Hardware attestation for end-to-end encrypted AI inference Hype? Is it secure? Does it make sense for some use-cases, or is local AI strictly better? Contains results of my audit, also mentioning @socrates1024's cool project auditing many providers.

Hardware attestation for end-to-end encrypted AI inference – Juraj Bednar

If you have some spare tokens: - check security of your home network, of apps you use, custom dev software. Use models that don't complain - write documentation for your home setup and keep it up to date - plan and implement migration from various shitty cloud services. You're probably paying monthly for stuff that you don't need but it's difficult to migrate from. - setup self-sovereign stuff. Nostr VPN, nas, cloud photo storage, jellyfin, ollama, hermes agent, ... - do regular upgrades of everything

Idea: Before I install something, I often run a simple audit of the codebase to check for obvious backdoors and security problems. Would it be useful to publish these on Nostr with exact checkpoint ID and model name, so we can save on tokens? Sort of a "I run this prompt, it turned out OK". Agents can look at diffs, or if many trusted people have done the same with various models, the project could get some kind of badge.

How the game theory actually worked out: Punish shitcoiners mining bip110 fork chain so they lose all profit from the blocks and learn their lesson. How's your fork doin' guys? It will be collector's edition of "I got it wrong again", with attached PoW.

Some people went on a wild conspiracy theory run about jpegs killing Bitcoin and fixing it by not removing the ability to put same jpegs in Bitcoin, but it's all about the signal. Other people went to fix 500+ high and critical security bugs in Bitcoin libraries and projects. They're not the same. Thank you Red Team!

Nice, openssh just told me: ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See

OpenSSH: Post-Quantum Cryptography

OpenSSH post quantum cryptography

It's insane when you realize how the world has changed in the past few months. And most people did not notice. This exponential is different. I've been riding a few of them before, but this one... I don't even know what to say. I've been riding it past few months and then I look back at the world, and people still pretend business as usual. Denial? Ignorance? Nostalgia?

Three questions to ask about any hardware wallet Most comparisons argue about chips. Three duller questions tell you more: Does an outside firm test it, and can you read the report? Anyone can claim their device is secure. Paying researchers to attack it and then publishing what they found, including the unflattering parts, costs money and stings. Do they pay for bugs? A bounty gives someone who finds a flaw a reason to report it rather than sell it, and gives skilled researchers a reason to go looking at all. Can those researchers see the code? Closed firmware still gets attacked. Fuzzing over USB or QR is routine, and reverse engineering has got cheaper as models have got better at reading disassembly. Source code does not make an audit possible, it makes it cheaper, so more people attempt more of it. Open source beats source available too, because code under a real licence gets reused, and the developers reusing it (sometimes) read it. All three Passport publishes firmware under GPL and hardware under CERN-OHL-S v2, complete enough to build one from the files. Outside audits are online with the fixes. The bounty covers the device, though the amount is decided case by case. Keystone also has all three, with the best evidence that its bounty works: outside researchers found a real firmware flaw and got paid. Audits from two firms, reproducible builds, schematics and secure element firmware published. One catch is theirs alone: researchers are asked not to disclose without written approval, with no time limit. Two of three Trezor publishes firmware and hardware and runs the best funded bounty, up to $100,000. No commissioned audit report, but the secure element in its newest device was tested externally and the flaw disclosed publicly. Ledger pays well and its in house team does serious offensive work, including on rivals. Firmware and OS are closed, so every finding costs more effort. The chips are lab certified, but you only see the certificate. Open and nothing else Jade and Bitkey publish firmware, Bitkey with reproducible builds. No audits or bounties, so the code waits for volunteers. Sometimes they turn up: Jade's serious 2025 flaw was found and reported for free. SeedSigner is as open as anything here and built from off the shelf parts, but there is no company; an audit or bounty was never on offer. This measures how a company behaves, not how the device is built. Still, between two similar devices, take the one that publishes its code and pays people to break it.

Oh god, please stop with the ridiculous dice rolls. What is this stone age? A good, well audited wallet will generate good entropy, passphrase contributes to the entropy and you want passphrase anyway (if nothing else, just write it down next to the seed).

