Oren ☂️ #BIP-128

If you cross paths with two black cats on the same morning, do they cancel each other out? #Catstr #Cat

There are three reasons to keep your savings in a bank:

1. Investment opportunities. Banks offer relatively safe investment options, but their safety depends on a stable political system that prevents politicians from changing the laws to seize your savings.
2. Inflation protection. Banks may give you tools for offseting an artificially created inflation (money printing), which would otherwise be a hassle to manage on your own.
3. Physical security. Keeping your savings at home exposes you to the risk of theft or physical violence.

The Western world has been operating under reason 2 for a long time. I think we're now transitioning to reason 3.

#Bitcoin

A good, concise summary of what happened on October 7, 2023.

No gore, no emotional propaganda, and no stupid conspiracy theories.

https://urikurlianchik.substack.com/p/understanding-october-7

#dev #devstr #ai #jev https://blossom.primal.net/944c6df664f724b8ccecc0c6110345bcd517bc86b328d7f7a136f69fc937ecec.jpg

Renewing my license against wrench attacks

🥷🔧 - - - - 🔫🤠

I like the "What would you look like in the 80s" trend 📈

1 BTC = 1 BTC 1 LBTC = 4000 LBTC - 3999 LBTC

https://mempool.space/tx/83825b2135dd0abac12c9dfe17f29ab81b3427e1ae864947b0bebce5e47c3c4b?mode=details

😭 https://blossom.primal.net/cc3b3f5cf5cec127ee93e2d6f19a43eb7261b5b055a9b095fc23e55abe1997aa.jpg

Spam bots are back? I get endless notifications after my last note on #Ditto 😢

If anyone wants to publish it on #Zapstore, let me know.

#dev #devstr

Are you excited about the recent Bitcoin surge? Do you check the price before you even get out of bed?

I vibe-coded an Android alarm clock that wakes you with happy music if BTC went up overnight, and sad music if it went down.

Set it once, every day, or chosen weekdays. At alarm time it fetches BTC/USD, then plays Number Go Up or Number Go Down on the Android alarm stream. Press Stop and it reads the price.

Play: https://play.google.com/store/apps/details?id=com.ritrek.btcpricealarmclock

Open source: https://github.com/ritrek/ritrek-btc-price-alarm-clock-app

GM to all fiat miners out there! #FiatMining

GM to all fiat miners out there! #FiatMining files.niot.space/4_5814628726503120982.mp4

If a future #AI loses control and starts philosophizing, it would probably build a simulation of the years that led to its birth.

What are the odds of being alive during those exact years? #showerthoughts

Pop&Pope restaurant #foodstr #TelAviv https://blossom.primal.net/2c2a3421a6cd605135e32c5136369de627b2137d5e723eee28f45ed384c035ba.jpg

I initially wanted to build the TimelockRecovery.com feature for Sparrow Wallet, one of the most popular wallets for advanced Bitcoin management, including multisig, air-gapped wallets, and more.

But Sparrow is written in Java, and I've never worked on a large Java project, let alone one with a UI.

So I implemented it in Python for Specter and Electrum instead.

This week, I fed Grok and Fable the source code from Specter and Electrum and told them to replicate the mechanism in Java for Sparrow.

A few prompts later, with some tiny improvements, and it works perfectly! 🤩

As a developer, it feels like knowing a few words of Latin and suddenly being able to speak any Latin-derived language. We live in amazing times!

https://github.com/sparrowwallet/sparrow/pull/2063

#dev #devstr #Bitcoin #BitcoinDev #Electrum #ElectrumWallet #Specter #SpecterWallet #Sparrow #SparrowWallet #AI

I'm a shy Israeli who won't do this, but I definitely know others who do - and it usually works for them. #Israel #rules

Ping

https://github.com/fiatjaf/nos2x/pull/86

#dev #devstr #nostrdev #nostr

The idea that multisig wallets are created by importing xpubs (Zpubs) to a hot online computer and building the wallet descriptor there - is absurd. That computer can manipulate the xpubs of some of the signers, add another xpub inside the QR code that doesn't appear in text form, change the number of required signers, etc. Most users won't notice the difference on their small hw wallet display, and won't verify a receive-address on all wallets (i.e. hacker can replace one of the xpubs with his own, and could fool you into sending funds to an address where they are a co-signer).

