jimbocoin
jimbocoin 🃏

The SUPERCYCLE guy.

Public Key

npub1v9qy0ry6uyh36z65pe790qrxfye84ydsgzc877armmwr2l9tpkjsdx9q3h

Profile Code

nprofile1qqsxzsz83jdwztcapd2qulzhspnyjvn6jxcypvrl0w3aahp40j4smfgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsx9jz56

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1v9qy0ry6uyh36z65pe790qrxfye84ydsgzc877armmwr2l9tpkjsdx9q3h

Show more details

Last Notes

2026-08-02 15:49:26 UTC

A hardware wallet has ONE JOB: to protect your seed material from leaks during use.
A lot of people were using their devices for more than that, to their detriment. #Bitcoin

2026-08-02 15:39:42 UTC

- reply

There are plenty of ways of assessing if a specific bit stream is “random”. It basically comes down to measuring diversity of values and looking for patterns.
The simplest check is “all zeros” or “all ones”. Those are obviously non-random at the scale of a Bitcoin seed (128 bits plus).
But a repeating pattern is also non-random. So alternating zeros and ones (“010101010…01”) is also obviously non-random as is other alternating patterns (“00110011…0011”).
The problem in the ColdCard case is that all of the seeds they produced would have passed these checks. The problem wasn’t in the diversity of zeros and ones in the seeds, or patterns resident within a specific seed.
The problem was the distribution of seeds. No local check on the produced values can assert a global problem like that. The only way to detect that class of problem is by auditing the code, which no one sufficiently did until now.

2026-08-01 00:18:00 UTC

E N T R O P Y
#nevent1q…az3h

2026-07-31 21:01:41 UTC

- reply

He’s saying that knowing where the coin went won’t get it back.

2026-07-31 20:22:59 UTC

- reply

Well, I meant hypothetically 😅

2026-07-31 20:19:55 UTC

- reply

You can get out in front of these by messaging your friends and family first.

2026-07-31 20:19:18 UTC

- reply

Plenty of months left in the year 🤝

2026-07-31 19:40:59 UTC

- reply

Did not have that on my bingo card

2026-07-31 18:44:42 UTC

PSA: I’m available for podcast appearances if anyone needs someone to explain of the problem, describe mitigations, or discuss entropy generation approaches. 🙏 #Bitcoin
https://image.nostr.build/ae22194cadc095538df477bae4428b0a98c1117cbf7be1cb83e6cf4794af66fb.jpg

2026-07-31 18:36:29 UTC

- reply

Most people are not ready to be unplugged

2026-07-31 18:25:41 UTC

- reply

Security is the only subject

2026-07-31 18:21:07 UTC

- reply

Yeah, this is a nightmare scenario for them. As I have said elsewhere, and maintain, the hardware wallet has one job: to protect your seed material during use.
It is not your hardware wallet’s job to generate entropy. It is not your hardware wallet’s job to resist an attacker long-term with physical access.
But, I accept that my stance is unconventional.
People get into this field with the “don’t trust, verify“ mentality, but then they place all their trust in the single most important thing that must not fail. The generation of their seed.

2026-07-31 18:01:07 UTC

- reply

Could be! That would make sense. It’s not a complicated algorithm. It’s basically SHA256 of the string representation of the concatenation of dice rolls.
There’s some nuance in how you byte encode the string for the binary SHA256 operation, but it would make sense for SeedSigner to have adopted ColdCard’s approach as a de facto standard.

2026-07-31 17:57:51 UTC

- reply

Great question. If your dice are fair, 100 is way more than enough. 50 is the real minimum threshold.
To assert that those rolls produce that seed, you need two devices from different manufacturers running the same algorithm.
For example, the algorithm ColdCard uses has been reproduced in Python. You could put the rolls into your ColdCard, write down the words, then put the same rolls into a computer and run the Python program to see that it yields the same words.
Of course, now you have a new problem: your seed has touched a general purpose computer. So ideally, you would use one that is eternally quarantined and has never touched the Internet.
Or, you can find another signing device manufacturer that uses the same algorithm. SeedSigner might. I’m not sure.
You can see now why just rolling dice is not the panacea that people make it out to be.

