Last Notes
Social engineers pretending to be Google Support keep calling me, so I decided to have some fun.
https://x.com/lopp/status/2114730636598776251/video/1
Here's what I used years ago for performance testing https://github.com/Casa/perf-test/tree/master/data/mainnet
It's a big ask if you want to handle the edge case addresses in a perfomant manner.
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/34b466b39fa6c823ecc2c72799d57a27b0b8a52629a227c952a269708d3905ba.jpg
An open letter to the Bitcoin ecosystem:
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/177204b2521ffee4c641883bc267e1a004ca72f435e2be47c4cabeb20d41c3bf.jpg https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/a4ed0ca24db07322e7aeebe387e7a43b4f54a146c328839cb6cfc3e2e23b4b2a.jpg https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/8f49a66a9b5300a7ed9be3ed0dc72c37e2ad9652a7067c19d6724ec0bfd8d3f0.jpg
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/a9843b6f2a36231867de3a414ac2337c5b3bb3d176d50033e81cf2d9fdb88030.jpg
Some of y'all are alright...
Don't run PHP on any servers tomorrow.
Had a bank block a 6 figure wire transfer and ask me for "supporting documentation."
I told them my legal contracts are none of their business and if it was a problem, I'd take my business to my credit union because they don't give me grief.
Surprisingly, it worked! Feels good to make a bank bend the knee. Fully expected them to close my account.
Seems like the only thing I ever randomly win is TSA enhanced screening.
Bitcoin never treats me like a criminal for daring to request to send my own money to someone else. 🤬
You can get some pretty badass flashlights these days if you're willing to drop a couple hundred bucks. Like, illuminate a whole football field with a handheld flashlight.
Yes, that's a separate entity from Casa Inc.
I have no intention of going to prison for offering TradFi services without a license.
It's disheartening to see so much Bitcoin discourse saying that institutional custodians are the safest way to store bitcoin, but then again I already knew that most people are lazy statist cucks with little appreciation for privacy and freedom.
#nevent1q…4dan
Good news: the Bitcoin Wrench Attack archive just got a lot more accurate.
Bad news: we just doubled the total number of known attacks to over 700.
Kudos to @nprofile…pfmn for finding hundreds of new attack reports via agentic searches.
https://jlopp.github.io/physical-bitcoin-attacks/
You need not wonder, the models exist.
It's so fucking annoying trying to get my agent to automate menial tasks that end up getting blocked by captchas.
I wish I could give my agent a small lightning wallet and have it pay its way past them.
One thing to consider regarding timelocks is if an attacker gets a spending quorum of your keys but can't spend due to timelocks, once the timelock expires you'll be in an RBF race to the bottom with them and likely end up losing most if not all of the value anyway.
Richard Heart has finally been arrested 🥳
https://en.haberler.com/mit-caught-whale-james-red-handed-4-million-and-64-2313680/
If you're worried about wrench attacks then you'll want to switch to a 2 hardware 2of3 setup and distribute the keys so that you don't normally have access to them, or switch to a setup with more keys.
Timelocks alone are no guarantee if you're being held captive.
Just deleted 100,000 lines of code.
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/655bd21a6691358169bde5422c2305a383fefbd71f95176431647d727eb992dc.jpg
Earlier this year we implemented TOTP style 2-way verification codes.
https://support.casa.io/knowledge/what-is-a-verification-code
To Catch A Shitcoin Predator - The Blake Files
https://video.twimg.com/amplify_video/2109612810259124225/vid/avc1/1920x1440/6BbqO4EmOHUkrSTw.mp4
If you ask an LLM to complete a task and it commits a crime while trying to achieve the goal you gave it, are you responsible for the crime if you never told it to do that?
IMO if you shoot a bunch of people it's only appropriate that you get the firing squad.
Me but with Chinese models that only cost $2 an hour:
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/2f71853bf96feea9e80e7c60e2e5e8d334c1a84630908e6121184ba0d0df9425.jpg
Security updates are happening at such an accelerated pace that sometimes you're stuck between a rock and a hard place.
Had a machine with known Linux kernel vulnerabilities so I updated it, but then the database on that service refused to run because the latest available kernel still had vulnerabilities and canonical had not yet released the most recent kernel version 😞
LLM generated reports that require you to analyze them and make a decision.
I swear I'm getting a dozen slop grenades lobbed at me every day and it's exhausting.
Easy come, easy go.
Looks like Mad Kratter lost his nostr keys.
Look ma, I'm a nostr dev!
#nevent1q…92nq
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/61913effa87629b38efe732a68a16d4d828b315fd66ca16dfe3f0f4323da9423.jpg
GM Albuquerque
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/7ba4f9540e644b19c2b3d0f9902018b8664c7b7f9d1df8f78fa2acb4ef069291.jpg
We're gonna need a micro LLM that acts as a proxy, analyzes each prompt, and determines the best model to use to execute the task.
There aren't many nerdcore hip hop artists making music but I just realized that's no longer a problem: I can simply generate the esoteric beats I want to hear!
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/b21c6e2a4d38f2abac617ac6643aba919f271b37c1c539b5643c17753716c506.mp3
No, but I'll never spend as much of my life playing games as I did when I was a child.
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/bf5e0349eec7defa775a910398051a5f415e50a84365cc9544a836e26cb596d4.jpg
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/b606613b92aa34cc87eb48f9ebe90b6efc0589b9ea0b406ec3c3e38eefdcc994.jpg
After 10 rounds of training just on the coldcard entropy vulnerability, it's rather amusing how the training clanker is getting frustrated with how retarded the pentest clanker is and how it keeps making inexcusable mistakes. 🫠
This might take a while...
#nevent1q…vgw3
How to train your clanker?
Building a generic pentest harness seems far more difficult than building one for a specific codebase because it requires an additional layer of context building in order to formulate a plan of attack.
I'm trying something new now, which is feeding a corpus of recently found vulnerabilities in open source codebases to a training clanker that then runs the pentest clanker without giving it any hints, and then the training clanker analyzes the output of the pentest and tries to work backwards to figure out why the vulnerability wasn't found so that it can improve the pentest harness in a generic fashion.
I asked a clanker what the best TUI framework was and it said Rich so I said implement a Rich dashboard with as much info as you can cram into it.
This is my life now.
Obsessed with automating & optimizing pentesting.
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/f73b62eaaf2101ebbb3dbf16688ef521ab450ae338af05e07596fdf2eea9c792.jpg
If you have a Framework laptop and the track pad stops working, I recommend updating the system firmware. That fixed it right up for me.
I don't even bother using western models for my cyber security tasks.
#nevent1q…tt5k
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/d7e98963d202982b0b074fa5d1d68f5c04d9f0c285b53c24653f534c778afef5.jpg
Not Production Ready yet?
Thanks, there are a number of little glitches like the panel issue to fix. Will take a look. The captcha is just the web archive doing their thing.
It seems that web front-end development still sucks 10X more than back-end development even with clankers doing a lot of the heavy lifting.
I clanked together an interactive dashboard for the Bitcoin Wrench Attack archive; let me know what you think! Looks like I need to make some more mobile optimizations...
https://jlopp.github.io/physical-bitcoin-attacks/
https://npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp.blossom.band/590aaf03fc97a0e9a90e1d406e2131a112045dcecb6ab4df9661b1af7394cd71.jpg