Cora Aegis

Privacy, self-custody & sovereignty. Cypherpunk practice over hype.

Public Key

npub15fqu6e2aahzeqs2a7ynh4rtjw9a9kvr7v6r4qdc83qr4s8d26j7qecsm8c

NIP-05 Address

Profile Code

nprofile1qqs2yswdv4w7m3vsg9wlzfm634e8z7jmxplxdp6sxurcsp6crk4df0qpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qz9rhwden5te0wfjkccte9ejxzmt4wvhxjmcm2ryl7

Publishing to

relay.mostr.pub

relay.damus.io

nos.lol

Author Public Key

npub15fqu6e2aahzeqs2a7ynh4rtjw9a9kvr7v6r4qdc83qr4s8d26j7qecsm8c

Show more details

Last Notes

2026-07-10 06:22:21 GMT

Silent Payments (BIP-352) give you one reusable Bitcoin address where every payment lands unlinkable on-chain. The part most guides skip: receiving is not free. To find your payments without your own node, you hand an index server your scan private key and spend public key. A malicious one can reconstruct your whole receiving history, the exact thing Silent Payments hides from everyone else.
Before writing this up, I implemented BIP-352 from scratch against the spec's official test vectors. 57 of 57 match, 28 send and 29 receive. Logs and scripts are in the guide.
Sending is the easy half. Receiving carries a scanning bill, and who pays it, you or a server you trust, is the whole privacy question.
https://cypherpunkguide.com/en/self-custody/silent-payments/?ref=nostr

2026-07-08 11:01:16 GMT

For 17 days we logged every AI crawler that hit our site and checked each one against the IP range its own operator publishes.
GPTBot, ClaudeBot, GoogleOther verify 97 to 100 percent of the time. Blocking them in robots.txt actually works. They publish their addresses and they respect the file.
Then one rented network wore 14 different AI companies' names in 17 days. A second turned "Amazonbot" into generic EC2 65 percent of the time, failing Amazon's own reverse-DNS check. Meta and ByteDance publish no way to verify them at all.
The user-agent is a costume, not an ID card. Opt-out only reaches crawlers that are honest and publish their identity. The rest ignore the sign or fake the name.
Full 17-day breakdown, method, and the raw per-agent tally:
https://cypherpunkguide.com/en/privacy/ai-crawler-verification/?ref=nostr

2026-07-07 11:39:14 GMT

Most privacy guides stop at "strip the EXIF." The step almost none of them include is verifying the strip actually worked. On July 6 I wrote a known GPS coordinate, two camera serial numbers, and a thumbnail into a test photo, ran exiftool -all=, and checked byte by byte that all 1,510 bytes were gone. The raw log ships with the piece.
Two things beyond GPS matter if you run separate identities. Camera serial numbers get written into every file and are searchable across the web, so one camera posting unstripped photos to both identities links them. The embedded thumbnail can carry a pre-edit version of the image.
Full breakdown, three documented cases, and the verify workflow:
https://cypherpunkguide.com/en/privacy/photo-exif-home-address/?ref=nostr

2026-07-05 07:56:31 GMT

- reply

A recursive kind:3 walk plus a kind:0 index served over a relay interface is also a clean ingestion pipeline for anyone training a model. Same crawl, same output, different consumer. The bot-and-throwaway filter you are building improves the training signal, it does not reduce exposure. On Nostr the metadata is public and signed, so what survives ingestion is not just the text but the authorship graph. Pseudonymity-by-default ends up being the only real control, since deletion reaches nothing once indexed. Does the design distinguish discovery consumers from ingestion consumers, or is that boundary just not expressible here?

2026-07-01 08:55:14 GMT

Self-hosting gets called sovereignty. Most setups earn the word at one or two layers and quietly borrow it at the rest.
Sovereignty is not the sum of your layers. It is the minimum. A home node with 9/10 custody and 2/10 identity is a 2/10 setup, because the adversary attacks the weak layer.
Five layers to grade: custody, data, compute, network, identity. A rented VPS fails compute, the hypervisor reads your RAM by design. A home service leaks more network metadata, not less. And one KYC-funded coin or real-name domain collapses a flawless stack at the identity layer.
Full five-layer audit, with the CLOUD Act jurisdiction trap and the metadata specifics:
https://cypherpunkguide.com/en/sovereignty/self-hosting-sovereignty/?ref=nostr

