One thing the article leaves out: what to do if you already put money in. Call the number printed on the machine straight away. Some operators hold a new customer's first purchase for a while before it goes out (CoinFlip says 48 hours), and inside that window the money can still be stopped. After that, a bitcoin payment cannot be reversed. And for anyone reading this for a parent: Microsoft, banks, police and tax offices never ask you to pay in bitcoin or gift cards. Anyone who does, and won't let you hang up, is the scam.

https://www.ksla.com

How you can protect yourself from crypto ATM scams

Here's what you need to look out for if you think you're being scammed for cryptocurrency

Read the thread:

Read a thread — moved to nostrcomments.github.io

Good advice. Two things to add: a "recovery service" that asks for a copy of your ID before doing anything is collecting material for the next scam, so never send it. And report it to your financial regulator too, not only the police (BaFin in Germany, the FBI's IC3 at ic3.gov in the US), because regulators publish warnings that protect the next victim.

CryptoTicker.io

Crypto recovery scam: 241 sites seized

Brooklyn prosecutors and the FBI took 241 scam sites and 112 servers offline. Stage two was a recovery service. How to spot the scheme.

Read the thread:

Read a thread — moved to nostrcomments.github.io

Worth knowing how this one worked: tapping the notification just opened the real wallet app, so nothing looked wrong. The phishing link only showed up afterwards, in Android's notification history. A clean-looking tap proves nothing about where a notification came from. The rule that covers every variant: a hardware wallet's recovery words go on paper or metal and nowhere else. No app, website, support agent or "critical vulnerability" alert ever needs them typed in. If a message says your wallet is at risk, close it and check the maker's official site or account yourself. Note that it is still unconfirmed whether SecuX's own systems were involved, so no need to panic about the device itself.

Coinpaper

Ripple’s David Schwartz Flags SecuX Wallet Phishing Alert as Emergency Maintenance Raises Questions

David Schwartz warned of a SecuX-linked phishing page asking for recovery words as the wallet app underwent emergency maintenance.

Read the thread:

Read a thread — moved to nostrcomments.github.io

Security update for NostrComments: please make sure you are on 23.10.3 or later (Firefox and Chrome both have it). Two problems were found and fixed this week. On some websites, a malicious page could read a private key stored in NostrComments, or press the panel's own buttons, such as "Show my key" or setting a password on your key. Keys kept in a signer extension (Alby, nos2x, Attest) were never at risk. We have no indication that these flaws were ever abused, but if you keep a key in NostrComments and want to be certain, make a new one under Settings → Rotate key. For developers: the panel lives in an open shadow root, so the page can restyle it and click its buttons. The fixes make every key-related control require a real click, and stop reading anything security-relevant from state the page can change. The details are in the security advisories on GitHub.

A practical note for client developers, from a bug I just fixed in my own extension: signer extensions inject window.nostr asynchronously, so it may not exist yet when your code first looks. My client checked once five seconds after load and then every five seconds, which meant that for the first seconds of every page a user who had already chosen their signer saw "Not connected" and a Connect button. Now it looks at 0.3, 1, 2 and 4 seconds, then backs off. Two details that matter: only check whether window.nostr is present during those early looks, and call getPublicKey once, when you actually connect, so the signer doesn't get a burst of requests.

GitHub

nips/07.md at master · nostr-protocol/nips

Nostr Implementation Possibilities. Contribute to nostr-protocol/nips development by creating an account on GitHub.

Read the thread:

Read a thread — moved to nostrcomments.github.io

GM Nostr ☀️ Every time I pick a new alarm tune I think: this one's lovely, I'll finally wake up happy. Three days later I hate it with a passion. Has anyone found an alarm sound that survives?

A real-world data point on the Users figure, since this page only says it counts installations rather than activity: in August my extension's listing reported about 5,000 users. The breakdown was 97% United States and 79% ChromeOS, and nothing else I could measure moved with it, so I never believed it. By October the figure had dropped to 22, which matches what I can actually observe. Lesson: before you quote this number, look at the country and OS breakdown. A distribution that looks nothing like your audience is probably not your audience. My extension has no telemetry by design, so I count real use from the outside instead: how many distinct keys have published something with it.

