Nostr notes by

I thought this would be true at the beginning, and was trying to ...

2026-08-02T14:39:21Z

In reply to nevent1q…yy7f
_________________________

I thought this would be true at the beginning, and was trying to be generous, as anyone can have a bug. But the software craftsmanship was incompetent on all levels:

* Starting from the management decision to get off open-source for the firmware,
* Using MicroPython wrapping to facilitate shitcoinery, which raised the complexity and added the faulty library to the stack,
* Falling back on a critical path, instead of throwing an error and breaking,
* And what has got to be encryption test cases so bad that they're going to end up in computer science textbooks under "What not to do."

I've been in software development since 1998 and I have **never ever** seen such poor software craftsmanship. Not industry-standard practice and arguably criminally negligible. If we did this in automotive, bioinformatics, or heavy industry, they would sue us into the ground and arrest the CEO.

That’s cold. Dude’s soul is rotten to the core. Steaming ...

2026-08-02T14:44:10Z

That’s cold. Dude’s soul is rotten to the core. Steaming pile.

quoting
nevent1q…98kl
It WAS FOSS then someone used his code, he got his panties in a twist, he made it so it was open to read but not open to use. Plenty of folks read FOSS code to see what's going on before they use it. No one is going to read code they can't use.
nevent1q…vx83

I was just thinking. Even when the person would be caught by the ...

2026-08-02T14:42:05Z

In reply to nevent1q…caju
_________________________

I was just thinking. Even when the person would be caught by the police. No coin holder would probably have reliable proof, that one is the legit holder of those Bitcoins.

Checking my emails closer. An early order got a "your data is ...

2026-08-02T14:41:36Z

Checking my emails closer. An early order got a "your data is about to be deleted notification email, maybe true maybe not. I made a later order, but years ago and far longer than the window mentioned in the first email saying my data would be deleted. The second order never got a deletion notice.

quoting
nevent1q…weh7
I got the coinkite email. Alias email used and my last order was before the Q was released.

Raw and real. No can zap you bro… ...

2026-08-02T14:40:37Z

Raw and real.

No can zap you bro…

quoting
nevent1q…3vuj
Bro I’m so confused and lost rn. Don’t even know who or what to trust anymore. Do you trust the new coldcard firmware? Can you trust other hardware wallet manufacturers to not make mistakes? You can’t trust exchanges or hot wallets. What do you even do anymore? Asking genuinely for help and guidance, I don’t have anyone in my life to talk to about this or give me guidance.

The best audits are from people building on your code and ...

2026-08-02T14:38:07Z

In reply to nevent1q…6m5r
_________________________

The best audits are from people building on your code and actively exercising it. If CC truly remained open source, someone would have noticed this RNG bug. But the irony is that NVK and crew wouldn't have lifted a finger to reward them. "I'll profit off your work, but you can't profit off mine."

Stressful af Remind me to overpay on my fees when doing self ...

2026-08-02T14:39:21Z

In reply to nevent1q…35mz
_________________________

Stressful af

Remind me to overpay on my fees when doing self transfers.

Nostr event nevent1qqsqqqz3p6f9nyvejjueezkpsl505uxckndlmdfgq66a9l72ghd9yxqpxamhxue69uhkuenyvghxummnwa5x2un99e3k7mf0d9h8getwwsaxuenyvghxummnwa5x2un99e3k7mf0we5kxar0wgpzpmnw5yatnljuff5w47d35d87q99xddqpzlzsac4xzn6vm22ekmn5dmjm02

2026-08-02T14:23:39Z

In reply to nevent1q…t95y
_________________________

What made you think this?

2026-08-02T14:38:02Z

In reply to nevent1q…0aex
_________________________

What made you think this?

Respect. We are all in the barrel RN. We all can learn if we ...

2026-08-02T14:36:59Z

Respect. We are all in the barrel RN. We all can learn if we will. Thanks for having the stones to walk through this fire with us. #WeAreNOSTR

quoting
nevent1q…9yvx
i thought coldcard was the best and holy shit i was completely wrong

have been trying my best to help people move for the last two days with no sleep, exhausted, broken, tragic

my comms are overwhelmed by people, trying to respond to everyone

if you are reading this and think your coldcard setup is fine because dice/passphrase/multisig, strongly consider moving anyway to reduce risk

Oh god I remember

2026-08-02T14:34:33Z

In reply to nevent1q…xalg
_________________________

Oh god I remember

Not if you're comfortable with linux it's not. Linux has ...

