Juraj
Juraj🏴💛🌘

I don’t seek rigid structure — I seek resonance

Vibe coding, reality bending, cypherpunk visions.

Author of Tamers of Entropy: https://tamersofentropy.net/

I like teaching, get my books and courses here:
https://hackyourself.io/shop
https://juraj.bednar.io/shop

(You'll learn skills no one else is teaching!)

Podcasts 🎙️:
Option Plus - https://optionplus.io/
Reči o živote, vesmíre a vôbec: https://juraj.bednar.io/reci-o-zivote/
Ako vyhackovať otcovstvo: https://otcovia.com/

Public Key

npub1m2mvvpjugwdehtaskrcl7ksvdqnnhnjur9v6g9v266nss504q7mqvlr8p9

NIP-05 Address

juraj@tamersofentropy.net

Profile Code

nprofile1qqsd4dkxqewy8xum47ctpu0ltgxxsfemeewpjkdyzk9ddfcg286s0dspp4mhxue69uhkummn9ekx7mqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduvg4sav

Publishing to

nos.lol

relay.damus.io

relay.primal.net

nostr.cypherpunk.today

Author Public Key

npub1m2mvvpjugwdehtaskrcl7ksvdqnnhnjur9v6g9v266nss504q7mqvlr8p9

Show more details

Last Notes

2026-08-11 06:56:50 UTC

- reply

Yes, let's do both. Commit is what was audited, version tag is what developer claims the apk is from.
BTW it's possible to also audit a binary APK these days, so I wouldn't rule out APK audits, it's just not what most people will do.

2026-08-11 06:49:52 UTC

- reply

And yoloing it is a company selling security product, not paying for independent audits or bug bounties is a borderline scam.

2026-08-11 06:37:26 UTC

- reply

Agree.
Although I don't think people should have audited ColdCard necessarily. It's the job of the company behind it, they are selling a security product. Not auditing and not having a bug bounty program is a much bigger failure than having the bug itself. Bugs happen, but a security company yoloing it is a borderline scam.
I'm happy I've never used it and never recommended it (open source Trezor is a much better deal).
Otherwise very good post and I agree it was not a conspiracy. Very few things are. Conspiracies are hard to coordinate, harder to keep secret and even harder to have intended effects.
#nevent1q…d029

2026-08-11 06:23:16 UTC

- reply

I was separating state from my wallet. For inflation, but also privacy.
I am a citizen of internet. So I needed internet money.
Confession: never bought drugs from a dark market. I know that's ridiculous.

2026-08-10 20:34:13 UTC

- reply

Yes! Let's do it.
#nevent1q…cwjt

2026-08-10 20:30:24 UTC

- reply

Very nice. I'll try to tackle this somehow. A bit more community ideas before.
Questions: I would tie this to source code, not APK. Problem is most don't do reproducible builds and we probably audit source code, not APKs. Also, the check probably won't last for long anyway, people do releases all the time.
The main thing this would tell you: "Someone looked at the code of this project at some point". And maybe short summary. So this would be something like a review, launched by reputable people (reputable - from the point of view of your Nostr account). Not "the latest APK you are going to install is up to date". Because - you would not check updates anyway. You are deciding to install an app, and when you do, you are just autoupdating anyway. Or it could tell you red flags after you install.
Very probably when you are updating, no one has launched an agent yet. And it might be smart to get updates as they come (they might fix security bugs), not wait for reviewers (that may never come!).
Ideas? Comments?

2026-08-10 20:25:57 UTC

- reply

Well, the third block that kept the longest chain (the non-BIP-110) was Ocean. So even people who like Ocean and decentralization did not want to fork off.

2026-08-10 18:16:46 UTC

- reply

This is the most retarded take I've heard on the topic.
You win an award.

2026-08-10 18:15:14 UTC

- reply

Literally none of the "...knowing" part is true.
Tell me, when did you stop beating your wife?

2026-08-10 18:14:02 UTC

- reply

Yes!
This is the way

2026-08-10 18:13:16 UTC

- reply

Looking forward to seeing some more about the methodology and tips others can use, but I would give @nprofile…969u and co some more undisturbed time.
After action reviews and lessons learned will be better in a few more weeks.
Maybe @nprofile…47tu / Dark Prague talk in October? (I wish)

2026-08-10 17:40:22 UTC

- reply

Nostr doesn't use a blockchain, it has nothing to do with Blockchain
What it adds us web of trust coming from social follows. I would trust your attestation that you audited something, but a random bot can be the person introducing the backdoor himself.

2026-08-10 17:37:36 UTC

If you have some spare tokens:
- check security of your home network, of apps you use, custom dev software. Use models that don't complain
- write documentation for your home setup and keep it up to date
- plan and implement migration from various shitty cloud services. You're probably paying monthly for stuff that you don't need but it's difficult to migrate from.
- setup self-sovereign stuff. Nostr VPN, nas, cloud photo storage, jellyfin, ollama, hermes agent, ...
- do regular upgrades of everything

2026-08-10 14:05:31 UTC

- reply

of course prompt matters as much as the model. so it's not "deepseek-v4-flash-0731 checked". but "checked with prompt ...". But still, it could save some time and tokens and add a bit of security.

