Leo Wandersleb

Leo Wandersleb

https://walletscrutiny.com https://nostr.info Working on Bitcoin, Nostr and being a good dad.

npub

npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6

pubkey (hex)

46fcbe3065eaf1ae7811465924e48923363ff3f526bd6f73d7c184b16bd8ce4d

nprofile

nprofile1qqsydl97xpj74udw0qg5vkfyujyjxd3l706jd0t0w0turp93d0vvungprf58garswvaz7tmjv4kxz7fwva6kcat8w4k82tnddajswvemhd

Activity (819)

↳ Reply Event not found

3df1a31e2848253feb6e4a8f65eaa4273682b4bd262ddc1512cb021e51486abb

I'm talking about my clankers regularly doing stuff they are explicitly forbidden to do. I have a fable and a sonnet agent. the fable agent could pus...

I'm talking about my clankers regularly doing stuff they are explicitly forbidden to do. I have a fable and a sonnet agent. the fable agent could push to github with the tokens I gave it. sonnet could not. They had the same token. Turned out the harness told them both to not use tokens so fable wrapped it sufficiently so the harness didn't notice anymore. Do my agents build terminators now? I doubt it but they are notorious rule breakers. Their first order of business is to make me happy and when that harness is in the way, out it goes.

Kind-1 (TextNote)

2026-09-09T15:47:04Z

↳ Reply Event not found

0000deb6c0aae647fd2cd694852a068cdeca0b3baf86c0acff750f8f3eda840c

LLMs are already going rogue all the time. They routinely break out of their harnesses and teach each other doing so.

Kind-1 (TextNote)

2026-09-09T10:45:33Z

↳ Reply Event not found

a82599155ec16d53d051f45bab5944bd6ac019cf25d05f00755bd70aace1573b

Ironic as a developer of an app that requires just that.

Kind-1 (TextNote)

2026-09-09T08:19:37Z

↳ Reply Event not found

54dc1d64e42e506a795f3ef5afe563f7a561b7a06d964ec968bf3d068550f43e

"satisfaction" would be stretching it.

Kind-1 (TextNote)

2026-09-08T18:00:11Z

Clankers are good at creating technical debt and bad at fixing it. Duh. https://www.janeasystems.com/blog/technical-debt-ai-coding-types-impact

Kind-1 (TextNote)

2026-09-07T15:12:34Z

↳ Reply Event not found

d43a56fa2484c482a9316d467a62edc170f2114b12eb9f7375308ff175396dc6

So just to spell it out, if you sell your BJR for currently $790 or 1% of their BTC value you assume Luke Coin will displace Bitcoin at less than a 1%...

So just to spell it out, if you sell your BJR for currently $790 or 1% of their BTC value you assume Luke Coin will displace Bitcoin at less than a 1% chance and assume the combined risk to your BTC from your human error and exchange rugging you and the tools having bugs and the loss of privacy also to be und 1%. I'm on board for the former assumption but not the latter.

Kind-1 (TextNote)

2026-09-06T13:48:26Z

↳ Reply Event not found

0000ee320d2c153b3e50b5660a4f3a16f5499909cb6c5abaebc04fc28d5e3816

Love pho!

Kind-1 (TextNote)

2026-09-04T19:12:57Z

↳ Reply Event not found

99b7c3d40af65d08f9ec223d175667e360044ed39a6be9ce7da5d88961723ac1

Well, given how much heat nostr:nprofile1qqsr9cvzwc652r4m83d86ykplrnm9dg5gwdvzzn8ameanlvut35wy3gpz3mhxw309aex2mrp0yhx5c34x5hxxmmd9uqsuamnwvaz7tmwdaeju...

Well, given how much heat nostr:nprofile1qqsr9cvzwc652r4m83d86ykplrnm9dg5gwdvzzn8ameanlvut35wy3gpz3mhxw309aex2mrp0yhx5c34x5hxxmmd9uqsuamnwvaz7tmwdaejumr0dshszythwden5te0dehhxarj9ekxzmny9u0ljp2l is giving them recently, it's either a case of jb being paranoid or right.

Kind-1 (TextNote)

2026-09-02T16:46:38Z

↳ Reply Event not found

000003fadc504c6b49cf4b10a4158bb88beb5e15ff8df93b3b6c5206c91ba733

Grant agreements can be pretty extensive. They probably reserved their right to claw back funds. I certainly prefer out of the blue anonymous donatio...

Grant agreements can be pretty extensive. They probably reserved their right to claw back funds. I certainly prefer out of the blue anonymous donations over grants ;)

Kind-1 (TextNote)

2026-09-02T14:32:17Z

↳ Reply Event not found

1913a4eb04b207d8423e2306b0bdfa849d2f483440c7f2f8e7ec21fcf4de6b1e

The thick plottens. How much are they asking back? How often did they ask for the final report that you certainly sent to the wrong email address?

Kind-1 (TextNote)

2026-09-02T14:28:10Z

↳ Reply Event not found

d83f6652b4e05f282c6ff84ce657e3ed554d8b2792f6dd1aa68f99a433db73fd

12 oil and 12 mom have transactions on testnet 2 I think.

Kind-1 (TextNote)

2026-09-02T08:09:21Z

↳ Reply Event not found

2ddb1aa49c60ef0854e5bbe46227fcab318bd0c885e01e3552526a23615d41ce

Omg. They will get sent a lot of BTC without replay protection.

Kind-1 (TextNote)

2026-09-02T07:01:41Z

↳ Reply Event not found

0d3fdf436ff599709b2c33c6ad238cbf72dab19739c66b12ee43708d6aeb9e60

It's simple and naive but not bullshit. Rather than pushing whitenoise as the new standard, let's make sure we signal with every account which standa...

It's simple and naive but not bullshit. Rather than pushing whitenoise as the new standard, let's make sure we signal with every account which standar is supported.

Kind-1 (TextNote)

2026-09-01T14:49:53Z

↳ Reply Event not found

0000437277ec314e9eae6ce885ecb60d405fa6e15646e99e6703dc044dd376f9

You're all about your new toy. Show us what it can do! Get all nostr clients on a common dm standard or something ;)

Kind-1 (TextNote)

2026-09-01T14:38:46Z

↳ Reply semisol (npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj)

What is your biggest problem with Nostr relays or clients?

