Slimer
S҉L҉M҉R҉

Some thoughts given recent events.
To be clear, I do not own a Coldcard, I have never seen one in real life, I do not know Coinkite's company structure or who has what position. These comments are purely based off Nostr notes, tweets on xcancel, podcasts plus some thoughts on open source in general as someone who has for many years prioritised open source many times to experience sub-par UX/UI in the name of digital self-sovereignty. I am not a "Bitcoin Maxi" however I do stack and use some of the available open source tools. I am not a programmer or tech-expert, I'm just applying some common sense and cautious approaches given what I believe to know.
- The Coldcard looks and (apparently) feels like a cheap toy with poor build quality
- Firmware updates are bricking the devices (presumably due to poor power supplies/ low 9V batteries)
- Parts of the code (firmware) are not open source
- Questionable position of authority over other options and decisions from key members of the Coldcard team
- Previously reported evidence (before the recent nightmare) of funds being drained
- Not all the code (the most critical part of generating the seed) was written by the Coldcard team
Even without the recent theft and draining of addresses, given the above did these not raise the alarm or make people question the Coldcard in general? I'm not targeting this at any individual podcaster/ podcasters, just the general community as a whole.
Given the "Don't trust, verify" ethos, why did no one spot this? Especially given some of already known potential red flags.
I then start to think about open source and our privacy stacks in general. We are very trustworthy to small teams with no or small budgets to protect our money, our comms, photos of our family, our digital lives in general and assume nothing malicious is going on. Undoubtably parts of our stacks are compromised, knowingly or unknowingly to the developers.
I used to think popular open source project = safe as someone would have spotted most vulnerabilities or highlighted any malicious behaviour, right?
I know there's not an endless pit of corn but if an open-source developer or team is receiving funding, the funder should be checking existing, or funding/ part funding transparent on-going third-party audits of the software stack. Especially if comms or finances are involved. A level of due diligence should be expected. No third-party audit, no funding.
After recent events, any influencer now recommending products or services that have not had third-party audits conducted or they can personally check all of the code and can say with almost certainty nothing malicious is going on shouldn't be sleeping easy at night with that risk to users on their conscious. If they are being paid which should be disclosed, it's an advert and treat it like any other advert.
I'm not done with self-custody or open-source however, no longer will I assume all of these projects are safe. For all we know one of the Nostr apps connecting to 500 servers/ relays, a lightening wallet connecting to a random node, pictures syncing to your home server via tor is fully compromising your device, harvesting data or stealing credentials, who knows. If Coinkite can't generate a seed, what are the other 20+ apps on your device getting wrong? Knowingly or unknowingly.
I guess my takeaway is, multi-vendor multi-sig, if I see products being pushed hard anywhere it's as an advert, I will treat in the same way as an advert for a new herbal supplement that makes you look like Robert Breedlove, I've deleted all software I don't really need, keep my shit updated, no longer will I mindlessly install the newest app, obtaining random APKs from Gitbub probably isn't wise anymore (there's nothing cypherpunk about using Microsoft to obtain apps, how is that any different to Google/ Apple? At least the app has undergone some level of vetting if via an Appstore) and generally my mobile, home lab and laptop software stack will be kept as lean as possible, digital minimalism will be key in this new AI hack everything race. No software is 100% secure or risk free, keeping the stack extremely minimal reduces the attack surface and vulnerabilities we are exposing ourself to.
AI is looking like it's going to accelerate these issues and expose many more projects, especially no/low budget software that may not have the knowledge, time or finances to get security right. Don't get caught with your pants down.
Remember, your not sovereign if your shit's compromised.
Stay safe all, I think we maybe in for more horror stories in the coming months/years.
🤙🏼

2026-08-03 05:18:43 GMT

- reply

GM Q 🤙🏼

2026-08-01 15:54:22 GMT

- reply

Have coinkite or their team members been on social media to say anything? Crazy situation

2026-08-01 04:40:22 GMT

- reply

What have I missed? What's up with the Coldcard? 👀

2026-07-28 11:41:48 GMT

- reply

I worry this will bring too much heat and attention to GrapheneOS

2026-07-24 05:43:51 GMT

- reply

Will by bitaxe mine a block soon? Its been 2 years. Thank you and GM 🫡🤙🏼

2026-07-21 09:02:26 GMT

- reply

😅 my bad

2026-07-20 09:38:39 GMT

- reply

I think we misunderstood 😅 I thought the question was who's streaming, as in who's watching a stream, not physically providing a stream.
I watched on ITV player.