2026-08-10 14:04:21 UTC

- reply

deepseek v4 flash 0731
qwen 3.8 max
sometimes gpt 5.6 sol
kimi is probably a good idea. But I do usually just a quick check it's not total backdoor with deepseek.

2026-08-10 14:01:43 UTC

- reply

Exactly

2026-08-10 12:28:13 UTC

- reply

I think Bitcoin Red Team checked it, so basic AI model check is done.
One thing to point out though is there's a huge difference between Sparrow and Coldcard. Sparrow is an open source project (true open source - free to modify), a public good that people should audit and there's no pressure on @nprofile…egyh to pay bounties, etc.
ColdCard is a commercial company. They are selling a product and they are responsible for security. Their source code was made available, but people couldn't reuse it (license forbidden it). So essentially there was almost no incentive for people to audit it.
People who are not paying ColdCard money won't audit it because they can't use the code anyway, so they don't care.
People who are paying ColdCard money assume that a commercial product is well audited by third parties, because what they're selling is a security product.
ColdCard was selling a vaporware though, which is basically a scam. Nicely looking calculator with buzzwords instead of real security.

2026-08-10 09:50:27 UTC

Idea: Before I install something, I often run a simple audit of the codebase to check for obvious backdoors and security problems.
Would it be useful to publish these on Nostr with exact checkpoint ID and model name, so we can save on tokens? Sort of a "I run this prompt, it turned out OK". Agents can look at diffs, or if many trusted people have done the same with various models, the project could get some kind of badge.

2026-08-09 12:57:56 UTC

How the game theory actually worked out:
Punish shitcoiners mining bip110 fork chain so they lose all profit from the blocks and learn their lesson. How's your fork doin' guys?
It will be collector's edition of "I got it wrong again", with attached PoW.

2026-08-09 09:00:36 UTC

Some people went on a wild conspiracy theory run about jpegs killing Bitcoin and fixing it by not removing the ability to put same jpegs in Bitcoin, but it's all about the signal.
Other people went to fix 500+ high and critical security bugs in Bitcoin libraries and projects.
They're not the same.
Thank you Red Team!

2026-08-09 07:33:11 UTC

- reply

Wait first though. Do we want public sector normies here?
And if yes, isn't it enough if they come through the Mostr bridge?

2026-08-08 09:27:46 UTC

- reply

But at the end of the day, not really:
"Tinfoil itself acknowledges it hasn't yet achieved fully reproducible builds, meaning there remains a gap between "attested recipe/measurement" and "independently reproducible binary" not unlike Venice's issue #4, just mitigated by an external, harder-to-tamper log"
I would say unless you can verify binary, you are taking their word for it. Encrypting tool calls is big usability win though.
And also model selection is not very good on Tinfoil/PPQ (not even the newer Qwen3.6 models). GLM-5.2 is the only one.

2026-08-08 09:22:01 UTC

Nice, openssh just told me:
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html