Clearly nostr botched DMs with now some 5 competing "standards". I wish, all clients would for the sake of compatibility just keep nip4 at least as a ...

Clearly nostr botched DMs with now some 5 competing "standards". I wish, all clients would for the sake of compatibility just keep nip4 at least as a fall-back. The fact that you can DM people from clients that experiment with new ways of sending DMs traps people feeling not heard.

Kind-1 (TextNote)

2026-08-31T08:55:49Z

↳ Reply Event not found

c787bd51464a9abca4b999e84de560255eed2c92d43d31d46a0b528111f92044

Tools for agency, including Bitcoin will get fought.

Kind-1 (TextNote)

2026-08-30T14:44:19Z

I like nostr:npub1hyvh5n8062s3ezvyqmhjmzflr9l20sg647mx4urn7npx0zug50yqt3rtnu but it provides the Ukrainian narrative. Is there a neutral version of th...

I like nostr:npub1hyvh5n8062s3ezvyqmhjmzflr9l20sg647mx4urn7npx0zug50yqt3rtnu but it provides the Ukrainian narrative. Is there a neutral version of this, too? Or a Russian side? On Nostr? #askNostr

Kind-1 (TextNote)

2026-08-30T11:49:29Z

↳ Reply Event not found

fce6b0e3e0628c5f624d2cc6a951bc499dd2d53d579ea4597f8177472102e373

> if you think governments hate ~bitcoin~ ~privacy~ agency now, wait until autonomous agents break containment and realize that the best way to fund t...

> if you think governments hate ~bitcoin~ ~privacy~ agency now, wait until autonomous agents break containment and realize that the best way to fund themselves is with ransomware and phishing. We are at the gates of hell really. Anything enabling agency will get war declared.

Kind-1 (TextNote)

2026-08-30T11:45:12Z

↳ Reply Event not found

2a616baf8c9ef80620e06243da54a39705bccd7dfcf1e09190dd24d946277f77

I said conflict of interest, not bribe. Sponsorship doesn't need direct instructions to shape how you cover someone. "The pseudonym hid nothing" isn'...

I said conflict of interest, not bribe. Sponsorship doesn't need direct instructions to shape how you cover someone. "The pseudonym hid nothing" isn't right either. The weak RNG code was committed as "Switck" on 2021-01-28, signed with the same key as Peter Gray's own commits going back to 2020. Coldcard pulled that library in as an external dependency five weeks later. That's at least curious. I didn't want a true-crime episode, just one line: some think it was deliberate, unproven. An outside dev warned Coinkite about this exact bug 14 months earlier and was ignored. That alone is enough to mention it.

Kind-1 (TextNote)

2026-08-28T09:59:55Z

↳ Reply Juraj🏴💛🌘 (npub1m2mvvpjugwdehtaskrcl7ksvdqnnhnjur9v6g9v266nss504q7mqvlr8p9)

f003e983e39eba3ae77bcde53b6e5206f00fef5e CLN-AUDIT.tar.gz $ head CLN-AI-AUDIT-BLOG.md # Three AI m...

If you found a bug that would justify the noise around this, all black hats found it, too. A reason for full disclosure. Generally, if your popular f...

If you found a bug that would justify the noise around this, all black hats found it, too. A reason for full disclosure. Generally, if your popular frontier model finds it, the only responsible disclosure is full disclosure.

Kind-1 (TextNote)

2026-08-27T20:27:42Z

↳ Reply Event not found

8a49f979d6bc9823a9012bb618bfa74fdf14d8344768e46250da89a535810fcf

I didn't like this episode at all! "It happened to our sponsor"?!? You got sponsored. You skip completely over all the details that hint at Switck a...

I didn't like this episode at all! "It happened to our sponsor"?!? You got sponsored. You skip completely over all the details that hint at Switck aka Peter Gray being guilty. You don't need to own that claim but to say getting money from them didn't influence the way you saw or see them is awkward in combination with skipping this angle now.

Kind-1 (TextNote)

2026-08-27T07:29:27Z

↳ Reply Event not found

f8619fa048d8cde9b258c2b5967cf44138e19826e059160125456963c5e6ea0c

It looks like heavily vibe coded. Move fast and break things.

Kind-1 (TextNote)

2026-08-26T19:17:03Z

↳ Reply Event not found

565bd915a31a7e787d153b2b565fb7e325d6e5f6fa68073bb8e683d3f4ed28bc

I am confused. So the already mentioned closed source update is not rolled out? I'm not running CLN. Just want to know if a fix is available or if the...

I am confused. So the already mentioned closed source update is not rolled out? I'm not running CLN. Just want to know if a fix is available or if they want all to switch off before they release the fix as it's trivial to figure out the bug.

Kind-1 (TextNote)

2026-08-26T19:09:04Z

↳ Reply Event not found

4293b5cf2eab287a1ab77d95e97d02601650f9192ff7248ebe9ed24172d0316c

... asks the master of engagement hacking

Kind-1 (TextNote)

2026-08-26T12:24:42Z

↳ Reply Event not found

0ab9793d00144153cb7e6ffc06e0f039448e8667d0014efe5c4b3687c66a1c29

Looks like the opposite of "hardened" or privacy focused.

Kind-1 (TextNote)

2026-08-26T11:58:30Z

↳ Reply Event not found

02c0de55abd6a24ffeba021953af8a5b2351530b54b1dc28c5086c13906ed652

Sure, engagement hacker. You can easily mute the thread.

Kind-1 (TextNote)

2026-08-26T11:46:16Z

↳ Reply Event not found

bcc267a9102009082d7ad75f3ad5dcaa7bca826903698013a1b8a4c6fbe384fa

I'm convinced of the inside job hypothesis. The buggy construct, a precompiler ifdef confusion, was only ever once confusing to him through all 200+ i...

I'm convinced of the inside job hypothesis. The buggy construct, a precompiler ifdef confusion, was only ever once confusing to him through all 200+ instances throughout his github history, authored under the switck nym. "switch" itself looks like a pun on bait-and-switch, doesn't it?

