bumi

working on getalby.com - a browser extension with lightning and Nostr support

Public Key

npub1xv8mzscll8vvy5rsdw7dcqtd2j268a6yupr6gzqh86f2ulhy9kkqmclk3x

NIP-05 Address

Profile Code

nprofile1qqsrxra3gv0lnkxz2pcxh0xuq9k4f9dr7azwq3aypqtnay4w0mjzmtqpp4mhxue69uhkummn9ekx7mqpz4mhxue69uhk2er9dchxummnw3ezumrpdejqz9nhwden5te0dehhxarj9e4k7umddaejummjvuq3vamnwvaz7tmjv4kxz7fwdehhxarj9e3xzmnyqyw8wumn8ghj7mn0wd68ytnzd96xxmmfdejhytnnda3kjctvqy8hwumn8ghj7mn0wd68ytnddaksk2grfc

Publishing to

nostr.bitcoiner.social

nostr.mom

Author Public Key

npub1xv8mzscll8vvy5rsdw7dcqtd2j268a6yupr6gzqh86f2ulhy9kkqmclk3x

Show more details

Last Notes

2025-10-30 10:41:23 GMT

- reply

implementation should be pretty simple.
let me know if you have questions.

2025-10-30 10:39:25 GMT

- reply

what do you see?
and what would you like?

2025-10-30 10:38:43 GMT

- reply

I think pretty much all options in that screen have some sort of NWC support.
CLN there for example is also connected through NWC.
You have LND, LNbits, coinos, rizful, alby hub, I think there is a list on the website.

2025-10-30 07:46:17 GMT

- reply

Checkout NWC.dev
that’s what NWC is for.

2025-10-29 22:10:15 GMT

https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-invisible-dependencies

2025-10-28 17:28:13 GMT

Do you know the NWC based lightning message board for your website?
It's in the Alby Hub app store. (demo: https://getalby.github.io/lightning-messageboard/demo.html )

2025-10-28 12:39:57 GMT

- reply

yep, potentially some caching maybe.
keep me posted if you see issues again. thanks.
start9 is for sure a great setup!

2025-10-28 11:22:26 GMT

- reply

hmm, and it does not load when you refresh by pulling down the transaction list? or restarting the app?
that's interesting. Do you have different sub wallets?

2025-10-28 11:14:47 GMT

- reply

No, on what setup? for example a server might have better connectivity than a home device where a network issue can happen for example.

2025-10-28 11:13:44 GMT

Who of you is building an app with user agent "node" that can not handle failed LNURL invoice creations and then is stuck in an endless loop do LNURL calls?

2025-10-28 11:09:31 GMT

- reply

I will investigate if I see something in our logs.
Do you know where chriso runs the wallet? maybe there was some network issue?

2025-10-28 11:04:36 GMT

- reply

hmm, worked for me.

2025-10-28 10:56:10 GMT

- reply

I think some lightning addresses had an outage for ~1h last night... maybe that was the issue? but all systems should be green:
https://status.getalby.com/

2025-10-28 10:07:32 GMT

- reply

hey, what are you looking for?

2025-10-28 09:09:10 GMT

- reply

ohhh… maybe you mean that @nprofile…kl9d ? who liked your post…
that user has a nice profile picture of a finger and liked your post… ask that user to apologize for the profile picture.
and maybe please first check what you do and see before you blame and others… 🙏

2025-10-28 08:51:05 GMT

- reply

ohhh… maybe you mean that @nprofile…5wpa ? who liked your post…
that user has a nice profile picture of a finger and liked your post… ask that user to apologize for the profile picture.
and maybe please first check what you do and see before you blame and others… 🙏

2025-10-28 08:44:21 GMT

- reply

finger emoji? please don’t make things up or show me where I should have given you the finger!
I just shared your post and said that you proudly don’t pay for a service that you consumed and your posts full of insults…

2025-10-27 15:11:51 GMT

- reply

do you have it from the official apple appstore?

2025-10-27 10:28:59 GMT

- reply

do you have a link?

2025-10-27 10:24:41 GMT

- reply

that sounds pretty strange Alby Hub will actually never ask for a seed phrase once setup.
the seed is for backup only.
where do you enter that?

