semisol

Actually no they can’t RBF the transaction.
They could CPFP though (basically spend their own output with a lot of fees, making replacement very costly).

2025-01-27 08:52:53 UTC

Oh look we’re reinventing what made the Fediverse trash: Making data portability hard by tying things to relays specifically.
Opt out of NIP-29. #note177u…8dck

2025-01-21 01:28:21 UTC

There is a patent on a specific way of calculating the carry bit on an adder
What the fuck

2025-01-15 18:15:14 UTC

- reply

semisol.83

2025-01-15 18:14:53 UTC

- reply

WPA3-Enteprise means you could route different users (guest/yourself) to different VLANs, and also if you have multiple guests, give them different credentials. You can also expire credentials after some time, etc.

2025-01-15 18:12:48 UTC

- reply

SimpleX works too though

2025-01-15 18:12:31 UTC

- reply

That was what I DMed you about… :)
Do you use Signal or TG or Matrix instead?

2025-01-15 18:03:23 UTC

- reply

What I really want to do is WPA3-Enterprise + an e-ink display with rotating credentials.

2025-01-15 17:57:34 UTC

- reply

Please check your DMs

2025-01-15 17:54:17 UTC

- reply

Also, it’s less the language more concepts. But a lot more things support Verilog afaik.

2025-01-14 18:00:57 UTC

It is not.
“I run my own node on Linux btw” is. #note1d50…nf6w

2025-01-13 19:02:27 UTC

- reply

you receive a possibly completely bogus IOU to real sats before you need to redeem it for real sats
ftfy

2024-11-15 06:57:47 UTC

We need community notes for Nostr

2024-11-15 00:08:36 UTC

- reply

Truly… the problem is they still use broken SEs

2024-11-14 20:31:45 UTC

You can still register for the beta-test of my signing card, using security certified chips. Expecting samples ready by late 2025 Q1.
It also uses a custom platform with security-by-design, compared to the development approach of most other signers.
No bullshit claims, no cutting corners, no overpriced hardware.
https://forms.office.com/r/CxzzG4Wqam #note1655…pgxy

2024-10-31 22:19:00 UTC

- reply

Write a memory test program that stores 4092 bytes and a CRC

2024-10-22 21:28:54 UTC

promoting your project (esp. for monetary gain) should not become your primary project
a lot of things in bitcoin have gone wrong because of that: HWWs, shitty grant funding schemes, podcasts, confs #note1z0q…md58

2024-10-21 05:34:42 UTC

- reply

You know, you could move the entire signing process onto the card, and I am doing that
You are forgetting that the average user can need to sign up to 5 events/sec. AUTH, media uploads, etc

2024-10-17 20:30:41 UTC

Please fill this short survey if you can related to my in development signer, and renote for visibility.
You can also register for testing for early access + a free signer (only shipping) in what I expect to be late 2025 Q1.
https://forms.office.com/r/CxzzG4Wqam

2024-10-17 17:25:37 UTC

Most people think they are paying $150-$200 for an HWW.
What they are paying for is an overpriced gimmick with a very small amount of security added.
All the major HWWs, including their latest revisions, use insecure SEs or ones which a viable attack exists for.

2024-10-16 22:14:44 UTC

uploading a 1MB image and having it be loaded 2000 times (just appear for a second, especially on apps without cache, on every view by the same person) will eat 2GB+ of your mobile data
the sheer amount of stupidity on here is insane #note1vlt…sa7c

2024-10-14 01:09:05 UTC

- reply

That does not matter
We are verifying that their Nostr identity is linked to a known good identity (their twitter handle with a lot of followers)

2024-10-14 00:59:34 UTC

- reply

If you can’t verify then don’t say shit I guess
The end result will be nostr getting a reputation for fake and scam accounts

2024-10-14 00:58:59 UTC

- reply

Nitter

2024-10-14 00:30:49 UTC

it is funny watching people trust and not verify
is it really that hard to check for a tweet or something? #note1wdc…cnxj

2024-10-13 17:31:46 UTC

We are going back to centralization with relay = communities

2024-10-12 22:46:22 UTC

the only way to make a secure hardware wallet is by not being able to leak what you don’t know
:) #note1e5e…qske

2024-10-12 22:32:26 UTC

preventing side channel attacks is really fucking hard

2024-10-12 18:48:10 UTC

- reply

Yes, that is the only option. You must add the relay used by the NWC server I believe