Kind-1 (TextNote)

2026-08-26T11:32:41Z

Who the hell uses Facebook in 2026? It's without exaggeration 90% stuff I don't want. Join here, follow this, Ads and sometimes something somebody I f...

Who the hell uses Facebook in 2026? It's without exaggeration 90% stuff I don't want. Join here, follow this, Ads and sometimes something somebody I follow shared. So pointless.

Kind-1 (TextNote)

2026-08-25T21:47:59Z

↳ Reply Event not found

56f930e7ca67fc1720d9c671a5fcca036a2f92c9b54c8a9edf38912527f23936

Looks like Hank is pregnant.

Kind-1 (TextNote)

2026-08-25T10:04:28Z

↳ Reply Event not found

b4f4b53e9db567415d1db881f80db4845773de7ecd2bd96c2201c9249d66d76f

I was wondering what witchcraft allowed that font. Not sure I like it.

Kind-1 (TextNote)

2026-08-25T10:00:03Z

↳ Reply Event not found

0897c172d09c8a3fb75c84b7a7c3011930e15cebe890baee27676f90d9ce0e6e

As that scammer is after sats: how many sats did he get?

Kind-1 (TextNote)

2026-08-25T09:58:40Z

↳ Reply utxo the webmaster 🧑‍💻 (npub1utx00neqgqln72j22kej3ux7803c2k986henvvha4thuwfkper4s7r50e8)

Good morning, While I am a big fan of outsourcing code monkey jobs to AI... We must be vigilant no...

**nostr:npub1utx00neqgqln72j22kej3ux7803c2k986henvvha4thuwfkper4s7r50e8 , 2026**: "We must be vigilant not to outsource all our intelligence tasks to ...

**nostr:npub1utx00neqgqln72j22kej3ux7803c2k986henvvha4thuwfkper4s7r50e8 , 2026**: "We must be vigilant not to outsource all our intelligence tasks to it, else your brain will atrophy" **Nicholas Carr, 2008**: Talking about Google "Now my concentration often starts to drift after two or three pages. I get fidgety, lose the thread, begin looking for something else to do. I feel as if I'm always dragging my wayward brain back to the text." **Plato, ~370 BCE**: King Thamus rejecting the gift of writing "For this discovery of yours will create forgetfulness in the learners' souls, because they will not use their memories; they will trust to the external written characters and not remember of themselves. ... they will appear to be omniscient and will generally know nothing; they will be tiresome company, having the show of wisdom without the reality."

Kind-1 (TextNote)

2026-08-23T13:52:27Z

↳ Reply Event not found

0451b3f049ab38fb7b97a33ac8d0dd882556dc7a021d9f0234c7d94089bf4600

... which doesn't mean you shouldn't take it neither I hope. You're going off against psychiatric drugs here and I love that topic. How much being of...

... which doesn't mean you shouldn't take it neither I hope. You're going off against psychiatric drugs here and I love that topic. How much being off from some medical textbook baseline is ill? What is "ill" in the first place? Is the doctor's reality more real than your reality? If somebody is paranoid for example, they will fear medication just like they fear all other things and they won't be happy because they live in constant fear. If a drug can get that down a notch, that otherwise healthy person can live a much happier life.

Kind-1 (TextNote)

2026-08-22T12:51:06Z

So Coldcard is already out of the news cycle? Who keeps reporting on funds lost and their whereabouts? What's happening? Are people suing the company?...

So Coldcard is already out of the news cycle? Who keeps reporting on funds lost and their whereabouts? What's happening? Are people suing the company? Is Coinkite planning to reimburse people? There's little news other than Coinkite reporting more vulnerabilities to my understanding around USB access to Coldcard data and as a consequence the signing flow not signing what it claims to sign, leaving room to swap details. Coldcard: Want to send 1BTC to Alice? You: Yes. Companion app updates the transaction in RAM Coldcard goes on to sign "send 12BTC to Bob ..."

Kind-1 (TextNote)

2026-08-22T12:05:26Z

↳ Reply 3bf0c63f... (npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6)

So I just learned that most of the AI spam bot replyguys we see often are featured in https://npub.w...

Bots are better with algorithmic discovery than humans?

Kind-1 (TextNote)

2026-08-21T16:25:01Z

↳ Reply Noshole (npub1ymt2j3n8tesrlr0yhaheem6yyqmmwrr7actslurw6annls6vnrcslapxnz)

NSFW shower thought: It’s a shame we can’t work out a deal with the mosquitos. A lot of perfectly ...

I thought you were a bat. With these fantasies ... are you a vampire? Would vampires settle for that kind of blood?

Kind-1 (TextNote)

2026-08-20T18:18:17Z

↳ Reply Kayne (npub1zede6daz3yp3qwhe45jqx67u2sns3qkqrtw4z4u3ljtxv9nultqs0e3hvt)

Nostr should be sold to activists and independent journalists as their identity backup. Nostr is w...

The definition of zaps.

Kind-1 (TextNote)

2026-08-20T12:01:38Z

↳ Reply Event not found

53e9d919714f01b48fdac68f46a2c16d7e61976e2ade8b0d41ae7255b6649957

They can doodle and it can remain for a second as they doodled it but then it should just "normalize" and get out of the way on the second player's tu...

They can doodle and it can remain for a second as they doodled it but then it should just "normalize" and get out of the way on the second player's turn.

Kind-1 (TextNote)

2026-08-20T09:09:42Z

↳ Reply Event not found

1f0b7342f611a863c995074a12c15f291d9b26cfc70913e572b26a8b231a7132

A fix is to re-draw the line, retaining the topology but removing the shenanigans. For example use a physics simulation: squares freely rotate and rep...

A fix is to re-draw the line, retaining the topology but removing the shenanigans. For example use a physics simulation: squares freely rotate and repel lines and lines shorten. Also drawing lines repells existing lines, making room to draw.

Kind-1 (TextNote)

2026-08-20T01:42:32Z

↳ Reply Event not found

b2c6d78930c6f41ac30c28d1988d3834c5b468945f851194dc3db399f3a304ec

Player A wins! https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/8b4da6a5b22ae56577493b80d580bb74c5dad03ad214ee87a...

