BlessedBovine's avatar
BlessedBovine
blessedbovine@nostrplebs.com
npub1c4n2...559a
Husband of npub12wk0tlwr5wa39l6slw8rskwsvkatcll6zjrx8d909ltkvu7lsalsveyvqf Father Catholic Bitcoiner (Class of 2023) American Dreamer Bitcoin Full Node Runner on Tor On Nostr Since 850200; Verified 852712
BlessedBovine's avatar
BlessedBovine 20 hours ago
This Coinkite failure has seriously left my faith in hardware wallets in a shaken mess. I don't even know where to start over. Back to analysis paralysis.
@SoapMiner is the best. We love the soap, been proud customers of his since November of last year. What has stood out to me the most has been the amazing scents. My wife is very sensitive to odors "good" or "bad" she can find either overwhelming. However, she has given the stamp of approval for every scent I've bought us. The feel of the soap is also great on the skin, so much so that I've also just been using it on my face. Which is nice, because I used to use a separate face wash. I've been keeping track of how long each soapbar lasts us, and have found that each bar last us 30 days of normal use. I look forward to continuing to be a happy customer, and just got some deodorant to give that a try. I'm no soap connoisseur, so I don't have any major critiques. The soap cleans, feels nice, and lasts. The only thing that might be a good addition would be an option to buy one of the soap bar lifting pads as an add on. Keep up the great work! #Soap #SatEconomy #CircularEconomy #V4V
I guess #Aqua is down because #Boltz is down. This is the second near miss for me. I had a small amount of Sats on Aqua to use for fun money, however I moved it on chain last week because I wasn't sure what would happen to those Sats in the event of the impending fork.
Happy anniversary, @npub12wk0...yvqf! I love you. We've been married seven years now, a little more than a quarter of my life. I can't imagine life without you. We've accomplished so much together, we've grown together, and you've helped me grow as an individual. It feels like we've lived a lifetime together, and in some ways we have. I am incredibly blessed that I have had the opportunity to share these past seven years with you. Through all the hardships and happiness. I wouldn't want to do it with anyone but you. Earlier today, our eighteen month old son ripped off his shorts and diaper during nap time, and flung his poop outside his crib. While also getting poop all over everything in his crib - including all over himself. I cleaned the poop covered child, and you took care of the room and crib. We worked together as a team, jumping into our respective roles as if we'd done it a thousand times. That is the strength of our relationship, that we always lean on eachother for support. I felt that the poop incident was a pretty good allegory of our marriage. A little something like this: Life is beautiful. In the middle of what should be a calm moment, life goes to shit. We see the shit, we lean on eachother to clean the shit up. Then life is beautiful again. Thank you for always being there to enjoy the good times with me, and also for working to clean up the shit life throws at us as well. I love you now, and forever.
My heart is heavy for all those who lost any of their precious time and energy to the ColdCard entropy failure. It's devastating to see people talking about losing the entirety of their time and energy from the past X years - long before I found the Bitcoin space. So many pioneers that forged the path ahead and built amazing educational platforms and spaces. They provided me with all the tools necessary to enter into the Bitcoin space with such a strong conviction in the future of what Bitcoin could bring to society. This is my first Bear Market. The falling USD price hasn't really bothered me. Thanks to the amazing Bitcoin Pioneers' tales of how bad things had been in the past Bear Markets combined with the lack of changes in the fundamentals of Bitcoin. I have stayed grounded in "โˆž/21M" and, to paraphrase @hodl, leverage won't magically make you an OG." This current ColdCard debacle is the first time I've been extremely uncomfortable to be a part of the Bitcoin community. To preface the next part: I have zero, zip, zilch, prior experience in cryptography, coding, or other software skills. I, like many others, spent a significant time trying to educate myself on different hardware wallets before we took our Sats off an exchange. To be honest though, much of the technical jargon was lost on me. One thing did stand out to me though, ColdCard seemed to have the best (anecdotal) hardware wallet. I particularly liked the Q for it's QR scanner and full QWER keyboard. Knowing that most Sats are lost due to user error, I felt the Q provided ample tools to help verify, send, and receive Bitcoin transactions while minimizing user error. We're all told, "Don't trust. Verify." I did the best I felt I could, short of learning how to code myself to review CoinKite's code. I reviewed as much as I could on the reputation of the devices and feedback from people that had used them. For all intensive purposes, the Q felt like it would provide the best user experience for my wife or heirs if something happened to me, and