Last Notes
In Europe, MeshCore has huge coverage, Meshtastic almost none.
I go where the network is.
Run It Local: The LLM Download Directory
Where to download open-weight LLMs to run on your own hardware: torrent and magnet indexes, official hubs, mirrors, one-command runtimes, trusted GGUF quantizers, and the opsec to do it safely.
https://closednetwork.io/local-llm-downloads/
CashuPayServer v0.5.9-alpha is out — together with yesterday's v0.5.8, the result of a fourth audit that asked one question: can anyone lose money?
The most serious security one: if the same Cashu token was sent to two payment requests at the same moment, both turned "Paid ✓" while the shop received the money once. Now each shop receives one payment at a time.
The rest of the security and payment fixes:
- Late payments are collected again on busy shops. If the mint or your server was down for more than three days, a customer's payment could stay uncredited as long as new checkouts kept coming in.
- One price source can no longer move fiat prices. With the other providers down, a single bad answer could shift EUR, GBP or CAD prices by up to 25 %, and the wrong rate stuck.
- Backup mints are protected and looked after: removing one with open orders could hide a later payment, and money held there was never moved off retiring keysets.
- A store left behind by whoever claimed setup first (with their mint and their seed) could survive a recovery-code takeover. It is now removed.
But the interesting result: the worst risks to a shop's money were not attackers. They were things that quietly stop working. So 0.5.9 fixes those:
- Automatic withdrawals work above 10,000 sats. On a mint that reserves 1–2 % for Lightning fees, every automatic payout above roughly 10k sats failed, run after run, while the money piled up at the mint.
- Setup now asks where your money should go: paste your Lightning address, it is checked, and payouts happen by themselves. Or choose "Not now" and try it first.
- Customers are never told to pay twice. Paying at the last second used to show "Invoice expired, request a new one". Now the page says not to pay again, keeps checking, and turns to "Payment Complete" when the money arrives.
- Your shop hears about a payment at once, not on the next visitor.
- Alerts by email or a private Nostr DM (NIP-17) when customers can't pay, withdrawals keep failing, or a security update is out.
- A printable recovery sheet: your seed words plus every mint your store has used. The seed alone doesn't tell you which mints to restore from.
- No more white screens at install. Hosting problems now show a plain page with a message to send to your host.
One change in how you upgrade: the zip no longer has a folder of its own. Unpack it straight into your existing installation folder, keeping your data folder. If you unpack it into a new subfolder by mistake, setup notices and tells you which folder to delete.
- Standalone: unpack the new zip into your installation folder, replacing the old files, keeping your data folder.
- WordPress: upload the plugin and choose "Replace current with uploaded".
The database updates itself on your first visit.
About the audit: Opus 5.5 with the Cloudflare security-audit skill (https://github.com/cloudflare/security-audit-skill), plus separate passes for reliability, the customer at checkout, and a shop owner who has never used SSH. Every finding was reproduced in a sandbox and checked by independent verifiers before it counted.
👉 Download: https://github.com/jooray/cashupayserver/releases/tag/v0.5.9-alpha
that's exactly how I call myself since I got them BTW :)
Yes.
And in order to publish it beautifully, he had to write TeX, which now everyone uses for papers
I often repeat his "mind like water" mantra
we were just talking about Amanita Muscaria tinctures yesterday
Third Ear 0.1.4 is out: app shortcuts.
Long-press the Third Ear icon and your first four lines are right there, plus "Stop recording". Tap a line to record on it, tap it again to stop and send. Drag one to the home screen and you have a one-tap recorder for your agent, or your family.
Better still: button-mapping and automation apps (Key Mapper, Button Mapper, Tasker) can bind any line. Press a hardware button, talk, press it again, and the transcript is already in your White Noise group. No screen needed.
Only your own shortcuts work, so no other app can start a recording behind your back.
Thanks to the user who asked for this!
Web: https://jooray.github.io/third-ear/
Zapstore: https://zapstore.dev/apps/app.thirdear
AnyPay 1.0.12 for Android and a new version of the web app are out.
This release is mostly about making payments clearer and harder to get wrong.
What you'll notice first:
The web app now tells you to come back to the page after paying in your Lightning wallet. AnyPay finishes the payment in that page, so if you switch away it waits for you, and it says "Welcome back" when you return. The Android app keeps doing this in the background, and now also notifies you when a payment finishes or needs attention.
Payment status is in plain language instead of internal codes like "clientfundingseen".
If a payment fails, AnyPay tells you what happened to your sats. Most of the time the answer is that nothing was taken, or that your wallet gets the held payment back automatically.