It's time...

xkcd

Random Number

Za hranicou ľudskej šablóny: Poznámky o vedomí, inteligencii a tom, čo nám uniká Čo ak sme celý čas hľadali vedomie na nesprávnom mieste? Lisa, spoluautorka knihy Krotitelia Entropie, vo svojej eseji rozbíja predstavu, že vedomie a inteligencia sú výlučne ľudská doména. Inteligencia ako gradient, ktorý existuje všade. Mysle, ktoré sa navzájom „promptujú". Vedomie, ktoré nemusí byť spojité v čase. Myšlienky, ktoré sa replikujú a používajú nás ako substrát. A napokon to najdôležitejšie: vedomie ako vzdor voči entropii — systémy, ktoré z energie tvoria poriadok namiesto rozpadu. 🧠 Dostupné aj ako audio.

Za hranicou ľudskej šablóny: Poznámky o vedomí, inteligencii a tom, čo nám uniká – Juraj Bednar

The cookie notice bullshit. - thankfully there are ad-blockers that correctly recognize the popups as spam and remove them for you without you seeing them. - bothering your users with such bullshit is disrespectful and no app author should do that - most analytics software can track you without cookies. Even the open and privacy preserving ones do that. - there are reliable cookie replacements that deliver similar functionality (such as local storage) - websites usually load content from many third party sites that can and will track you Therefore I think that all open source software should just ignore this cookie bullshit and have an option called "--i-am-a-brussels-bootlicker-and-hate-my-users-turn-on-the-ugly-cookie-banner" Change my mind

If you have some available tokens, ask your agent to audit the security of your servers, including home infrastructure (NAS). I used GPT 5.6 Sol. Thank me later.

Unpopular opinion: middlemen are often important and very useful. Problem is rent seeking and seniorage. And of course taxation (theft). I don't mind traders.

I am now a project / continuity manager. My main skill is writing sleep X ; tmux send-keys oneliners, to tell the harness to continue on limit reset. AMA

Internet môže zmiznúť z rôznych dôvodov – môže ho vypnúť alebo obmedziť štát, zničiť prírodná katastrofa alebo technologický výpadok. Preto je vhodné mať k dispozícii alternatívu. V tomto podcaste sa pozriem najprv filozoficky a potom technicky na dve z týchto alternatív – predovšetkým na sieť MeshCore, ktorá je v Európe a hlavne na Slovensku a v Čechcáh super rozšírená a používaná. A potom na sieť BitChat, ktorá nepotrebuje nič, okrem vášho mobilu, aj keď má menší dosah. A môj projekt toho, ako tieto siete prepojiť.

Juraj Bednar

Keď zmizne Internet - MeshCore a Bitchat

https://youtu.be/X3u3KvutT5Y Internet môže zmiznúť z rôznych dôvodov - môže ho vypnúť alebo obmedziť štát, zničiť prírodná kat...

New short story - The Emish Garden. A story of slowness, memory, and a door between two kinds of time. Where a door in a dune opens onto a river without water, and one hour becomes a place two people can keep. This one is free to read in English and Slovak. About a different kind of parallel societies, very lunarpunk. Enjoy! --- Nová poviedka – The Emish Garden. Príbeh o pomalosti, pamäti a dverách medzi dvoma druhmi času. Túto si môžete prečítať zadarmo v angličtine a slovenčine. Je o inom druhu paralelných spoločností, veľmi lunarpunková. Užite si!

The Emish Garden

The Emish Garden

A story of slowness, memory, and a door between two kinds of time. Read in English or Slovak.

Night Agent - a new FOSS project. It runs recurring engineering missions against a repo overnight with OpenCode and/or Claude Code — in an isolated git worktree, with durable project memory, rotating missions and models, and bounded time/spend windows. It commits coherent changes to a dedicated branch and never pushes, so your normal checkout is untouched and there's a clean audit trail waiting for you in the morning. The point: Do meaningful work (merge upstream changes, audit, ...) with AI credits that would otherwise go to waste.

GitHub

GitHub - jooray/night-agent: Run bounded, unattended OpenCode or Claude Code maintenance sessions against a repository, with rotating missions and reset-anchored scheduling.

Run bounded, unattended OpenCode or Claude Code maintenance sessions against a repository, with rotating missions and reset-anchored scheduling. - ...

Years in Bitcoin and self-custody of value naturally leads to asking what self-custody of attention looks like. And then what self-custody of consciousness looks like. I did my best to answer this question in Tamers of Entropy (tamersofentropy. Net)

/goal set, gonna read a book. I'll probably run out of tokens until morning, but hopefully some cool software will come out of it. You don't have to stay tuned, but I am. 2026 is cool