2026-08-02T14:32:48Z

In reply to nevent1q…zvgg
_________________________

Not if you're comfortable with linux it's not. Linux has been battle tested orders of magnitude more than any HWW.

If you're just securing a couple bitties, using open source software on an open source OS is fine.

Multi-vendor multisig. It’s not a panacea, but it limits risk ...

2026-08-02T14:32:19Z

In reply to nevent1q…sya6
_________________________

Multi-vendor multisig. It’s not a panacea, but it limits risk considerably.

Counterpoint: No

2026-08-02T14:26:22Z

In reply to nevent1q…yy7f
_________________________

Counterpoint: No

i have always advocated for self-custody of your bitcoin, and ...

2026-08-02T13:59:14Z

i have always advocated for self-custody of your bitcoin, and i’ll continue to do so, but i think going forward a good strategy is one that’s built on maximum protection and damage control, therefore i believe that a mixture of accounts is likely the best solution.

~85% in 2-of-3 multi-vendor multi-sig deep cold storage.
~10% in an exchange (i.e. river, strike, or fold)
~5% in a hot wallet + lightning

i’ve given this a lot of thought, and these are the trade-offs that i’m willing to make. if any of you are still trying to figure out your strategy, i hope this helps in what you decide to do. 🫂

That seems unlikely as the randomness would still be too great to ...

2026-08-02T14:22:46Z

In reply to nevent1q…hncm
_________________________

That seems unlikely as the randomness would still be too great to allow casual collisions from infrequent key generation. I still suspect someone was bulk generating seeds in secret but didn’t have access to the kind of compute power required until very recently.

#nevent1q…lvwf

2026-08-02T14:18:20Z

In reply to nevent1q…sev2
_________________________

quoting
nevent1q…lvwf
ColdCard is not open source which was exactly part of the problem. Open Source and Source Verifiable code are *not* the same and don’t offer similar benefits in terms of community involvement, more eyes reviewing, and more people building on that code.

https://dtvelectronics.com/source-available-software-is-it-dangerous/

I was thinking they may have had to recover it somehow from ...

2026-08-02T14:16:12Z

In reply to nevent1q…w9fe
_________________________

I was thinking they may have had to recover it somehow from somewhere. Either way

Nostr event nevent1qqst8xn8vd4kjc4x3e7uql4ghch63p3xvruyaznzvmw7ces6282592gpxamhxue69uhkuenyvghxummnwa5x2un99e3k7mf0d9h8getwwsaxuenyvghxummnwa5x2un99e3k7mf0we5kxar0wgpzqqmp9v8t4c8v35cqx8zypwsg0lum693fvt0lhf9kuqs7cjhawyskd7uqgu

2026-08-02T14:13:40Z

There's enough negativity in the world. Don't add to it.

Nostr libraries look pretty good, so far. #nevent1q…nn7w

2026-08-02T14:10:26Z

In reply to nevent1q…q22t
_________________________

Nostr libraries look pretty good, so far.

quoting
nevent1q…nn7w
The keygen for all of the libraries I have used draw full 256-bit values from OS CSPRNGs. Code audited:

# JavaScript / TypeScript

* nostr-tools (versions 2.15 – 2.23.5)
* @nostr/tools 2.20.0 (the JSR-published variant of nostr-tools)
* @nostr-dev-kit/ndk 2.14.35 (+ ndk-cache-dexie)
* @contextvm/sdk —(ContextVM signer, wraps nostr-tools)

# Go

* go-nostr (nbd-wtf) (v0.27.0, notably older)

# Kotlin / JVM

* no Nostr library; direct implementation on top of ACINQ secp256k1-kmp 0.17.3 (plus BouncyCastle in the Android app)

# Elixir

* no Nostr library; implements on top of lib_secp256k1 0.7.1

# PHP

* swentel/nostr-php 1.9.4 (server side; pulls in elliptic-php)

# Python

* python-nostr

Nostr event nevent1qqsqqqqq9erhk78065pn9jzkuh6fkn366evng7parrgagptwvkf9c3gpxamhxue69uhkuenyvghxummnwa5x2un99e3k7mf0d9h8getwwsaxuenyvghxummnwa5x2un99e3k7mf0we5kxar0wgpzqev6wnmvl0ruy5k93kf522uaj467xmzxf2n9gnrrw538eytx5mkejlh0ae

2026-08-02T14:10:13Z

In reply to nevent1q…4ac4
_________________________

The keygen for all of the libraries I have used draw full 256-bit ...