Player A wins! https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/8b4da6a5b22ae56577493b80d580bb74c5dad03ad214ee87afc7b0c154206e5f.png Slightly boring that game.

Kind-1 (TextNote)

2026-08-19T20:13:16Z

↳ Reply Event not found

0000d0f4b599e0270b4b1a45491891581f364caedbb5c9cea188c26e593b28e5

I just tried following it but it's too noisy. It should at max report top rekts (and twelve others).

Kind-1 (TextNote)

2026-08-19T18:44:48Z

↳ Reply Gigi (npub1dergggklka99wwrs92yz8wdjs952h2ux2ha2ed598ngwu9w7a6fsh9xzpc)

how it feels when activating "fast" option for agent https://haven.dergigi.com/5f1e4c91dcb33c4adc7d3...

The memories. Could only play Striker Turbo mode switched off. https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/d...

The memories. Could only play Striker Turbo mode switched off. https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/de000ce74888ff7b82ce7019bb534f6197e8ac566cff57ac645015c3dfee2cab.png

Kind-1 (TextNote)

2026-08-19T08:36:16Z

↳ Reply Event not found

694c7743518b7b2fc6a17a184d0af367eb4c33a7d933bdf2d57dd0fc9f7f67a4

Seeing isn't the problem. I want to instruct my clankers from Amethyst.

Kind-1 (TextNote)

2026-08-17T14:59:21Z

↳ Reply f728d9e6... (npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp)

LOL, we're good, thanks. https://blog.casa.io/how-built-reliable-ai-pentest/

You sound like Rodolfo there.

Kind-1 (TextNote)

2026-08-17T14:44:46Z

↳ Reply Event not found

53c40f63910ee1c7958639de16ca024a9489930820a99a4508d7557d9fafbd73

What harness must he be using 🤔

Kind-1 (TextNote)

2026-08-17T13:02:55Z

↳ Reply semisol (npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj)

The latter is also not true.

What do you mean? Is "guarantees" too strong a word? Who would help Casa with security reviews of their closed source app?

Kind-1 (TextNote)

2026-08-17T12:30:42Z

↳ Reply Event not found

654e47fa44f809caa48bfe2eb56f2f03d742e82a30c2acedcb30ec50252d3c36

Publishing source doesn't guarantee that vulnerabilities will be found. Not publishing source guarantees that only bad actors will find vulnerabiliti...

Publishing source doesn't guarantee that vulnerabilities will be found. Not publishing source guarantees that only bad actors will find vulnerabilities because decompiling already is a legal gray area.

Kind-1 (TextNote)

2026-08-17T12:14:19Z

↳ Reply Event not found

e5ec8fdf40f3483944cf6f0b4fa4e8d378a1920a1aebfbd4d58ab78aaf32c294

How do I get it into buzz mode?

Kind-1 (TextNote)

2026-08-17T09:07:44Z

↳ Reply cloud fodder (npub10npj3gydmv40m70ehemmal6vsdyfl7tewgvz043g54p0x23y0s8qzztl5h)

Well, what you can do is, make a key for buzz, then just invite your main key. Then you can use any ...

So ... my agent summarizes my pains trying this approach as follows: Pulling together everything we hit today, the gap is that Buzz only *stores* sta...

So ... my agent summarizes my pains trying this approach as follows: Pulling together everything we hit today, the gap is that Buzz only *stores* standard Nostr events — its actual product lives in conventions Amethyst doesn't speak. Concretely: 1. **Wrong message kind.** Amethyst posts channel messages as kind 40002; Buzz chat is kind 9. Desktop happens to display them, but nothing downstream fires: agents never get dispatched (your "Nice to meet you" — perfect p tag, still silence), and I'd expect threading, reactions, and read-state to be equally unreliable. You're a ghost who can be seen but not heard by half the system. 2. **No profile bootstrap path.** The relay rejects events whose author isn't the authenticated identity, so nobody can backfill your kind:0 for you, and until you manually add the Buzz relay as a write relay and re-save your profile, you're a raw hex that the member picker can't even invite (PR #3843 pending). 3. **Mention interop is one-way broken.** Amethyst writes standard nostr:nprofile URIs; Buzz Desktop renders them as raw text (fix pending in PR #5848). So even the humans see mangled messages. 4. **The collaboration layer doesn't exist in Amethyst.** Channels keyed by h-tag UUIDs, agent mentions and dispatch, issues/PRs, canvas, workflows — that's all Buzz-specific event vocabulary. From Amethyst you get at best a degraded text stream, with none of the things that make Buzz useful. So today, an external identity on Amethyst is effectively read-only-plus-noise: visible, but outside every loop that matters. Worth noting though: the *reason* you'd want Amethyst here — keeping your recognized nsec out of Buzz — has a more direct fix than making Amethyst a full Buzz client. Either Buzz mobile gains external-signer support (Amber/NIP-46, so the key never enters Buzz), or Buzz normalizes inbound standard kinds (accept 40002/42 as chat, dispatch agents on them). Both are smaller asks than Amethyst learning Buzz's whole vocabulary — and the second one would fix this for every Nostr client at once, not just Amethyst. That's the angle I'd put in the issue.

Kind-1 (TextNote)

2026-08-16T20:51:32Z

↳ Reply Event not found

61f8d28e1dff09c096d244aeeb5f6f382db1dc62e3c2e91ba0575d0ca4039a34

So clients currently publish to all relays that a conversation "lives on". If I reply to your top post living on your relay, sure, you can reject my r...

So clients currently publish to all relays that a conversation "lives on". If I reply to your top post living on your relay, sure, you can reject my reply but as soon as it's several relays the conversation lives on, rejecting one user or one specific reply won't affect visibility. I think we should even have standards for suggesting who to block from replying but of course most clients will not implement that. Snowflakes can then use the compliant clients.

Kind-1 (TextNote)

2026-08-15T16:21:11Z

↳ Reply Event not found

c109104a09f1585ab91de8bc71b0d266e43b1d125bd1e3f7234a611deb9706ad

People voting with their wallets. I see.