give them the highest chance of success. I did not expect that I'd see ColdCard have a failure so catastrophic as to screw up the single most important part of the security, generating a secure 128bit private key. When I saw the warning go out from some of my fellow Nostriches that there was a vulnerability in the MK3 series my heart started racing. Did it go beyond the MK3? Were my wife and I affected? I started reading as much information as I could. Keeping up with every detail as more and more UTXOs were drained and more info was breaking. Then I saw it, MK4, MK5, and Q were all sub 128bits of entropy. I had accidentally exposed my wife and I, and all our future generations, to the vulnerability. To say my heart dropped into my stomach would be an understatement. I didn't know how long it would be before the hostile attackers were finished with all the MK3 wallets and started on the MK4/5/Q. I did know that I needed to update things quickly but smoothly. A problem quickly arose as I realized our security setup was so difficult to access in the event of a true emergency, like this, that I may not be able to move a single sat in time. The amount of time from the initial incident to when I was first able to even look at the public addresses of our sats took far too long. I felt more and more sick the more time passed without knowing if we'd already been rugged. When I was finally able to check our UTXOs, there was not a Sat out of place. Not yet anyways. I knew we weren't out the woods yet. Even though I'd accessed our Xpubs for the Sats, it would still take quite some time before I could gain access to our keys. The only things keeping me calm was that we had used a passphrase (that I later learned was too weak), and my wife. As soon as I had access to our private keys, I wrote out a checklist. The checklist provided myself a step-by-step guide to make sure that I did things as cleanly and orderly as possible, to minimize potential missteps in a complete migration to new keys. I rolled 100 independent dice to generate our new wallet. It took me 32hrs from the time I learned of the vulnerability to the time I was actually capable of accessing my cold storage and generating the new seeds to sweep our sats to. The only reason I managed to do it in 32hrs was that my emergency contact was able to meet me half way. Without the emergency contact, our sats would've been exposed for at least another 12hrs. I'm incredibly humbled and grateful that our sats are safe. I understand how incredibly fortunate we are to have been able to keep what small amount of Sats we've been able to stack, because it may not be a lot to most people, but it is a lot to us. I feel like I'd prepared for all the attack vectors, but I never expected that the entropy of a non-tampered with hww would be the one that got closest to compromising our sat stack. What a sobering and panick inducing experience. As a pleb without a background in cryptography or technology, I really took the generation of seed phases for granted. Never again. Rolling my own entropy, and diversifying our hww from now on. Which will be difficult, because the Q was a big purchase, one I thought would be worth the investment. Oh how wrong I was.
Disclosure: I'm a pleb with no technical background (software nor hardware), and I am not a cryptographer. As far as I can tell, using dice input to generate a seed phrase on a ColdCard Q bypasses the coding failure that causes the low entropy seed phrase generation. I tested this by rolling dice 100x independently, then inputing the results into the CCQ, the python script provided by CoinKite for the independent verification (I didn't trust this one as much), and https://iancoleman.io/bip39. The CCQ produced the same HexString as the python script. The CCQ also produced the same seed phrase as iancoleman. I performed this test three times. Am I correct in my understanding that the provided cross-verification means that if you use the CCQ to process 100 dice rolls then you have a seedphrase generated from the appropriate amount of entropy? I believe @semisol already confirmed dice generated keys were safe, but I thought it best to verify myself. I also wanted to provide other plebs a way they could check their own devices. #ColdCard #MK3 #MK4 #MK5 #CCQ @Dr. The Daniel ๐Ÿ–– @utxo the webmaster ๐Ÿง‘โ€๐Ÿ’ป @HODL
Admist all that is going on in the world, a baby was born. My wife is amazing, and recovering wonderfully from giving birth to our son. Hug your loved ones, and remember why we're here. I love you @npub12wk0...yvqf image
Working right now. For how long? I don't know. It has been rather unreliable as of now. Don't know if it's my machine or tailscale config.
Everytime I see the US National Debt swing another Trillion up, an unexplainable sense of excitement courses through me. Just saw we are almost at $40 Trillion.
Finished reading 2001: A Space Odyssey last week. It was a very enjoyable read. I appreciated the brief chapters, which made it very easy to pick up and read admist my busy day. Excited to watch the movie soon.
@Johnny, I updated my Lightning address. For some reason Amethyst couldn't find your DM relays for me to respond to you directly.
โ†‘