dannybuntu's avatar
dannybuntu
dannybuntu@walletscrutiny.com
npub1r709...sf7d
Open Source contributor to FOSS project walletscrutiny.com and nostr.info
dannybuntu's avatar
dannybuntu 1 week ago
"Whether you believe in God or not - religions, these are institutions that have had several thousands of years of practice to get it right - what do they all have? Prayer - words of affirmation and the practice of gratitude."
dannybuntu's avatar
dannybuntu 2 weeks ago
@Bitkey v2026.11.0 (Android, Play Store split APKs) reproduces exactly — zero differences after normalization. This one is a fix landing. Our v2026.8.0 and v2026.10.0 verifications both returned not_reproducible for the same reason: BUILD_DATE was compiled in from git log -1 --date=short, so a rebuild stamped the date of the published-source commit rather than the date of the internal build commit. In v2026.10.0 the entire difference was one content byte — 2026-05-21 vs 2026-05-22. At v2026.11.0 upstream ships verifiable-build/android/release-build-date.txt and reads it in preference to git. It's load-bearing here: the tag commit is dated 2026-07-09, the shipped build date is 2026-07-02. Under the old logic this release would have failed by a seven-day margin. classes.dex now matches byte for byte. resources.arsc semantically identical across all resource-bearing splits. Remaining AndroidManifest.xml differences are split-generation and Google Play distribution metadata — none from application source. Scope: Play Store split APK variant, arm64-v8a / xxhdpi / SDK 35. Full verification:
WalletScrutiny
Build Verifier Page
A project to improve wallet security
dannybuntu's avatar
dannybuntu 2 weeks ago
@BitcoinSafeOrg Desktop v2.1.0 — Linux AppImage (x86_64) reproduces exactly. Built from tag 2.1.0 (commit c208831) in a containerized environment. The resulting archive is byte-identical to the file published on the release page: Bitcoin-Safe-2.1.0-x86_64.AppImage.tar.gz sha256 8568fe64eac2935786b59c2e8e9161f7eecbcf8f80c4c93f5b8f605bbec980f6 No stripping or normalization — the artifact users download is the artifact compared. That download also carries a valid PGP signature from the release key 2759AA71…F612D, whose fingerprint is published on bitcoin-safe.org independently of the GitHub assets it signs
WalletScrutiny
Build Verifier Page
A project to improve wallet security
dannybuntu's avatar
dannybuntu 2 weeks ago
Binge-watched "Little House on the Prairie" on Netflix, about living life in the American Frontier. There are things common and different with the Filipinos "living life in the Philippine Islands" maybe a book about it deserves to be written. But I can't time-travel. Somebody should have written about it. Maybe some of the Spasnish have. I know the Americans missionaries have, but I want a different perspective. Filipinos by the way, back then is the term used to describe the Spanish who migrated to the Philippines. They hold a higher distinction when compared to us brown-skins - we were called indios. Which kinda sounds like "Indians"
dannybuntu's avatar
dannybuntu 2 weeks ago
Update 2026-07-17. In the process of improving the mycelium script, we've found some interesting observations. > Update — alternate Google Play hash for Mycelium 3.22.0.2. Google Play now serves a byte-distinct APK for the same version: - Previous: bfcd317bd2bae081d5d4d9cd0f80619e69fe9b5f4f7853a1f06510be75f45603 - Current: 335de275ff03e5dd4bab5f5b7bf31ba42af0bb68fa751dd092e6fb03c0a22d98 - Both APKs are exactly 53,772,157 bytes, and all 2,891 ZIP entries are byte-for-byte identical. Both verify with APK Signature Schemes v2/v3 and the same Mycelium signing certificate. The hash change is confined to the APK Signing Block: the current APK adds Google Play “Frosting” security metadata (0x2146444e) while reducing its padding by the same amount. No application code or resources changed. The reproducible verdict therefore remains unchanged. We did not upload the new report as it would overlap the previous one. Verdict unchanged: reproducible.
WalletScrutiny
Mycelium Bitcoin Wallet
Review of Mycelium Bitcoin Wallet (verdict: sourceavailable)
dannybuntu's avatar
dannybuntu 3 weeks ago
Fatherhood When people post on social media about fatherhood, it's almost always the warm and cute moments that make people go "awwww". It's never about the grit and enduring patience that makes one's hair either disappear or go gray. I live in a country that is engulfed with so many delusions and illusions. 15 million children are in a family that is designated as single-parent family. 93.7% of those single parents are mothers. In a country that is replete with "macho" Don Corleone leaders, politicians and father figures - we are now transitioning to the Fucc boi, type of male. Despite my qualms about organized Christianity - Christian fathers are a rare, necessary and perhaps dying breed. Because in this day and age, nobody wants to be a father. Mothers are linked first through their physiological and then their emotional bonds. Fathers are linked through sheer will - we have to go against our nature. We have to endure things we don't really need to endure.
dannybuntu's avatar
dannybuntu 0 months ago
Updated my public profile with a clearer record of my Bitcoin wallet review and reproducibility work. Current WalletScrutiny numbers: • 3,655 / 6,538 Bitcoin-related app/device pages authored or reviewed • 286 reproducibility verification and endorsement reports • 2,674 authored commits in the official WalletScrutiny GitLab history • 26.54% of 10,076 unique commits in scope This work covers wallet custody review, source availability triage, reproducible build verification, binary comparison, and evidence-based Bitcoin app/device analysis. If a Bitcoin wallet claims to be open source, reproducible, or self-custodial, that claim should be testable. Profile:
GitHub
GitHub - xrviv/about: About
About. Contribute to xrviv/about development by creating an account on GitHub.
 image
dannybuntu's avatar
dannybuntu 0 months ago
We verified Blockstream Green 5.5.1 twice today. F-Droid build: reproducible ✅ — every byte matches when built from source, native crypto library included. Play Store build: not reproducible ❌ — because Blockstream ships a prebuilt binary blob (GDK) that can't be regenerated from the published source. If a wallet's binary can't be rebuilt from its source, you're trusting the vendor, not the code.
WalletScrutiny
Blockstream Bitcoin Wallet
Review of Blockstream Bitcoin Wallet (verdict: sourceavailable)
dannybuntu's avatar
dannybuntu 1 month ago
“Non-custodial” is a claim, not a fact. Any wallet can say your keys never leave your device — the only way to actually know is to open the source, find the code that turns your seed phrase into a private key, and check it yourself. That’s true reverse engineering, and it’s the same instinct behind WalletScrutiny’s reproducible-build work: don’t trust the label on the box, verify what’s inside.
The Triage Log
Trust, But Verify: Reverse-Engineering a Wallet’s Key Derivation
A hands-on walkthrough using ADAMANT Messenger as a case study
dannybuntu's avatar
dannybuntu 1 month ago
Listening to Oxford Mathematician John Lennox
↑