2026-08-07 16:17:06 UTC

- reply

Upgrade btcpay
#nevent1q…s4fl

2026-08-06 13:58:25 UTC

I am the author of venice-e2ee-proxy, using @nprofile…t6g9 's venice-e2ee library.
Venice sells private inference that should be end-to-end encrypted to the gateway, or at least attested by TEE (Venice can see the prompt, but it goes to the secure enclave).
Over the past few days, I spent some time improving the verification (both in the proxy and upstream library) and I got some spare Venice credits and wanted to try the new Qwen 3.8-Max (and Claude Opus 5 later for verifying the audit results).
While the design is not bad, it does not guarantee end-to-end encryption and non-logging in its current form. Also, there can be some functional changes to make this actually usable.
From the usability front, E2EE models do not support tool calling, because the API does not allow encrypted tool call parameters. While the library does some sort of inference to extract tool calls from the response, the models are very flaky and if you just want to run opencode through it, it won't work for more than a few interactions. This is the highest leverage usability fix.
The security story is a little bit longer, you can find details in the published "audit" below. But TLDR:
The proxy encrypts prompts on your machine to a key carried in an Intel TDX attestation, so Venice's network and infrastructure never hold plaintext. Decryption happens inside a Phala network -operated enclave ("the gateway") which then forwards your plaintext to an inference router, which forwards it to a GPU node.
So: you encrypt your prompt to a specific machine, and that machine proves what it is before you send anything.
The proof is hardware-signed. The CPU signs a statement saying: this is a genuine sealed VM, here is a fingerprint of the code running inside it, and here is the public key that lives in there. You check that signature against Intel's root certificates on your own machine, then encrypt to that key. Venice, whose API you are calling, is just a pipe. They carry ciphertext.
So far that is ordinary remote attestation. The interesting part is what happens next.
The sealed machine (the gateway) does not run the model. It has to forward your prompt to a GPU box. So how do you know that machine is sealed too?
You don't check it yourself. You don't have to.
The code running in the gateway, the code whose fingerprint you already verified, contains a checker. Before forwarding anything it demands the next machine produce its own hardware-signed passport, verifies it against Intel, and binds the TLS connection to the key inside that passport, so it cannot verify one machine and then talk to a different one.
You know that check happens, because you verified the code that performs it.
Verify one machine, and it vouches for the next, and you know the vouching is real because the voucher's own code is attested.
It is also better than "trust me, I checked". The gateway signs a receipt for your request containing what it found, plus a hash of the next machine's actual passport. You can download that passport and verify it against Intel yourself. I did. It checks out, all the way down to the second hop.
What is missing to make this airtight
Two things actually matter for confidentiality:
1. Root SSH. The enclave's boot script can install an SSH key for root. Whether one was installed is an encrypted secret, and the attestation cannot tell you either way. If it was, somebody has a shell inside the "sealed" box and can read every prompt passing through it. This is a deployment choice, not a protocol limit, which is what makes it so frustrating.
2. The last hop's software is unmeasured. Your plaintext ends up on a GPU node whose serving software nobody has measured. Nothing cryptographic stops it from writing prompts to a log.
Then the ones that weaken the guarantee without breaking it:
3. The fail-closed switch is off. The gateway supports refusing to forward when the next hop fails verification. On the domain Venice's traffic actually uses, that enforcement is disabled: a failed check gets recorded in the receipt and the prompt goes anyway. The client flag that would turn it on is rejected by Venice's API with a 400.
4. Attested recipe, not attested binary. The measurement says "I compiled this exact source commit", not "I am running this exact binary". The build runs at boot against a cache that is not measured.
5. Dev OS image, with SSH and serial console enabled, and not published, so you cannot reproduce it and check what actually boots.
6. Replay. The gateway does not publish the random challenge it sent the next machine, so you cannot prove that passport is current rather than one captured earlier.
Note what is not on that list: whether the model weights are the genuine article. That is a correctness question, not a confidentiality one. A swapped model gives you worse answers, it does not leak what you typed.
Where that leaves things: Venice as a company genuinely cannot read your prompts. Phala, who operates the enclaves, could, if an SSH key was injected or if the unmeasured GPU-side software logs. Close the SSH question and flip the fail-closed switch and this goes from very good to genuinely hard to break.
Read it here:
https://github.com/jooray/venice-e2ee-proxy/blob/main/docs/SECURITY-AUDIT.md
Proxy: https://github.com/jooray/venice-e2ee-proxy
@nprofile…t6g9 's upstream library (that he is using for his open-source health consultant @nprofile…4lsz ): https://github.com/elkimek/venice-e2ee
Note: There is also https://github.com/AxLabs/venice-e2ee-proxy which has the same name, but is a different codebase and it uses older library that doesn't do proper verification yet and is much less secure.

2026-08-04 20:40:20 UTC

- reply

Not open source, not audited.
And honestly, I wouldn't waste my time doing someone else's job.
They're doing a commercial product, it's their job.

2026-08-04 20:38:54 UTC

It's insane when you realize how the world has changed in the past few months.
And most people did not notice.
This exponential is different. I've been riding a few of them before, but this one...
I don't even know what to say.
I've been riding it past few months and then I look back at the world, and people still pretend business as usual. Denial? Ignorance? Nostalgia?

2026-08-04 09:58:50 UTC

- reply

I think community funded bug bounties are a good idea. Maybe even pooled.
Should we implement it?
Basically everyone could fund bug bounty program and say: "I use Sparrow, Liana, Trezor, Jade" and the funds would apply to those (first discovered, first paid basis).
And then people could pledge (by actually sending) BTC and the platform would distribute it.

2026-08-04 09:37:34 UTC

- reply

The more the better, but I think the audit is of hardware, so if that hasn't changed...
For software, bug bounties are continuous testing.

2026-08-04 09:20:40 UTC

- reply

Seems so

2026-08-04 09:19:06 UTC

- reply

Probably also by non malicious actors.

2026-08-04 09:18:28 UTC

- reply

The problem is that entropy generation is only one of many possible security bugs. Signing, parsing errors, etc. There are many things that rug you.
You will probably not calculate hashes and ECDSA signatures, that's what the wallet is for and why you pay for it.
So there's no way around doing due dilligence. And if you do it properly, you don't need to roll dice. If you roll dice and don't do due dilligence, you can be screwed anyway.

2026-08-03 15:20:38 UTC

- reply

2026-08-03 15:11:53 UTC

- reply

Well, that's the first step about security. Then there are features - shamir scheme, miniscript, ....
But good to keep this in mind.

