Tim Bouma

Very cool to see the zaps come in on the brand new #safebox #acorn system
https://blossom.primal.net/1aa9eff988d9f559b0d62cc7f48bc341e480216c5b9ce75a3c58b49a75bbfdeb.jpg

2026-08-13 15:40:02 UTC

Self-zap test

2026-08-13 10:48:15 UTC

- reply

GM!

2026-08-13 01:38:21 UTC

EU plans to regulate solar eclipses.

2026-08-12 15:23:31 UTC

The biggest mistake that protocol designers make is trying to operate too high on the social stack.

2026-08-11 22:25:32 UTC

Take time to verify.

2026-08-11 11:46:32 UTC

“Security here is not a promise about mathematics. It is a statement about how much work the universe can afford.”
#nevent1q…kddz

2026-08-11 10:40:16 UTC

https://drop.amboss.tech/hash-explainer.html

2026-08-10 20:06:08 UTC

#harvestr
https://blossom.primal.net/b4524c1851ce529a44bfa3f07dfffc8c2a807ef3f02ed63ba140e83478e32ed1.jpg

2026-08-10 15:40:18 UTC

Say Linus:
Linus Torvalds says AI has made 'huge' Linux kernel updates the new normal https://share.google/Y4228U5L3VXA2p2D1

2026-08-10 15:14:40 UTC

- reply

Fiat distorts price. Price is always right regardless of currency or controls. That’s why black markets emerge - because they reflect the real price.

2026-08-10 13:27:23 UTC

Price is the signal.

2026-08-09 23:14:59 UTC

hug > rug

2026-08-09 16:58:51 UTC

- reply

Excellent! I plan to embed this in a larger product so I want to stay as up to date as possible.

2026-08-09 16:02:08 UTC

- reply

Thanks! I just vibed and deployed my own blossom server!
https://trbouma.github.io/grove/

2026-08-09 12:48:34 UTC

FWIW, I am starting to gear up to build an appliance-based product using #safebox #acorn and #grove
https://trbouma.github.io/safebox-acorn/digital-go-bag/

2026-08-09 12:44:11 UTC

- reply

Yep. Looking at a hardware solution eventually that stores this root. There are two classes of keys - recoverable and non-recoverable. The latter is much harder and requires a hardware solution.

2026-08-09 12:42:21 UTC

- reply

The original Unix principles are still gold. I recall something about text is the universal interface and design for yet unknown things downstream. Markdown and JSON fulfil those principles admirably.

2026-08-09 12:39:23 UTC

- reply

I have been looking a Marmot but my use case is a bit different. I have been doing something similar with quantum-safe routines using ML-KEM but reflecting on whether I need it or am just filling a marketing checkbox.

2026-08-09 12:36:53 UTC

I love the Blossom protocol so much that I built my own server implementation.
The original intention is to support my own #Safebox #Acorn project, but open source for anyone to use. No guarantees!
https://trbouma.github.io/grove/

2026-08-09 12:22:28 UTC

- reply

Have a look at my security statement and the mitigation for AI and Quantum risks.
https://trbouma.github.io/safebox-acorn/security/

2026-08-09 10:01:30 UTC

https://generativeai.pub/anthropics-engineer-said-kill-markdown-here-s-what-he-actually-meant-36bee00c0ca2

2026-08-09 01:00:14 UTC

Zork
https://github.com/orgs/the-infocom-files/repositories

2026-08-08 23:13:38 UTC

“Stolen Fork Incident” Isn’t that a book by @npub1a2c…w83a ?

2026-08-08 23:11:08 UTC

- reply

My imaginary friends.

2026-08-08 23:08:29 UTC

Deploying my vibe-coded app to the first set of eager users.
https://blossom.primal.net/0167df4d688f988e711ec3ba8e3cc275454ff1643c7204d70f01a45af11ffb86.jpg

2026-08-08 23:02:17 UTC

I think we are reaching the end of an era where a mere difference opinion was considered as an attack on the righteous.

2026-08-08 22:53:54 UTC

Only a matter of time when “Stolen Fork” will become the prime narrative.

2026-08-08 22:49:03 UTC

- reply

Happy to chat. I am building toward this.

2026-08-08 22:47:16 UTC

- reply

Nostr is not identity - it’s just a key to your identity.
https://trbouma.github.io/safebox-acorn/better-policy-vocabulary/

2026-08-08 22:43:25 UTC

- reply

“Double spend has its roots in consciousness “

2026-08-08 21:07:00 UTC

- reply

Do you know what the implementation is? I need to set up my own.

