore: https://zapstore.dev/apps/today.cypherpunk.nostrautica
- GitHub: https://github.com/jooray/nostrautica/releases/tag/android-v0.15.0
Vizor Zcash wallet
https://vizor.cash/
EcoNoir tlačenka – Veď Francúzsko varilo podľa receptu!
Francúzske vlády už dekády robia všetko „správne“. Rozumej varia podľa ekonomických receptov, ktoré neustále počúvame od Pikettyho, Stiglitza, Krugmana a ľavicových influencerov.
https://econoirsk.substack.com/p/econoir-tlacenka-ved-francuzsko-varilo
Routstr ( @npub130m…l29s ) confidential mode update, live on routstr.cypherpunk.today and in the demo PWA (v0.1.31):
- The node's signed offer now defines which request parameters it pins. Clients enforce one rule: a pin may only switch an extra off.
- Fairer billing: idle connections can't block paying clients, a long response gets time to finish, only attested usage is charged, the node's own provider-key errors cost only the session fee, prompt-cache writes are billed correctly, and a failed database write is retried instead of charging the full reservation.
- Hardening: the proofs also bind the record's content type, proof connections need a per-session token, clients refuse unsafe offers and limit how much the node can make them buffer, and the browser pre-warms only after your first message.
- Sidecar: session files are deleted after 24 h, and the container is built from digest-pinned base images with no package installs.
- Upstream: the v2 PRs are rebased, plus six separate fixes for every Routstr node: admin login, revoking credentials, startup reservations, log redaction, no caching of API keys, private logs.
- Paper: every figure is backed by archived receipts and runs, or marked as unarchived.
Your prompts and the model's answers stay private from the node, and you never get its API key.
https://jooray.github.io/routstr-confidential-pwa/
https://blossom.primal.net/258640bd81f526b9675e5f348b902b500e02127f3d6e9b8ed4338faf437cd0bc.png
nsite-clay 0.3.26 is out. It's about sites with more than one page.
Until now each page of a site stood on its own. To edit another one you had to know its address, open it and sign in again, and a new page meant a trip back to the publisher.
Now the editing toolbar has a Pages button. It lists every page of your site and opens the one you pick, ready to edit. You stay signed in for an hour while you move around, and the hour starts over whenever you do something. A signer app like Amber or a browser extension carries across tabs. A key you typed in stays in that one tab and is never saved.
From the same dialog you can add a page. It copies the design, header, footer and blocks of the page you're on and can put itself in that page's menu. Or let Edit with AI write it from a short description. Both pages go out in one publish.
Links have a real dialog now: pick one of your pages or a heading on it, or type a web address, an email or a phone number. While you edit, a link that leads nowhere gets a dashed outline.
Also: an upgrade taken on one page now moves every page of the site (before, it could leave the others with a broken editor). Settings can copy instructions for your own coding agent, and the CLI has a pull command.
Existing sites get all of this from Settings, Upgrade.
https://nsite-clay.cypherpunk.today/
Demo:
https://blossom.primal.net/43b5b702ebb455531f408b4888ea477c8594e24237359243d584b93276d0ba1f.mp4
Exposing AdFection
How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
Exposing AdFection
How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
Localhost Recording Studio 0.5.0 — the app now tells you what it is doing, and the catalogue tells you which takes you liked.
Against 0.4.9:
- The song page answers. Open a take while it is being made and you get the phase — LISTENING, SCORING, RECORDING, MIXING, MASTERING, FILING — the time left, and a rule under the words that fills as the job moves. The ring of the disc carries the same progress. Before this, the phase lived only in the studio and a song page said nothing at all about the job that was running.
- Hearts. Mark a keeper from its page or with a long press; the index shows a filled heart next to every take you liked, so a batch of variations can be scanned for the good ones.
- NEW. A finished take nobody has heard yet is marked NEW in the list. The mark goes when you play the mix or like the take.
- The hole in the disc is a play/pause button. It used to seek only on the ring, and did nothing on the song page. While a take is still mixing, it plays the preview.
- Covers remember their score. The score written down from a recording is kept, keyed by the recording's own bytes, so covering the same file again skips the listening and goes straight to the song — in a later session too, or after the first take was deleted. SCORE and MELODY stay apart.
https://jooray.github.io/studio-localhost/
Android on Zapstore, Mac and Android builds on GitHub: https://github.com/jooray/studio-localhost/releases/latest
And check this nice hallucinated song playing in the interface :)
https://blossom.primal.net/718640cedda32591889416c8b67f61a7d50eeb155dcddeb5179d3d84f146b4c5.mp4