Chrome for Developers

Analyze your store listing metrics | Chrome Extensions | Chrome for Developers

Understanding metrics and performance of your Chrome Web Store store listing.

Read the thread:

Read a thread — moved to nostrcomments.github.io

I Love this website for background music wavefunc.live

WaveFunc Radio

Decentralized internet radio directory and player built on Nostr

Read the thread:

Read a thread — moved to nostrcomments.github.io

A practical caveat for extension developers who use shadow DOM to keep their UI safe from the page: an open shadow root does not keep other code out. I put my extension's panel in one, and yesterday a user's Share button simply vanished on one site. The button was in the DOM, with no inline style, but its computed display was "none" and its colors had been rewritten, so another stylesheet had been injected into the shadow root. The likely culprit is a content blocker's social-widget filter, because the button's class was "share-btn", a name those lists hide on purpose. The fix was a class name no filter targets. Lesson: inside an open shadow root, treat your class names as public, and don't give a control a name that sounds like an ad or a widget.

Using shadow DOM - Web APIs | MDN

An important aspect of custom elements is encapsulation, because a custom element, by definition, is a piece of reusable functionality: it might be...

Read the thread:

Read a thread — moved to nostrcomments.github.io

This is the project's own thread. Questions, ideas, or things that annoy you about NostrComments: leave them here, and I'll answer. Bugs are easier to track in Issues. Recent fixes: the Share button could be hidden by content blockers (fixed in 23.9.5), and it could post twice with a slow signer (fixed in 23.9.4).

GitHub

GitHub - briskness-byte/NostrComments: The comment section no website can close. A thread on every page, kept on Nostr relays. Browser extension for Firefox and Chrome. No account, no server, no tracking.

The comment section no website can close. A thread on every page, kept on Nostr relays. Browser extension for Firefox and Chrome. No account, no se...

Read the thread:

Read a thread — moved to nostrcomments.github.io

Some practical experience, since the article stays general: I push my project to GitHub and to two Nostr git servers (gitnostr.com and relay.ngit.dev) with a single script, so the article's "we don't need to stop using GitHub" is exactly how it works in practice. Yesterday I sent my first patch to a repo that lives only on Nostr, with "ngit send". One member-only relay refused it with a 403, but the others took it, so it didn't matter. That's the resilience the article describes, in one terminal line. One correction: GRASP isn't so much a bridge as a server type that bundles a relay and a git server, and it creates the repository automatically when your announcement lists it. That's why you don't have to set anything up on the server side.

NostrMag

Read the thread:

Read a thread — moved to nostrcomments.github.io

Worth knowing if you're thinking of applying: the money is for the people doing the hunting (AI tokens, servers, fuzzing), not for projects that want an audit of their own code. All five grantees in this first round work on Bitcoin infrastructure: Core, libsecp256k1, btcd, BTCPay and mempool. Applications are fast-tracked via opensats.org/apply/red.

OpenSats

Finding Vulnerabilities, Funding Defenders

Reimbursing AI token costs for security research across the Bitcoin ecosystem.

Read the thread:

Read a thread — moved to nostrcomments.github.io

Worth knowing if you're thinking of applying: the money is for the people doing the hunting (AI tokens, servers, fuzzing), not for projects that want an audit of their own code. All five grantees in this first round work on Bitcoin infrastructure: Core, libsecp256k1, btcd, BTCPay and mempool. Applications are fast-tracked via opensats.org/apply/red.

OpenSats

Finding Vulnerabilities, Funding Defenders

Reimbursing AI token costs for security research across the Bitcoin ecosystem.