2025-10-27 10:16:54 GMT

- reply

2025-10-27 10:02:38 GMT

- reply

In the setup of Alby Hub (which is not in any App Store actually) you will get prompted to open a channel (which is the core concept and requirement of lightning) and are needed to receive and send payments. Lightning channels from service providers (there are 4 supported) cost money.
We know this is a new and still complicated concept and we try to make it usable... any feedback is greatly welcomed.
You must have clicked on "Confirm Payment"...
No need to use all those swear words, feel free and go to use other services!
We're happy to help and explain things and also look into your case if you send details to support.

2025-10-27 09:53:04 GMT

- reply

You likely bought a channel and clicked "confirm payment" which also stated the details. Otherwise you would not get such an email...
I guess you ignored it and we can improve the interface for sure. (though I am not sure what is not to understand when one actively clicks "confirm payment")
I know lightning channels are still a new and complicated concept.
Do you have any constructive feedback on how to improve it?
to me this here is like going into a café, seeing the price, ordering a cappuccino, half drinking it and then running out without paying to the marketplace and whining that the café charges for a cappuccino. 😉

2025-10-27 08:24:55 GMT

- reply

Bro buying and using services and then bragging about not paying for it. great attitude.
#nevent1q…ejqs

2025-10-25 10:19:34 GMT

anyone using deltachat here?

2025-10-24 17:23:09 GMT

- reply

just set your nostr key, that should not be a problem.
where are you stuck?

2025-10-24 17:22:23 GMT

- reply

is your internet all up and connecting?

2025-10-22 16:56:46 GMT

anyone running Alby Hub on a raspberry pi zero?

2025-10-22 13:36:37 GMT

- reply

just a seed that still has some USDT on it but I don't have use for it.

2025-10-22 13:25:27 GMT

there are 1.936 USDT on Tron on this seed:
since chaos together talk enhance boat birth finger immune spend miracle follow
take it.

2025-10-21 15:20:46 GMT

- reply

Hey, I don't think there is much else you could or should have done. You could have directly contacted us as we have direct communication channels open but likely by that time it was already worked on. Thanks for raising the warning and caring. Problem for sure was that we allowed people to enter lightning addresses - for which we sadly had a lot of support requests. So an email address could be exposed for a known lightning address.
At the same time lots of requests have been sent with emails from some leaks (where no account exists) - that's always the case on the evil internet...
Each of those request came from a different residential IP address (we have strict rate limits but the firewall did not catch all).
We'll remove password logins those are too often a source of such problems.
no account was at risk, Alby Hub and the Extension are anyway unaffected.

2025-10-21 12:18:50 GMT

- reply

yes. and the lighting address is often publicly posted on nostr.

2025-10-21 09:50:01 GMT

- reply

The password reset email could be requested with an email and attackers use leaked emails from lists recorded in for example haveibeenpwned.
Sadly in the Alby case the password reset email could also be requested with the lightning address which is likely what happened to you. Some attacker got the lightning address from nostr for example to do this.
We have disabled this now.

2025-10-21 09:35:29 GMT

- reply

yes, many requests we see originate from emails that also don't have accounts with Alby. There are many brute force attacks out there in the wild internet sadly.
Using alias email addresses like the ones proton offers is encouraged.

2025-10-21 09:28:50 GMT

- reply

Never share nsecs or any keys. No-one ever must ask you for that.
Keys are always just local (in the Alby Extension, Alby Hub) (and keep a backup of it)
Nothing is affected here.
Attackers could request password reset emails (which can be ignored) and if a lightning address was used to request the reset the email was exposed. Those potentially have been gathered from nostr before.

2025-10-21 09:18:56 GMT

- reply

that's correct. and we're very sorry this happened. we couldn't filter all requests and reset emails have been requested.
that email can be ignored and for additional security we now also enforce login with an one time token.

2025-10-21 09:15:17 GMT

- reply

I am sorry we failed you here and as you pointed out this should not have happened. User information must never be displayed and from one data point only no other data must be retrievable. we're very cautious there, have checks, strict rate limiting, firewalls, etc.
This started as a feature to help users keep their accounts and we failed here. Most of the requests (coming from residential proxies all over the place) seem to have not succeeded but still too many have.
fixes have been deployed and we likely will remove password logins in favor of the increased login with one time token. (would love to hear your feedback on this) we regularly see and block requests with user data registered in sets visible in haveibeenpwned.

