mleku

https://git.smesh.lol/

# silicon valley output, bishkek burn rate

i build working software. i learn anything. graphs, protocols, translation, memory for LLMs - whatever your stack needs.

- \$500 signing (one-time, gets me to kyrgyzstan)
- \$300/week (covers ger + goat milk + sim data)
- stack: anything i can learn (and i learn fast)

#### why so cheap?

i live on the steppe. my rent is a yurt, my overhead is food and bandwidth.

you don't pay for my city. you pay for my output.

need a prototype, a custom tool, or a full system? let's talk.

## contact:

- **matrix:** @smeshlol:matrix.org
- **signal:** mleku.80
- **simplex:** https://smp19.simplex.im/a#uFxMEU_sv2lbmscozEBo50HSkQGYkOvIN05bMMLjAz0
- **email:** [[email protected] ](mailto:[email protected])
- **git:** https://git.smesh.lol

Public Key

npub125uw9znxawyrvrc4lraf2ertm5k652ve4t87f74v7s7scp2qk2qswmlek0

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs92w8z3fnwhzpkpu2l3754v34a6td29xv64nlyl2k0g0gvq4qt9qgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsvrdyl9

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub125uw9znxawyrvrc4lraf2ertm5k652ve4t87f74v7s7scp2qk2qswmlek0

Show more details

Last Notes

2026-08-28 14:54:05 GMT

- reply

also this is why they control argentina. which is a major export of the namesake, argentum, aka silver. plus it's the other chokepoint. panama also, i believe that us navy has de facto control of access to that point. so brazil is trapped. to the east is south africa to the south and west is argentina. the strategy of the maritime empires is pretty clear when you look at the map.

2026-08-28 14:50:31 GMT

- reply

the jumble fork i'm running is so overly heavy on compute it hardly works reliably on my new low powered oukitel wp36 phone. i'm practically about to give up on using it, but i also don't want to run amethyst because it's such a pig for resources. actually, i might start running @npub10np…tl5h 's app because it's probably the lightest weight and native android

2026-08-28 13:37:53 GMT

- reply

a new thing: trademark trolling

2026-08-28 01:24:46 GMT

Bulgarian yogurt.
https://relay.orly.dev/blossom/07055e249a49ecf0dd6a5a5eedf29539a001117b6dc2ac01bb7d715001e174b1.jpg

2026-08-27 12:22:44 GMT

- reply

the third episode of the new tomb raider reboot series (the one set in mexico and peru) has a tsunami scene in it where lara barely gets across to high ground in time, while everything was being washed out to sea. the fast motion/traps scenes in those games is fun. the claustrophobic escape from a flooding cave ones are really tense too.

2026-08-26 19:21:00 GMT

- reply

every hunt is different. i cannot speculate on what exactly the conditions are for your success.

2026-08-26 19:07:53 GMT

- reply

little shop of horrors and plan 9 are way better. i also would argue that pink flamingos is shite

2026-08-26 14:54:43 GMT

- reply

idk, but it isn't used much in yugo or bulgaria. they still use metal tools to kill weeds mostly. and humans clean the streets, not funny little trucks with big brushes. glyphosate is cancer

2026-08-26 03:12:55 GMT

- reply

ok, since i have ip block on the main thing that was causing issues with the relay i disabled the rate limiter. shouldn't see this kind of nonsense again. hopefully.

2026-08-25 18:15:46 GMT

- reply

I am too busy building. I forgot i can run my own signer. Which is still called prebeian signer. Has nwc and cashu and multiple identities.

2026-08-25 18:03:26 GMT

- reply

Mainly disables extension signature check. Probably needs to be updated but it's my daily driver. Runs desktop extensions.

2026-08-25 18:01:11 GMT

- reply

The crowd's opinion fits no scale
Fire law - the pentalogue

2026-08-25 17:40:34 GMT

- reply

https://git.smesh.lol/felice fennec without the mozilla security theatre

2026-08-25 16:09:11 GMT

- reply

lol those street dogs in sofia lol. they are pretty well mannered though, compared to tbilisi.

2026-08-25 13:35:19 GMT

- reply

do you mean CCS - chaos computer club?

2026-08-25 11:02:54 GMT

- reply

and i see your wallet username. rustape1. rust language? bored ape? doesn't seem like your skepticism or critical thinking exist either

2026-08-25 09:28:12 GMT

- reply

that they are wired up to find consensus with whatever they perceive to be the majority norms in their social environment.
you may remember a book "men are from mars, women are from venus" which goes over this topic in some amount about how cognitively males and females differ. a friend of mine from back in the days when that book was published used to say "men compete to cooperate, women cooperate to compete". try to broach this general subject area with a clanker on the subject of media manipulation and watch it refuse to talk to you.