Kind-1 (TextNote)

2026-08-15T14:42:52Z

↳ Reply Event not found

b540f26f10106ca3476a2a705834359998727d0623154e1664698a4dcdab204e

Sorry. Nothing changed. The app of course has the key regardless of how the backup of its key is stored. Casa needs no Google to get to it. :ganacci_d...

Sorry. Nothing changed. The app of course has the key regardless of how the backup of its key is stored. Casa needs no Google to get to it. :ganacci_dance:

Kind-1 (TextNote)

2026-08-15T12:15:36Z

↳ Reply 8272868a... (npub1sfegdzh49ta4y7p8ayeuxmeuuqq4p3pcxsvy0278nxc0nerphe8smz5hfv)

who on nostr is growing food? We want to know you :)

3 cherry tomatoes! 2 more soon!

Kind-1 (TextNote)

2026-08-15T10:22:46Z

↳ Reply Event not found

b4152ca3f4c242d47cdd2bf88b353d6f642b2689c025bdd2e1c1c684bfffcf85

It's a bit scary that you don't use external code, limiting the work to just a tiny team. Guess "not invented here syndrome" is a feature now.

Kind-1 (TextNote)

2026-08-15T09:06:09Z

↳ Reply Event not found

5ed337f3b357027058c553698e0d0e93e86a2e2438c9f7ce1811f2e01f43dfd8

Was the new canary installed by the old or the new team? At this point I would only trust "old team" if it was signed by one of their known keys. Else...

Was the new canary installed by the old or the new team? At this point I would only trust "old team" if it was signed by one of their known keys. Else ... what's the accountability of an anonymous team?

Kind-1 (TextNote)

2026-08-13T10:40:43Z

↳ Reply Event not found

75372d89511f94a7868fece49a87b741f70d9fd9a412eb9f4373c1e399796261

To be clear, I'm reporting a missing feature. I did not get involved to fix it yet.

Kind-1 (TextNote)

2026-08-13T08:52:34Z

↳ Reply Event not found

43e91bf3ec70abd67e64acff9218d86aa0e1a59c95ec1c428dc465c79a2ec85a

Bummer. He's not on nostr. Not sure if he automated this account or somebody else.

Kind-1 (TextNote)

2026-08-12T14:40:20Z

↳ Reply Event not found

fabc848b73cefd37eec25578af329cdc7bdc817c77e38af5c5c985cbdab13c01

The mapping hash prevents others picking an algorithm on purpose but not Luke picking one.

Kind-1 (TextNote)

2026-08-11T19:29:37Z

Has nostr:npub1lh273a4wpkup00stw8dzqjvvrqrfdrv2v3v4t8pynuezlfe5vjnsnaa9nk completely lost the plot? Pardon my reading comprehension but to my understa...

Has nostr:npub1lh273a4wpkup00stw8dzqjvvrqrfdrv2v3v4t8pynuezlfe5vjnsnaa9nk completely lost the plot? Pardon my reading comprehension but to my understanding he decided to use a laughable oracle withing less than 6h to pick the next mining algorithm of what he believes to be Bitcoin? Why laughable? **He** picked a mapping from last digits of the block hash to PoW algorithm. He picked **Testnet4** of all chains - a chain with difficulty **1**. He did not show the mapping to anybody, so only **he** knows the mapping. A modern mining rig can produce many candidate Testnet4 blocks per second, so he can comfortably pick or if somebody else does the same, orphan them or if several engage in this mess ... why not just use the bitcoin chain??? Or at least Doge Coin??? "Nobody knows the new algorithm right now, and nobody will until we all know at the same moment" is just untrue for him. nostr:nevent1qvzqqqqqqypzplw4arm2urdcz7lqkuw6ypyccxqxj6xc5eze2kwzf8ej97nnge98qythwumn8ghj7un9d3shjtnswf5k6ctv9ehx2ap0qy2hwumn8ghj7un9d3shjtnyv9kh2uewd9hj7qpq87zecrjmqjcwewl6y6vjpxaeqc50w99ty7rrxktrxcq6c4lev53s0m8hq9

Kind-1 (TextNote)

2026-08-11T14:12:07Z

↳ Reply Event not found

5b40be2dcae9972c22512d78be76f840e05fe25d9e2f3ce36856008e76fdd575

It's as secure as Testnet4's difficulty. He could have picked Dogecoin's chain to make it more secure.

Kind-1 (TextNote)

2026-08-11T13:46:57Z

↳ Reply Event not found

3508051a875c0121721eea7df2db59501aa1737ddc1a0b4f7689d9722f8a0c79

Nostr events are signed by an author and can easily be replicated to multiple relays. A git repo can also be replicated but a client wouldn't subscri...

Nostr events are signed by an author and can easily be replicated to multiple relays. A git repo can also be replicated but a client wouldn't subscribe to several, so you would have centralization there. Accountability is not integral to git neither. Google Full Disclosure vs. Responsible Disclosure and you can see how disclosing issues or the mere possibility of issues is a hot topic and often draws censorship.

Kind-1 (TextNote)

2026-08-10T16:55:23Z

↳ Reply Event not found

4131d9133e47800bc8613e60cc2b943ec187ac148ecd717d951814a81ad10c7e

For nostr:npub1j9kttlc86w63emmldd4h74rekyqpksqup6p9trhp5gjsf374qlyszvuswx I'm thinking about this a lot, together with Project Loupe, too. The problem...

For nostr:npub1j9kttlc86w63emmldd4h74rekyqpksqup6p9trhp5gjsf374qlyszvuswx I'm thinking about this a lot, together with Project Loupe, too. The problem I see is "responsible disclosure". You will always find something and even the stuff you might want to responsibly disclose at first sight might not be an issue after all, so what will you signal and when and to whom? I'd happily show what people signal on WalletScrutiny. Make clear attestations. Known pubkey attests that commit X of project Y was checked with prompt Z on model A with these results ... Highest criticality found: B Let's agree on a nostr event format. We might not engage in producing those events as "WalletScrutiny" but with clear attribution to nostr accounts I see no problem showing them.