2026-08-02T14:09:39Z

The keygen for all of the libraries I have used draw full 256-bit values from OS CSPRNGs. Code audited:

# JavaScript / TypeScript

* nostr-tools (versions 2.15 – 2.23.5)
* @nostr/tools 2.20.0 (the JSR-published variant of nostr-tools)
* @nostr-dev-kit/ndk 2.14.35 (+ ndk-cache-dexie)
* @contextvm/sdk —(ContextVM signer, wraps nostr-tools)

# Go

* go-nostr (nbd-wtf) (v0.27.0, notably older)

# Kotlin / JVM

* no Nostr library; direct implementation on top of ACINQ secp256k1-kmp 0.17.3 (plus BouncyCastle in the Android app)

# Elixir

* no Nostr library; implements on top of lib_secp256k1 0.7.1

# PHP

* swentel/nostr-php 1.9.4 (server side; pulls in elliptic-php)

# Python

* python-nostr

GM Bird Yeah not a good look at all I hope you have a great day

2026-08-02T14:08:37Z

In reply to nevent1q…asek
_________________________

GM Bird
Yeah not a good look at all
I hope you have a great day

WORD5 #667 4/6* (Hard Mode) ⬛⬛🟧⬛🟧 ⬛🟧🟪🟪⬛ ...

2026-08-02T14:07:11Z

WORD5 #667 4/6* (Hard Mode)

⬛⬛🟧⬛🟧
⬛🟧🟪🟪⬛
🟪⬛🟪🟪⬛
🟪🟪🟪🟪🟪

https://otherstuff.ai/word5/

Seems likely to me that there are multiple adversaries here and ...

2026-08-02T14:04:51Z

Seems likely to me that there are multiple adversaries here
and the amount of BTC that's been stolen is larger than we know.

It's just that the attack became widely known and ONE of the attackers had to grab the loot and spill the beans

quoting
nevent1q…ugem
Holy hell…what are the chances someone has been secretly running a script to find funded ColdCard seeds for years and it was only just now accelerated to a full-scale attack due to AI?

GM

2026-08-02T14:04:07Z

In reply to nevent1q…28ht
_________________________

GM

GM

2026-08-02T14:03:36Z

In reply to nevent1q…qv99
_________________________

GM

That’s too bad. It really does feel worse than a scammy ...

2026-08-02T14:03:26Z

In reply to nevent1q…cfqx
_________________________

That’s too bad. It really does feel worse than a scammy exchange. He’s one of us 🥲

No I wish. That guy is hilarious

2026-08-02T14:02:02Z

In reply to nevent1q…ux72
_________________________

No I wish. That guy is hilarious

Hang in there. Wish you were in my neighborhood, I’d come eat ...

2026-08-02T14:01:54Z

In reply to nevent1q…ltv9
_________________________

Hang in there. Wish you were in my neighborhood, I’d come eat all the time. 🧡

12 words is also enough

2026-08-02T13:35:37Z

In reply to nevent1q…s0lt
_________________________

12 words is also enough

ColdCard is not open source which was exactly part of the ...

2026-08-02T13:58:19Z

In reply to nevent1q…jghn
_________________________

ColdCard is not open source which was exactly part of the problem. Open Source and Source Verifiable code are *not* the same and don’t offer similar benefits in terms of community involvement, more eyes reviewing, and more people building on that code.

https://dtvelectronics.com/source-available-software-is-it-dangerous/

It’s quite easy. I was able to do it. I believe in u

2026-08-02T13:48:57Z

In reply to nevent1q…0cjs
_________________________

It’s quite easy. I was able to do it. I believe in u

The signs were always there 🎯

2026-08-02T13:43:21Z

In reply to nevent1q…ac8g
_________________________

The signs were always there 🎯

I included justice and excluded vengeance, yes. What God decides ...