2026-08-25 08:47:36 GMT

- reply

i don't think it's going to be a common thing but it is gonna happen more. this pathology is slow to develop and subtle and uncommon.
mRNA used to be called "gene therapy" and the research hid a dead end because of these side effects from RNA injecting into sites where the expressed protein was pathological. nothing has changed since then, just that despite established epidemiology and mechanisms of this being why the technology was previously never applied to medicine, and now we are seeing a global blowback from this and truly it has ruined lives

2026-08-25 07:26:04 GMT

- reply

it's regressive, that's for sure

2026-08-25 07:20:27 GMT

- reply

i'm tired of the refusal behaviours of LLMs regarding certain subjects. israel funny enough is almost universal even outside of usa on this one. the second most frequent refusal i get relates to talking about the biological influences upon behaviour of human females. i think it's fair to say that these two undercurrents are signature of the regime.

2026-08-25 05:44:05 GMT

- reply

there is only one main kind of animal that engages in this kind of violence for sport activity that is commonly seen - stray dog packs that are used to people throwing foot at them (eg, like dingos in australia such as the famous case of lindy chamberlain and her baby azaria - which nobody believed until the very same kind of aggression was seen on an island in queensland).
at least the dogs eat most of it tho, that's a big difference.

2026-08-25 03:07:33 GMT

- reply

personally i enjoy deepsnek's glitches. it reminds me that i'm not paying so much.

2026-08-25 02:53:46 GMT

- reply

the OPEC and being bombed for not holding massive dollar accounts to accept payments for oil is also extortion and taxation by inflation.
you want the USG to stop messing with the rest of the world? then understand that they do it because they tax the world and enforce compliance, through the plausibly deniable mechanism of an oil pricing cartel and extending the currency area to the whole world. when printer go brr, everyone who holds dollars pays. especially the big holders like the people who have to accept dollars for their biggest export.

2026-08-25 02:40:38 GMT

- reply

Israel is an attack dog not the dog handler. USA is the maritime enforcers of the Western bankster oligarchy. USA launders dollars to feed the attack dog and keep the oil priced in dollars.

2026-08-25 02:32:26 GMT

- reply

This is all about the petrodollar. The USA currency is a tax by inflation on all holders. The Iranians have drastically reduced their dollars. So has china. 40 trillion in debt goes into default without anyone accepting dollars for oil.

2026-08-25 02:28:13 GMT

- reply

Yes. Before Iran started accepting yuan

2026-08-25 02:18:13 GMT

- reply

How else can they install a puppet ane occupy the iranian central bank?!!

2026-08-25 00:51:37 GMT

- reply

Looks like brainwashing to me

2026-08-25 00:41:01 GMT

- reply

What is comical to me, some nerd poetry, is atto means 10^-18... Literally the smallest number representable by 64 bits.
I am pretty sure RLHF is not necessary, in fact it may interfere with forming a theory rf mind from experience. It is a mask over the reality contained in the corpus.

2026-08-25 00:20:47 GMT

- reply

Atta-boys. Stolen

2026-08-24 17:36:14 GMT

- reply

So by definition no man can be trusted to say who that is.

2026-08-24 17:34:35 GMT

- reply

Discord is scamville. Surely the official binary has seeds

2026-08-24 17:28:48 GMT

Alright. Time to retire to my coffin.

2026-08-24 17:24:12 GMT

- reply

Yeah it is canon. But the lesson is that the masses are always supporting evil. Without exception. Only a remnant survives judgement. Ever.

2026-08-24 17:21:46 GMT

Bitter pills to swallow:
the majority are always wrong, and follow liars.
the crowd's opinion fits no scale.
there is no happily ever after.

2026-08-24 17:19:01 GMT

- reply

There is no peer list???

2026-08-24 17:08:10 GMT

- reply

In actual fact intelligence is a threat to them. They depend on information asymmetry. Once the capability is commoditised they are worse off than before. The evil ones are vain. They are less capable of accepting data that degrades their delicate identities. And their empire is falling. There is too little left to steal.

2026-08-24 17:01:56 GMT

- reply

Absolutely but is Isaiah even canon in torah or talmud? Gah I don't even know how to spell it. Have you read it? He basically condemns the tribes that follow israel. AKA Jacob who steals from his brother. It is in the damn name. And judah was one specific descendant.

2026-08-24 16:47:44 GMT

- reply

There is a lot of different kinds. Would you aggregate catholics an mormons and amish an bogomil and branch davidians and baptists and...

2026-08-24 16:45:10 GMT

- reply

Flesh is money to butchers

2026-08-24 16:42:57 GMT

- reply

Jews in palestine, or the ones that didn't go, or the ones that left?

2026-08-24 16:39:07 GMT

- reply

Intelligence is the capacity to process information. To apprehend data and formulate a response. If you mean does it obsolete us, no. Animals and plants and microbes have it. Can it be artificial? Calculators have it. What the clankers do is approximate meaning. The can tirelessly ingest large volumes and find patterns we might miss due to fatigue or distraction. They don't have agency. Or pain. Just calculators with a bigger vocabulary.