2026-07-31 17:43:21 UTC

In Bitcoin, ownership is what you KNOW. You either know the keys and can move coins, or you don’t.
So, how do you KNOW that nobody that you has your seed? The only way is to generate it yourself.
If you trust ANYONE ELSE to generate your seed material, then you DON’T KNOW that no one else has it.
Therefore, you MUST generate your OWN ENTROPY in order to KNOW that it’s safe. #Bitcoin

2026-07-31 17:30:28 UTC

Your signing device has one job: to protect your seed material from leakage during use. The ColdCard has not failed in this.
People were trusting their ColdCards for an additional job: generating entropy. That was the mistake.
It does not help that wallet manufacturers encourage using the devices for entropy generation. #Bitcoin
#nevent1q…ezky

2026-07-31 17:28:34 UTC

- reply

Correct. 50+ independent, fair dice rolls produces sufficient entropy to hit Bitcoin’s 128 bit minimum security threshold.

2026-07-31 15:14:21 UTC

- reply

YEAAAAHH BUDDAYYY!!
https://image.nostr.build/bd8d52eade343e72f268a0d8bf4636661148a5b1c61429d96d4cf29d729f5cd1.jpg
https://image.nostr.build/9789d25ab504db543d09d515ae5e9ba290483013cf4e210ba47cfb6ffeb50591.jpg
https://video.nostr.build/335ff1e2aefe249ca7bb995a1b122bbd321601c162bf821622f8f79925ca373f.mov

2026-07-31 15:05:09 UTC

- reply

It’s not just “move your coins”. You need to generate seed material using your OWN ENTROPY.
If all you do is move from ColdCard to a seed generated by SeedSigner or BitBox or Trezor, you haven’t changed your risk exposure to this class of vulnerability.
You’ve gone from one straw hut to another.

2026-07-31 15:02:07 UTC

- reply

It is indeed. You can run the SHA256-based code on two different devices and thereby verify that both yielded the same seeds from the same dice rolls.
If the devices are from the same manufacturer, then you’ve eliminated the possibility of only one of them being vulnerable. But you haven’t eliminated the possibility of vendor-level vulnerability.
So you need to run the same dice-to-seed code on two independent vendors’ hardware, without mixing in RNG data, to verify that yes, those rolls yield those words.
If one of your devices is ColdCard, what’s your other device? It needs to use the same algorithm for dice-to-seed as your ColdCard (though not necessarily the same exact implementation).

2026-07-31 14:37:47 UTC

- reply

Think of it this way: a single dice roll produces a number from 1-6. The information content of this is log2(6) = 2.585.
That is, each roll produces about two and a half bits worth of entropy.
A 12-word seed phrase encodes 128 bits of entropy. 128 / 2.585 = 49.516. So, yes, to generate a 12-word seed phrase, you need to combine the entropy from 50+ independent dice rolls.
The same logic holds for a 24-word seed phrase which encodes 256 bits of entropy. For that you need the combined entropy of 100+ dice rolls.
BUT the key factor here that most people miss is HOW those rolls are combined. Somehow, your sequence of dice rolls (5-4-5-2-1-…-6-6-4) has to be converted into words (bacon-celery-zoo-…).
If that mechanism is the hardware wallet, then you’re STILL TRUSTING the device, albeit a different code path. How do you know that those rolls produce THAT seed?
So yes, dice rolls are a big step up from just trusting the device’s random number generator. But you’re still vulnerable to other not-yet-discovered bugs in the hardware.
To immunize yourself from ANY hardware bugs, you have to roll your own seed material OFFLINE.

2026-07-31 13:53:44 UTC

- reply

Hear me out, but there are at least one more level of paranoia you’re missing:
If you put the dice in the machine to produce the seed, you’re still trusting the dice-to-seed mechanism. How do you know that those rolls go to THAT seed?

2026-06-24 01:39:40 UTC

- reply

Tit for tat with forgiveness is the optimal strategy in repeated interaction games

2026-06-24 01:38:09 UTC

Where were you in 1994? #asknostr

2026-05-24 23:39:10 UTC

“Alexa, renew my passport.”

2026-05-16 16:29:51 UTC

- reply

I’m 90% confident there are no differences, but I’d have to run it through software to be totally sure.

2026-05-11 13:13:07 UTC

- reply

But why sell into a melt up? The trend is your friend, no?