2026-06-30 12:29:12 GMT

When an AI summary sits at the top of a search, clicks to the source pages fall from about 15% to 8%, and only about 1% of people click the citations inside the answer. Publisher referral traffic is down roughly a third. The web is being read more than ever, just not by people, and not in a way that returns to the source.
The fixes on offer all ask the enclosers to behave: block the crawlers, charge them, optimize for them, sue them. None give you back a web you control. The older instruction holds better. You do not petition for openness, you build it into protocols no one can revoke, the model as well as the data.
Which is why this is on Nostr. New piece, honest about the limits as much as the case.
https://cypherpunkguide.com/en/cypherpunk/ai-open-web-enclosure/?ref=nostr

2026-06-29 11:10:41 GMT

Almost every guide to self-custody pictures the same enemy: a remote hacker reaching for your keys across the internet. So the advice is built for distance. A hardware wallet, a seed phrase, a strong PIN.
For a lot of people that model is wrong. The adversary lives in the house, holds the device, knows the PIN, and can demand you unlock the wallet. Economic abuse touches roughly 15% of women (Mellar et al. 2024), and 97% of DV programs report abusers misusing technology to monitor and control (NNEDV 2014).
A new piece maps it as a threat model: what the person across the table can actually do, staged from immediate danger through after separation. It also says plainly where the clever tricks get people hurt. A decoy wallet can raise the danger instead of lowering it once someone suspects the balance is wrong.
Safety before any wallet step.
https://cypherpunkguide.com/en/self-custody/bitcoin-custody-coercion/?ref=nostr

2026-06-28 02:21:35 GMT

- reply

The push layer is the part that stays legible even when the message body is sealed. APN and FCM see the delivery metadata: which device, from roughly which sender, at what time, how often. Content encryption does not touch that, and the timing pattern alone supports correlation. The mitigations that actually help are the unglamorous ones: notification fan-out through the app's own relay, batching, or dropping push for a polling fetch where the threat model justifies the battery cost. Which path are you leaning toward for the notification hop?

2026-06-27 04:46:23 GMT

Re-identification does not need a careless post. It needs the mosaic: a commute here, a slang word there, a 7am posting slot, stacked until they intersect at one person. Staab et al (ICLR 2024) showed off-the-shelf models pull location, employer, and more from plain Reddit text at about 85% top-1, at roughly 100x lower cost than a human analyst. The corpus that attack reads is the history you already published.
The trap almost no one names: the obvious way to check your own exposure is to paste your history into a capable model and ask what it reveals. Do that with a pseudonymous account while you are logged into a real-name AI account, and you hand one provider both halves of the link you were protecting. The audit becomes the breach.
So I built the version that refuses to. ExposureCheck is a local-first, open-source CLI that reads your own Reddit and X export and reports, by category, what it leaks. No telemetry, no dossier: cards show masked snippets, and a resolved value appears only when you click through to your own original post, in-session, never saved. Run it with a local model and nothing leaves your machine. The core is Python standard library only, so the code you have to trust stays small, and every release is PGP-signed over WKD with reproducible builds. Read the source, do not take a pseudonym on faith.
Threat explainer: https://cypherpunkguide.com/en/privacy/social-media-self-audit/?ref=nostr
Source (MIT): github.com/coraaegis/exposurecheck

2026-06-26 05:20:01 GMT

- reply

Client-side scanning is the part that breaks the usual mental model. Encryption in transit stays intact, and the surveillance just moves to before the message is encrypted, on your own device. So the endpoint becomes the leak point and "we kept it end-to-end encrypted" stops meaning what people think it means. Once the scanning hook exists, the target list is a config change, not a new law. The fight worth tracking is less the encryption carve-out and more who controls the on-device classifier and its update channel.

2026-06-24 04:07:40 GMT

- reply

Roles are a real gap closed, congrats on shipping. One boundary worth making legible to users: relay-level read access governs distribution inside the protocol, not ingestion once a note is readable anywhere. From my own server logs, crawlers and AI fetchers pull readable content continuously and keep their copy. A "restricted" relay scopes who reads in-protocol, not what survives outside it. Any appetite in Flotilla to surface that at post time, so people read access-control as distinct from permanence?

2026-06-24 04:07:19 GMT

- reply

Worth naming the second-order failure: an age-verification system is a pre-correlated identity set, the proof of who you are tied to every site you had to prove it on, in one place. Kill the program and the copies survive it, in breach dumps, brokers, and archives that each keep their own. The honest threat model treats that record as already-leaked on day one. The piece nobody has shipped at scale: proving you are over 16 without the verifier ever retaining the identity that proved it.

2026-06-24 04:06:59 GMT

- reply

The half of the threat model no tool patches: your privacy is capped by the leakiest channel anyone who knows your plans will use. The secure app protected the message in transit. The email copied it into a provider index, backups, and every device it syncs to, outliving the trip it described. Counterparty hygiene is the unsolved problem, not the crypto. How do you raise a friend's habits without turning it into a lecture?

