how's kind 1 nostr doing these days

first external contribution 🦍🦍🦍 View quoted note →

HelloHotspot Pay-as-you-go eSIMs from silent.link and VPNs from Obscura, paid from one balance in the app. No email, no contract. Built on Cashu.

HelloHotspot

HelloHotspot: eSIM data that never expires

Pay-as-you-go eSIMs from silent.link in 150+ countries and VPNs from Obscura, both paid from one balance in the app that you fill over Lightning. P...

very excited about this: a bitcoin-backed stablecoin that's built with cashu ecash is launching very soon. it could become the most private usd digital cash system ever built. incredible. will keep you posted.

Thank you all for helping to build, test, and promote Bitchat. Proud of the Bitcoin and Nostr community for stepping up and defending freedom of speech for people around the world.

bitchat (a nostr client) is nr 1 social app in the french app store

gm, nobody hacks nostr

4

no more slop

Thank you for working on Bitcoin. Seriously. Fiat money and the system of control they've built around it is terrifying and it will never loosen its grip around our necks. If we don't save ourselves, noone will. Thank you for helping.

just sold for 21 sats, in for the tech

Nonfungible.cash

in-for-the-tech · sold

Sold by calle for 21 sats on Nonfungible.cash.

the NFT is in the JPG

Nonfungible.cash

Nonfungible.cash · The NFT is the JPG

Turn any picture into a collectible. Send the JPG, or a link, and you

updates - improved builtin cashu wallet - filter market offers - profiles support banner images

gm

www.deusaderit.com/gothicc

bitchat 2 is available now

you can now login with your npub

Nonfungible.cash

calle · Nonfungible.cash

3 NFTs on Nonfungible.cash: IMG_0412, freedom of speech_#02, htlc

gm

hey @LN⚡Server are you still there? users having issues with your mint

While I'm at it – another proof that nostr devs aren't serious about adoption is still the lack of key rotation. I get it. It's a big task and can't be solved by any individual client, it needs to be addressed on a protocol level. I'm also aware of the that were put forward. But you know what? Writing markdown and pushing it to the nips repo isn't enough. It's step 0. This is a typical issue that would require devs to come together and all pull in one direction. It likely would have needed a champion who is willing to push for this change, talk to people, explain it to everyone, and actually care. Similar to how we push for bigger changes in the Bitcoin protocol. It takes time, and it takes a serious effort. Once again, nobody has taken over that role because nobody really cared enough. Back in the day, there were massively big users who would've loved to join nostr – but didn't do it because of a lack of key rotation. Why would anyone with so much to lose join a protocol that can permanently rekt your identity with a simple XSS bug that exposes your nsec? Nobody listened to them. This was brought up over, and over, and over again. Nobody cared enough.

Liquid hack explained. Liquid has confidential transactions that hide the amounts for improved privacy. A bug in how these transactions are validated caused inflation of Liquid BTC (L-BTC) and allowed hackers to empty the entire side chain. Liquid nodes don't see the amounts of a confidential transaction, so to make sure that the transaction is still valid and doesn't cause inflation nodes check something called a balance proof and a range proof. The balance proof establish that sum of the input amounts equal the output amounts, i.e., that "x L-BTC going in and x L-BTC going out". But there's a catch. Only relying on a balance proof isn't enough. You also need the range proof. The range proof establishes that a hidden output amount falls within a positive range. That means a valid output must be at least 1 L-sat and at most 2^64 − 1 L-sats. Range proofs make sure that you can't mint "negative L-BTC". Why is this even necessary? Remember, the amounts are hidden and a hidden negative amount would allow extra positive outputs to balance against it. Without a range proof, a transaction could say "I've put 1 L-BTC in, and I'm taking two outputs out: one with 4000 L-BTC and one with -3999 L-BTC)." This is going to cause a disaster in a little bit. Once the balance proof, the range proof, and other validations pass, a transaction is regarded as valid and can pass consensus. However, because especially the range proof is computationally expensive, Liquid nodes cache the result of a successful range proof in memory. Essentially, the node remembers "I saw this range proof before and it was valid, all good!". In order to recognize the same range proof later on, you need to assign a label to it. This is called a cache key. This cache key is the actual cause of the bug. The way this cache key was constructed allowed two different transactions to collide on their cache key. Essentially, one valid transaction (1 L-BTC in, 1 L-BTC out) had the same cache key as an invalid transaction (1 L-BTC in, 4000 L-BTC out). Here's the hack: the attackers submitted the valid transaction (1 L-BTC in, 1 L-BTC out) first. Liquid nodes verified this transaction successfully, created a cache key called REKT and stored it in their cache. Then the attackers carefully crafted a second invalid transaction with (1 L-BTC in, 4000 L-BTC out) that created the same cache key REKT. Instead of validating the second transaction and realizing that it printed money out of thin air, Liquid nodes found it in their cache and said "hey I saw this transaction before, everything is fine" and that caused the inflation. The attackers then took their 4000 L-BTC and withdrew 4000 BTC onto the Bitcoin base chain.