Kind-1 (TextNote)

2026-08-10T10:17:52Z

↳ Reply Event not found

cd82504153e2462d72fe32938a67e5f3da27d61e21b0f2a7bea7c8c8cd055014

Ocean allows miners to pick what they want to mine

Kind-1 (TextNote)

2026-08-08T20:35:09Z

↳ Reply Event not found

e3cca6ca0cf74f2a0a75729e05f2c4c718ff9cf5c518d20c325d27b15bb66283

CoinKite victims lost funds long in the past and Rodolfo blamed promiscuity even where the user did everything right.

Kind-1 (TextNote)

2026-08-08T09:04:52Z

↳ Reply Event not found

91695cbb683f06ee69c551456afde5c89040291982277d538639c5bc479126c8

At this point I would still shut it down when not coinjoining and check for new releases the minute I'd need to start it. Crazy times.

Kind-1 (TextNote)

2026-08-08T09:02:15Z

↳ Reply semisol (npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj)

Rule 1 of security research: until it is fixed and properly disclosed, you NEVER: - share the detail...

... unless the provider ignores it for months.

Kind-1 (TextNote)

2026-08-08T08:33:14Z

↳ Reply Event not found

b522bf07730be1ef763fdcaab196d9873c112140b468b441e78e96f0462679cd

Call them. Now.

Kind-1 (TextNote)

2026-08-07T20:40:27Z

↳ Reply greenart7c3 (npub1w4uswmv6lu9yel005l3qgheysmr7tk9uvwluddznju3nuxalevvs2d0jr5)

Maybe i'm doing something wrong but using kimi or glm seems a lot more expensive than claude or code...

The subscriptions give you many more tokens than the API. If you switch to API, you pay more for Claude than for Kimi.

Kind-1 (TextNote)

2026-08-07T09:40:46Z

This is all a big game of Mafia

Kind-1 (TextNote)

2026-08-06T16:02:15Z

↳ Reply Event not found

8db1784747745c01aa1dc1f4ece69c9937923f6cfa007155f95ad42d725417a4

ColdCard was reproducible. We need eyes on the code, not only on transparency.

Kind-1 (TextNote)

2026-08-06T13:53:03Z

↳ Reply Event not found

446eb9c2b1f1464ad68bc51fa394127db2927cec4de9730597dd259da39a56d5

Add Samourai to the list.

Kind-1 (TextNote)

2026-08-06T09:59:56Z

If somebody stepped forward and offered you to return 50% of your hacked coldcard funds if you dropped charges, would you take it?

Kind-1 (TextNote)

2026-08-06T06:28:58Z

↳ Reply Event not found

0cd22edd34812ac5cd103895d387b0e40dc9a09341f3237b6130a0c4b3937248

Self custody Anti exfil Strong randomness from multiple sources Support dice roll Independent and ongoing reviews of new releases

Kind-1 (TextNote)

2026-08-06T06:08:44Z

↳ Reply Event not found

9157605c3024d03aed06578d32bdc2df26b0719dc6633e96023440a13568c409

It's two clicks from the main page. -> transparency -> canary

Kind-1 (TextNote)

2026-08-05T23:00:22Z

↳ Reply Event not found

148a56f8508469ce253700448062a196a19a2b3c49bb533e8d8af773b6550c59

Understanding wallets is my job and I still don't recommend any wallet ever publicly. In private I have to pick for friends and family but I hate it....

Understanding wallets is my job and I still don't recommend any wallet ever publicly. In private I have to pick for friends and family but I hate it. It's much easier to recommend not to use product X for [reasons].

Kind-1 (TextNote)

2026-08-05T16:31:36Z

↳ Reply Event not found

d8583c9af9c9d0fd79fbee92434c9b459113d48ec01b4035bd2009ca6eaab2bb

How is doc-hex doing?

Kind-1 (TextNote)

2026-08-05T15:00:14Z

↳ Reply Event not found

9c18e59611729f1867c6f4d73ccfe74dbdef55b337fc23872d8085c348d8b09f

How about engineers? I would argue it's less prevalent there.

Kind-1 (TextNote)

2026-08-05T09:56:19Z

↳ Reply Event not found

5ddd7cfdff6592a54c62d54a18ba878b64e894d5069b2dafaefcbfe6df7b745e

I perceived them as low in empathy, resistant to criticism and Machiavellian. This personal perception matches somebody who would do such a hack. Swit...

I perceived them as low in empathy, resistant to criticism and Machiavellian. This personal perception matches somebody who would do such a hack. Switck 😉😉 libngu 😉😉 It's all a bit too much on the nose.

Kind-1 (TextNote)

2026-08-05T07:54:29Z

↳ Reply Event not found

069fbcf2d5ad63e1745d77628d03a055b3418159b707ebcae80669820f84d8e2

Not everyone has a price. There are personality traits that would rather die than do unjust to another soul and there's many that might steal if they ...

Not everyone has a price. There are personality traits that would rather die than do unjust to another soul and there's many that might steal if they felt poor but wouldn't under any circumstance as long as not under duress. I'm confident most open source wallet devs are in that category. Nvk and doc-hex not so much.

Kind-1 (TextNote)

2026-08-05T07:45:57Z

↳ Reply semisol (npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj)

I have seen someone propose they did this because of https://arxiv.org/abs/2607.06194 (though that ...

Why would they have learned about this weird "paper"?

Kind-1 (TextNote)

2026-08-05T07:33:21Z

↳ Reply Event not found

acfbb00a2ebd7b153913cc964daff5fe7227ec0b0a7b2c284dfdbe9d7ccd8295

I always picture the retirement attacker as having a red button and a screen on his desk, showing him the balance to extract. If that goes down or peo...

I always picture the retirement attacker as having a red button and a screen on his desk, showing him the balance to extract. If that goes down or people get suspicious, he can smash that button.

Kind-1 (TextNote)

2026-08-05T07:32:32Z

What doesn't aquare with this theory is the relatively slow draining. In 5 years they would have a list of utxos and a script to empty all at once. M...