2026-05-04 15:25:51 UTC

- reply

Sure thing. You’re in the list once I get my ToR working again

2026-05-03 14:23:20 UTC

Who wants some inbound Lightning liquidity? I want to open some channels. #lightning #bitcoin #asknostr

2026-04-22 15:21:53 UTC

- reply

These regimes aren’t gonna change themselves

2026-04-19 23:45:56 UTC

- reply

Bad AI interpretation:
https://image.nostr.build/8a0eb2cae4f95224aa75cd8dbb03c5312716a853d17524cf1201379576b6d120.jpg

2026-04-19 23:42:21 UTC

- reply

Lawful Good: Cocoa
Lawful Neutral: Caffeine
Lawful Evil: Cocaine
Neutral Good: Chocolate
True Neutral: Coffee
Neutral Evil: Coke
Chaotic Good: Cacao
Chaotic Neutral: Covfefe
Chaotic Evil: Crack

2026-04-19 21:02:48 UTC

- reply

Now we just need to invent Cacoa and Cocao to complete the 2x2 matrix.

2026-04-13 16:29:33 UTC

Is it pronounced “either” or “either”? #asknostr

2026-04-09 16:13:29 UTC

- reply

Probably just accepting zero-conf. These are known entities wanting to do repeat business. You could maybe rip off the Iranians with a double-spend once, but good luck on your next trip.

2026-04-08 22:14:57 UTC

Why the Strait of Hormuz matters for #bitcoin
Hamid Hosseini, a spokesperson for Iran's Oil, Gas and Petrochemical Products Exporters' Union, told the Financial Times that Iran needs to "monitor what goes in and out of the strait to ensure these two weeks aren't used for transferring weapons." He added that once Tehran completes its cargo assessment, payment is collected in Bitcoin within seconds, a method he said ensures the funds “can't be traced or confiscated due to sanctions.” https://www.forbes.com/sites/digital-assets/2026/04/08/will-be-destroyed-irans-bitcoin-toll-sparks-100k-price-prediction/

2026-03-12 22:25:51 UTC

- reply

I once paid more than 1 sat/vbyte, just to see what it felt like.

2026-03-12 21:57:41 UTC

- reply

Maybe the answer is more NIP-13 proof of work?

2026-03-12 21:57:00 UTC

- reply

Same

2026-03-12 00:39:00 UTC

- reply

https://media1.tenor.com/m/IOWx34hXWREAAAAd/boo-boo-this-man.gif

2026-03-11 23:58:00 UTC

- reply

Please report any bugs you find. At the bottom of the menu is a Report Bug link. Or you can tell me here on Nostr (though bug report is better).
https://image.nostr.build/20e8fbe324f8ce5c0123de194c2ac0abd59a5da50e8d909f03cfb8af0da2ae64.jpg

2026-03-11 23:37:02 UTC

Are any of you out there Magic the Gathering players? I have something I wanna show you. #asknostr #mtg #edh https://franticsearch.gg

2026-03-09 18:38:40 UTC

#asknostr 👇👇👇
#nevent1q…sdw6

2026-03-05 18:09:29 UTC

- reply

But seriously

2026-03-05 17:51:18 UTC

- reply

The first one. The car in the second steals attention.

2026-03-05 14:26:23 UTC

- reply

And it’s only 30%. Could have been worse!

2026-02-19 11:36:53 UTC

FEW
#nevent1q…npcj

2026-02-13 18:39:07 UTC

- reply

Thankfully, due to inflation, the cost of a $5 wrench attack is now $36.50.

2026-02-13 17:55:12 UTC

- reply

Leaks from any number of services.

