BTCforPlebs's avatar
BTCforPlebs
btcforplebs@btcforplebs.com
npub1w4rz...382j
Learn nostr and bitcoin, pleb style
BTCforPlebs's avatar
BTCforPlebs 1 month ago
Foot-gun = no fun. I ran a small Cashu mint for 1 year. Yesterday I found it empty. About 1.5M sats gone, and only around 247k had ever been put in. Nobody broke into my server. Nobody touched my node. I did this to myself. The setup file that comes with the software has a line that says, in plain words, "put a random key here." It even tells you the command to make one. I did not run the command. I pasted the instruction itself in as my key and hit go. It started up fine. That was the problem. For months my mint's secret key was a sentence that anyone who has ever opened that setup file has seen. Eventually somebody noticed, used it to print themselves fake money from my mint, and cashed it out. I was stupid twice. Once, because I never read the one line you are supposed to read twice. Twice, because I saw it start and took that as "it's safe." Nutshell software does refuse to start on a couple of obviously fake keys. It just does not refuse its own example. Should it? Yes, and I have sent them a fix. Should I have checked instead of assuming? Also yes. If I never looked at what the guard rail was, I do not get to blame the guard rail. The mint is off for good. Open source is retards helping retards. This week I was the retard. So here is my turn helping: a fix and a warning. I still believe in this stuff. The bug that got me was in a file I could open, read, fix, and send back the same day. That is the whole point. @calle
BTCforPlebs's avatar
BTCforPlebs 10 months ago
All your models are broken 2009: ⚪️ 2010: ⚪️ 2011: 🟢 2012: 🟢 2013: 🟢 2014: 🔴 2015: 🟢 2016: 🟢 2017: 🟢 2018: 🔴 2019: 🟢 2020: 🟢 2021: 🟢 2022: 🔴 2023: 🟢 2024: 🟢 2025: 🔴
↑