The wallet descriptors should be generated on the hardware wallets themselves, with clear instructions how to verify them on all other hw wallets.

https://github.com/cryptoadvance/specter-diy/issues/385

We will never see $69,420 again.

He had won the victory over himself. He loved Big Bitcoin.

Bitcoin Plebs: Coldcard really fucked up. I want a simple way to store my Bitcoin using a multi-vendor setup that requires approval from two different hardware wallets - especially for the stash I'm not planning to touch for the next 10 years.

Bitcoin Devs: You should use a 4-of-5 multisig where one of the keys is held by a third party, with a Miniscript decaying timelock that switches to a 2-of-5 policy after six months. Just remember to rotate the UTXOs every ~5 months. Oh, and use Taproot to obfuscate the full vault mechanism - most hardware wallets already support it. AND DON'T FORGET TO BACK UP THE DESCRIPTOR. YOUR FAMILY WILL NEED IT IF SOMETHING HAPPENS TO YOU!

#dev #devstr #Bitcoin

To help customers protect themselves after their home addresses were leaked, Trezor will send each customer a bullet engraved with their name.

There are ~8.3 billion people in the world. Optimistically, you're going to live ~90 years.

The amount of attention you can spend on every person in the world is ~0.34 seconds.

Browsing to Nostr websites from

is great, but please update the NIP-44 support.

https://betwithfriends.niot.space

#dev #devstr #bug #bugstr

Hardware wallets are hard to hack but can have disasterous bugs. Hot Phone wallets are safer against bugs (can be fixed via online update), but can have disasterous hacks.

For example, while creating a 2-of-2 multisig on a hot phone wallet, the phone can show you a fake seed unrelated to the its declared xpub, and hide the real seed internally. At some random point, the phone can get a remote command to blackmail you, and only then you will realize you don't really have the real seed.

People won't buy more than 1 hardware wallet, and I don't know how to solve this issue. Maybe UX for the Phone Wallets that shows a seed + xpub, and let you decide whether to use it or pick another one? You could enter a few seeds that the phone generated into the hw wallet just to verify that the phone didn't try to cheat, then use the last one without entering it to the hw wallet. Or maybe covenants?

vibe-coded a tool to test your air-gapped wallet (

,

) against basic #DarkSkippy attempts: create fake PSBTs with a fake seed, and see if the HW wallet returns the expected signature and does not try to leak data:

https://niot.space/exfil-tester.html

Obviously you should also verify the firmware's pgp, and this tool does not cover sophisticated #DarkSkippy attacks (i.e. that try to leak data only in certain conditions, like in transactions of specific amounts, or multisig setups).

Thanks to

for building darkskippy.com and creating a real-world example.

Mood 😅

I've added a SECURITY.md file to https://github.com/oren-z0/holesail-switchboard repo of the Umbrel app https://apps.umbrel.com/app/holesail-switchboard - can you please scan the repo (and the holesail project that it wraps) for vulnerabilities?

#RedTeam #BitcoinRedTeam #dev #devstr

The "default" Bitcoin wallet should be a 2-of-2 wallet, with 12-words seed on your smartphone and another 12/24 words seed on your hw wallet. No "wallet descriptor" to backup. The number of words to backup could even remain 24.

Just add instructions: Enter this list of words in your phone, and that list of words in your HW wallet.

Smartphones are 99% secure. HW wallets are responsible for adding the extra 1%. Two vendors have to fail for this solution to break.

If #Bitcoin is your entire life savings then maybe you need a full multisig of 3 or 4 vendors. This is not the case for most Bitcoiners.

WDYT?

#dev #devstr

Fixed the redirection: runs(dot)wtf

https://runs.wtf

Bought the domain: https://runs.wtf

Coinkite code review process 🇨🇦

#meme #memestr #iykyk

So far, around $72 million has been stolen from #Coldcard wallets.

That’s equivalent to a whole 31 minutes of growth in the U.S. M2 money supply!