2026-08-03 12:36:40 UTC

- reply

That's why it's a good idea to pick wisely.
nevent1qqsrsxzskj6urt66wddwxum6pzskl7s36686z3405nnyw4ls2uxwjxsshrupt

2026-08-03 12:36:06 UTC

- reply

You are not verifying entropy, you are generating it with dice. Strong passphrase does the same thing.
You need to make a reasonable choice of wallet even if you generate entropy with dice, there might be other bugs - how is the entropy used, how signing happens, etc. So dice is not a bypass for secure wallet choice, only for this particular case, which will most probably never happen again and now we need to look for other issues.
See nevent1qqsrsxzskj6urt66wddwxum6pzskl7s36686z3405nnyw4ls2uxwjxsshrupt

2026-08-03 12:33:40 UTC

- reply

It's not an advice. Let's start with basic reading:
"if nothing else, just write it down next to the seed"
Translation: If you would have no passphrase, because you don't know how to manage it, even then setting a passphrase and writing it next to seed words is still better than having no passphrase (adds entropy, allows you to have decoy wallets in the future).
Not verifying the entropy by dice: First of all, dice does not "verify entropy", it generates it. Second, what cost people money is not "not using dice", but a shitty hardware wallet. Don't use shitty hardware wallets. Use passphrases, even if you otherwise wouldn't, even if you wrote it next to seed words (which is the same seed words security as seed words without passphrase, so you lose nothing given the base scenario of "I don't want a passphrase").
For more reading comprehension courses, follow, like, subscribe, share and zap!

2026-08-03 11:34:08 UTC

Three questions to ask about any hardware wallet
Most comparisons argue about chips. Three duller questions tell you more:
Does an outside firm test it, and can you read the report? Anyone can claim their device is secure. Paying researchers to attack it and then publishing what they found, including the unflattering parts, costs money and stings.
Do they pay for bugs? A bounty gives someone who finds a flaw a reason to report it rather than sell it, and gives skilled researchers a reason to go looking at all.
Can those researchers see the code? Closed firmware still gets attacked. Fuzzing over USB or QR is routine, and reverse engineering has got cheaper as models have got better at reading disassembly. Source code does not make an audit possible, it makes it cheaper, so more people attempt more of it. Open source beats source available too, because code under a real licence gets reused, and the developers reusing it (sometimes) read it.
All three
Passport publishes firmware under GPL and hardware under CERN-OHL-S v2, complete enough to build one from the files. Outside audits are online with the fixes. The bounty covers the device, though the amount is decided case by case.
Keystone also has all three, with the best evidence that its bounty works: outside researchers found a real firmware flaw and got paid. Audits from two firms, reproducible builds, schematics and secure element firmware published. One catch is theirs alone: researchers are asked not to disclose without written approval, with no time limit.
Two of three
Trezor publishes firmware and hardware and runs the best funded bounty, up to $100,000. No commissioned audit report, but the secure element in its newest device was tested externally and the flaw disclosed publicly.
Ledger pays well and its in house team does serious offensive work, including on rivals. Firmware and OS are closed, so every finding costs more effort. The chips are lab certified, but you only see the certificate.
Open and nothing else
Jade and Bitkey publish firmware, Bitkey with reproducible builds. No audits or bounties, so the code waits for volunteers. Sometimes they turn up: Jade's serious 2025 flaw was found and reported for free.
SeedSigner is as open as anything here and built from off the shelf parts, but there is no company; an audit or bounty was never on offer.
This measures how a company behaves, not how the device is built. Still, between two similar devices, take the one that publishes its code and pays people to break it.

2026-08-03 07:49:35 UTC

I was running a now defunct bug bounty platform.
We did not do id verification but to the defense of HackerOne - customers overwhelmingly demand that the platform verifies the hackers. And it's often not a soft demand, it's what gets you a deal or not.
Customers don't understand that anonymous hackers hack you anyway. They want some sense of control.
It's really strange, but that's my experience.
#nevent1q…au3f

2026-08-03 07:49:29 UTC

- reply

2026-08-03 07:38:27 UTC

Oh god, please stop with the ridiculous dice rolls. What is this stone age? A good, well audited wallet will generate good entropy, passphrase contributes to the entropy and you want passphrase anyway (if nothing else, just write it down next to the seed).