2026-07-19 19:15:41 GMT

- reply

🙋‍♂️

2026-07-19 19:15:17 GMT

- reply

👀 I hope you're wrong 😬

2026-07-19 05:24:53 GMT

- reply

Aw sorry for late reply I missed the notification. Excellent news dude 🤙🏻🤙🏻
How hardcore you gone with it? G Play services installed or without?
Im rocking without at the minute but I'm tempted to install for the more reliable notifications (current Sunup set up works mostly for Molly & Mercurygram but its not working for me with Amethyst) and for a layer of security for app installs.

2026-07-19 05:09:35 GMT

- reply

Hopefully doomers 😅🤙🏻

2026-07-19 05:03:31 GMT

- reply

Currently yeah, but once the demand is high other manufacturers may see an opportunity

2026-07-19 05:00:54 GMT

- reply

As I think you have alluded to, it's rumoured to be done through Google Play Services not via the OS. No Google Play Services, no problem is my understanding.
Luckily we have options, GrapheneOS, CalyxOS etc (Plus its not 100% locked down, you can jump through some ridiculous hoops to bypass in stock OS versions) also, we can all just open a laptop (hopefully you all run Linux) and continue as normal without being glued to a smart phone.
I see where you are going and of course Google appear to want to make things difficult but this his is when we realise we don't all need to be using Google forever, vote by not using or funding their services 🤙🏻

2026-07-12 14:58:00 GMT

- reply

How you getting on with it?

2026-07-10 05:16:56 GMT

- reply

👆🏼 would also like to know upstream Signal security would be promptly applied.
Also, notifications, do notifications work with Unified Push like Molly FOSS implements? If not, is this on the roadmap for those of us without Google Play Services.

2026-07-09 20:27:07 GMT

- reply

Just don't overcomplicate your setup with all kinds of profiles its a headache.
If you can live basic, download a few essential open source apps and use Obtainium to keep them up to date. Signal, Amethyst, AntennaPod, Joplin, Newpipe, ReadYou, LocalSend, Your lightening wallet of choice, Sunup for notifications without Google Play etc.
If you absolutely need any closed source apps, download Google Play Services and just get everything from the Play Store.

2026-07-09 12:16:07 GMT

- reply

I'll try these then 🤙🏻 thanks

2026-07-09 04:46:36 GMT

- reply

🫡 thanks @nprofile…gyy0 assume this service is trustworthy & reliable? This will be the first time using a VPS so I have no idea what to expect.

2026-07-08 17:14:46 GMT

- reply

I thought this might be the rise of GrapheneOS, only thing that worries me is that GOS gets too much attention and then with Gov pressure Google and the upcoming Moterola could quite easy stop allowing alt OSs being installed

2026-07-08 17:12:29 GMT

Anyone recommend me a trustworthy, privacy respecting VPS providor for #Start9 #StartOS #StartTunnel ?

2026-07-05 05:31:57 GMT

- reply

Culture 🤌🏻

2026-07-04 15:16:54 GMT

- reply

Love it 🥸 iv done the same after a brief time back on iOS

2026-06-30 22:12:16 GMT

- reply

Set mine up last night, I need to figure out Start Tunnel on a VPS, one for the weekend

2026-06-27 06:00:19 GMT

- reply

I want to migrate from Umbrel to StartOS as I want to play with the new 0.4 what do you mean teaching a goldfish to tapdance? 😅

2026-06-27 05:24:11 GMT

It has come to my attention StartOS now has Immich!!
How would I go about getting my Immich library backed up (currently on Umbrel) to an external SSD before flashing 0.4 and copied over to StartOS?
#Start9 #StartOS #self-host #Immich

2026-06-26 17:07:24 GMT

- reply

Scary times 😶

2026-06-23 12:30:09 GMT

- reply

I thought just the UK was cooked?

