SkateSpots Drop #004

It's a WEEKLY newsletter and we ship whenever the f*** we want — and this week the whole 'trustless hardware' cult got its seed phrases enumerated on a rented GPU. While the Bitcoin influencer complex was busy filming themselves whispering 'not your keys, not your coins' into a $400 microphone, ~$88 MILLION walked out of Coldcard wallets through a random number generator that forgot how to be random. We, meanwhile, taught a Sasquatch to plan your skate trip, built you a real crew, and made the app stop face-planting. Priorities.

What shipped

PSA: your $150 'unhackable' brick may have been rolling loaded dice since 2021

Not Financial Advice

In case you were online this week: a firmware flaw made certain Coldcard hardware wallets skip their actual hardware random number generator and quietly fall back to a software one seeded off the chip's serial number and clock. Translation: seeds that were supposed to be 1-in-2²⁵⁶ collapsed to a space you can brute-force on a couple of rented GPUs in a weekend. An attacker regenerated candidate seeds OFFLINE, matched them to funded addresses on-chain, and swept 1,367 BTC ($88M) from 4,500+ wallets — without ever touching a single device. Affected: Mk2/Mk3 on firmware 4.0.1+, and Mk4/Q/Mk5 on older builds. Not affected: anyone who used the boring dice-roll option. The nerds who rolled 50 dice like dorks and got clowned for it are the only ones sleeping tonight. Skate lesson: the trick you practiced 500 times in the flat is the one that saves you in the street.

The 'not your keys, not your coins' guys have gone very quiet

Vibes

For years the hardware-wallet influencer complex sold self-custody as a personality — affiliate links in every bio, 'DYOR' tattooed on the forehead, a laser-eyes PFP screaming that touching an exchange makes you a peasant. Turns out you CAN own your keys, follow every rule, air-gap the thing in a Faraday bag inside a safe inside a mountain — and still get drained because a build flag skipped one function call. Self-custody is still the move. But maybe stop treating a mantra like it's a security audit. Cope, seethe, roll dice. SkateSpots holds zero of your Bitcoin and never will — the only thing we custody is a list of curbs.

Sasquatch went Pro — and it actually does stuff now

Sasquatch

The hairy one graduated from 'answers questions' to 'gets things done.' Sasquatch Pro is a read-only personal assistant that can look at your spots, crews and messages, then DRAFT actions for you — post a spot, reply to a gig — and hand them over for YOU to confirm before anything's signed or published. Nothing goes out without your tap. Your keys, your call. (See? We can say that sentence without it costing anyone $88 million.)

Trip Planner: tell Sasquatch where you're going, get a session

Sasquatch

New Trip Planner: give Sasquatch a city and it stitches together nearby spots, shops and any local events into an actual skate itinerary instead of you tab-hopping around the map like it's 2011. Land in a new town, ask, go skate.

Sasquatch Pro paywall — npub-bound, Lightning-gated

Sasquatch

Pro features unlock via a Lightning payment tied to your npub — pay once, it follows your identity, not a device or an account we could lock you out of. You get a receipt DM to your own inbox. Free tier still answers plenty; it just stops short of doing your homework for you.

Sasquatch no longer folds when the AI gets rate-limited

Sasquatch

When the upstream AI throttles us, Sasquatch now falls back to a local glossary + a backup provider instead of shrugging and dying mid-sentence. Ask about a trick, get an answer, even when the robots are busy.

The Trick Glossary got massively fatter

Glossary

We nuked the fake 'difficulty levels' (a switch isn't 'beginner' just because YouTube said so) and instead piled in way more tricks, terminology and hardware terms — corrected the wrong ones, added the missing ones. It's a proper reference now, not a listicle.

Skate Crews got a spine: proximity, rep, hiring & a treasury

Crews

Crews leveled all the way up. Proximity discovery surfaces crews near you. Activity and rep signals show which ones are actually alive vs which are two guys and a group chat. There's a hiring pipeline for gigs, crew-hosted events wired straight into the calendar, and reverse links so a crew's spots, events and members all connect. We also renamed 'Start a Crew' → 'Create Crew' and drew a clear line between a Crew (your people) and the Lab (hired guns).

Crew bands: your session has a soundtrack now

Crews

A crew can flag itself as a band / music project and take gig bookings — because half of skateboarding is the music and the other half is arguing about the music. Book the crew for the session AND the after-party.

Ripped out Geyser, wired in Angor across the whole app

Funding

Support-the-project funding now runs through Angor — decentralized, Bitcoin-native crowdfunding with no platform sitting between you and the sats. On-brand for a Nostr app: fewer middlemen, more direct. Every 'Supporters' surface in the app now points at Angor.

Two 'Profiles' were confusing everyone — so we unified them

Profiles

There was a public Profile page AND an Edit Profile screen and nobody could tell which was which. They're now clearly named and cross-linked: your public page has an obvious 'Edit' path, and editing shows you exactly what the world sees. Profiles also got richer — crews you're in, a bot flag, and CLINK contact links all render inline.

Real gig messaging + a best-in-class message picker

Messaging

Booking someone from the Lab or a crew now opens actual messaging instead of a dead end. The New Message picker got rebuilt so finding a person is fast and painless — search, tap, talk.

Profile page stopped hanging off the edge of your phone

Fix

Profiles were overflowing horizontally on narrow screens — sideways-scrolling into the void. Boxed in and behaving on every screen size now.

The Stash stopped crashing when you had no browser extension

Keys

A whole class of crashes traced back to the app poking at a nip44 encryption getter that isn't there when you're not using an extension signer. We stopped touching it on the render path entirely — check the login type and window.nostr directly instead. Your encrypted Stash opens without taking the app down with it.

First-launch beta disclaimer — because honesty is a feature

Beta

SkateSpots is v1.1.0 and proudly, loudly BETA. You now get a one-time heads-up on first launch and a little BETA badge in the footer. We'd rather tell you it's still cooking than pretend it's flawless — looking at you, 'production-ready' firmware.

Android versioning now auto-syncs — no more manual gradle rituals

Android

The Android version now derives straight from package.json, so ZapStore releases stop tripping over hand-edited gradle numbers. Boring, load-bearing, and the only reason new builds keep landing on your phone.

Community

No funds were harmed in the making of this newsletter, because we don't hold any of yours — SkateSpots custodies curbs, not coins. If you run a hardware wallet: check your model and firmware, and if you're in scope, migrate to a fresh seed you don't generate on a bad build. Then come map a spot. Everything syncs through wss://goskatespots.nostr1.com. Keep your keys, roll your dice, and keep skating.

---

Read every drop at https://skate-spots.org/#/newsletter