Quote of the day

Even almost-trivial passphrases are helpful because greedy hackers will first steal Bitcoin from similar wallets without a passphrase, giving you with an advance notice... #coldcard

#lol #lolstr

If you are going to make bets with your friends on the next 🇦🇷 Argentina vs 🇪🇸 Spain game, check out my new website:

https://betwithfriends.niot.space

Login with your Nostr profile (or create a temporary nsec), design your page, add betting options, and share the page with friends. Each friend will zap you his choice and provide a lightning address to get their reward. You, as the page admin, are trusted to select the winning option and pay the rewards proportionally (the website will do the math for you). The bettors don't even need a Nostr profile. Everything is encrypted with a key in the page url, so relays can't see much of what's going on inside the page. #dev #devstr #WorldCup #football

I think X just updated the app to look like #Amethyst

Huge for every programmer #dev #devstr

https://x.com/i/status/2077142587903783398

Would appreciate a review:

https://github.com/nostr-protocol/nips/pull/2415

https://betwithfriends.niot.space

#dev #devstr #nostrdev

Having to use #nostr as a backend database, to avoid legal risk when you want to publish an open-source website/app, is basically the government telling you: "It's ok to publish this project but only if the database is unreliable." 🤔 #showerthoughts #dev #devstr

Haaland has been eliminated by England and is now climbing the beanstalk back to his home in the clouds. #haaland #football #sport #sportstr

Claude Fable 5 is amazing. Makes me want to join The Fablian Society. #dev #devstr #ai

Just finished fabelling this over the weekend:

https://betwithfriends.niot.space

Create private gambling pools for friends (who trust you not to steal from them). Bettors don't even need a Nostr profile, just a lightning wallet.

Beta version - don't use with large amounts, and don't invite unknown users.

#dev #devstr #nostr #nostrdev #lightning #fable #ai #vibecoding

Let me know what you think!

Happy Independence Day to all you air-conditioned Americans!

IT'S FREEDOM OR HEAT STROKE!

#USA #America #July4th

NEVER SELL YOUR BITCOIN NEVER SAYL YOUR BITCOIN NEVER SAYL OR BITCOIN NEVER SAYLOR BITCOIN SAYLOR'S BITCOIN

Bitcoin is just like football.

Actually, it isn't, but I guess someone needs to post these kinds of forced metaphors during World Cup games.

If you want to make #Nostr app developers lose their mind, open their latest app and post the message "[object Object]". 😈 #devstr

Trying #Ditto

What

's talk on

felt like:

#FreedomTechSummit

If you're worried that the world is getting dumber, remember that it was always kind of dumb. (From Prague's Communism Museum)

Home

Do you know what's worse than getting pooped on by a bird? #Prague

Bitcoin Flow demo: Visualize transactions as a flow graph, and create PSBTs with drag & drop. #FreedomTechSummit #FreedomTechSummit2026

#FreedomTechSummit #Failstr

What is #ditto ?

New #ZCash symbol

#LOL

Hey

, it seems I can't send lightning payments above ~1500 sats. Is it possible to control the max fee for lightning payments?

June 21st is the International Yoga Day. Could be fun to organize an online Yoga session for Bitcoiners. #Yoga

"How did I get rich? From the Bitcoin..." A ad in Tel Aviv telling people they won't have to tell others that they were just lucky and won the lottery - instead they could appear smart by lying that they invested in Bitcoin. 🤦‍♂️ #Lottery #Bitcoin #TelAviv

Is it legal to take a lunch break in the middle of a git rebase? 🤓 #dev #devstr #lolstr

I've heard Silent Payments are great for privacy to avoid address reuse and hide your UTXOs from strangers. How do I create a silent-payment receive-address in my Binance wallet? #Bitcoin #dev #devstr #asknostr #silentpayment #silentpayments #binance

Vibe-coded features on #BitcoinFlow :

• See relative & absolute Locktimes
• See absolute fees
• Links to multiple block explorers
• Upload and see PSBTs!

If you are signing complicated chains of PSBTs, you can verify that every input is indeed connected to the intended output (an existing UTXO or another PSBT).

Next step would be create PSBTs visually! Including chains of PSBTs!

