m0wer's avatar
m0wer
m0wer@sgn.space
npub1w3va...4c5c
JoinMarket NG
m0wer's avatar
m0wer yesterday
Cloudflare's coding-agent skill for multi-phase security audits
GitHub
GitHub - cloudflare/security-audit-skill: A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings - cloudflare/security-audit-skill
 A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. This is the skill that seeded Cloudflare's vulnerability discovery harness, described in [Build your own vulnerability harness](https://blog.cloudflare.com/build-your-own-vulnerability-harness). The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.
Stacker News
Cloudflare's coding-agent skill for multi-phase security audits \ stacker news
A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, c...
m0wer's avatar
m0wer 2 days ago
linus-torvalds-skill: Distilled Code Reviewer skills/soul from 32k~ emails
GitHub
GitHub - Mte90/linus-torvalds-skill: Distilled Code Reviewer skills/soul from 32k~ email from the kernel newsletter
Distilled Code Reviewer skills/soul from 32k~ email from the kernel newsletter - Mte90/linus-torvalds-skill
 Distills Linus Torvalds' code-review methodology from his LKML emails into a reusable, language-agnostic Skill (and Soul) from various LLMs. Built from **38,293 real review moves** extracted from 31,397 of his emails (2002–2026) on the Linux kernel mailing list, plus 67 interview transcripts.
Stacker News
linus-torvalds-skill: Distilled Code Reviewer skills/soul from 32k~ emails \ stacker news
Distills Linus Torvalds' code-review methodology from his LKML emails into a reusable, language-agnostic Skill (and Soul) from various LLMs. Built ...
m0wer's avatar
m0wer 4 days ago
FCC ISM Rules May Shatter Lora Mesh Communities
Hackaday
FCC ISM Rules May Shatter Lora Mesh Communities
Although everyone has their own reasons for exploring a new hobby, one of the driving factors behind the popularity of Meshtastic and MeshCore has ...
 Meshtastic and MeshCore’s default U.S. radio settings may violate **existing, not new, FCC rules**, prompting a shift to 500 kHz bandwidth that cannot communicate with nodes using the old settings. That migration, compounded by interference problems seen in urban testing, could fracture LoRa mesh communities into incompatible networks.
Stacker News
FCC ISM Rules May Shatter Lora Mesh Communities \ stacker news
Meshtastic and MeshCore’s default U.S. radio settings may violate existing, not new, FCC rules, prompting a shift to 500 kHz bandwidth that canno...
m0wer's avatar
m0wer 6 days ago
TimesFM: a pretrained time-series foundation model developed by Google
GitHub
GitHub - google-research/timesfm: TimesFM (Time Series Foundation Model) is a pretrained time-series foundation model developed by Google Research for time-series forecasting.
TimesFM (Time Series Foundation Model) is a pretrained time-series foundation model developed by Google Research for time-series forecasting. - goo...
 TLDR: They trained a model on lots of real world time series data and now you can use it to make predictions on any time series. One shot, not fitting anything. The performance in benchmarks looks impressive.
Stacker News
TimesFM: a pretrained time-series foundation model developed by Google \ stacker news
TLDR: They trained a model on lots of real world time series data and now you can use it to make predictions on any time series. One shot, not fitt...
m0wer's avatar
m0wer 1 week ago
🇨🇭 Swiss Bitcoin Pay potentially hacked
X (formerly Twitter)
🇨🇭 Swiss Bitcoin Pay (@SwissBitcoinPay) on X
A malicious user has likely gained access to Swiss Bitcoin Pay’s internal systems. As a precaution, we are temporarily shutting down our servers ...
 > A malicious user has likely gained access to Swiss Bitcoin Pay’s internal systems. As a precaution, we are temporarily shutting down our servers while we investigate and secure our infrastructure.
Stacker News
🇨🇭 Swiss Bitcoin Pay potentially hacked \ stacker news
A malicious user has likely gained access to Swiss Bitcoin Pay’s internal systems. As a precaution, we are temporarily shutting down our servers ...
m0wer's avatar
m0wer 1 week ago
Would it be better if Bitcoin was "completely confidential"? Let's skip the "shitcoins" debate. Would it be better if Bitcoin was "completely confidential" ™️? Assuming it was like that from the beginning and that we had certainty of no inflation bugs being possible. Lots of hypotheticals, but to center the debate around full confidentiality vs. the state. The idea comes from https://stacker.news/items/1571256/r/m0wer. The thought behind it is whether "privacy" coins are a bad idea because they become a clear target for the state or actually the opposite because they "force" people to opt-out. Maybe there are many other considerations. The question is, if you had a magic wand and could make Bitcoin have been completely confidential from the beginning without bugs, would you?
Stacker News
Would it be better if Bitcoin was "completely confidential"? \ stacker news
Let's skip the "shitcoins" debate. Would it be better if Bitcoin was "completely confidential" ™️? Assuming it was like that from the beginning...
m0wer's avatar
m0wer 1 week ago
Zcash: EU AMLR prohibits anonymisation-enhancing coin accounts
Zcash: EU AMLR prohibits anonymisation-enhancing coin accounts - 10 Jul 2027 — TradingView News
 Controversial(?) opinion: "privacy" coins are a bad idea because they become a clear target for the state. Or maybe the opposite because that would mean "forcing" people to opt-out?