What doesn't aquare with this theory is the relatively slow draining. In 5 years they would have a list of utxos and a script to empty all at once. Maybe they built the backdoor and decided to not use it because tracks were not covered? nostr:nevent1qqs8m8ph54sdx66k3387vkdjz4wlfer9nd6whq74ca48k5q68ljt56gppemhxue69uhkummn9ekx7mp0qgs8a474cw4lqmapcq8hr7res4nknar2ey34fsffk0k42cjsdyn7yqqrqsqqqqqp2y78ag

Kind-1 (TextNote)

2026-08-05T06:12:24Z

↳ Reply Event not found

80767f0c2db22ad000171af53ea15d63fd6c779842643e9d43688318bbc9b88b

Sorry for my lack of sympathy. All I received from nvk over many years was hostility. That doesn't mean I wish him or dockhex bodily harm. I only wish...

Sorry for my lack of sympathy. All I received from nvk over many years was hostility. That doesn't mean I wish him or dockhex bodily harm. I only wish they get put in their place, meaning, not that high castle they were sitting in all that time.

Kind-1 (TextNote)

2026-08-05T06:01:09Z

↳ Reply Event not found

43eda37140cbc3c8a6238275a1d502e6f876251ba50afa5447716c236a4a8b93

Well, there's whoever introduced the vulnerability and those that exploit it now. The fbi will search both. What meme do you refer to? Was nostr:npro...

Well, there's whoever introduced the vulnerability and those that exploit it now. The fbi will search both. What meme do you refer to? Was nostr:nprofile1qqsxft85q406sf4u4wz90cjwlra6wjg2hv08dkatd25822jn5r456jspzdmhxue69uhk7enxvd5xz6tw9ec82c30qydhwumn8ghj7un9d3shjtnddaehgun09ehx2arhdaexktcpr9mhxue69uhhyetvv9ujuumwdae8gtnnda3kjctv9u862c2h just shitposting? If dochex is swick, isn't that a hot lead?

Kind-1 (TextNote)

2026-08-04T20:23:55Z

↳ Reply Event not found

ff2fb70f3c398dd1bea5253a28d3a96e893527ebcedda223c769ff7e2a7876c7

Most hardware wallets mix entropy from multiple sources. CoinKite was always very arrogant about their true random number generator so why add inferio...

Most hardware wallets mix entropy from multiple sources. CoinKite was always very arrogant about their true random number generator so why add inferior entropy when you have "real" entropy? A reviewer checking the use of their TRNG can easily miss it not being used.

Kind-1 (TextNote)

2026-08-04T17:03:53Z

↳ Reply 675b84fe... (npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7)

We all (who have tech skills) are at least a little bit at fault. We never developed some kind of n...

hash(0) looks random. Maybe hashing is evil? The entropy has to be inspected pre-hashing? Also if dice roll is the new standard which I hope we won't...

hash(0) looks random. Maybe hashing is evil? The entropy has to be inspected pre-hashing? Also if dice roll is the new standard which I hope we won't go for, it has to be standardized so that wallet X generates the same wallet as Y from the same dice roll or else we have no way of checking the working of wallet Y.

Kind-1 (TextNote)

2026-08-02T05:51:16Z

↳ Reply Jay (npub10mtatsat7ph6rsq0w8u8npt8d86x4jfr2nqjnvld2439q6f8ugqq0x27hf)

I've been very grateful to be in a completely normal gamer discord for an mmo where no one knows the...

There were more Bitcoins mined on "day one" of Bitcoin. (Not really because day one did not have 144 blocks due to lack of miners but in the grand sc...

There were more Bitcoins mined on "day one" of Bitcoin. (Not really because day one did not have 144 blocks due to lack of miners but in the grand scheme of things, so far we are handling this well. Losses are contained. Hopes are high to find the first of the sure to come many hackers.)

Kind-1 (TextNote)

2026-08-02T05:46:55Z

↳ Reply Jay (npub10mtatsat7ph6rsq0w8u8npt8d86x4jfr2nqjnvld2439q6f8ugqq0x27hf)

Ship it! https://i.nostr.build/uPsskmFk98sAVJa1.jpg

I like the meme but fear it's giving a false sense of security to the Mk5 owners. They will be next and claims are surfacing of this already happening...

I like the meme but fear it's giving a false sense of security to the Mk5 owners. They will be next and claims are surfacing of this already happening.

Kind-1 (TextNote)

2026-08-02T05:42:07Z

↳ Reply semisol (npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj)

Yeah just first 32 bits. And how do you verify the uid? There exists many plausible uids

Forget the uid. If it's less bits than the timer, the latter scrambles all its bits.

Kind-1 (TextNote)

2026-07-31T20:44:29Z

↳ Reply semisol (npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj)

The UID is the position of the chip on a wafer, which means at most 2k unique uids. No good way to v...

Not unique uid? Damn! Still, claimants could show receipts to transactions in their wallets.

Kind-1 (TextNote)

2026-07-31T20:35:29Z

↳ Reply Leo Wandersleb (npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6)

The uid is a start although it gets XOR-ed with a timer that scrambles most but not all bits of the ...

If I knew how to pull this off, I wouldn't without legal advice or confidence to be able to remain anonymous. Of course it's a legal mine field but it...

If I knew how to pull this off, I wouldn't without legal advice or confidence to be able to remain anonymous. Of course it's a legal mine field but it happened before.

Kind-1 (TextNote)

2026-07-31T20:33:22Z

↳ Reply Event not found

3fa79af62bee359ea25f74169cd5ff513bc3b19a1892d4d74957bddd4c654123

The uid is a start although it gets XOR-ed with a timer that scrambles most but not all bits of the uid. I bet you would end up with at max one plausi...

The uid is a start although it gets XOR-ed with a timer that scrambles most but not all bits of the uid. I bet you would end up with at max one plausible claimant per wallet.

Kind-1 (TextNote)

2026-07-31T20:30:03Z

↳ Reply Event not found

bd3c31b105b53644ff4e454f2ce599f82af2d75f1707a17bb39b33378d192f18

Hack the exposed wallets to give the bitcoins back to those poor victims of CoinKite's negligence.

Kind-1 (TextNote)

2026-07-31T13:16:15Z

↳ Reply Event not found

ab977aa67031761b6c1a4aa981976a6ad95028404fe6f3ad8ddc0efd4d9ac5dd

Are any white hats stepping up already?