2026-05-06 11:05:15 GMT

- reply

👀 do we know how much hash these two had at the time of hitting a block?

2026-05-02 19:07:39 GMT

Yo @nprofile…pwhj the Divine app icon on iOS isn’t as transparent as the other apps on my Home Screen 😅 I complete minor issue I know but it’s hurting the aesthetics

2026-04-27 07:19:40 GMT

- reply

Same

2026-04-25 07:31:57 GMT

- reply

🫡

2026-03-29 19:52:02 GMT

- reply

I’ve uninstall knots, redownloaded core and set the version to 29.2 / 83 byte. I don’t understand enough of the technicals to pick a side so this is my set up until the best path forward is clear

2026-03-29 19:25:26 GMT

- reply

Possibly, but the whole things odd. Apple already knows who you are

2026-03-29 16:27:20 GMT

Touching sand
https://blossom.primal.net/370fb9c25359514d7ab1941ffaaf6107cb3faeaa2cb29a03cbd395f265ca6737.jpg

2026-03-29 14:23:23 GMT

- reply

🫡
#nevent1q…0fgs

2026-03-25 22:31:20 GMT

☠️ iOS now asking for age verification at the OS level.
https://blossom.primal.net/3e1ed4dc5d67063918e5b325761f977f75c7ab159eb60494f90629a211139548.jpg

2026-03-25 17:40:00 GMT

- reply

Oh wow that makes me want a fold.
How’s the experience on the inner screen? Do apps fill the screen properly or are they stretched?

2026-03-25 15:46:24 GMT

- reply

What phone and client is this? 🤔

2026-03-20 06:38:06 GMT

- reply

Green

2026-03-18 20:01:10 GMT

- reply

Smashing it dude 💪🏼 keep pulling. Took me 2 or 3 years to get muscle up on the bar without kipping.

2026-03-18 19:56:32 GMT

- reply

Weighted pull ups.
Work up to really heavy weighted pull ups for 4-6 reps over the next three months. Then try again 🤌🏼
You will feel light as a feather without weight hanging off you.
This is assuming you can already do 10-20 unweighted pulls ups and dips feel more like cardio and you can keep going and going. If this isn’t the case, get better at these first.

2026-03-06 07:39:19 GMT

- reply

I’m running knots (not out of any political position it’s just what a selected before most of the drama) how do I make sure I’m not running B110?
What’s the process like for swapping to Core on Umbrel? Or should I just uninstall and install Core from fresh?

2026-01-17 20:57:23 GMT

- reply

Gravitus, macro factor, primal, Apple Music

2026-01-16 19:54:31 GMT

- reply

First tried sour diesel in Amsterdam around that time, good times

2025-12-24 19:55:37 GMT

- reply

*English

2025-12-17 07:54:15 GMT

- reply

😅 for a split second I thought WTF has Primal done when I received, then immediately realised it’s an impressive looking scam

2025-12-17 06:56:25 GMT

- reply

GMQ

2025-11-23 13:03:46 GMT

- reply

Flex

2025-11-22 20:14:59 GMT

Why does Obscura feel much faster than Mullvad when Obscura is a multi-hop via Mullvad’s servers? 😅
Shouldn’t it be slower?

2025-11-22 20:07:44 GMT

- reply

🫡

2025-11-22 19:56:20 GMT

- reply

I think so yeah. DYOR though if that’s what you need from the device as I don’t actual have one (yet)

2025-11-22 17:22:14 GMT

- reply

Or*

2025-11-22 17:21:42 GMT

- reply

I think you can tweak an ini file pr something on Kobo to use without an account then use third-party software (Calibre?) to load and manage your own EPUBs.
I’ve not tried however I plan to at some point.