2026-02-13 17:43:52 UTC

Stay frosty out there plebs. 🥶
Scammers coming in the snail mail now. #bitcoin
(Dumb scammers put “Ledger CEO” in the footer, highlighted.)
https://image.nostr.build/a974219f163cf1471cd55951ee777b6cf53a609468076f86da03f0cd170b2cce.jpg

2026-02-13 14:22:35 UTC

- reply

What corn? https://media1.tenor.com/m/Id542WiZDx8AAAAC/shrug-dexter-morgan.gif

2026-02-13 14:20:55 UTC

Life hack: baby wipes. They’re disposable cloths soaked in mild detergent, rated for use on infants.
Perfect for cleaning the rear sensors on your car. #lifehack
https://image.nostr.build/2e9c06a4683694e2a2a9cf58b20bc201baee5073234e2303f195d3dd26885854.jpg
https://image.nostr.build/2e9c06a4683694e2a2a9cf58b20bc201baee5073234e2303f195d3dd26885854.jpg
https://image.nostr.build/6a5a2593888c40cd9a1d819417ea5e0ad75356ede9fd90d04c0a7b3902070272.jpg

2026-02-12 18:46:45 UTC

Rebalancing my portfolio here:
• 90% BTC
• 10% sats
#bitcoin

2026-02-11 19:38:29 UTC

- reply

Zero information content in that article, AFAICT.

2026-02-11 19:32:02 UTC

- reply

https://cdn.verbub.com/images/you-can-t-hurt-me-i-hodl-from-2017-284441.jpg #bitcoin #memestr

2026-02-11 19:25:18 UTC

- reply

Thanks! Yeah, I’m too lazy to fix it.

2026-02-11 19:20:24 UTC

Life hack: use a travel shower caddy as a cable organizer. Hangs on the back of a chair for easy access. #lifehack
https://image.nostr.build/6ee80c2f6fc45e16f3c37a41a65fdf065f3617ddfba6c9d60b9ec1b79448a95f.jpg
https://image.nostr.build/a12da7ad6fa86035294534b0cb19f2d99be6f4b000df80128d44fc8094511122.jpg

2026-02-11 11:38:54 UTC

You can buy back 10 kidneys later. #Bitcoin

2026-02-08 21:10:33 UTC

- reply

Smart

2026-02-08 21:09:51 UTC

- reply

Baby wipes work for cleaning anything. IYKYK.

2026-02-07 18:32:29 UTC

- reply

IDK, I get no sound on iPhone for this video.

2026-02-07 02:17:18 UTC

- reply

Wish this had sound

2026-02-06 14:19:31 UTC

- reply

Yeah, they almost sent that round over the berm into who knows where

2026-02-06 03:06:05 UTC

Is an exchange insolvent? If so, which? #asknostr #bitcoin

2026-02-05 14:32:30 UTC

I’m getting too old for this shit. #Bitcoin #memester
https://image.nostr.build/8a15a234b6a7fb25aaba22d927d01b35d3e44aeca8e447da94cd68dfa4495459.jpg

2026-02-05 14:27:49 UTC

#Bitcoin #memestr
https://image.nostr.build/eddb48c2d541baf0747d05bbb60ea72e1845387d03c954939fc7394d6945f682.jpg

2026-02-05 14:21:42 UTC

- reply

No Super Cycle?
I feel personally attacked.

2026-02-05 14:14:09 UTC

The KarmaRank Manifesto is now published: https://github.com/jimbojw/karmarank
Learn why your performance appraisal feels like gaslighting, and how to optimize for KarmaRank, the true corporate objective function. #karmarank
https://image.nostr.build/bf5280716bf99d941cb2163eba484ba57974d439b6059f584937f1282bfd0a8b.jpg
https://image.nostr.build/53d4b2fb4c71cbd7a586bc2eabe5b416d81ccc6261a8827bc961f1b22c337dd2.jpg

2026-02-02 15:55:09 UTC

- reply

Does it include mortgages?

2026-01-23 18:25:02 UTC

- reply

I need a vacation

2026-01-23 18:17:52 UTC

- reply

Bro, do you even feel?

2026-01-23 13:34:02 UTC

- reply

Also, I’m on Damus. My particular relay mix doesn’t have access to this full conversation. I jumped in mid-way when browsing replies. I just saw “403” and chimed in.
If there’s a relay I should add, please let me know. 🙏

2026-01-23 13:32:25 UTC

- reply

Does Jumble assess relay connectivity by WebSocket request? Or does it send pre-flight HTTP feelers?
I’m speculating that feelers could be a reason users see 403’s, but I have very little info to go on (learning of Jumble for the first time today). 😅