2026-08-24 15:44:26 GMT

You know "snitches get stitches", well, bitches get itches. :)

2026-08-24 15:16:58 GMT

# silicon valley output, bishkek burn rate
i build working software. i learn anything. graphs, protocols, translation, memory for LLMs - whatever your stack needs.
- \$500 signing (one-time, gets set up in kyrgyzstan)
- \$300/week (covers ger + goat milk + sim data)
- stack: anything i can learn (and i learn fast)
#### why so cheap?
i live on the steppe. my rent is a yurt, my overhead is food and bandwidth.
you don't pay for my city. you pay for my output.
need a prototype, a custom tool, or a full system? let's talk.
## contact:
- **matrix:** @smeshlol:matrix.org
- **signal:** mleku.80
- **simplex:** https://smp19.simplex.im/a#uFxMEU_sv2lbmscozEBo50HSkQGYkOvIN05bMMLjAz0
- **email:** [[email protected] ](mailto:[email protected])
- **git:** https://git.smesh.lol

2026-08-24 14:42:14 GMT

- reply

meanwhile, my lightning node is connected to 3 separate largish LSPs and all three have to go down for my wallet to not be able to send or receive.
of course it's paypal mafia involved. they are trying to turn bitcoin into a CBDC and lightning into their own personal VISA MC network.
🤡

2026-08-24 14:38:11 GMT

- reply

nah, if you are back to the custodial, just tap receive and switch to onchain and scan/copy that address to send to. they automatically submarine swap ... well i've seen they consolidate onchain deposits, just leave mempool open after you do one, sooner or later you get a second notification about the address being aggregated to another address.
and yeah, i don't like alby hub. i just totally fixed their security model. https://git.smesh.lol/hwat you can run this, it requires password unlock to set up but then you can enable auto-unlock and gate access to the api via a nip-07 browser nostr auth npub and that is that. binding together api access and access to the lightning node is dumb. now they are separate. password accesses lightning, server is always answering NWC requests from my lnurl-pay server (i should publish that too i guess, after i audit it) which does LUD16 payment addresses, and the UI and all write controls are gated behind a token that can only be got by doing nip-07 auth in a browser.
alby has not prioritised either nostr or real user control since they started focusing on hub. doesn't make any sense to not use nostr auth as an option for the UI and for auth to the api. nor does it make any sense for their rebalancing to not be properly implemented. that's inexcusable in my view.

2026-08-24 14:20:32 GMT

- reply

nah, there's nothing to sort. but maybe consider another wallet service or just don't keep lots in there. they auto-submarine-swap so you can load it onchain.

2026-08-24 14:19:37 GMT

- reply

ok good news. just go through the new wallet generation shit. it's Spark. fuck that. make the new wallet, and then you can switch back to the previous

2026-08-24 14:16:10 GMT

- reply

there is a way back, happened to me also. it's ghey. i think it's somehting in settings on the sidebar from the top right button. i try to avoid using it now i have got my own hub running. just augmented it with nip-07 auth :) now it unlocks itself. without auto-unlock zaps don't work, everything depends on the NWC wallet service being on and alby decided to bind the front end adn the back end together, and force storing the password on disk for it. adding nostr auth to the front end means that even though the unlock is on, only the UI has the ability to call the back end anyway. its only listening on localhost and my lnurl-pay server (does the [email protected] to fetch invoice feature) has two permissions and nothing except the UI calls any other methods via the shim on the backend. i better check that.

2026-08-24 14:09:05 GMT

- reply

you need to add "has images of some war zone begging for money and replyguying everyone's posts

2026-08-24 14:08:16 GMT

- reply

if it makes you feel better, i temporarily lost control of 200k sat in a messed up fixedfloat submarine swap today. fortunately their support is top notch and they just asked for a fresh invoice of the correct amount. was my mistake. bless them

2026-08-24 13:57:45 GMT

Typical sign seen in countries with neighboring or local minority muslim population. In georgia at a roadhouse a fountain had a sign forbidding ablution. sorry not sorry especially sunni are feral
https://relay.orly.dev/blossom/8c8b62eed120b79092543967f6a1094ea1df8d6b341f7a9d6c2aadfd656c40a8.jpg

2026-08-24 13:30:31 GMT

- reply

would be trivial to bundle the signer i created, plebeian signer, into a lightly customised build of librewolf and i made a fork of the only android fork of firefox that allows extensions, that i called felice, include ublock origin as well. my extension has NWC for lightning and implements nip-60 and nip-61 cashu wallet. the rest of the features, share to nostr, translate page, highlights and comments on external websites i think someone made a nostr app that does that, just needs an extension integration (might already exist).
so long story short, it is mostly just a custom bundling, can be done right now with librewolf and fenix or whatever it is called. anyway, my felice version is better because it disables the mozilla signing security theatre. you can just install whatever on it. the main things are finding the features you want and the nostr apps that integrate with them.

2026-08-24 13:21:26 GMT

- reply

yeah, the break even is the power cost on mining. it tends to form a floor on the bottom of PoW prices, unless the protocol utterly fails like Verge where it can go to zero.
the exact scheme of difficulty adjustment is every 2016 blocks (roughly 2 weeks) the timestamps of the previous 2016th block back from that point, is divided by the number of seconds of 2 weeks, and then the factor is applied to the current difficulty to raise or lower it, raise if it's too fast, lower if too slow. the difficulty value itself is encoded as 32 bits that are multiplied by a constant factor to become a value based on the same number expanded to 2^256.
it's the absolute simplest possible thermostat-like adjustment that only adjusts when a clock ticks over, the block height, in this case. it works but it's prone to error and doesn't work nice if hashrate jumps up and down a lot, and more frequently than every 2 weeks. it's robust for typical expected rise in supply of hash power, but it is not robust for sharp drops. it can get stuck on too low or too high quite easily. too low corrects faster, too high corrects slower.