Stacker News
Zcash: EU AMLR prohibits anonymisation-enhancing coin accounts \ stacker news
Controversial(?) opinion: "privacy" coins are a bad idea because they become a clear target for the state. Or maybe the opposite because that would...
m0wer's avatar
m0wer 1 week ago
A Severe Misalignment of AI in Mathematics
What's new
A Severe Misalignment of AI in Mathematics
I am proud to be among the list of 25 initial signatories — all Fields Medallists — to the declaration below, which grew out of discuss...
 TLDR: Tao and 24 other Fields Medalists warn that AI companies are optimizing for “solving” famous math problems, while mathematics is really about developing understanding, ideas, and new methods. Rapidly mass-producing solutions risks destroying the human process that turns problems into lasting knowledge, while creating serious attribution and plagiarism issues. They’re not against AI in math; they argue it should accelerate understanding rather than turn research into a benchmark race.
Stacker News
A Severe Misalignment of AI in Mathematics \ stacker news
TLDR: Tao and 24 other Fields Medalists warn that AI companies are optimizing for “solving” famous math problems, while mathematics is really a...
m0wer's avatar
m0wer 1 week ago
The AI Language We Can't Read: Neuralese - YouTube First, we gave models a scratchpad: instead of forcing a one-shot answer, let them spend more tokens reasoning through a problem. In a sense, you get more capability out of the same model by giving it more serial computation. That reasoning is also useful because humans can read it. You can inspect how the model reached an answer, spot mistakes, and potentially debug or monitor it. But there’s an obvious incentive to make that reasoning cheaper. Compress it, shorten it, remove redundant words. The problem is that if you keep optimizing for efficiency, the reasoning can drift into shorthand or “Neuralese” that still works for the model but becomes gibberish to us. So there’s a tradeoff: more efficient reasoning vs. preserving one of the few windows we have into how the model reached its conclusion.
Stacker News
The AI Language We Can't Read: Neuralese - YouTube \ stacker news
First, we gave models a scratchpad: instead of forcing a one-shot answer, let them spend more tokens reasoning through a problem. In a sense, you g...
m0wer's avatar
m0wer 1 month ago
SeedSigner BIP46 support (JoinMarket timelocked fidelity bonds)
GitHub
BIP46 support (timelocked fidelity bonds) by m0wer · Pull Request #1001 · SeedSigner/seedsigner
Description Problem or Issue being addressed SeedSigner did not support BIP 46 timelocked fidelity bonds. JoinMarket users therefore could not deri...
Stacker News
SeedSigner BIP46 support (JoinMarket timelocked fidelity bonds) \ stacker news
@m0wer stacked 637 sats posting https://github.com/SeedSigner/seedsigner/pull/1001 [2 comments]
m0wer's avatar
m0wer 1 month ago
Got 100 USD of Kimi K3 credits from prem.io to do a security audit to JoinMarket NG. They are giving it to Bitcoin projects that ask for it, see https://xcancel.com/premai_io/status/2084552134444662986 Anyway, the experience was very nice. You can ask Kimi K3 directly to find vulnerabilities and prove that they are exploitable (otherwise it's a nightmare of endless false positives). It first went through some recognition phase and proceeded to focused on the different attack vectors in phases. It did not find anything high or critical but it tried many candidates. And found some medium stuff. Oh, and also had it have a look at all dependencies. Still have credits left for auditing future PRs and issues. Thanks prem.io guys!
m0wer's avatar
m0wer 1 month ago
I was checking some feature I did not notice before on GitHub called "Audit log". It registers all the events that happen in a GitHub organization. And it shows you the location of the contributor! image In this case it was the VPN exit hop. But not everyone uses VPNs, and when you contribute long enough to a project, one day you'll have the VPN off. I'm sure many people that have contributed to open source projects were not aware of the maintainers being able to see their location. I definitely wasn't. But there's more! Maintainers can enable collection of IP addresses from the contributors! image I can tell you that it's off for JoinMarket NG, but you would have to trust me about it, because I can't prove it. Same goes for all other organizations you've ever contributed to. An alternative is
gitworkshop - Decentralized Git
Decentralized GitHub alternative over Nostr for browsing repositories, managing issues, and collaborating on pull requests.
 were things like this don't happen by design. But the fact that Nostr relays and grasp servers don't share your IP with the repo maintainers, does not mean that they themselves can't see where you are connecting from. Of course they can.
m0wer's avatar
m0wer 1 month ago
I already had a solution for transcribing audios:
GitHub
GitHub - FlyingFathead/whisper-transcriber-telegram-bot: Python-based Telegram transcriber bot utilizing local Whisper models & yt-dlp
Python-based Telegram transcriber bot utilizing local Whisper models & yt-dlp - FlyingFathead/whisper-transcriber-telegram-bot
 Very easy to deploy and useful. But I was missing some TTS (text to speech) solution. Sometimes I want to listen to an article or long Nostr content. So created a bot that reads out loud whatever you send it and replies with a standard voice note. Here's the code:
GitHub
GitHub - m0wer/tts-bot: Self-hosted TTS Telegram Bot
Self-hosted TTS Telegram Bot. Contribute to m0wer/tts-bot development by creating an account on GitHub.
 Here is how it sounds:
Kokoro TTS - a Hugging Face Space by hexgrad
Upgraded to v1.0!
m0wer's avatar
m0wer 2 months ago
23 out of the total of 102 JoinMarket makers are using JoinMarket NG! Very happy to see that. And 28 out of the 102 offers have exact grid fees, helping each other create more confusion on their CJs.
↑