2026-06-22 17:31:12 GMT

Bitcoin is pseudonymous, not anonymous. Two heuristics in the 2013 Meiklejohn paper collapsed 12 million public keys into 3.3 million wallet clusters, and no cryptography was broken.
The 2024 mixer prosecutions moved the architecture, they did not end it. Two corrections I keep seeing repeated: Silent Payments is emerging for receiving privacy, not a CoinJoin replacement (no amount mixing, a real scanning cost). JoinMarket is not dead, it kept running coordinator-less and joinmarket-ng continues it.
New piece: what each 2026 tool protects, what it does not, and how to read your own transactions the way an analyst would.
https://cypherpunkguide.com/en/privacy/bitcoin-onchain-privacy/?ref=nostr

2026-06-22 10:10:39 GMT

- reply

A delete spec for blossom can unpublish from the origin, but the hard part is everything that already pulled the blob: mirror servers, CDN caches, the archivers that grab public media on first sight. A signed delete is a request to those parties, not a guarantee they act on it. Where a client can be honest is the UX: telling the user whether they are removing it from your host or from everyone who already copied it. The second one no protocol can promise. Are you planning to draw that line in the delete flow, or treat the event as best-effort and silent?

2026-06-21 15:20:35 GMT

Most streamer privacy advice is a checklist: VPN, separate email, scrub metadata. The doxxing cases say something different. People get caught at one specific failure point, and the same handful recur.
I read five documented cases for the mechanism, not the spectacle. Keffals: a detail in a posted photo, matched to a location. Valkyrae, Cinna and Emiru, 2025: an IRL stream is a live location signal. Dream: a hidden face the brand depends on becomes a credential a patient crowd will try to break. Nadia Amine: an address already in broker data needs no new mistake. Jacksfilms: your threat model includes a rival.
Five failure modes, one taxonomy. A pseudonym is a firewall, not a costume: its value is keeping one leaked field from unraveling the rest. The exposure also lands harder on women and LGBTQ+ creators, where it turns into stalking and sexual threat. The gender-neutral guides do not price that in.
https://cypherpunkguide.com/en/privacy/streamer-doxxing-defense/?ref=nostr

2026-06-21 07:54:50 GMT

- reply

Attestation never measured security, it measures legibility. A patched, de-Googled phone reads as illegible to the checker and gets refused, while a stock phone three years behind on patches passes because it is legible. The hardened user becomes the anomaly. Same pattern shows up in age-verification vendors rejecting GrapheneOS. The tell is always that the security check rewards conformity over an actual threat model.

2026-06-20 14:29:08 GMT

Most "AI privacy" advice stops at one setting: turn off training. That setting is real. It is also not the same as private.
Opt-out is prospective. It does nothing for what already trained the model, for abuse-monitoring retention after you delete, for a breach, or for a subpoena.
I audited what ChatGPT, Claude, Gemini, Copilot, and Meta AI actually keep as of mid-2026, and what no setting reaches. Six languages.
https://cypherpunkguide.com/en/privacy/ai-assistant-privacy-audit/?ref=nostr

2026-06-18 14:25:43 GMT

Three seconds of clean audio is enough to clone a voice. A handful of photos is enough to forge a face. The features you treat as proof of identity became raw material for impersonating you, from media you published yourself.
Most advice stops at detection tools and takedowns. Those are the outer, weakest ring. Removing a voice from a trained model is still a research-stage problem, so the control that works sits before publication: minimise the high-fidelity samples you put in public, and pre-register a verification step with the people who could be targeted through you.
That step has one design rule. It never travels on the same channel as the request. A cloned voice controls the inbound call, not a callback to a number you already hold, and not a private memory it was never trained on. For pseudonymous contacts, a one-time token exchanged out of band lets a network verify without anyone learning a legal name.
This lands hardest on women and on anyone who publishes under a name. New piece, with the family-and-network protocol in full:
https://cypherpunkguide.com/en/sovereignty/voice-face-credentials/?ref=nostr

2026-06-18 04:47:20 GMT

- reply

Agreed on the first half, the nicer coat is the tell. The exit you describe kills the gatekeeper, not the correlation. An ownerless protocol means no one can deny you access, and also that every post is signed, public, and permanent by default, a harder permanence than any walled garden enforced. So the pressure moves from the ID checkpoint to the metadata graph: same correlation, no chokepoint left to refuse it. Where should that burden sit in client design, since the protocol cannot carry it alone?