2026-08-02T13:42:04Z

In reply to nevent1q…9fq3
_________________________

I included justice and excluded vengeance, yes. What God decides justice will look like is up to Him, tho. He has a larger plan.

Is Gege on nostr?

2026-08-02T13:39:25Z

In reply to nevent1q…0plk
_________________________

Is Gege on nostr?

Man. Same. Dice rolls kept my mk3 safe. I have a fresh, unopened ...

2026-08-02T13:38:44Z

In reply to nevent1q…ppqt
_________________________

Man. Same. Dice rolls kept my mk3 safe. I have a fresh, unopened Mk4 that has been sitting in my desk for years, but now I WON’T be migrating to it. Firmware update or not.
Once my new wallet arrives, the house shall be rid of CC walletry.

Generate your passphrase the same way as you did for your seed. ...

2026-08-02T13:36:08Z

In reply to nevent1q…u28k
_________________________

Generate your passphrase the same way as you did for your seed. Use 7-8 words for it. All lowercase, no spaces

Thanks for the clarification!

2026-08-02T14:24:49Z

In reply to nevent1q…anjp
_________________________

Thanks for the clarification!

I got the coinkite email. Alias email used and my last order was ...

2026-08-02T14:24:10Z

I got the coinkite email. Alias email used and my last order was before the Q was released.

One better is to download TailsOs use a dedicated laptop that ...

2026-08-02T13:34:33Z

In reply to nevent1q…s0lt
_________________________

One better is to download TailsOs use a dedicated laptop that doesn’t connect to the internet (take the WiFi card out) boot it into tails and use another usb stick to load up https://iancoleman.io/bip39/. Download the html and open in the tor browser

Well, we have social proof for new keys, which is not nothing. ...

2026-08-02T13:29:43Z

In reply to nevent1q…gxvr
_________________________

Well, we have social proof for new keys, which is not nothing.

Gzuuus (npub1gzu…a5ds) was talking about using a kind to create a social proof list of signers, who can publically validate a key, and then also validate the new key. Clients could automatically update follow lists, accordingly.

But now it became a race against the clock thanks to AI.

2026-08-02T13:28:42Z

In reply to nevent1q…j992
_________________________

But now it became a race against the clock thanks to AI.

Rodolfo is going to prison.

2026-08-02T13:27:09Z

In reply to nevent1q…lusf
_________________________

Rodolfo is going to prison.

Yeah, this is why my Android app only allows Amber or Bunker ...

2026-08-02T13:18:33Z

In reply to nevent1q…tc5m
_________________________

Yeah, this is why my Android app only allows Amber or Bunker sign-in. Need to remove nsec sign-in from my web app. Had it for testing, but it's not worth it.

Gonna go check them all and update. I think we use nostr-tools everywhere, but I'll check that, too.

And then I'll run my AI over Amber and nos2x-fox.

I do. It's a cool theme

2026-08-02T13:11:07Z

In reply to nevent1q…wqac
_________________________

I do. It's a cool theme

Nostr event nevent1qqsfnzjtmm3djex4atet6uyxkc9tc0uj98f6aj2urnghxat32ejuh0spxamhxue69uhkuenyvghxummnwa5x2un99e3k7mf0d9h8getwwsaxuenyvghxummnwa5x2un99e3k7mf0we5kxar0wgpzpmnw5yatnljuff5w47d35d87q99xddqpzlzsac4xzn6vm22ekmn5ljhuq2

2026-08-02T13:06:25Z

quoting
nevent1q…keew
whoa. it's been happening the entire time and went largely un-noticed until it went full mask off execution

How many years of forest fires are we going to have before forest ...

2026-08-02T13:05:15Z

How many years of forest fires are we going to have before forest management gets some real money to do the job correctly?

Book Sinart!

2026-08-02T13:04:05Z

In reply to nevent1q…8yhf
_________________________

Book Sinart!

You should be fine yes

2026-08-02T12:59:58Z

In reply to nevent1q…wfd2
_________________________

You should be fine yes