Abandon MLS at your own peril. Now, you can't say nobody ever warned you. I just warned you. View article →

Anyone keeping track of Black Forest Labs #AI project?

View quoted note →

My main problem with hardware wallets is the social risk. If you order one, everyone knows you have put crypto on it. An old laptop, tablet, or cell phone is just an old, general-purpose computer. Biggest risk is that someone throws it away.

I think anyone suing Cold Card has a good case, even merely based on the audits that have already been performed. There is nothing at all normal about how this stuff was built. Outrageous, irresponsible behavior and open contempt for the customers, IMO. Their best bet is probably to claim that they were all taking hallucinogenic drugs while working; _it is that bad_. And it just keeps getting worse. Every time there is a scandal like this, I am left staring in shock at how bad it all is, as I can't imagine anyone actually being this grotesquely bad. It's completely outside my frame of reference. **This is the shit you get when developers don't stay humble. This is the shit you get when nepotism is rife.** View quoted note →

The keygen for all of the libraries I have used draw full 256-bit values from OS CSPRNGs. Code audited: # JavaScript / TypeScript * nostr-tools (versions 2.15 – 2.23.5) * @nostr/tools 2.20.0 (the JSR-published variant of nostr-tools) * @nostr-dev-kit/ndk 2.14.35 (+ ndk-cache-dexie) * @contextvm/sdk —(ContextVM signer, wraps nostr-tools) # Go * go-nostr (nbd-wtf) (v0.27.0, notably older) # Kotlin / JVM * no Nostr library; direct implementation on top of ACINQ secp256k1-kmp 0.17.3 (plus BouncyCastle in the Android app) # Elixir * no Nostr library; implements on top of lib_secp256k1 0.7.1 # PHP * swentel/nostr-php 1.9.4 (server side; pulls in elliptic-php) # Python * python-nostr