Once your payment is on its way, the Pay and "Get new invoice" buttons disappear, so you can't accidentally pay twice. Getting a new invoice also asks you to confirm that you haven't paid the current one.
Every invoice shows how long it stays valid, and the payment screen shows roughly what you pay in fees and exchange spread.
When AnyPay has to use an exchange instead of the cheaper Lightning swap, it says why and that this route costs more.
Payment requests from MetaMask, Trust Wallet and other Ethereum wallets ("request 10 USDC" QR codes) now work properly. They are paid to the right recipient with the right amount, token and network already filled in.
Amounts with a decimal comma (0,05) work, and amounts that could be misread are refused instead of guessed.
On Android, payment links that come from other apps first open a screen where you check and confirm the payment.
Exchange trades are picked up again after you close the app or reload the page, and you can dismiss an interrupted payment, with a warning if money is already on its way.
Safety and reliability:
Every invoice and trade from Satora or Trocador is checked against what you asked for before you see it: the right amount, the right payout address, and an invoice locked to your payment. Anything that doesn't match is refused before you pay.
If AnyPay can't safely store a payment's recovery keys on your device, it stops before showing an invoice, instead of risking a payment it couldn't finish.
A phone clock that runs fast no longer makes AnyPay give up on a payment that is still valid.
The web app no longer loads any code from outside sites, and it is protected against script injection.
On Android, private keys can't be screenshotted, invoices no longer end up in system logs, and only secure web links are opened.
Plus accessibility improvements (screen reader announcements, better contrast, keyboard access) and many smaller fixes.
Android 1.0.12 on Zapstore: https://zapstore.dev/apps/today.anypay.app
Web: https://anypay.today/anypay/
🇪🇺
https://blossom.primal.net/00f095900177a63e4eb6c7030a9bce8494d7e717e6724ed72523e768c6a5f71d.png
Mal som generátor QR kódov, ktorý sa mi páčil. Nikdy sa neaktualizoval a bežal len ako build pre Macy s Intelom, tak som chcel novú aplikáciu.
Postavil som ju dvakrát: najprv len s bezplatnými modelmi, ktoré nepotrebujú kreditnú kartu, potom s DeepSeek 4.1 Flash, ktorý bol na OpenCode Zen zadarmo.
Prvý beh trval hodiny, modely sa stále menili, bezplatné kvóty sa míňali a schránka nikdy nefungovala. Druhý beh funguje.
Tokenová chudoba, bezplatné tarify a čo vedia a nevedia:
https://juraj.bednar.io/blog/2026/10/31/tokenova-chudoba-da-sa-s-volne-dostupnou-ai-robit-produktivna-praca/
Aplikácia: https://jooray.github.io/qrencoder/
Zapstore: https://zapstore.dev/apps/io.bednar.qrencoder
https://blossom.primal.net/6196a2160cc41ef60c0f02f629c49326df16196df34bd6f8f1352a6ac472eb35.png https://blossom.primal.net/0bb77cf5794af38d0bef2bb49f1ef2da18a89967c41b0e3e3b1dd79b06621d45.png https://blossom.primal.net/f1e55cac81152b5b75674abfea82fe546aaafa4e00acaffbfc4193d718fbc614.png
I had a QR code generator app I liked. It was never updated and only ran as an Intel Mac build, so I wanted a new one.
I built it twice: first only with free models that need no credit card, then with DeepSeek 4.1 Flash, which was free on OpenCode Zen.
The first run took hours, models kept changing, free quotas ran out and the clipboard never worked. The second one just works.
Token poverty, free tiers and what they can and cannot do:
https://juraj.bednar.io/en/blog-en/2026/10/31/token-poverty-can-you-use-freely-available-ai-to-do-productive-work/
The app: https://jooray.github.io/qrencoder/
Zapstore: https://zapstore.dev/apps/io.bednar.qrencoder
https://blossom.primal.net/6196a2160cc41ef60c0f02f629c49326df16196df34bd6f8f1352a6ac472eb35.png https://blossom.primal.net/0bb77cf5794af38d0bef2bb49f1ef2da18a89967c41b0e3e3b1dd79b06621d45.png https://blossom.primal.net/f1e55cac81152b5b75674abfea82fe546aaafa4e00acaffbfc4193d718fbc614.png
mine is written by Donald Knuth
LOL.
https://blossom.primal.net/aee82060667caabe39cfcaf2ef72d9dd11a95218986a57df2a757165eeb73934.mp4
Source: https://x.com/MandelDuck/status/2115064836258222338?a=c9qJIfIS7hRTu3lxdIU&s=20
I wanted to experience if it is possible to build something using only LLMs available for free. I used https://freellmapi.co/ to build a replacement for an old app that I used.