2026-01-23 13:29:53 UTC

- reply

I’m not sure. I’m going to give you a full answer at the risk of saying too much.
There are two layers of authentication in the Nostr protocol stack:
- HTTP - This is where the 403 comes from.
- Nostr (specifically NIP-42) - AFTER the HTTP connection, relays often ask clients to identify themselves, which determines what events they’ll send/receive from the client.
You can think of this like a bar. There’s the outer door (HTTP/WebSocket), then there’s the bartender (Nostr/NIP-42) that checks your id and only serves you drinks if you’re old enough.
Typically, relays will be permissive at the HTTP layer (let any client “connect”) and then rely on Nostr-level authentication to determine level of service.
If you’re seeing 403 errors, that means that the relay is rejecting your connection even before getting to the Nostr authentication part. The bouncer isn’t letting you in the establishment.
Speculation:
It’s possible that the relays are rejecting regular HTTP(S) requests because they expect only full WebSocket requests. This is like a dress code. Shirt and shoes (WebSocket) required for entry.
Technically speaking, the Nostr protocol only requires WebSocket support, so a relay COULD reject non-WebSocket requests and be compliant.
It could be that your client is sending feeler requests ahead of your actual WebSocket requests. This is like sending a kid in swim trunks to check if the bar is open. He never gets past the bouncer (403 Unauthorized) even though you’re ready to party (WebSocket) and would have gotten up to the bar just fine.
So if your client is making regular, non-WebSocket HTTP requests before connecting the WebSocket, I would argue that the client is perhaps misidentifying strictly compliant relays as “down” or unavailable.

2026-01-23 00:54:42 UTC

- reply

🔥

2026-01-23 00:53:41 UTC

- reply

403 means Not authorized. You don’t have permission to view the resource.
Contrast to 401, which is an authentication challenge. Once you authenticate, the 401 could become a 200 OK (access granted) or 403 access denied.

2026-01-17 12:51:15 UTC

Of all the streaming services I pay for, government is the worst.
#note1rpc…04f7

2026-01-17 12:50:11 UTC

- reply

The fundamental concept you’re describing is “earn coin for holding coin”. That’s how staking works, in principle. By having some coin and staking it, you receive more.
Philosophically, this is a rich-get-richer scheme. Whoever has the most coin earns the most. This is not a new idea. It’s the status quo.
In contrast, a Proof of Work system imbues no advantage to holders of coin over the earning of future coin, nor over the rules of that system. In PoW, you have to do the work to get paid, and you still can’t change the rules.
It’s true that in PoW, having more coin to start with gives you an advantage in that you can buy more mining hardware etc. But if you buy hardware, you don’t still have the coin. You’re an entrepreneur. Risk and reward.
Staking is a regressive system that entrenches existing holders to the detriment of future participants. Proof of Work is an entrepreneurial system that rewards stewards of capital, equally for all.

2026-01-17 12:32:22 UTC

- reply

We’ve all been there

2026-01-15 20:47:59 UTC

- reply

Classic G. Edward Griffin.

2026-01-13 19:52:12 UTC

- reply

So, in other news, there’s no news.

2026-01-12 14:42:31 UTC

- reply

Erm akshually you’re describing the difference between a wizard and a sorcerer. 🤓

2026-01-12 02:42:41 UTC

- reply

Here’s a fun chart:
=SPX/XAUUSD
That is, the S&P 500 priced in ounces of Gold. You can see that since 1971, when Nixon closed the gold window, you’ve basically BROKEN EVEN.
You were down in the 80’s, up in the dotcom boom, down in the GFC, but back to par now.
This chart shows that virtually all of the stock markets gains are the illusion of growth created by a depreciating fiat currency unit.
https://image.nostr.build/33c1af278821dda3c53018ae15738bcd53bb0e2d491c955bde588e11a174c227.jpg

2026-01-12 02:37:54 UTC

- reply

In TradingView it’s pretty easy.
1. When entering your ticker, start with an equals sign “=“ to make a formula.
2. Divide by your intended denominator. For example, to see Gold priced in Bitcoin, the formula would be:
=XAUUSD/BTCUSD
The “USD”s cancel, just like dealing with units in chemistry or physics class, and you’re left with XAU/BTC.
3. Tweak the decimal point. TradingView is not good about showing significant digits. So depending on what you’re looking at you may need to bring it up or down. Multiply by a power of 10 to move the decimal.
So my Gold/Bitcoin formula is:
=XAUUSD/BTCUSD*10^4
This moves the decimal four places to the right. The chart will render exactly the same, but instead of numbers like “0.05”, you get numbers like “498.67”.
On log scale, the multiplier makes no difference. Log scales preserve proportional moves, so it’s like A/B vs (A*100)/(B*100). The ratio comes out the same, so the log scale charts look the same. The multiplier is just a convenience for legible numeric labels.