2025-10-20 14:24:31 GMT

- reply

do you think there is a difference between a hardware wallet and a web wallet associated to a nostr key?
for me it’s kinda confusing to apply something from hardware wallet to a web wallet that works with a nostr key and also prompts users for the actual private key

2025-10-20 10:33:08 GMT

- reply

that basically says the user is a security vulnerability or we have a too complicated system where users need to sign events that they don't understand? :) (at the same time users complain they get asked too much) and any signing prompt is imo better than handing over the private key.
generally the user needs a bit of trust in the webapp. otherwise signing something is never a good idea imo.
I think there is a signPsbt function.

2025-10-17 08:13:19 GMT

- reply

ich glaube du hast in deinem Alby account kein wallet connected?
schau mal in deinem getalby.com/dashboard

2025-10-07 07:55:55 GMT

- reply

what is a zap useful for when things have to be coordinated in a DM?
and what do people sell? is that a real thing? or a nostr-dream?

2025-10-06 08:20:17 GMT

- reply

what amounts are you talking about and where do you have that data from?

2025-09-22 17:27:24 GMT

- reply

Yes, it's a different key by default.
You need a backup of both master keys and you will not loose the LNULR-auth identity.

2025-09-21 15:00:03 GMT

- reply

it’s all on Alby Hub now. where users have full control.

2025-09-21 14:59:36 GMT

- reply

you then ignored the emails and notifications until the full shutdown of the legacy system. :)
it’s shut down

2025-09-20 10:39:02 GMT

- reply

that’s not about accessing alby… that’s the mt pelerin topup service. please check with them. or use another topup service

2025-08-10 20:13:05 GMT

great new NWC service:
https://rizful.com/

2025-07-31 10:38:07 GMT

- reply

did you read the instructions? - You actually typed "I understand" that you read and understood it.
You MUST connect a NWC wallet and then go to the "Wallet Configuration" page.

2025-07-27 19:27:17 GMT

- reply

that’s basically NWC (without a secret), why is NWC not OK?

2025-07-27 19:19:18 GMT

- reply

what can Alby do?

2025-07-27 19:03:39 GMT

- reply

not currently widely adopted, is it?

2025-07-27 18:31:05 GMT

- reply

but you don’t need to run the LNURL server. you can use a service or a privacy preserving public hoster.
NWC does not expose details about your node.
would be -> lnurl hoster -> nwc (relay through tor) -> your node.
what am I missing? (maybe not perfect but possible)
I doubt clients will adopt a NWC only or similar flow anytime soon

2025-07-27 17:50:25 GMT

- reply

why not?
just the lightning address needs to be public.
but with NWC nothing of your node should be exposed.

2025-07-10 09:07:49 GMT

Be careful: there are currently pretty good scam emails being sent out. They tell there are apps for LNBits, Phoenix Wallet, Alby, and others available to download. The link goes to fake websites that have matching styles.
Do not click on the links do never download anything!

2025-07-06 12:43:14 GMT

- reply

it’s not a payment if you put sats in a channel. it’s your sats. - I think you have a misunderstanding there.
if you want to get incoming liquidity then you can buy it from one of the LSPs. This is the default flow because it’s the easiest and most reliable and most people want it.
but I understand your thoughts? - where was that “free” even that much emphasized? where did you read it?
I used the comparison before:
are your surprised that you have to put gas into a car to drive which depends on your needs and distance?

2025-07-06 08:36:51 GMT

- reply

you need to learn a bit about channels and how they work.
check the guides.
if you open a channel with onchain sats then this is an outgoing channel, it’s your sats - you will end up with outgoing capacity and no incoming capacity (until you sent some sats out)
opening a channel form an LSP gives you a good, big channel with incoming capacity, that costs.
channels are not provided by Alby.
channels are the foundation of the lightning network.

2025-06-28 20:38:31 GMT

- reply

and you read the message? and you did what it says?
just follow the instructions

2025-06-22 09:19:29 GMT

- reply

you should not deposit onchain.
the first one was about buying a channel with incoming liquidity from a lighting service provider. it gives you best connectivity and the ability to instantly receive.
when you use onchain funds you can open an outgoing channel.
channels should be big to be able to send/receive some amounts.
you used a different interface there.
if you’re interested learn a bit about channels, there are links to guides