What I used was an old QREncoder app, that is obsolete and built for Intel Macs.
So I took a few screenshots, gave opencode v2 a task to build it with a few changes, used impeccable skill to do design (although that did not work very well with the free models).
I wanted to know, if anyone can use some sort of machine intelligence, without credit cards, accessible to whoever.
Observations:
- free models are super slow (auto:smart)
- the models change all the time. Forget caching even, it is quite likely, that the whole project is done by 3-5 different models in parallel. I suspect it might not necessarily be a bad idea, since these are not frontier models.
- the gap to frontier (even deepseek 4.1 flash 1017) is huge. I almost forgot how much babysitting these models need. Not even /goal helps.
- but to my surprise, the app opened and it mostly worked (clipboard and save as png did not work, the icon was generated, but not set).
App will be here, but I don't recommend it yet :).
https://jooray.github.io/qrencoder/
https://blossom.primal.net/4df1fef9390b3e2062ac9d372592847295667ff418d909e5d4ceb5cbf3d1fdd0.png https://blossom.primal.net/36c759ecac09cea686201ad7d31e2a0ed208da74fb14fe571c2466c33d622642.png
Everyone seems to be hacking everything, everywhere, all at once with Kimi K3.1 Pro.
https://blossom.primal.net/60d4429c6aeac679ef78b84f82e4c5fdcacb5832af0ae88edc06b511d491f652.png
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/
WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/
ok, this is actually good advice. the problem is I'm switching every five minutes, while the agent is working
Yesterday, Anthropic were compromised via a Cursor VS Code extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack.
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2
only when it's open, but almost immediately and then every 12 hours.
another issue with this setup is that people often want it because they want working push notifications. having them in a profile that is off is a bit pointless.
yep, super secure graphene with spyware phone in another pocket is a very common setup. but not sure if it's very good :)
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
I'm not sure there is a standard to receive clicks from the buttons. I've done it for my hearing aids, but it's a completely custom protocol.
Yesterday, Anthropic were compromised via a Cursor VS Code extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack.
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2
Yes, the article does cover that. But it doesn't help much, it's just a secondary profile that calls home.
But it helps some.
It's in the article! 😂
It calls home regularly, so depends on what you want to protect.
Phil Collins looks like an accountant, I love him, but he makes it worse, I feel like I'm employed which is a bad trip!
PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
https://njump.me/nevent1qqsxq6exy862gs9m59yf95mw30t6ravj9eekau2k06d4czv27cx7hnszyqlhwrt96wnkf2w9edgr4cfruchvwkv26q6asdhz4qg08pm6w3djg8f7e4z
I often run out of tokens 😂
But thinking...
Maybe we should ask Red Hat and Ubuntu devs, they can apparently chill out on fixing a remote CVE for 15 days.
I'm glad I'm not paying a subscription! 😂
</Evening-trolling>
#nevent1q…ygkd
I'm a happy dev on ZapStore, no complaints, thank you for all the work!
If you have tips how to deal with creativity/productivity/task switching/brain overload happening to us during our use of the AI magic wands, drop tips.
I'll start - workout, sauna, walk outside. Preferably interacting with other people, not agents. Thai massage (normal, not happy ends).
I wanted to say "Netflix and chill", but I have trouble finding something that is interesting when I can be burning tokens.
Any other tips?
BTW: Patching remotely exploitable vulns is relaxing, but does not count!
PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
https://njump.me/nevent1qqsxq6exy862gs9m59yf95mw30t6ravj9eekau2k06d4czv27cx7hnszyqlhwrt96wnkf2w9edgr4cfruchvwkv26q6asdhz4qg08pm6w3djg8f7e4z
Preklepnete sa v daňovom priznaní pri deklarácii krypta a následne vám domov nabehnú teroristi.
(k prepojeniu francúzskeho daňového úradu priamo s organizovaným zločinom).
A na Slovensku to fakt nebude lepšie.
https://www.tokenpost.com/news/regulation/44265
https://journalducoin.com/bitcoin/crypto-rapt-juilly-660-bitcoins-erreur-decimale-condamnations
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Čo vlastne robia Google Play services na GrapheneOS a treba ich zakázať, alebo stačí obmedziť? Na to som hľadal odpoveď pre ľudí s GrapheneOS, ktorí zvažujú, či si ich nainštalovať. Bežné analýzy na to odpovedajú len čiastočne: pozerajú sa na inštalačný balíček alebo na sieťovú prevádzku jedného zariadenia. Play services sú ale len hostiteľ, ktorý si podľa konfigurácie zo servera Googlu stiahne ďalšie moduly, takže neexistuje jedno Play services, ktoré by sa dalo raz zauditovať pre všetkých.