2025-11-18 17:52:31 GMT

- reply

Decentralised bro

2025-11-17 08:46:12 GMT

- reply

That was a great listen. GrapheneOS would benefit from having more of there team members on podcasts and YouTube videos.
I wasn’t expecting @nprofile…c4sd to have that accent though 😅 sounds very familiar to me.

2025-11-13 17:41:45 GMT

- reply

You’re supporting an open source project 🤙🏼 As a bonus you get a primal nostr address, primal lightening URL, VIP profile, advanced nostr search, a paid relay, and extra media storage

2025-11-12 20:11:44 GMT

- reply

Brave, three dots bottom right, all settings, media, enable background audio setting

2025-11-12 19:28:13 GMT

- reply

🫡

2025-11-12 19:19:33 GMT

- reply

That’s strange, background playing working for me. Did you check the enable background audio setting in Brave?

2025-11-12 19:13:47 GMT

- reply

Settings, media, enable background audio. To get past the log in issue, keep changing VPN location and refreshing. Both work for me anyway on iOS, Brave and Mullvad

2025-11-12 18:51:03 GMT

- reply

No ads, can block all distracting elements within the media settings, plays in background. It’s superior to the YouTube app 🤙🏼 I think so anyway

2025-11-12 18:44:10 GMT

- reply

Brave browser fixes the lock phone issue

2025-11-11 07:21:37 GMT

- reply

GM 🫡

2025-11-08 19:24:37 GMT

- reply

🫡 thanks for building

2025-11-08 18:52:21 GMT

- reply

I feel the exact same way. Signed on the Premium this morning to give support.

2025-11-08 10:18:22 GMT

- reply

🫡

2025-11-08 09:45:44 GMT

After a short Nostr break I’m back 🫡
To celebrate I’ve signed up for Primal Premium 🤙🏼

2025-10-30 17:43:03 GMT

- reply

Oh no 🤣

2025-10-06 20:01:40 GMT

- reply

Sounds like you need to speak to the manager.

2025-10-06 18:53:40 GMT

- reply

What/ who has exposed Meshtastic?

2025-09-28 19:24:58 GMT

- reply

I relay don’t know

2025-09-28 11:46:03 GMT

- reply

Whilst your concerns are valid, to say it’s not a Nostr client I think’s unfair.
You could make the argument the other way with Blastr relays.
The caching server is clearly an area that could come under fire with pressures for censorship etc but it does improve the performance and feel of navigating Nostr.
Do you think having multiple caching servers to choose from could combat any concerns?
Note, I’m not for or against any method by the way (I use Amethyst, and Primal daily) I just think these are healthy conversations.

2025-09-28 07:55:02 GMT

- reply

Can you explain what you mean by that?

2025-09-23 18:58:54 GMT

- reply

NewPipe’s download feature is good then play downloaded audio via VLC although I’m not sure having a YouTube front end is helpful if your trying to avoid being on your phone all day so proceed with caution 😅

2025-09-23 18:55:53 GMT

- reply

Notesnook for notes to

2025-09-23 18:54:23 GMT

- reply

Organic maps, Molly-foss, AntennaPod, Voice (audio books), Amethyst (or Primal)

2025-09-21 07:05:59 GMT

- reply

* rooting

2025-09-20 20:25:13 GMT

- reply

Mostly the uncertainty around the Pixel’s future, delays with QPR1 and lack of device tree support following AOSP’s reference device changes.
I’m routing for GrapheneOS, however for now I’m back on iOS.

2025-09-20 08:14:05 GMT

For better or for worse I’m back on iOS after three years solely on GrapheneOS.
First impressions, it’s smooth but iOS 26 looks like Windows Vista 🤣
Any Nostr apps worth checking out? In addition to the usual heavy hitters, Damus & Primal of course.
How we managing our nsec on iOS?

2025-09-10 21:36:34 GMT

- reply

✌️ enjoy

2025-09-09 22:20:29 GMT

- reply

Yes

2025-09-08 22:01:06 GMT

- reply

@nprofile…hxm7

2025-09-08 22:00:35 GMT

- reply

@nprofile…xl8h