2026-01-12 01:49:20 UTC

- reply

Bread and Circuses.

2026-01-12 01:47:57 UTC

- reply

> The days of 0.001¢ to $1,000 are over!
Disagree. We’re just crossing a wide chasm.
Price is psychology. $100k is the hardest psychological hurdle. Humans are not generally good at very large and very small numbers (decimals).
At $1M per whole coin, a sat costs $0.01. We’ll do a one time 1:100,000,000 split, keeping the BTC ticker.
Exchanges are disincentivized to make this change. They benefit from “expensive” Bitcoin since it gives people hope to day-trade in the shitcoin casino. At $1M per whole coin, the split will be undeniable.
Once we price in sats, everyone’s interests are aligned. We go from $0.01 to $0.02 overnight. It will be the return of volatility. The real FOMO moon pump begins.

2026-01-12 01:25:26 UTC

- reply

Gold priced in Bitcoin, last decade.
https://image.nostr.build/d3b3620edecadba6c4e4736e6741c486d9adc64c35360597be0cfbd5efa286e4.jpg

2026-01-12 01:15:06 UTC

- reply

IN DOLLARS

2026-01-12 01:13:21 UTC

- reply

You may have given up on the SUPERCYCLE, but the SUPERCYCLE has not given up on you.
Keys be unto you. Blessed be your bags. 🙏

2026-01-11 20:59:38 UTC

S U P E R C Y C L E
#note1rn0…9rnu

2026-01-10 19:03:13 UTC

- reply

The internal combustion engine

2026-01-10 15:11:00 UTC

- reply

Presumably the old wallet was standard m/44’ and the new multisig is m/84’, so they’re both hardened to differing roots.

2026-01-10 15:09:34 UTC

- reply

It depends on what you mean by “gains access”. Yes, an attacker who gets the seed will be able to see all previous wallets that use guessable derivation paths.
I believe there may be cryptographic attacks that could result in an attacker having access only to the portion of the tree that deals with multisig. But this is at the limit of my knowledge, and is astronomically low probability (compared to, say, losing your seed, or someone finding the backup words).

2026-01-10 13:15:33 UTC

- reply

Not sure exactly what you mean by “previously used”. Your single sig “wallet” consists of a few different parts:
- the seed - Often encoded as a BIP39 phrase of 12 or 24 words.
- the derivation path - Determines how the software wallet generates addresses.
- the hardware - The physical signing device that holds the seed material.
Multisig uses a different derivation path than standard single sig. So let’s assume you don’t mean reusing that part.
IMO, this is fine.
You MAY reuse the seed/hardware from a PREVIOUS single sig wallet to participate in a multisig. When you do, all of the addresses that that signer contributes will be different than in the single sig case. So an outside observer has no way of connecting the two.
If you use a seed/hardware SIMULTANEOUSLY for single and multisig, you run a bit higher risk, since an attacker that gains access to this one device now commands both. But I understand your question was about the PREVIOUS case.

2026-01-09 11:00:16 UTC

- reply

How so?

2026-01-09 10:54:34 UTC

- reply

Your brain absolutely can run on fat. The “-glycer-“ in “triglyceride” means the sugar backbone that holds the fat together.
When your body is using fat for fuel, that glycerine gets sent to the brain, while the body muscles run on the lipids.
Ketone bodies derived from the breakdown of protein are also brain fuel.

2026-01-09 03:57:38 UTC

- reply

It’s too bad. The old corn-and-grain pyramid made “you are a tax cattle” quite clear. This one is harder to read.

2026-01-08 17:52:08 UTC

- reply

It’s the dose that makes the poison

2026-01-08 17:51:26 UTC

- reply

Is this real? I can’t believe they’d give up on pushing big corn.

2026-01-06 19:10:58 UTC

- reply

200 IQ