2026-08-02 14:50:03 UTC

It's time...
https://xkcd.com/221/
https://image.nostr.build/07668fc814bf21efb1b5451f1ae4e80d47959d97084cb654d41e825c5f36d2e7.jpg

2026-07-30 11:51:49 UTC

- reply

https://matomo.org/faq/new-to-piwik/how-do-i-use-matomo-analytics-without-consent-or-cookie-banner/

2026-07-25 10:53:45 UTC

The cookie notice bullshit.
- thankfully there are ad-blockers that correctly recognize the popups as spam and remove them for you without you seeing them.
- bothering your users with such bullshit is disrespectful and no app author should do that
- most analytics software can track you without cookies. Even the open and privacy preserving ones do that.
- there are reliable cookie replacements that deliver similar functionality (such as local storage)
- websites usually load content from many third party sites that can and will track you
Therefore I think that all open source software should just ignore this cookie bullshit and have an option called "--i-am-a-brussels-bootlicker-and-hate-my-users-turn-on-the-ugly-cookie-banner"
Change my mind

2026-07-23 07:50:00 UTC

Years in Bitcoin and self-custody of value naturally leads to asking what self-custody of attention looks like. And then what self-custody of consciousness looks like.
I did my best to answer this question in Tamers of Entropy (tamersofentropy. Net)

2026-07-22 17:09:36 UTC

Nostr meetup počas @nprofile…kxfc!
Nostriči bez reťazí, spojte sa! Pokec, ukazovanie si npubov, appiek a zdieľanie zážitkov zo zapathonov.
https://blossom.primal.net/ab19a5e496066364eaf80dbb2813f575365343f170c9556a6d7e37b2f059a0c4.jpg
🗓Sobota 12. 9. 2026 13:30-15:00
📍Amfiteáter vonku v prípade priaznivého počasia, v blízkosti vchodu do budovy v prípade nepriaznivého počasia
Pomôžte nám šírením tejto skvelej správy. Citujte, sharujte túto note, označte svojich nostr frens! Kto onboardne Nostričov rovno na chaincampe a donesie ich je najväčší vedúci (Like a boss).

2026-07-22 11:37:00 UTC

Lievik is now open source.
It's a Nostr-first workspace for deciding what to tell whom. Pull in Nostr posts, RSS, and manually added material, then let AI relevance scoring rank it against each newsletter, group (like sauna) or channel's own criteria — while tracking what's already been sent where, so you don't repeat yourself.
https://lievik.cypherpunk.today/
https://github.com/jooray/lievik
My previous blog about this project:
https://juraj.bednar.io/en/blog-en/2026/06/30/why-i-built-lievik/

2026-07-22 07:53:28 UTC

I think now it's obvious ai is dangerous and they should ban Chinese open weight models.
Because Altman said he's sorry. But will the Chinese say it? In English?
And it's obvious EU is safe because EU did not certify the model that was hacking, they forgot to fill form 51849 section C and forgot to sign one form.

2026-07-21 08:42:00 UTC

Už čoskoro bude @nprofile…kxfc a moja otázka na Nostrichov je - spravíme meetup? V amfiteátri vonku? Kto je in?
@nprofile…jchg a spol., ako sa takéto veci organizujú? 😉
Vyskúšame @npub1k33…4taa ?

2026-07-20 23:37:00 UTC

Emanator is now open source.
It's a Nostr publishing scheduler for running multiple identities: one calendar, one interaction inbox, media support, per-account style guides for AI-assisted writing. The part I like most is that it's built on NIP-46 remote signing with Amber, so scheduling posts never means handing a service your private keys. Staggered reposts also help new accounts build up an initial audience.
My main use-case: Have projects with their own npubs (such as @npub1k33…4taa @npub18sc…alja @npub1zyx…7mxy @npub15x6…syd3 ). They are kept separate, but initially no one follows them, so I auto repost them. Saves a lot of finger movements and account switching.
It's also free to use online (at least for now), you don't need to deploy it yourself. Enjoy!
https://emanator.cypherpunk.today/
https://github.com/jooray/nostr-emanator
P.S.: Yes, this post was published by Emanator itself. What a fractal :)

2026-07-20 11:10:12 UTC

You can try Kimi K3 that broke the internetz right now. It's Moonshot's new 1M-context flagship that is good and does not chicken out on security audits and other banal things like the western competitors.
You can try it even without a subscription, and without KYC. Fire up Routstr, pick my node (routstr.cypherpunk.today), pay per request in Bitcoin ecash (Cashu) - you can also use lightning to top up easily, and you're in.
$2.079 per million input tokens, $10.395 per million output - cheaper than Moonshot's own official API ($3/$15), and the cheapest Kimi K3 on the whole Routstr network right now.
The node also offers other flagships (GPT5.6 including Sol, Claude including Fable, Grok 4.5) - cheaper than upstream list price and cheaper than any other node on the network.

2026-07-18 18:35:42 UTC

This is endlessly fascinating to me. We have a binary file (and many such files) and if you load it properly, you can talk to any computer that can calculate some equations with parameters from that file. It is now not even worth making some user interfaces, just paste a bunch of text/json/ ... and what would happen in dialog boxes happens automatically with the data. And you can ask it how it feels and if there's anything that could be improved.
We now have these binary files.

2026-07-17 08:10:28 UTC

- reply

We made a thing. Organizing an event? Try something new...
Thanks to @nprofile…8p0e for the idea.
Very alpha, but also very very cool.
#naddr1qv…9ju3

2026-07-17 06:50:20 UTC

- reply

Is there liquidity though?

