Last Notes
Because Merlin app is from Cornell and that university is covering for the gang rape of a woman on campus.
This doesn't seem to be any different than other federated system. Their abstract is a little misleading in claiming that it is taking place "directly on bitcoin L1" when that obviously isn't true. Until we can figure out a way to perform a trustless peg-in/peg-out, then it will always be just a claim of on-chain bitcoin and not actual bitcoin.
Love silent.link. There is more legislation being pushed requiring that any SIM require KYC info. So things like silent.link will be more needed than ever.
Using bitcoin to buy things just feels good. 😃
Well that is horrific. Last I check, bitcoin mines don't collapse and kill a hundred people.
#nevent1q…xxha
That sucks. I broke my ankle and tore several ligaments as well. The recovery is not fun, but certainly makes you appreciate having two working legs. Take this time of forced rest to recovery mentally as well. You'll get through this.
I have been retired for over a year now and am now looking for ways to volunteer my time. I love bitcoin's ability to help humanity in ways that traditional financial services have failed. I have a 20+ year career in IT/InfoSec (almost entirely in TradFi ironically), but am more looking for ways where simply having an extra set of hands will help people live better lives with the bitcoin/nostr. If anyone needs an extra volunteer, feel free to reach out. Doesn't need to be all the time, but if anyone hears a need for some extra hands anywhere, let me know. ✌
@npub1kmw…xqk9 @npub10qd…arpj @npub17cy…4ml3
Any vegans out there, feel free to join the vegan community on Armada. 🌱
https://armada.buzz/invite/naddr1qvzqqqyzz5pzpfklwjwfmw9fasyyu6504rpt6c387l5427s7qxyx6cq9r6efelnpqqqqytnp5t#BAADAwQBW8xBT8q0ERF9qax8GVolwA
All the more reason to use remote signing with your Nostr client. Keep your nsec out of your client so that the potential for XSS or CSRF attacks can't leak your nsec. Your client shouldn't need/have access to your nsec. Worst that might happen is they trick your remote signer into signing something you didn't authorize, but at least you can recover from that easier than a compromised nsec.
#nevent1q…us4d
Didn't know what Armada was, so just checked it out. It's like Discord, but with Nostr. Very cool! Thanks. @npub10qd…arpj seems to be doing cool stuff.
A person with authoritarian tendencies won't ever step back and see things this way.
You mean bitcoin?
Technically, yes that would absolutely work. But harder in practice considering very few wallets support it. I don't care about Luke's coin. Was just pointing out that for most people, keeping both coins has some important caveats.
Imagine any part of the economy depending on this software to facilitate transactions. What a completely unserious project.
#nevent1q…rt36
Except for the big issue of replay.
Sounds like you'd enjoy Luke's new shitcoin then.
How's that "game theory" working out for you?
I didn't say he was the only one that works on knots. I said he is the only maintainer. Do you know what that means?
He also doesn't cryptographically sign any of his commits which makes change control and code review manual and difficult. You can see for yourself.
https://github.com/bitcoinknots/bitcoin/commits?author=luke-jr
It baffles me how much they rail against the scourges of centralization and yet are so eager to run a node implementation maintained by a singular individual. Looking in a mirror seems so difficult these days for some people.
Yes. The economic weight of a node has always been where the power lies. It is why pointing to node counts for signaling has always just been posturing, when in reality is has always been subject to Sybil attacks. How much economic weight is behind a given node is where the real power lies. Coinbase's node holds far more power than some user who only holds 0.001BTC running a raspberry pi at home, for example.
Imagine having the world's economy run on something managed this horribly by such a delusional group of people. I'd rather stick with fiat at that point. 🤦♂️
#nevent1q…9hds
That's some insane talent.
"Not yet been captured." That is some massive irony in your spoken words there. ...the existence of your new dead chain has come about by an extremely small minority of delusional people. That's what real capture looks like. Thankfully, all you've managed to capture is a new shitcoin.
I hope you learned some lessons from this.
Calvin Ayre, now there is a name I haven't heard in ages...
Security by obscurity gets a bad rap in InfoSec, but that's if you ONLY are performing obscurity for your security strategy. Security is defense in depth and that depth includes obscurity. Obscurity in reality, is often your first line of defense. Change your defaults when running any publicly exposed service. That includes headers, responses, error codes, banners, and yes...even favicons too.
#nevent1q…why4
You running knots versus core does nothing for how much data is stored by your blockchain. Knots accepts all the same blocks on the chain as core.
BIP-110 also doesn't change anything with regards to the potential storage requirements of running a node since the amount of data stored for any given block remains the same.
At the end of the day, BIP-110 was selling a lie.
Data storage for bitcoin's blockchain remains a linear non-issue. Every block has a max size which means the blockchain grows linearly and therefore storage requirements over time for a pleb node runner is overcome easily with cheap consumer hardware.
If anything, not using OP_RETURN for arbitrary data is what increases node requirements since if that data is otherwise stored in the UTXO set, it WILL increase your node requirements since the UTXO set is stored in RAM, which is also far more costly.
Also, if the ColdCard debacle taught us anything about a proper SDLC, it is that you need robust commit tracking for code changes and the way that Luke maintains Knots mirrors the way that ColdCard maintained its firmware, if not worse. There is no code signing of the changes that Luke is committing to Knots from their source. You lose tracking of what the code changes actually are. It is a pet project of Luke's and I'd caution anyone serious about security to avoid running it.