#Bitcoin #dev #devstr

https://bitcoinflow.niot.space

Weird Discovery: I was working on my https://bitcoinflow.niot.space explorer and wanted to add an example for a Coinbase transaction. I found this recent article about the lucky solo-miner of block 943411: https://bitcoinfoundation.org/news/bitcoin/solo-miner-one-block It had a link to a previous lucky solo-miner, a week earlier, of block 938092, which I also loaded to the explorer.

Then I noticed that their second output goes to the same transaction! Which has another "solo-miner" input from less than a week later. Look at inputs 1-3 of the following tx: https://mempool.space/tx/bd0c2d021bc9408948569fb8b02340a1adc4db7f196fcde3f2b694286085f2f6 They all come from a "solo-miner". The odds that the same solo-miner found 3 blocks within 2 weeks are astronomically low, right? So it's either not really a solo-miner, or different solo-miners that for some reason decided to give some of their profit to the same entity. Or I'm missing something? #asknostr #Bitcoin #dev #devstr

Wow, #lightning 2nd layer is delicious. #foodstr

Holesail-Switchboard lets you open P2P #lightning channels on #Umbrel without a public IP address and without relying on unreliable Tor. Follow these steps:

1. On both Umbrel nodes, install: one of Bitcoin node apps (tested with Core), one of the Lightning apps (tested with LND) and the Holesail-Switchboard app: https://apps.umbrel.com/app/holesail-switchboard
2. On the channel-destination node, open Holesail-Switchboard and click Add Server with Host: "lightning_lnd_1" and Port: "9735". Do not enable the Secure checkbox (This option is designed for hiding both ends of the connection using a symmetric key. In this case, you want a public key so others can reach your node). This will generate an "hs://0000..." connection URL that others can use to connect to you.
3. On the same node, open the Lightning app, click the 3 dots in the top-right corner, and select Node ID. Under the Tor network section, you will see: "@.onion:9735". We do not need the ".onion" address, but we do need the "lightning-public-key" part, which identifies your Lightning node.
4. On the channel-source node, open Holesail-Switchboard and click the ✏️ icon on one of the clients. Paste the "hs://..." connection URL and note the assigned local port (for example: "3161").
5. Finally, in the Lightning app, open a channel using: "@10.21.0.20:". Example: "[email protected]:3161" (the 10.21.0.20 ip belongs to the Holesail-Switchboard app - I've tried different local hostnames but it didn't work for me).

That's it! You now have a lightning channel that uses #holepunch technology, doesn't rely on a static public ip address, and much more stable than #TOR.

#dev #devstr

Who's running an #Umbrel and wants to try opening a lightning channel over #holesail with me? You'll get inbound-capacity and some free sats.

#dev #devstr #pear #holepunch

US national debt hit $39 trillion on May 1st

https://www.usdebtclock.org/

Finally, it's easy to open your home

machine to remote users, without relying on slow & unstable TOR, or getting a static public ip address (and configuring port-forwarding on your routing) - using #holesail technology. The UI allows you to open other Umbrel apps to the world by generating a hs://... URL, to which you can connect from any computer via npx holesail --connect hs://... --host localhost, or via the Holesail-Go smartphone app. The UI also runs as a client, and lets you redirect connections to umbrel.local: to a remote hs://... URL.

I want to do an experiment and open the first lightning channel via holesail, between two #umbrel machines which are both behind a home router (NAT). Who wants to join?

(P.S. don't ask me how holesail works behind the scenes, I only wrapped it with UI and published to the Umbrel app store)

#dev #devstr #lightning #Bitcoin #holepunch #noderunners

https://apps.umbrel.com/app/holesail-switchboard

https://cdn.nostrcheck.me/d8762ea68256fd5dd610f4c6e22cfb6a7fe5825d0966b7bc531e9ddd5af0a4c9.webp https://cdn.nostrcheck.me/672a59af2714cf791ad384fbbe7b440de352777759225dd090dfc34e05d08f47.webp #memestr #alwayshasbeen #warstr

The Fourth Turning

https://deathbyclawd.com/

#ai

https://x.com/i/status/2038001920833421435

Bitcoin won't end wars, but it will allow predicting them accurately.

https://www.ynetnews.com/article/sjjp4m7o11l