/dev/fd0's avatar
/dev/fd0
floppy@joinstr.xyz
npub1v6qj...nzyr
/dev/fd0's avatar
/dev/fd0 1 week ago
My next post is about OHTTP and its usage in payjoin (most overhyped privacy tool) Spoiler: - Relay and directory collusion breaks privacy - Payjoin cannot be used with untrusted senders or colluding servers image
/dev/fd0's avatar
/dev/fd0 2 weeks ago
Can someone explain me this? 1. Someone reports a vulnerability 2. It is fixed even if hidden in normal commits 3. New release with no public disclosure 4. Attackers review the commits and exploit the vulnerability What do you achieve by delaying the public disclosure?
/dev/fd0's avatar
/dev/fd0 2 weeks ago
The old website has been moved to old.joinstr.xyz and a new minimalist dark-mode website is live at joinstr.xyz. Joinstr now has a community forum at forum.joinstr.xyz that uses Nostr and Squalk. The old SimpleX chat is dead.
image image
/dev/fd0's avatar
/dev/fd0 3 weeks ago
The next wave of AI-assisted attacks won't be about discovering bugs but about subtly introducing vulnerabilities into code that pass review unnoticed.
/dev/fd0's avatar
/dev/fd0 3 weeks ago
The easiest way to contribute to finding bugs without using too many AI tokens: - Find projects with multiple implementations or libs - Prepare a fuzzing harness for differential fuzzing - Run the fuzzer - Report the findings
/dev/fd0's avatar
/dev/fd0 3 weeks ago
If the victory lap is over, maybe people should know that most bitcoin infrastructure is still vulnerable and we had multiple security incidents over the last couple of weeks.
/dev/fd0's avatar
/dev/fd0 0 months ago
Greg Maxwell's opinion on the use of LLMs in bitcoin development image
↑