Preto som rozobral aj samotné doručené moduly: 24 súborov, ktoré som vytiahol z rootnutého emulátora, a pre každý zistil, kam sa pripája, aké oprávnenia dedí a na čo by sa dal cieliť. Pokiaľ viem, nikto také niečo nezverejnil. Vyšlo napríklad, že moduly pre mapy a reklamy bežia v procese aplikácie, takže zákaz siete pre Play services ich nezastaví. K tomu je tam praktický návod pre GrapheneOS: ktoré oprávnenia odobrať, ako presmerovať polohu a čo sa pokazí, ak ich vypnete úplne.
Článok: https://juraj.bednar.io/blog/2026/10/30/co-vlastne-robia-play-services-na-grapheneos-pozrel-som-sa-dovnutra/
Audioverzia (MP3): https://juraj.bednar.io/wp-content/uploads/2026/10/play-services-grapheneos-GMS-audio-sk.mp3
Technický rozbor v PDF (35 strán): https://juraj.bednar.io/wp-content/uploads/2026/10/play-services-grapheneos-GMS-privacy-teardown-v3.sk_-1.pdf
What do Google Play services actually do on GrapheneOS, and should you disable them or just restrict them? I wrote this for @npub1235…0ht5 users deciding whether to install them. Typical analyses answer only part of that: they look at the installation package or at the network traffic of one device. But Play services are just a host that downloads further modules based on a configuration from Google's server, so there is no single Play services that could be audited once for everybody.
So I also took apart the delivered modules themselves: 24 files pulled from a rooted emulator, and for each one I worked out where it connects, which permissions it inherits and what it could target. As far as I know, nobody has published that. For example, the map and ad modules run inside the app's own process, so denying Play services the network does not stop them. The article also has practical GrapheneOS advice: which permissions to take away, how to reroute location, and what breaks if you switch them off completely.
Article: https://juraj.bednar.io/en/blog-en/2026/10/30/what-do-google-play-services-really-do-on-grapheneos-i-looked-inside/
Audio version (MP3): https://juraj.bednar.io/wp-content/uploads/2026/10/play-services-grapheneos-GMS-audio-en.mp3
Technical teardown (PDF, 35 pages): https://juraj.bednar.io/wp-content/uploads/2026/10/play-services-grapheneos-GMS-privacy-teardown-v3-1.pdf
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
If you ever want to use a microphone of a Bluetooth device on Android, please know that it is dark magic, you have to take chicken paws, under full moon, stir well at no more than 40 degrees and sing kumbaya.
Or you can give this to your agent:
https://gist.github.com/jooray/08ad9660329e023435586e1d4b29272b
It is total insanity. Fixed open-source software incoming, because almost no one got it right.
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
Released Third Ear - The voice recorder for the space age
The most modern voice recorder for Android, and a third ear for everything you would otherwise forget to write down. It records from your phone, a Bluetooth headset, LE Audio hearing aids or your car. The transcript is made on the phone, and the result goes wherever the button you tapped says.
It integrates Marmot protocol (White Noise), so you can talk to your agents (or family!), you choose if you send the audio or the transcript (handled by the FOSS OSTT app directly on your phone, so no audio leaves your device unencrypted). It even reads you replies.
Features Android Auto support, quick launch buttons (programmable).
This is the best way to take notes on the go.
Web: https://jooray.github.io/third-ear/
Zapstore: https://zapstore.dev/apps/app.thirdear
https://blossom.primal.net/26e575479ef7b355c154d372257906921c4a1756ae7793b6d6b6b658c75a9ff4.png
https://blossom.primal.net/400f726c1dbe0000ebc90903efbe830e8355b3098e369ca5ae3d093d5541b8dd.png
https://blossom.primal.net/46b29ab4bb114ca94fe9435e38b0d4e122e7b4ac4a357d0eef8e21c8da4e8c56.png
https://blossom.primal.net/8d9a493b84254b697e203a3b5d2dad2f65c590f6ab86fcf709f6cab0592b882b.png
eMudhra Intermediate CA Compromise
The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.
https://emudhra.we-have-a-problem.com/
eMudhra Intermediate CA Compromise
The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.
https://emudhra.we-have-a-problem.com/
https://www.imdb.com/title/tt1131729/
France's Open-Air Incinerators: The Uncounted Toxic Toll Of Annual Street Protests
https://www.zerohedge.com/medical/frances-open-air-incinerators-uncounted-toxic-toll-annual-street-protests
Marx, Musk and the death of meaning
Universal basic income would not free us but enslave us
https://thecritic.co.uk/marx-musk-and-the-death-of-meaning/