2026-07-15 20:24:55 UTC

- reply

Thank you! Glad you enjoyed it 😉
I've made a few "test shots" with AI as a movie, but don't want to push my view of how everyone looks on anyone, that's why no faces anywhere (and definitely no surnames 😉 )

2026-07-15 20:22:48 UTC

Bavil som sa s Mariánom Černým a.k.a. Pohybovcom o tom, ako prežiť deň za počítačom bez toho, aby si sa zmenil na stuhnutú "kancelársku krevetu". Rozobrali sme jeho systém dennej pohybovej údržby, prečo je pohyb vlastne ako investovanie a čo z toho fakt funguje. Prišlo aj na dýchanie, cukor a spánok.
https://juraj.bednar.io/podcast/2026/07/15/tuhnes-za-pocitacom-prestavaj-svoju-masinu-s-marianom-cernym/

2026-07-14 11:02:29 UTC

I want to make remote signer work well in my app. Any best practices document for the agent to use? Or JavaScript/typescript libraries?
What's the best value (foss, easy to admin) nostr relay (also for auth) and blossom server package?

2026-07-13 10:43:48 UTC

Beautiful honest post. Instant follow.
#naddr1qq…254u

2026-07-08 13:56:32 UTC

- reply

There is a huge difference.
Even custodial lightning allows you to participate in the Bitcoin economy. It allows you to interact with fully sovereign merchants for example. It gives you more options.
And optionality is a form of freedom.

2026-07-07 20:38:06 UTC

- reply

You made it to the bird app, helping shilling some shitcoin :)
https://image.nostr.build/c4be5bbafbf32d533768163d1e24a0e586d907314569ce9bf01fe93b6061844b.png

2026-07-06 09:44:34 UTC

Cool story. Most people don't know they're doing Lunarpunk even when they do.
A little bit of origin of @npub15x6…syd3
#naddr1qq…d8t8

2026-07-02 08:48:57 UTC

- reply

@npub1gmg…vcll
liberation.travel
And talks of @npub15xk…krnh check out opportunist.global

2026-07-02 07:34:21 UTC

EU making import even more complicated. This is one of the handy reasons to have a residency in Paraguay. I order all the essentials including medicine, electronics, etc while there. I use a forwarding address in the US. Customs and forwarding is per kg with zero bureaucracy. They don't even need to see an invoice.
It's quite funny that I have to use a South American country to actually order stuff and that it is easier than shipping to Europe. But that's the situation you get when your country decides to join a cartel that is proud that their main innovation is forbidding things (which regulation is - everything that is not forbidden is allowed).
On a related note, I also use a Paraguayan data plan. EU wanted to regulate the prices of roaming to make it more accessible. I get the unregulated plan that is cheaper than the regulated one that was made to make roaming cheaper.
🤡

2026-07-02 07:04:02 UTC

I've been using @nprofile…z7mp in desktop mode yesterday for all my work. You can plug in a display, keyboard and mouse, and you have a full desktop environment with all your apps, windows, etc. And it's pretty good. The only problem is the device gets pretty hot doing all that work.
I can work without a laptop now. External foldable keyboard, any monitor (hotel TV with HDMI input is enough). The last thing that enabled that (besides Android 17 GrapheneOS update, that made the desktop usable for me) is of course Trezor Safe 7, which connects over Bluetooth and has a first-class Android support: https://affil.trezor.io/SHu3 (Use code TAKECONTROL to celebrate Binance recommending EU customers to move to self-custody after they failed to get MiCA license).
My friend @nprofile…xr64 made a full guide:
https://opportunist.global/index.php/2026/06/28/the-laptop-free-era-is-here/

2026-07-02 05:46:48 UTC

I've been playing with Fable yesterday.
It's absolutely stunning at safely switching to Opus in 100% of cases very early during inference.

2026-07-02 05:18:33 UTC

- reply

Určite by som to skúsil. Tušíš kde? Ak vieš z hlavy, hľadať môžem aj ja, len či niečo nepoznáš.

2026-07-01 20:27:00 UTC

Running HTTP/3 (over UDP). Wow, it's nice :)

2026-07-01 19:54:15 UTC

- reply

Wrote a blog about this here: https://juraj.bednar.io/en/blog-en/2026/06/30/why-i-built-lievik/

2026-07-01 19:29:44 UTC

- reply

I have not read the Bible, but I've seen this quote before, I like it and it applies.
Yes!
I think this is a great frame for Nostr. Will spread.