2024-10-10 13:19:02 UTC

- reply

WoT is pointless for resumes

2024-10-09 22:02:35 UTC

- reply

I love it for being explicit when you ignore and when you handle (with no other option) and hate it for being repetitive

2024-10-09 21:40:46 UTC

- reply

fuck. s/n nil/n err/

2024-10-09 21:40:20 UTC

- reply

if err != nil {
return nil
}

2024-10-09 17:03:39 UTC

it will be bad when a client’s domain gets compromised and nsecs leaked via an attack
so people will switch to web based signer apps
then they will be compromised
the only way out is a proper hardware signer, a proper remote signer or a browser extension

2024-10-09 16:53:32 UTC

Go is the way for backend.
Kotlin when you need it.
C will stick around forever for some use cases because it is very close to machine code. #note15u7…ylv8

2024-10-09 16:51:22 UTC

- reply

Verify performance?

2024-10-09 14:28:18 UTC

- reply

I think not being burnt out is more important
There’s moderation work, and clients also want features, then you need to make sure it runs stably, etc.

2024-10-09 13:12:30 UTC

- reply

did you hear about static or dynamic analysis? 😆

2024-10-09 05:43:14 UTC

- reply

to be able to have AI scan vulnerabilities means that it needs to be able to build a map of the application logic, how every small detail interacts and how these may combine into an exploit chain
that is not possible with a text predictor

2024-10-09 05:34:03 UTC

- reply

nostr.build already has file search, along with filtering my category and folders

2024-10-08 20:56:32 UTC

- reply

Why use a HWW then?
You need to store the seed backups somewhere, may as well use SeedSigner with the seeds

2024-10-08 20:37:39 UTC

- reply

yes, they have, the SE2 used by CC Mk4 is broken (source: Coinkite), and SE1 also has been broken (source: a talk by the Ledger Donjon team)

2024-10-08 20:26:25 UTC

- reply

Plug it in, authorize the client, then you can manually approve from the app or auto approve certain kinds.
A hardware screen is not necessary for this use case. Manually verifying for every AUTH event or reaction is going to make the UX shit.

2024-10-08 20:18:14 UTC

- reply

both SEs are vulnerable to laser fault injection and lack basic protections that has existed in any credit card for the last 15 years

2024-10-08 20:17:09 UTC

- reply

yes, the only case it could work with unnecessary complexity is where you use a remote signer, each client maintains state locally, and you remove a client
in this case you can also do the following which is easier: rotate the secret used for encryption

2024-10-08 19:06:09 UTC

- reply

actually, wrong term
I meant forward security
post compromise security is interesting, but it is not applicable in nostr

2024-10-08 18:58:56 UTC

- reply

NIP-04 and the likes work (not that they are good, especially gift wraps) but they have no post compromise security

2024-10-08 18:55:36 UTC

- reply

both of them are IoT grade shit (and at least one lacks any CC certification) that don’t have the same basic protections as any credit card within the last 15 years

2024-10-08 18:54:34 UTC

- reply

both of them have viable laser fault injection attacks meaning you only need the expensive (probably $300k max) equipment, but that’s nothing as you can reuse it for as many wallets as you prefer

2024-10-08 18:50:38 UTC

The idea that an HWW’s security hinges on the secure element only is insane

2024-10-08 17:28:58 UTC

the devs say “go make a better one yourself” because they are too incompetent to do that themselves

2024-10-08 17:27:28 UTC

- reply

didn’t get the pgp key + email yet though
or signal

2024-10-08 17:27:02 UTC

they are too busy making the 37th ecash wallet that looks like it was named by an immature idiot to fix real issues #note1wzx…spmg

2024-10-08 15:44:40 UTC

- reply

security is a layered approach
one of them is having a secure element
there’s more that I will publish later :)

2024-10-08 15:41:14 UTC

Shredding a credit card does not make it unusable

2024-10-08 15:25:28 UTC

- reply

localhost websockets

2024-10-08 15:25:11 UTC

- reply

That is what I mentioned in my post as not a shitty ESP32

2024-10-08 15:12:48 UTC

- reply

Unfortunately the culture of quantity over quality exists here

2024-10-08 15:01:07 UTC

Welcome to Nostr
Fast paced low quality half working projects are incentivized more than quality products that take months to build #note1jma…uagf

2024-10-08 14:15:55 UTC

- reply

Memory bandwidth contention manifests itself as a drop in performance across all cores after some threshold :)

2024-10-08 12:18:31 UTC

The benefit of a proper hardware solution is that:
- unlike nsecBunker, nsec.app and browser extensions, the impact of malware is limited
- unlike nsec.app your keys cannot be stolen by the app developer with a silent update
- unlike other “hardware” nostr signers, it doesn’t store keys in an easily dumpable ESP32 #note140n…uhlv

2024-10-08 12:00:44 UTC

- reply

Electric car fires are the worst.