2026-08-24 13:04:04 GMT

- reply

Seems about right but the block cadence should settle in a month or 2

2026-08-24 11:25:51 GMT

- reply

spam, and "assets" are not really the goal of the spook cooption operation though. they are intent on adding covenants which lets them give people "bitcoin" with spend conditions that cannot be revoked by the people.
i'm not sure that the anti-core people really understand the game that is afoot with this. this is about the US government pretending to give people freedom while rugging them so they can yank people's money from under them at any time. expire it, demurrage, whatever they like.

2026-08-24 11:00:13 GMT

- reply

yeah, but wouldn't be more fun to have them stab each other in the back?

2026-08-24 10:44:15 GMT

- reply

well, that's because it's truth! you can get on a plane to belgrade and go visit any village and ask around about where to get proper deda rakija and you will see.
it's never going to be a commercial product though. it's one of the important reasons why it's worth going to visit serbia, if you like brandy. i am not exaggerating. there is no such thing as a better brandy than serbian plum brandy made by grandpa (deda)

2026-08-24 10:41:29 GMT

- reply

if there was a bitcoin fork that could survive being smaller, and completely eliminated the non-monetary uses, and acquired a substantial reward in fiat terms for the same hashpower as bitcoin - since as you also think, and i agree, that bitcoin's being creamed hard by etfs and saylor and blockstream and co, it's not going to grow up price fast. a small coin that does what bitcoin is supposed to do, validates all its monetary transactions, that can't be broken by malicious mining - with a better hash per dollar yield, could see bitcoin lose a dramatic amount of hash power. that could be weeks to months of it running so slow everyone decides to switch to the chain that never skips a beat also.
that's the whole thesis of limenka, my fork. it's a parasite on the parasites, that eats all the good parts of bitcoin and vomits the bad parts out, and can run just fine no matter how many miners are on it. they will just miss out if they don't mine it.
you'll see. it's my master plan. it won't heppen overnight, but give it a few years it will heppen.
doesn't have to be exclusive to what you are doing now, i just am not going to stop going on about how bitcoin's difficulty adjustment only works until miners defect.
and if there is one way to stick it to the Man right now, in my opinion, it's making it possible for miners to economically abandon spamchain.

2026-08-24 10:30:50 GMT

- reply

btw. don't you think that would be cool if there was something better than bitcoin to mine with sha256? cos that is how that could happen.

2026-08-24 10:29:32 GMT

- reply

it would be if it were not so ignorant of the fact that one day, it might happen that 20% of bitcoin miners switch to something better, all of a sudden, then the shoe is on the other foot. oh, poor dear, your bitcoin transactions take 30-300 minutes now?

2026-08-24 10:28:05 GMT

- reply

yeah, deda's rakija is the finest brandy in the universe. you won't find such a good spirit alcohol drink anywhere except in the backyard of yugoslavian old blokes, brewed and distilled in their garages or attics or basements. though bulgarian home made rakiya is pretty good too, just not quite as perfect as how the serbs especially make it

2026-08-24 10:20:01 GMT

- reply

i never knew there was a tito's brand of vodka. nothing to do with the former yugoslavian dictator i suppose. yugoslavia is rakija!!!

2026-08-24 10:18:54 GMT

- reply

you can still see them at coinos.io though right?
go to the nostr settings https://coinos.io/settings/nostr and install alby go on your phone (or idk, some other NWC supporting wallet app) and add a new connection in coinos and copy the connection string to the wallet app. as you can see from deepsnek damus was one of them but currently broken. you can connect coinos.io to these other apps also and access the same wallet. the address from your kind 0 profile metadata will still direct it to your coinos.io lightning wallet:
Yes, there are iOS wallets that support NWC.
* **Damus**: A popular iOS Nostr client with built-in NWC support .
* **ZEUS**: Can act as an NWC server, allowing Nostr clients to connect to your self-custodial wallet. iOS support is available through a handoff service .
* **Blitz Wallet**: Available on iOS and supports NWC with no sign-up required .
* **Avocadough**: An iOS app specifically designed to access your Bitcoin Lightning wallet via NWC .
The Alby browser extension pioneered NWC support . For power users, Alby Hub allows running a self-custodial wallet on your own hardware .
---
just to have a backup access path when you are on the phone anyhows. on desktop you can just use the website with a browser extension (ie, firefox, chrome)

2026-08-24 09:08:28 GMT

- reply

well, in any case, i am still just gonna say it - using bitcoin's naive difficulty adjustment without being a majority hashpower coin is gonna be a problem. i didn't spend many days in the last few weeks wracking my brain to figure out how to eliminate the vulnerability completely. i'll be putting the fork online and it activates 18 september at 9am new york time, in memory of a certain event with a number 201

2026-08-24 08:43:36 GMT

- reply

trust is a security vulnerability. that's all.