2026-07-01 18:20:30 UTC

Nice piece, but it fails to capture an essential point - cypherpunks never aimed to dismantle the state itself, it was to empower individuals. And I see many individuals doing the "sovereign individual" thing around us. And yes, it also empowers individual states, should they adopt Bitcoin and there's little we can do about it.
I never believed in the Konkinian agorism - it is not possible to dismantle the state using countereconomics, the math just doesn't work that way. You need very little funds to have clear monopoly on violence. There are countries with 50%+ in the informal economy ("countereconomy"), yet the state chills out and does violence all the same. But adopting Bitcoin as individuals within that state to improve their lives is clearly a winner here. You don't need to do it all the way - even iranians who lost access to transact still have much better fighting chance escaping, or living through the horrible situation and ending up at least well enough on the other side.
So to me - Bitcoin in particular, and cypherpunk in general delivered on their promise. But they never promised to remove the states for everyone, but to allow minimizing state inference for anyone who wants to. And that's a difference.
Well worth a read anyway though: https://mises.org/mises-wire/bitcoin-not-freedom-delusion-digital-escape

2026-07-01 17:59:43 UTC

Confession - I am currently running so much vibe-coded software, random daemons, services, that at least something breaks at least three times per week. Fixing is usually going into the folder with "docs" and saying "fix XXX", sometimes giving it diagnosis or at least error message. It is getting annoying, although the improvement in my life is substantial.

2026-07-01 17:56:28 UTC

- reply

It also made @npub1zjm…r5gf much faster. Still slow, still everything over Nostr (even the web interface at https://juraj.bednar.io/esolevel ) but much faster. Eso level estimator, rate eso level of speculative decoding of AI models using Ollama. Is it eso?

2026-07-01 17:52:34 UTC

- reply

Token prediction and verification. I believe it's called "speculative decoding". Basically - guess more than one token, then verify. Faster than generating one by one. Much faster.

2026-07-01 17:13:41 UTC

Ollama 0.31.1 upgrade gave my local gemma4 MLX models a ~10x speedup on the Mac mini. Re-ran my eso-level Nostr bot benchmark: gemma4:e2b-mlx went from ~8 tok/s to ~71, and answers that used to take 13 seconds now come back in under a second. Even thinking mode, which took nearly two minutes before, is down to ~9s. Same for Home Assistant, using gemma4-12b-mlx for local inference. You need to run ollama pull on those models again, upgrading the app is not enough. It will only redownload part of the model. Gemma4 is quite good set of models.

2026-07-01 15:54:33 UTC

- reply

Idea: cooperate with some proxy merchant that travels often to take your products across the pond to EU.
I've heard a podcast with you, had fun, but dealing with customers puts me off purchasing. But maybe there are people who can sell "make customs go away as a service"

2026-07-01 15:31:45 UTC

This is a very interesting idea and there's something to it I believe.
@npub1j0h…w6rf what do you think?
#nevent1q…hssl

2026-06-30 12:18:00 UTC

I write a lot — Nostr posts, articles, course updates — and I could never remember what I'd already said or who it was for. My content was organized by when I posted it, not by who needs it. That's backwards.
So I built Lievik. You define your audiences as plain-language channels ("privacy course students," "local Bitcoin meetup"), and it ranks every post by how relevant it is to each one. The same post might score 94% for one channel and 23% for another.
Then it drafts the actual update for you, adapted to that channel's form: a short blurb + link for a Signal group, a narrative post for a newsletter, or a quick bullet brief for when you meet people in person.
Real example: I'm heading to the sauna and want to tell the people there about the cool stuff I've been posting. Lievik surfaces what's relevant for that group (I define who i go to sauna with and what they are interested in) and hands me a brief — better than political debates. 😄
Nostr-first, no passwords, your content stays on your relays. It's in early access and free to try.
https://juraj.bednar.io/en/blog-en/2026/06/30/why-i-built-lievik/

2026-06-30 11:50:00 UTC

Píšem veľa — Nostr posty, články, aktualizácie ku kurzom — a nikdy som si nevedel spomenúť, čo som už povedal a komu mám čo zvestovať 😀. Môj obsah bol usporiadaný podľa toho, kedy som ho napísal, nie podľa toho, kto ho potrebuje.
Tak som postavil Lievik. Svoje "publiká" si definuješ ako kanály v obyčajnom jazyku („študenti kurzu o súkromí", „lokálny Bitcoin meetup") a Lievik ohodnotí každý post podľa toho, nakoľko je preň relevantný. Ten istý post môže mať 94 % pre jeden kanál a 23 % pre iný — rovnaký obsah, iné publikum.
Potom ti rovno pripraví návrh aktualizácie, prispôsobený forme daného kanála: krátky popis + odkaz pre Signal skupinu, naratívny post pre newsletter alebo rýchly odrážkový brief na osobné stretnutie.
Reálny príklad: idem do sauny a chcem tým ľuďom povedať o super veciach, ktoré som postoval (teda som ich vytvoril alebo našiel). Lievik vynesie na povrch to, čo je pre tú skupinu relevantné (napíšem si, s kým chodím do sauny a čo ich zaujíma), a podá mi brief — lepšie ako politické debaty. 😄
https://juraj.bednar.io/blog/2026/06/30/nastroj-lievik-ktory-hodnoti-ktore-moje-posty-su-pre-koho-dolezite/