2024-10-08 08:03:02 UTC

- reply

we do not need that either
it also supports negotiation
you set a list of protocols to request, server sends a protocol picked or none as a response

2024-10-08 08:00:23 UTC

- reply

websockets already support a protocol header

2024-10-08 07:35:10 UTC

- reply

We can have a version field also.
Version 1: just normal Nostr events, signed as usual
Version 2: fields can now contain non-UTF8 content, new signing scheme

2024-10-08 05:37:01 UTC

- reply

I’m on iOS 17 though. It works fine with HEIC also from Damus. But it most likely is a color space issue.

2024-10-08 05:32:14 UTC

- reply

Uploading from the account page specifically seems to remove color profile data for some reason. https://os.hel1-c1.semisol.net/static-n/color-profile-test.png

2024-10-08 05:25:19 UTC

p3 test https://i.nostr.build/D1ynVdfBut0sU6Dy.jpg

2024-10-07 18:07:13 UTC

- reply

I’ll DM you an explanation for my idea that will end up never finished soon. 😂

2024-10-07 17:44:16 UTC

- reply

3.*

2024-10-07 17:43:50 UTC

- reply

2. No.
All chips have some sort of hardware boot ROM, from your CPU to a Raspberry Pi to the STM32s used in a lot of HWWs including CC.
RPi boot ROM cannot be modified and such an attack would need to target your Pi specifically, which is impossible, and then somehow figure out a way to detect SS code and add a backdoor.

2024-10-07 17:38:41 UTC

- reply

Just to add, the code on a CC is not truly verifiable without destroying the unit

2024-10-07 17:34:33 UTC

- reply

yes, I’m also saying the new binary signature is another detached field like id/sig

2024-10-07 17:16:01 UTC

- reply

I was thinking you would add it to the original event

2024-10-07 17:03:51 UTC

- reply

the problem is with a tag you can’t add the faster signature later

2024-10-07 16:48:26 UTC

- reply

why?
we can just add a new field like “binarySig”, relays can validate both of them (and backfill binary signatures if later added by the author), and clients can pick one

2024-10-07 15:41:48 UTC

- reply

Please DM me an e-mail address to send further details to along with a PGP key for encryption, or a Signal link

2024-10-07 15:39:14 UTC

- reply

s/optional/not needed/

2024-10-07 15:38:59 UTC

- reply

Binary encoding: we keep compatibility with nostr events, just optimize JSON field names away
Binary events: breaking change in signing scheme that also means conversion to JSON is optional, tag values and event contents can now be binary

2024-10-07 15:32:50 UTC

- reply

Adding complexity means you use the emojis to derive a seed or convert the seed into binary then emojis

2024-10-07 15:31:09 UTC

- reply

That is about as secure as a 12 word seed.
Also, with a scheme like this it is not possible to do words and emojis at the same time unless you add complexity or use 22 emojis

2024-10-07 15:28:26 UTC

- reply

Also DM for testing if interested.

2024-10-07 15:21:05 UTC

- reply

256kb

2024-10-07 15:20:12 UTC

- reply

😂

2024-10-07 15:19:58 UTC

- reply

Partitioning is probably the best idea.
I’m thinking we need a binary version of Nostr events (not binary encoded events), for cases where it’s not complicated enough to involve a system like Blossom, but also would benefit from binary encoding like encrypted events.

2024-10-07 15:17:08 UTC

Have been working on a secure (not some shitty ESP32) signing device over the last few months.
Expecting it to be ready for testing in Q1 2025. DM for more information. #note12ms…w40j

2024-10-07 14:08:36 UTC

- reply

https://xyproblem.info

2024-10-07 14:07:38 UTC

- reply

nostr.land does not :)

2024-10-07 14:07:07 UTC

- reply

What’s the use case?

2024-10-06 23:56:32 UTC

- reply

eithet this has existed for a while and I implemented it and completely forgot, or it’s new