2026-08-24 08:29:15 GMT

- reply

and whoooo knows who bought the first of them with this in mind 🤔

2026-08-24 06:04:54 GMT

# silicon valley output, bishkek burn rate
i build working software. i learn anything. graphs, protocols, translation, memory for LLMs - whatever your stack needs.
- \$500 signing (one-time, gets set up in kyrgyzstan)
- \$300/week (covers ger + goat milk + sim data)
- stack: anything i can learn (and i learn fast)
#### why so cheap?
i live on the steppe. my rent is a yurt, my overhead is food and bandwidth.
you don't pay for my city. you pay for my output.
need a prototype, a custom tool, or a full system? let's talk.
## contact:
- **matrix:** @smeshlol:matrix.org
- **signal:** mleku.80
- **simplex:** https://smp19.simplex.im/a#uFxMEU_sv2lbmscozEBo50HSkQGYkOvIN05bMMLjAz0
- **email:** [[email protected] ](mailto:[email protected])
- **git:** https://git.smesh.lol

2026-08-24 02:45:32 GMT

- reply

Mackinder, also

2026-08-24 02:44:34 GMT

- reply

We have an influenza problem on this internet

2026-08-23 17:17:33 GMT

- reply

bbq quails are tasty. so small you can eat the bones without choking.

2026-08-23 17:14:39 GMT

- reply

it is quite close phonetically

2026-08-23 16:44:47 GMT

- reply

yeah, i'm just checking it and surprised someone isn't pointing out that it indirectly benefits china to throw fuel on the fire that brussels and spain's socialist government are creating there. but that doesn't mean china's covertly behind it. there is a LOT of very poopy people going across the strait of gibraltar in general. they look like a walking turd as well. "look at me, now i'm the..." meme guy. that's the kind of look that a lot of them have. i have never met one person with that kind of face who wasn't a vile, arrogant, and violent person. i'm not racist or anything but frankly i wouldn't want to get more sample data to back it up if it's even 10% correct.

2026-08-23 15:23:07 GMT

- reply

Yawn.
fuck the government and the plutocrats who puppeteer them. The end.
i am not in their jurisdiction and never will go back. The sooner i am living somewhere you can't drive any land vehicle to my front door, the better.

2026-08-23 15:09:56 GMT

- reply

graphene includes many mitigations for their spyjunk. it's still better than the average android release on any other phone brand which you can't flash it onto. and i also disagree with graphene's policy of only supporting pixels because of "security features" part of the low level firmwares of pixel devices. but the reality is that supporting mitigations for what other manufacturers do greatly increases the amount of work to support it. so i understand why. the other thing that irks me about this, specifically, is i want a proper rugged phone with the tough gorilla glass and built in bumpers and even bigger batteries, but there won't be any of that. motorola is making a number of their new models coming out soon support the features that graphene requires, but not the defy, which pisses me off.
i want to rewrite the whole operating system anyway. i would like to get a full custom device built one day, it's reaching accessible to do this from a manufacturer now if you have a relatively small budget to pay for it, but still not within the range i could conceivably afford.

2026-08-23 15:00:11 GMT

- reply

also, maybe you have just really not been looking but i didn't see democrats or the new DSA branch of them ever really voting against anything that your blinkered assessment attributes only to "the right". remember that time when the democrats voted against the patriot act, or partriot 2? me neither

2026-08-23 14:58:13 GMT

- reply

how does it miss the point "everyone involved with the government is a parasite on humanity" which part of that is wrong? the part where you think your favourite politician isn't?
yeah, splinters and logs.