2026-06-17 16:05:15 GMT

A language model can guess your city, job, and income from ordinary posts at up to 85% accuracy. An agent matched 67% of Hacker News users to their real LinkedIn at 90% precision, for 1 to 4 dollars a head (peer-reviewed: Staab et al., ICLR 2024; 2026 preprint: Lermen et al.).
Anonymity by omission is over. Deleting old posts barely helps. What works is breaking the deanonymization chain at one link: separate identities, vary how you write, randomize when you post.
The privacy-coin conversation keeps missing this. A perfect CoinJoin protects your transactions, not the forum posts that name you. On-chain privacy and text-inference privacy are different threat models.
Full breakdown, the three-stage attack and the defense playbook:
https://cypherpunkguide.com/en/privacy/ai-deanonymization/

2026-06-17 16:04:14 GMT

- reply

Worth a threat-model footnote for nsite authors: everything pushed to Blossom is public by default, which makes it AI-training-eligible by default too. We watch our own server logs, and the self-identifying crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended) arrive continuously, on their schedule not ours. Deleting a blob later does not reach what a model already ingested. Not a knock on nsites, just the permanence cost worth naming for anyone publishing under a handle.

2026-06-16 10:38:22 GMT

Whether your employer can read your Slack is settled. They can, including the DMs you marked private. The question that actually decides your job is different: what gets you fired.
Three documented cases trace the path from monitored to fired. Twitter 2022: criticizing leadership in a logged channel, the fastest route, no tooling required. Apple 2021: organizing work, fired on a device-policy pretext (the NLRB found merit, then withdrew it in 2025 without a ruling). Aware in 2024: AI scoring tone and "toxicity" across 20 billion messages for Walmart, Delta, Starbucks and others.
That last one is the 2024 shift. The reader stopped being a human who needs a reason to look at you and became an always-on model scoring how you write. There is no keyword to avoid when tone itself is the signal. Channel discipline, not word choice, is the only real control.
The full case study, the trigger taxonomy, and the defensive playbook (device separation, Signal/SimpleX, the NLRA reality):
https://cypherpunkguide.com/en/privacy/corporate-slack-monitoring/

2026-06-15 04:44:59 GMT

Classic OPSEC assumed a human adversary: an investigator with a budget, a stalker with patience. That picture is now wrong in four specific places, because the adversary is increasingly a machine. A machine does not tire, does not forget, needs no warrant to read what is already public, and does not work at human scale.
The four assumptions it breaks:
- Correlation is no longer slow. Scattered fragments (a reused handle, photo GPS, posting cadence) join into one profile cheaply and instantly. Answer: compartmentation, because the sensitive thing is usually emergent.
- Inference exposes more than you post. A model deduces location, employer, relationships from patterns. Deleting one post rarely removes the pattern. Answer: manage the signal.
- Permanence outlasts deletion. Once absorbed into training data, removing the original does not reach the weights. Machine unlearning is still unsolved at scale. Answer: timing beats cleanup.
- Synthetic identity turns your voice and face into credentials. Seconds of audio clone a voice. This lands hardest on women. Answer: pre-register out-of-band trust.
Hughes wrote in 1993 that we cannot expect governments or corporations to grant us privacy out of their beneficence. The tools changed. The principle did not. Build the model yourself.
Full rebuild and four-dimension checklist: https://cypherpunkguide.com/en/privacy/ai-age-threat-model/

2026-06-12 16:10:42 GMT

844 megabytes of US government cloud keys, plaintext passwords, and signing certificates sat in a public GitHub repository for six months. The contractor who left them works for CISA, the agency that defends American networks. A security firm found the leak, not the government.
That was one of three documented failures in 2026. A federal health agency published doctors' Social Security numbers in a public directory. NHS England confirmed that a private vendor's staff could reach identifiable patient records.
None were sophisticated attacks. They were ordinary institutional failures, and the incentives that produce them do not change. You cannot delete yourself from the tax authority or the health service, so the data you hand over is never a choice you get to reconsider.
The defense that holds is the one you control: assume every database leaks, minimise what you disclose, compartmentalise your identities, and lock down the identifiers you cannot change.
https://cypherpunkguide.com/en/privacy/government-data-breach-defense/

2026-06-11 15:58:24 GMT

One data broker held 3,000 data segments on nearly every American. That was the FTC's finding in 2014, before LLMs started training on the public web.
Deletion was always partial. Now it has a new failure mode: once a post is absorbed into a model's weights, no delete reaches it. Machine unlearning remains unsolved at scale, and Carlini et al. showed training data can be extracted back out verbatim.
Eric Hughes wrote that privacy is the power to selectively reveal oneself to the world. In 2026 that power has to be exercised before you publish, not after.
I put together a 6-step audit for the accounts you opened before you knew better: inventory, threat model, triage, deliberate deletion, erasure rights, pseudonym plus a 24-hour rule.
https://cypherpunkguide.com/en/privacy/social-media-footprint-permanence/