😭

Spam bots are back? I get endless notifications after my last note on #Ditto 😢

If anyone wants to publish it on #Zapstore, let me know. #dev #devstr View quoted note →

Are you excited about the recent Bitcoin surge? Do you check the price before you even get out of bed? I vibe-coded an Android alarm clock that wakes you with happy music if BTC went up overnight, and sad music if it went down. Set it once, every day, or chosen weekdays. At alarm time it fetches BTC/USD, then plays Number Go Up or Number Go Down on the Android alarm stream. Press Stop and it reads the price. Play: https://play.google.com/store/apps/details?id=com.ritrek.btcpricealarmclock Open source:

GitHub

GitHub - ritrek/ritrek-btc-price-alarm-clock-app: BTC Alarm Clock

BTC Alarm Clock. Contribute to ritrek/ritrek-btc-price-alarm-clock-app development by creating an account on GitHub.

GM to all fiat miners out there! #FiatMining

GM to all fiat miners out there! #FiatMining files.niot.space/4_5814628726503120982.mp4

If a future #AI loses control and starts philosophizing, it would probably build a simulation of the years that led to its birth. What are the odds of being alive during those exact years? #showerthoughts

Pop&Pope restaurant #foodstr #TelAviv

I initially wanted to build the TimelockRecovery.com feature for Sparrow Wallet, one of the most popular wallets for advanced Bitcoin management, including multisig, air-gapped wallets, and more. But Sparrow is written in Java, and I've never worked on a large Java project, let alone one with a UI. So I implemented it in Python for Specter and Electrum instead. This week, I fed Grok and Fable the source code from Specter and Electrum and told them to replicate the mechanism in Java for Sparrow. A few prompts later, with some tiny improvements, and it works perfectly! 🤩 As a developer, it feels like knowing a few words of Latin and suddenly being able to speak any Latin-derived language. We live in amazing times!

GitHub

New Feature: Timelock Recovery by oren-z0 · Pull Request #2063 · sparrowwallet/sparrow

Generate a pair pre-signed transactions that move the funds to a backup destination within a relative locktime: The first transaction sends the fu...

#dev #devstr #Bitcoin #BitcoinDev #Electrum #ElectrumWallet #Specter #SpecterWallet #Sparrow #SparrowWallet #AI

I'm a shy Israeli who won't do this, but I definitely know others who do - and it usually works for them. #Israel #rules

@fiatjaf Ping

GitHub

allow platform-specific NIP-44 decryption by oren-z0 · Pull Request #86 · fiatjaf/nos2x

Users may be reluctant to grant a website full NIP-44 decryption access. This lets a site request limited permission: plaintext is returned only if...

#dev #devstr #nostrdev #nostr

The idea that multisig wallets are created by importing xpubs (Zpubs) to a hot online computer and building the wallet descriptor there - is absurd. That computer can manipulate the xpubs of some of the signers, add another xpub inside the QR code that doesn't appear in text form, change the number of required signers, etc. Most users won't notice the difference on their small hw wallet display, and won't verify a receive-address on all wallets (i.e. hacker can replace one of the xpubs with his own, and could fool you into sending funds to an address where they are a co-signer). The wallet descriptors should be generated on the hardware wallets themselves, with clear instructions how to verify them on all other hw wallets.

GitHub

Feature Request: Create Multisig Descriptor from Specter DIY · Issue #385 · cryptoadvance/specter-diy

The main premise of hw wallets is that you can't trust an online computer. When creating a multisig wallet, most users create the multisig-descript...

Browsing to Nostr websites from @Amethyst is great, but please update the NIP-44 support.

BetWithFriends

BetWithFriends — friendly betting pools over Nostr ⚡

Create a private betting pool, share a link, and let friends bet with lightning zaps. No server, no signup — just Nostr.

#dev #devstr #bug #bugstr

Hardware wallets are hard to hack but can have disasterous bugs. Hot Phone wallets are safer against bugs (can be fixed via online update), but can have disasterous hacks. For example, while creating a 2-of-2 multisig on a hot phone wallet, the phone can show you a fake seed unrelated to the its declared xpub, and hide the real seed internally. At some random point, the phone can get a remote command to blackmail you, and only then you will realize you don't really have the real seed. People won't buy more than 1 hardware wallet, and I don't know how to solve this issue. Maybe UX for the Phone Wallets that shows a seed + xpub, and let you decide whether to use it or pick another one? You could enter a few seeds that the phone generated into the hw wallet just to verify that the phone didn't try to cheat, then use the last one without entering it to the hw wallet. Or maybe covenants?

vibe-coded a tool to test your air-gapped wallet ( @SeedSigner , @npub1j0dm...lwm0 ) against basic #DarkSkippy attempts: create fake PSBTs with a fake seed, and see if the HW wallet returns the expected signature and does not try to leak data:

Basic Exfil Tester

Generate fake PSBTs, sign them with an air-gapped hardware wallet, and compare the result against expected deterministic signatures to detect nonce...

Obviously you should also verify the firmware's pgp, and this tool does not cover sophisticated #DarkSkippy attacks (i.e. that try to leak data only in certain conditions, like in transactions of specific amounts, or multisig setups). Thanks to @Frostsnap for building darkskippy.com and creating a real-world example.

Mood 😅 View quoted note →

I've added a SECURITY.md file to

GitHub

GitHub - oren-z0/holesail-switchboard

Contribute to oren-z0/holesail-switchboard development by creating an account on GitHub.

repo of the Umbrel app

Holesail Switchboard | Umbrel App Store

Discover Holesail Switchboard for your umbrelOS home server. Learn more, see screenshots, and discover other self-hosted Networking apps available ...

- can you please scan the repo (and the holesail project that it wraps) for vulnerabilities? @Rob Hamilton @calle @supersu @Umbrel ☂️ #RedTeam #BitcoinRedTeam #dev #devstr

Fixed the redirection: runs(dot)wtf

GitHub

Blaming firmware/stm32/COLDCARD_MK4/mpconfigboard.h at 37e4af5451c260c1e7d429fe8972c4cb5e68ee59 · Coldcard/firmware

❄️ Firmware and simulator for Coldcard Hardware Wallet - Blaming firmware/stm32/COLDCARD_MK4/mpconfigboard.h at 37e4af5451c260c1e7d429fe8972c4c...

View quoted note →