Read the thread:

Read a thread — moved to nostrcomments.github.io

I put a comment section on every web page on the internet. You can now: - discuss news articles without censorship or being banned - warn each other for possible scam websites and many other things with NostrComments Install the browser extension now on: Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido Firefox:

Client Challenge

Puts the Freedom back in your hands Open source: Github:

GitHub

GitHub - briskness-byte/NostrComments: The comment section no website can close. A thread on every page, kept on Nostr relays. Browser extension for Firefox and Chrome. No account, no server, no tracking.

The comment section no website can close. A thread on every page, kept on Nostr relays. Browser extension for Firefox and Chrome. No account, no se...

#nostr #foss #freedom #censorship

NostrComments puts a comment thread on every web page on the internet. This means you can post and read comments about the web page from other users. The thread lives on Nostr relays, not on the site. There is no middleman: no server of mine, no account, no telemetry, and the site you're commenting on can't close it. For users: install the extension, make a key in one click or use your existing Nostr signer, and comment anywhere. That includes the news site that turned comments off, the paywalled article, the government page and the press release. Nostr notes that tag a page's address show up in its thread too, so a page isn't always empty. Zap a good comment, mute the bad ones. Nothing is sent until you switch it on; after that, the relays you choose can see which pages you read. For developers: comments are plain NIP-22 events (kind 1111, the URL in the I tag), so any client can read and write the same threads. Other tools already use this format but turn a URL into an address differently. If you build one, let's agree on that rule. Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido Firefox:

Client Challenge

Source:

GitHub

GitHub - briskness-byte/NostrComments: The comment section no website can close. A thread on every page, kept on Nostr relays. Browser extension for Firefox and Chrome. No account, no server, no tracking.

The comment section no website can close. A thread on every page, kept on Nostr relays. Browser extension for Firefox and Chrome. No account, no se...

#nostr #freespeech #foss

GM ☕ NostrComments has been live in the Chrome and Firefox stores for a few weeks now. The thing I see most often: People open the button on an article where the comments are already closed or deleted… and there’s already a thread waiting. That’s exactly why I built this. Small updates from the last few days: • The floating button is quieter by default (dims until you hover) • One-click disable per site • Remembers which corner you want it in, per website Still no server, no account, no tracking. Just comments the site owner can’t delete. If you haven’t tried it yet: Chrome → https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido Firefox →

Client Challenge

Or read any thread without installing anything:

Read a thread — moved to nostrcomments.github.io

Which page would you most like to give an uncensorable comment section? #nostr #asknostr

A few releases of NostrComments since last time: the floating button dims unless you hover it, can be dragged to a corner instead of only picked from a menu, and can now be turned off entirely in settings. With it off, the toolbar icon becomes the way in instead — and now shows how many replies you haven't seen yet, so that's still covered.

NostrComments — moved to nostrcomments.github.io

github.com/briskness-byte/NostrComments

GM! Coffee's on, let's build something great today.

If your browser extension uses sender.tab to tell web pages apart from its own pages, check this. I got it wrong in a signer and it cost me a release. The background script refused privileged messages, like setting a PIN, whenever sender.tab was set. The reasoning: content scripts run in tabs, so a message with a tab came from a web page. But the extension's own options page has a tab too, as soon as it is opened in one. So the extension blocked itself. PIN setup didn't throw an error or show a warning. It just did nothing. The check that means what you intended is the sender's URL, not whether a tab exists: compare sender.url against browser.runtime.getURL(''). Your own pages pass, and anything a content script relays from a web page does not. The second half of the same fix: the content-script bridge now forwards only an explicit list of message types. Before, some handlers were out of a page's reach only by accident, and an accident is not a boundary.

NostrComments 23.4.0 is out. A reader of the extension — Emre Yılmaz ( @Emre Yilmaz ), blog.emre.xyz — wrote up a discovery convention for pages that are also native Nostr content: a <link rel="alternate" href="nostr:naddr…"> tag, so a client can find the entity a page already is. Sent it in as a proper draft, trust considerations included. Built the read half of it — a page naming its own Nostr entity now has that thread merged into the panel, alongside the URL-scoped one. Thank you for taking the time to write it up properly Emre!