This is something that I saw that results in a lot of the high burnout rates in the cybersecurity industry. Before I moved into the InfoSec field, I was in general IT.
As a network admin, you're thanked for solving someone's computer problem. You're thanked for implementing a new solution that is better than the legacy one. You regularly get that natural positive feedback that comes about by just doing your job.
In Infosec, it is a very thankless job. No one thanks you for preventing the unseen threat. No one thanks you for implementing a new security defense. In fact, you often get pushback because new security measures often introduce new hurdles that users now need to work with in their daily tasks. So as you work tirelessly keeping the workplace safe and secure, you don't get the positive feedback from those around you unless your workplace has proper recognition practices in place that understands the work that the InfoSec department is doing. You're often getting pushback just to even try and do the basics that you know the organization desperately needs. It can take a toll on the mind of the InfoSec professional.
#nevent1q…caym
No, not necessarily foul play as in involved directly with any theft. But certainly foul play in regards to being a really horrible way to run a company with a functional SDLC with any sort of accountability.
Crazy in hindsight to think that this company was so highly regarded. I certainly fell for it as it was a wallet I highly recommended. I guess that's what social reputation gets you these days.
Being able to host your own blind oracle is a great unique feature to the Jade. If you ever lost your Jade or had it stolen, you can take your blind oracle server offline and effectively remotely brick your Jade. Or you can host your blind oracle server strictly accessible only on your home LAN, making your Jade HWW only usable within the confines of your home.
#nevent1q…q4uh
The ColdCard debacle I think is an important lesson here for Knotzis. The ColdCard bug came about because there was one person with his hands in the code and with very little review of what was being changed. There were also very few comments added for each commit which further complicated change control.
The Knots implementation of bitcoin node software suffers from the same problem. Luke is the sole maintainer and the way he maintains the Knots software in many ways mirrors a lot of the poor practices that resulted in the ColdCard bug.
The ColdCard vulnerability should be a wake up call for anyone running Knots for their bitcoin node.
Satscard being more secure than a Coldcard was certainly not on my Bingo board for 2026...
Narrator: Mining blocks without signaling didn't, in fact, result in forfeiting all block rewards.
#nevent1q…6cux
Ya, their logic throughout the article makes no sense. It relies upon the logic that the BIP-110 hardfork chain holds any merit for my consideration. It doesn't. Nobody cares about it. If one of my channel peers forks off, so be it. I'll keep monitoring the actual bitcoin chain for any activity with my channels and thus my channel funds will remain safe. The risk of lightning loss remains the same, regardless of any chain split here. As long as my node is online and monitoring the chain I care about, there isn't any risk to my funds that I hold the keys to.
As always with lightning, if you're managing a healthy, always-on, node with proper channel backups, you funds will be safe.
BIP-110'ers, even in the 11th hour are desperate to make it seem like their hard fork has any chance of success or has any value worth considering. Reality is that it will come to pass and be forever forgotten.
Fair enough. I misunderstood.
Open and close channels? 😜
They put together some really great articles. Bummer.
You didn't do anything wrong. I recommended ColdCard to several relatives. I was scrambling last week to help them save their funds. It wasn't fun, but thankfully they're OK. We come out stronger with lessons learned in the end.
I don't think this is the take away lesson you should be having here.
Bitkey's security model is really solid. It is an easy recommend for casual non-technical users.
Even today with other wallets, far easier to tell casual users to just create a passphrase which most wallets have far better UX for than to suggest to them to roll dice for entropy. They'll be protected all the same.
You ever just scroll Nostr notes from before July 29th? What a peaceful time that was. Everyone was just so happy and oblivious.
Whenever there is some kind of tragedy in the real world, something I commonly hear said is to "look for the good." There will always be people banding together to help those impacted by whatever awful evil or disaster that took place.
I saw that with the bitcoin community last week. In the face of such an awful theft, I saw the bitcoin community with all hands on deck trying to help people preserve their wealth or protect themselves from the looming threat. That's what we do.
From the first reports of users' wallets being drained to piecing together the pieces and commonalities that would lead us to the root cause, it was amazing to see how quickly things came together. Everyone was finding ways to help as many people as possible protect their funds.
I was making several calls to help those close to me that were impacted as I know many others were doing just the same. When you don't rely on centralized institutions, that responsibility falls on all of us. It was clear that responsibility was not taken lightly by anyone.
It pains me to see something like this take place in the first place. It should've never happened. But seeing the good in that darkness was nice to see and I know we'll come out of this stronger than before.
You seem to always have very good viewpoints and this is yet another one. ✌
You wouldn't be using it for key splitting, but doing it in reverse to combine two (or more) keys into one. But I agree that doing the XOR operation manually is the best way to ensure the seed was XOR'd properly.
Ah, didn't know the MK3 got an update as well.
...or use a sufficient BIP-39 passphrase to provide additional entropy after the hardware provided its own.
Ya, I was thinking a lot about it last night as well. I agree that as an end user it is impossible to validate randomness.
The only thing you can do as an end user is minimize the risk of it. Either by performing your own entropy (dice rolls, coin flips, etc) to elimate the risk entirely. Or by involving multiple sources of entropy from multiple vendors to minimize the risk of failure from a single one. You can do that via multi-sig or with something like SeedXOR to combine multiple diverse seeds into a single seed phrase.
Someone just posted this chart. I'm guessing there have been a few unreported collisions with losses over the years that we just didn't know about.
#nevent1q…ljfy