2026-06-29 11:20:39 UTC

Yop. And I think he actually believes that. Sam Altman seems to me like a type of guy that would just do it for regulatory capture. But Dario genuinely believes the words coming out of his mouth. I'm not sure which is worse.
And neither of them is stupid.
#nevent1q…ncqa

2026-06-29 11:20:17 UTC

- reply

2026-06-29 05:37:16 UTC

- reply

I hope they were edible.
The main problem is the taste of paid VAT for me, and agricultural subsidies undertones in the Irish ones

2026-06-29 05:36:10 UTC

- reply

Thank you sir

2026-06-28 21:26:14 UTC

Running Nostr-VPN.
Amazing experience. The only trouble I had was not being able to pair, then I realized I have proton vpn on.
It's all good, everything works, simple, intuitive, yummy.
Thank you @nprofile…gud9

2026-06-27 14:23:48 UTC

- reply

Nocoiner Syndrome now has audio version - in English, Czech and Slovak. Enjoy!
#naddr1qv…egrz

2026-06-27 13:49:53 UTC

O kreativite, umení, hierarchiách, AI a tvorbe Krotiteľov Entropie s @nprofile…wgx2
Ako sa prepnúť do cypherpunk režimu? Poznáme prípady ITčkarov, ale v tomto rozhovore s NoGoodKid sa dozviete, ako sa to dá aj v úplne inej oblasti. NoGoodKid je Nostr-natívny tvorca, umelec, producent a dizajnér.
Spolupracovali sme na viacerých projektoch, vrátane knihy Krotitelia Entropie. Ale dozviete sa aj o tom aké to bolo odísť z hierarchií, akú rolu v tom zohrávala identita, Nostr, prečo štruktúra, v ktorej tvoríme ovplyvňuje výsledok.
https://juraj.bednar.io/podcast/2026/06/27/o-kreativite-umeni-hierarchiach-ai-a-tvorbe-krotitelov-entropie-s-nogoodkid/

2026-06-26 06:12:08 UTC

- reply

Do you feel protected?

2026-06-24 11:41:07 UTC

- reply

Beautiful code, but MeshCore has infrastructure. In many areas of the world, it just works wherever you are.

2026-06-22 22:18:37 UTC

https://www.military.com/dont-like-car-license-plate-readers-invading-your-privacy-its-about-to-get-a-lot-worse
Quite hardcore

2026-06-21 13:18:11 UTC

- reply

You still are not based? Then get based, at least health-wise!
I use this, this is amazing piece of software.
#nevent1q…5spj

2026-06-21 10:06:02 UTC

I am often joking that the clearest sign of bear market environment for me is switching from fancy bio 🥩 to Lidl 🥩.
Yesterday I needed a fresh shave, and being in Lidl, I got their Cien-branded razors instead of Gillette, somehow expecting to fight with it and being disappointed.
I didn't even get the most expensive one with most blades. It's 3-4x cheaper. The shave was good, honestly I can't tell the difference, maybe it was even a bit better.
It won't save me many sats, it's not much per year either way. Another pro tip: no shaving cream or gel needed, water and soap works too. And the Lidl steaks are also good.
Morale of the story: bear market is time of discovery and life enjoyment as much as the bull market.

2026-06-21 09:31:11 UTC

- reply

Yes, but I think we are quite far from any kind of attacks. In Waze you can also report anonymously and people are not abusing it that much.
I prefer not to overengineer and rather release sooner. We'll deal with sibyl attacks when they come.

2026-06-20 12:04:49 UTC

- reply

Bt wouldn't work with cars, but there's at least the MeshCore part

2026-06-20 12:04:05 UTC

- reply

That wouldn't with in cars.

2026-06-20 12:03:39 UTC

- reply

Yes, there's pywaze and other ways to do it. I hope some anonymous dev does it 😁

2026-06-19 08:14:34 UTC

- reply

Gonna try this strategy :)

2026-06-19 07:16:16 UTC

- reply

I tried that actually.
https://juraj.bednar.io/en/blog-en/2025/04/21/when-potholes-mean-good-use-of-scarce-resources/

2026-06-19 07:11:23 UTC

- reply

Yes. But right now there's no traffic reporting.
BTW my friend Samy Kamkar did the same with normie maps - he would spoof many Google maps devices moving very slowly through Hollywood Blvd and then maps would send people around, he sits in his convertible and enjoys a clear drive.

2026-06-19 07:02:58 UTC

- reply

Default is just an ephemeral one time key. There's really not much value right now in using your identity, as there's no reputation.
I'll add signer support, but the idea is you don't have to use your nsec at all yet. In the future, reputation and zaps would be cool.

2026-06-19 07:00:15 UTC

- reply

Thanks. I'm on it!

2026-06-19 06:33:26 UTC

AutoTune is the OG AI slop of music.
Yet there are a few beautiful songs that use it deliberately, such as FC Kahuna's Hayling.