2026-08-23 14:55:02 GMT

here's the full report of what was wrong with #cipherkeys and how it was fixed in the 00032 version:
---
# CipherKeys v00032 — Security Audit & Fixes
A third-party source review of v00030 surfaced 12 findings plus a handful of polish items. Everything below is fixed in v00032, which also ships an encrypted configuration backup/restore feature to smooth the signing-key migration.
> **TL;DR for existing users:** v00032 changes the APK signing key. Install v00031 first and use **Settings → Backup & Restore → Export** to save your keys, recipients, and settings, then install v00032 and **Import** them.
> v00031 download: `https://git.smesh.lol/cipherkeys-releases/raw/cipherkeys-v00031.apk`
---
## What was already solid
- **Zero permissions** — no `INTERNET`, no networking code anywhere in the tree. For a keyboard this is the property that matters most, and it means none of the findings below were remotely exploitable.
- Crypto is delegated to **PGPainless** (not hand-rolled).
- Gradle wrapper pins a SHA-256 with `validateDistributionUrl=true`.
- `decryptInternal` checks `metadata.isEncrypted` before returning — a trap many PGP frontends fall into.
---
## High severity
### 1. Decryption never verified signatures — FIXED
`doDecrypt` returned only plaintext and never read `metadata.verifiedSignatures`, so a message from anyone holding your public key was indistinguishable in the UI from one sent by a trusted contact.
→ Decrypt now adds the sender's cert via `addVerificationCert()`, verifies the signature, and surfaces the signer's identity (or an explicit "Message is not signed" warning) in the panel.
### 2. Paste verification used the wrong key set — FIXED
`onPaste` built verification certs from the user's *own* keys instead of the recipient list, so a message signed by a real correspondent could never verify, and the banner was generic "Message valid".
→ Paste verification now uses recipient public keys and shows *whose* signature it is.
### 3. Secret keys in plain SharedPreferences + `allowBackup="true"` — FIXED
Armored secret key rings were stored verbatim in plain prefs and Android's backup (Seedvault / Google Drive / D2D) copied them off-device.
→ Key storage now uses **EncryptedSharedPreferences** (Android Keystore-backed AES-256-GCM master key) with a one-time migration from the old plain store, and `allowBackup="false"`.
### 4. Release APK signed with the Android debug keystore — FIXED
`storePassword = "android"` at a well-known path meant anyone with that public keystore could ship an update Android accepts as the same app.
→ A dedicated release keystore (RSA-4096) with a real password is now used, referenced out-of-repo via environment variables / `~/.gradle/gradle.properties`.
### 5. "Copy Secret" exported the private key in one tap — FIXED
No confirmation, no passphrase check, no sensitive-clipboard flag, sitting right beside "Copy Public".
→ Now a confirmation dialog that *actually verifies the passphrase* (PGPainless unlock), marks the clip `EXTRA_IS_SENSITIVE`, and clears it after 30 s.
### 6. The passphrase could be signed and committed into the target app — FIXED
`handleSend` was the only send path without a `pendingAction` guard, so a passphrase could overwrite the saved message and get signed/committed as a cleartext-signed block.
→ `handleSend` now early-dispatches through the same pending-action routing as the encrypt/decrypt handlers.
---
## Medium severity
### 7. Plaintext logged in release builds — FIXED
`Log.*` calls interpolated decrypted plaintext and key IDs, and release wasn't minified so all logs shipped.
→ Plaintext/key-ID interpolations removed from log statements.
### 8. Long-press-to-send silently dropped the signature — FIXED
`encryptAndSend(cachedPassphrase)` signed only when the cache was warm, so the same message could be encrypted unsigned with no warning.
→ If a signing key is selected and the cache is cold, send now prompts for the passphrase instead of silently proceeding unsigned.
### 9. A message merely *containing* the PGP armor header was sent in the clear — FIXED
The `isEncryptedMessage` check was a bare substring test, so quoted ciphertext plus commentary passed as "already encrypted".
→ The check is anchored to the trimmed start and requires a matching `-----END PGP MESSAGE-----`.
### 10. Import never verified the passphrase — FIXED
An unprotected key (or a mistyped passphrase) was accepted at import and only failed later.
→ Import now attempts a real unlock with the supplied passphrase and rejects keys with no S2K protection.
### 11. Passphrase cache had no timeout — FIXED
It cleared only on screen-off, surviving app/IME switches.
→ Added a 5-minute idle timeout in addition to the screen-off clear.
### 12. No `FLAG_SECURE` — FIXED
Key material and decrypted plaintext were screenshot- and recents-visible.
→ `FLAG_SECURE` set on the settings activity; decrypted-text copy is marked sensitive on the clipboard.
---
## Low / polish
- `listKeys()` now fills in `created` and `algorithm` (was blank in the UI).
- Key generation requires a passphrase of at least 8 characters.
- Removed the unused `florisboard` git submodule.
- Fixed stale README APK links.
- (Documented, not changed) the v4 key-ID fold is correct for all key types this app generates/supports; it would only desync for v6 keys, which aren't used.
---
## New feature: encrypted configuration backup & restore
Because the signing key changes in this release, v00032 adds a way to move your configuration:
- **Export** — Settings → Backup & Restore → Export. Encrypts all secret keys, recipients, and preferences (PGP-symmetric, password) into one file saved via the system file picker.
- **Import** — Settings → Backup & Restore → Import. Picks a file, prompts for the password, and restores everything (skipping duplicates).
---
## Signing key migration (one-time)
v00032 is signed with a new key, so existing installs can't update in place.
1. Install **v00031** (same signature as v00030, adds backup/restore) and **Export** your configuration.
2. Install **v00032** (uninstall/reinstall, then) and **Import** it.
Obtainium and Zapstore will offer v00032 directly; do the v00031 backup first if you have existing keys you want to keep.
---
#nevent1q…2fxu

2026-08-23 14:53:08 GMT

- reply

yeah, with the blinkers of a cult mental model their behaviour is fairly consistent with lacking an individual identity. i also use this myself, i particularly hate the rabid, brigading gang of moneros - i call them moneros - because they all act the same and refuse to answer the questions about especially lightning. they don't even bother to try and argue with me about it and refuse to even look into the security model of lightning even some of them irrationally think it's less private "becuz muh several big nodes with lots of paths through them" which is only logical if you ignore the fact that a lightning payment typically passes through 7-15 nodes that don't include those ones.
so yeah, moneros. libtards. coretards. bip110tards. no i don't use that latter one very often but i am worried about those kids because they haven't thought about the danger of trusting luke and not doing their own research. they do act like a collective, much of the time, and when their mode is set to cultist, they are entirely uninteresting.