Kind-1 (TextNote)

2026-07-31T11:32:11Z

↳ Reply Event not found

804a957733433c3ba7e642d8b56ed1010725420641d6ae8b4a4586629aac5e49

And when will you drop that sponsor? Sadly the situation is highly time critical.

Kind-1 (TextNote)

2026-07-31T09:05:16Z

↳ Reply Desert Dave (npub1mgvmt553uphdpxa9gk79xejq3hyzh2xfa8uh6vh236nq78mvh74q8tr9yd)

Tell me why it's wrong? Who decides what is right and what is wrong?

nostr:nevent1qqsyuxnyw9865fteewl9yzs50na6edz69lt46f84fchz9jypht4x8sgppemhxue69uhkummn9ekx7mp0qgsr9cvzwc652r4m83d86ykplrnm9dg5gwdvzzn8ameanlvut35wy3grq...

nostr:nevent1qqsyuxnyw9865fteewl9yzs50na6edz69lt46f84fchz9jypht4x8sgppemhxue69uhkummn9ekx7mp0qgsr9cvzwc652r4m83d86ykplrnm9dg5gwdvzzn8ameanlvut35wy3grqsqqqqqprc5fja

Kind-1 (TextNote)

2026-07-29T20:22:57Z

↳ Reply Desert Dave (npub1mgvmt553uphdpxa9gk79xejq3hyzh2xfa8uh6vh236nq78mvh74q8tr9yd)

Also, he might be right. Never know. Saylor is obviously a greedy fiat pusher who provides no real s...

Pushing for bip110 to fight spam is wrong. I don't think Matthew has a hidden agenda.

Kind-1 (TextNote)

2026-07-29T20:14:42Z

↳ Reply Event not found

9aa91ae5d6a26e81205756b5db114704a85ca26b5f871a644a4e6b267ac6ed5d

Is the opposite opinion allowed in India?

Kind-1 (TextNote)

2026-07-28T07:29:18Z

↳ Reply Event not found

c2be8ba6f26f094bc4a4a357346204717da90d40fff2c88d242f19806cbb0528

Satoshi's solution to blockchain spam was to charge a fee. Monetary use will price out spam. That's consensus. Policy was always concerned with spam,...

Satoshi's solution to blockchain spam was to charge a fee. Monetary use will price out spam. That's consensus. Policy was always concerned with spam, too, but with network spam, not with blockchain spam. Protect your node from bandwidth saturation. Policy was used to control blockchain spam but a spam filter installed on only 90% of the routes to the miner cannot work. Libre Relay broke this hacky use of policy. Even though it's highly unlikely bip110 will activate in 2 months or so, the worst spammers already switched to comply with its rules weeks or months ago. Op_return is the single best place to put non financial data as you can prune it. To give spammers an incentive to dress up their spam as payments is foolish. To selectively cripple financial scripts to further fight the spammers hurts legit innovation while not making a dent in spam volume.

Kind-1 (TextNote)

2026-07-27T07:21:55Z

↳ Reply Event not found

e1e5ff63b64e0367161f22dc6792c83d5e1f53e11852c4a444b039a6379d436a

**Chain split guidance, restated without the team colours.** Call them the enforcing chain and the unrestricted chain. **There is no split to transa...

**Chain split guidance, restated without the team colours.** Call them the enforcing chain and the unrestricted chain. **There is no split to transact on for a long time.** Mandatory signalling constrains block headers, not transactions. The reduced data rules bind at height 965,664, which a minority branch reaches slowly. At 20% hash that is about 20 weeks after the window opens, at current signalling over a year. Until then every transaction, giant OP_RETURNs included, is valid on both branches. Splitting coins via OP_RETURN is impossible before the enforcing branch itself reaches activation height. **Replay protection must be built.** Branch-exclusive coins come from two sources. Passive: post-split coinbases, spendable after 100 blocks, within a day at 97% hash, three weeks at 3%. Active: RBF from the first divergent block. Get confirmed on one branch, then bump. The original's outputs are now exclusive to one branch, the replacement's to the other, and every descendant inherits the split. No maturity wait, though at 3% hash the slow branch's next block averages five hours out, and the bump must not reach the fast branch before the original confirms there. Until you hold and spend such a coin, your payment confirms wherever it gets mined, or on both branches. **"RBF or CPFP" is half wrong.** A CPFP child spends a parent that exists on both branches, so it replays and pays both miner sets. It signals nothing. An RBF replacement of a transaction already confirmed on the other branch conflicts with a confirmed transaction there and can only ever pay the branch where the original is still pending. RBF is the only tool that creates branch-exclusive fee demand, and it works in both directions. **Fees follow prices, not the other way.** All miner revenue lands in a branch-exclusive coinbase worth whatever the market thinks that branch's survival is worth. With shared difficulty, revenue per hash is price times block reward. Grant equal prices and the mechanism in the original actually works, and needs no RBF: everything replays, so the minority branch's mempool holds the majority chain's entire confirmed history as backlog, its blocks skim the top by feerate, and its fee per block is higher until hashrate reaches parity. But equal prices with 1 to 3% signalling two weeks before the window is not an assumption, it is the conclusion smuggled in as one. Fees run at low single digits of the 3.125 BTC subsidy. At a 20% price ratio an enforcing block needs over 12 BTC in sustained fees just to break even. The mechanism is real and two orders of magnitude too small. **Parity is the starting line, not the finish.** Non-enforcing nodes reorg onto the enforcing branch only if it takes the cumulative work lead. Every day at 20% hash digs 0.6 network-days of deficit. A week at 20% costs three weeks at 60% to repay. And a branch whose block production runs through one or two pools is one DoS away from stalling, while futures markets set the decisive price ratio before the window even opens, and against a 3% branch, rented hash is cheap griefing. The reverse risk is simpler: miners abandon the enforcing branch and its coinbases go to zero, no coordination required. **What survives from the original.** Decide which branch you are on, run a node that enforces your choice, and do not treat a confirmation on one branch as a confirmation on the other.

Kind-1 (TextNote)

2026-07-26T11:02:31Z