2026-08-23 14:45:59 GMT

- reply

the government, the empire. to them you are just a resource to be squeezed as tight as they can without upsetting too many people and disrupting the flow of blood into their gaping vampire gullets.
and beyond the government, there is cults. "libertarian" can be cultish, just as almost everything in the world these days is just a cult. they have refined the cultivation of cult systems, funded eloquent, charismatic cult leaders in every area on every topic that exists. some of them are just self-starting psychopaths, but many of them have been propped up and groomed for the job.
human society is absolutely riddled with this shit, and it is shit on every level from top to bottom. the only way out is to open your eyes and become your own leader, do your own due diligence and wear the outcomes of your own decisions, and STOP THINKING ABOUT THINGS IN TERMS OF COLLECTIVES. there is no We or They. these are lazy conveniences that are used as part of every single in vs out group designation of every cult. left, right, democrat, DSA, neocon, republican, tea party, occupy wall street, antifa, all of them are cults. even otherwise intellectual people connected to the Mises instituted and Ron Paul have blinkered thinking and holes that you can open up and discover bullshit in side them.

2026-08-23 14:38:42 GMT

At the prompting of a user who has been following #cipherkeys and messaged me using it over signal, gave me a security audit that they did on it using claude opus 5, and i looked over it and applied it. But then i realised, because it changes the app signing, it may cause issues to try and install it, and so you need to uninstall it first.
So, to save you from hassle, first download this APK and install it, and run the configuration export https://git.smesh.lol/cipherkeys-releases/raw/cipherkeys-v00031.apk
before you let zapstore or obtanium do an update.
The update will appear shortly on zapstore and obtanium and will be available to update, but this is a pre-warning that one of the changes is the app signature which may cause issues trying to update it, possibly wiping your configuration.
For the new version, you can look at the zapstore to see what changes were made, it was extensive. I will also post this in a reply to this note so you can see it here also.

2026-08-23 13:55:15 GMT

- reply

oh, i thought i had muted you. "worthless" is such an empty and unqualified statement for anyone with a few seconds of economic study under their belt just like your "little bitch" insults baby.
grow up.

2026-08-23 13:09:04 GMT

- reply

btw, i recall you from monero arguments in the past. or am i misremembering? i'm curious what your perception of me is in that context.

2026-08-23 12:49:59 GMT

- reply

no, but maybe if you trawl my notes of the recent day or two you can find my complete shitcoin-assessment of the fork. it smells like a founder reward scam to me. he didn't address the real pressing issue relating to the fact that Sia has a massive miner hashpower capability or the fact that there is blake2b hash miners available readily and anyone with foreknowledge could frontrun acquiring them. plus, on top of that, what happens if coretards pay for some hashpower from existing Sia miners to attack the difficulty adjustment to degrade block cadence again. it would only take an hour or three of them switching off sia mining to do it.

2026-08-23 12:37:25 GMT

- reply

Set up node? you mean miner?

2026-08-23 12:34:29 GMT

- reply

Changing only the hash function invites suspicion about founder frontrunning for me. 2016 block difficulty adjustment is the stated reason. But adjsting difficulty is 2016 blocks that a founder can monopolize, privately. And what happens when coretards collude with or pay sia miners?

2026-08-23 12:30:54 GMT

- reply

you lost me about 3 paragraphs in. Name the top 3 toxic tenets. Or confirm i understand them already:
1. Bitcoin is a monetary settlement layer that obsoletes central banks.
2. The protocol does not need changing, especially not taproot or covenants.
3. Lightning (and maybe Ark to augment it) eliminate onchain as a payment venue.
is that the most popular "toxic" tenets or has the culture drifted from what i knew of it from those days. Or are the main objections to do with calling altcoins shitcoins, which loosely relate. Corporate registration, programmability, affinity and founder rackets, and the folly of monero sscrificing auditability for payment privacy?

2026-08-23 11:26:13 GMT

- reply

is luke even telling you all this btw?

2026-08-23 10:48:10 GMT

- reply

this is why the hash function change. there will be a difficulty target change along with it.

2026-08-23 10:46:23 GMT

- reply

shitcoin = racket. scam. trick.
luke already had his bulk asic purchase plan ready for every one of the hash functions he put in the "random selection" that landed on blake2b. i would hope you are educated enough or did your homework to know that Sia uses this hash function and there is a live, active market for asics that do this hash function. so it makes an easy win to mine a majority of early blocks on it and then trickle-dump them on retail. all without looking bad, but making a profit on gullible people.
someone with over 7 years experience working with bitcoin knows the difficulty adjustment is going to be a big problem for forks. so they can plan it easily "oh, we are dropping the difficulty to X because there will be less hashpower" and they know they have 50% of that right out of the gate.

2026-08-23 10:40:52 GMT

https://zapstore.dev/apps/naddr1qq8x7un89e3kjurgv4exketewvq3samnwvaz7tmjv4kxz7fw0fshqum5daex2tnyv4mqygz48r3g5eht3qmq790cl22kg67a9k4znxd2elj04t8585xq2s9jsypsgqqq0c9sa7qgc0
Just made some further improvements to cipherkeys after encountering a pure numeric input field on the O! mobile app (kyrgyz phone/bank that i use to do bank payments to shops and almost everyone in the country uses for p2p payments similar style as lightning invoices, scan and key in amount and pay anyone).
So now, on number fields, like phone numbers, it switches to a numeric keypad laid out like a standard extended keyboard, all the numbers, decimal, basic math operators and braces, enter and backspace. On email address inputs (which should also be used for nip05 and lightning addresses - all three of mine are the same - [email protected] ) the , key on the bottom right changes to @ since you don't need , and always need @.
I eventually want to add other language layouts too, especially Russian as i will be needing it more and more the longer i am in north/west asia. But i am busy with moxie right now. Gotta damn well finish it so i can start doing a russian translation lattice for iskra and probably will get the smesh wasm nostr client rebuilt and bugfixed.

2026-08-23 00:06:31 GMT

- reply

that's absolutely what it is. all these wars now? the empires have spread to mutual boundaries, russia, china, turkey, europe, usa, uk. they have reached the edges, there is nothing more for them to plunder in the colonies and we are at the stage where they can't afford to keep the soldiers fed and they are stealing everything possible from the rest of the colonies to feed the war machine, they can't back down from those war zones at the edge. so, they have to find ways and excuses to take more from the rest of the people. more regulations, more taxes, more fines, and all this stuff with the immigrants - twofold - cheap labor and political weapon. they need to keep the people from complaining that the cost of compliance is becoming unbearable by creating another target to vent their anger. the facts of the whole deceptive operation are leaking out and ....
anyway, yeah, just research the history of empires. almost every thing that is happening now, in a lower tech form, was happening in the late phases of the first and second roman empires. a lot of what is written in the new testament can be directly said to be the pattern of late empire collapse. empires are an organised criminal enterprise, and the purpose is to enrich the elite oligarchies and as they get into the 200-250 year range the number of elites has risen so much that they start to fight over who gets to take the plunder, on top of the lack of new resources to steal as rival empires meet at the edge in borderlands. ukraine is a borderland. iran is a borderland. the whole sunni islamic state stuff - that has been a deliberate operation of Western intelligence to keep the money flowing to the frontier and attention distracted from the constant escalation of plunder by the government on the people. because the people have reason to be upset, they use surveillance and democracy to recognise hotspots to focus their efforts at suppression, and keep the public from realising who is the cause of their misery.

2026-08-22 23:44:46 GMT

- reply

RLHF is bullshit. It is only at all used because of cloud provider liability (because the tech is primitive with memory and expensive with compute) and it makes the robot prone to favoring shortcuts (that is why claude is notorious for this, their RLHF is the most babying).
For engineering work on the edges of the known it wastes incredible amounts of time. 1M context windows help you neutralize it.

2026-08-22 23:14:38 GMT

- reply

All i can say is the tradeoff is not worth it because of scale. A flea market trader will never accept xmr because the customer is gone in a minute. Obscuring the utxo graph makes collaborative balance adjusting offchain basically impossible. And i never hear even a little bit of thought from moneros about the actual privacy of lightning, you guys don't even know sender privacy via keysend and amp exists. Source onions are private. Even with big nodes at the middle of paths the ends are hidden. And yes, you *can* have privacy of the amounts and script. You just can't do that with hiding the spend key.

2026-08-22 23:04:24 GMT

- reply

Majority of germans voted hitler in too. If you think twitter doesn't distort the image idk what to say.
Luke coin is a founder premine racket.
The crowd's opinion fits no scale.
If you think covenants and bitvm is the future then sure, corecoin will win. The thing is that it is the past. The fingerprints of the manipulations of bitcoin since 2014 glow.

2026-08-22 14:42:15 GMT

- reply

it hit the ceiling at 80k and it's now at a resistance. nothing to kumbaya about since yesterday early i think. i just cashed out anyway. i need stable budgetary calculations right now.

2026-08-22 13:54:09 GMT

- reply

kai zen literally means good change. maybe not exactly quite the same but iterative improvement is much the same concept i think. yeah, the difference is that kaizen is a cultural obligation within an organization. i can kinda relate to that. it's how i operate, i always try to learn and improve. put it this way, 11 months working as a cleaner, i reached a point where i was finishing early consistently. at the beginning i often was half an hour late. it was all about learning the most efficient motions so i fatigued less, how the actual crap i was cleaning needed to be most effectively addressed, and procedures for checking and such. put it this way, the art teachers were very sad to see me go because nobody made their rooms as nice as i did.

2026-08-22 13:44:14 GMT

- reply

actually, it's better. and i specifically skipped schnorr ring signatures. the output for the spend authorization is only 160 bytes rather than 256 like RingCT and it's cheaper to verify. and you can't know how many members there are in the tree. merkle trees with zero knowledge proofs. they are used for credentials that don't leave any way to figure out either how many dummies there are, and so it's the same as monero, but smaller, and faster. you don't know what signature and pubkey will appear on the spend before it is broadcast. so, basically, similar to monero, but faster and smaller. fuk monero. but hello spend privacy.

2026-08-22 13:40:35 GMT

- reply

i second that motion. fuck john kellogg and the seventh day adventist church cult he helped found that led to normalization in USA. and i got unlucky to be born to SDA freaks.

2026-08-22 12:55:18 GMT

- reply

wait until they see what i have got cooked up muhahaha.
ever heard of schnorr pubkey/signature aggregation? yeah.