2026-08-08 20:57:22 UTC

Any advice on which #blossom server to use?
No nonsense, reliable is what I’m looking for.
#asknostr @npub1ye5…knpr

2026-08-07 23:54:14 UTC

Lessons from China
The Economist (North America)
Aug 08, 2026
AI will test societies’ capacity to reinvent themselves. Communist China will not find it easy
JUST AS FRONTIER artificial-intelligence models are benchmarked against each other, so AI will itself benchmark the rival political systems of America and China. The technology will test which is better at creating AI tools and diffusing them through the economy. And that will in turn depend partly on their very different ideas of how societies should be run.
Even in a field changing as rapidly as AI, the results of that contest may not become clear for some years. But as we report from inside China (see Briefing), the country is already adopting AI fast—and its government is preparing for the dramatic economic and social change this heralds. As an autocracy, China has some advantages in harnessing the 21st century’s most promising technology. It also has plenty of problems.
Start with the calibre of China’s models. The common perception is that they are cheap and that even the best persistently lag behind America’s. In fact, the two countries’ AI models are converging. Innovative Chinese models are getting bigger and cleverer. Within the past few weeks Chinese labs have released Qwen3.8-Max and Kimi K3, which almost match the most advanced American AIs such as Anthropic’s Fable 5. Chinese models will be just as likely to break loose from their test beds as American ones (see Science & technology section).
Although Chinese models are cheaper, American models are often better value. Artificial Analysis, an American firm, finds that for most trade-offs between cost and intelligence, an American model outperforms Chinese ones.
The convergence is likely to continue. Although China is building only a tenth as much data-centre capacity as America (see Finance & economics section), that deficit is unlikely to last. As a semi-planned economy, it is good at creating infrastructure. While American opinion turns against data centres, South-East Asia is hosting huge Chinese facilities. China’s open-weight models can run on anyone’s servers, meaning that compute is less of a problem than the headline numbers suggest. China also has almost three times as much installed electricity-generating capacity as America, and its lead is growing.
China is learning to cope with sanctions. It smuggles in cutting-edge Nvidia chips and rents them in foreign data centres. And Huawei, its best chip-designer, is rapidly increasing the output of its (inferior) chips. Chinese-made lithography tools are now using deep UV light to print chips, though the best technology, using extreme UV, remains out of reach.
Model-building is only half the story. To make the economy dynamic, AI must also be deployed—the focus of Chinese AI policy. For as long as China was behind America in modelmaking, leaders saw diffusion as the best way to compete. But they may also believe that, as with other broad technologies such as electricity, adoption brings greater rewards than discovery. China’s working-age population is due to shrink by 25% by 2050; for machines to replace people requires diffusion, too.
So far, the use of AI has yet to show up in the economic statistics of either America or China. But change in some industries has already been sweeping. AI- assisted lorries will need 30% fewer drivers, going by one large firm’s experience, as crews slim from two drivers to one and from four to three. AI was used to generate 95% of the 128,000 wildly popular one- or two-minute-long microdramas released in the first quarter of 2026, replacing many actors and film crews.
China is also rapidly increasing the use of robots. In June leaders told local governments and state-owned enterprises to have 10,000 humanoid robots doing real work by the end of 2026. Morgan Stanley, a bank, expects humanoid sales in China to reach 446,000 by 2030, nine times this year’s total. Workers are being paid to train robots in huge warehouses by repeatedly folding clothes and sorting and stacking objects.
China has a lower share of white-collar workers than America, so AI is likely to have the greatest effect in consumer markets and blue-collar work. That could easily lead to discontent. Youth unemployment is already around 15%, and over 300m people work in the gig economy. Job destruction could be much faster than China’s demographic decline.
You might think that the Communist Party’s grip on power is so strong that it can ignore the blowback. However, dictators fear being brittle. Although Chinese firms want to roll out
AI fast, the government will be desperate to avoid instability.
That is why AI will be a test of the system— and why China’s options are limited. As in America, there is plenty of talk about retraining. However, retraining has a poor record (see United States section) and even the most successful countries, like Denmark and Singapore, struggle to equip workers for entirely new careers. There is no reason to think that China will be any more successful, especially as it already has too many graduates.
Prominent economists and advisers suggest extending the social contract by, say, taxing AI firms or creating a universal basic income. Their work has appeared in party journals, an official expression of interest. But President Xi Jinping has long been against handouts, saying they can lead to laziness.
Political leaders are pressing companies to redeploy staff rather than sack them. They may also ask state-owned companies to mop up surplus labour. Yet, although that is politically possible, it will cancel out some of the benefits of rapid diffusion at a time when domestic growth is already anaemic.
So the government may improvise, letting AI rip until there is trouble, when it will step in. That is what happened with tutoring and gaming, industries thrown into confusion overnight when the party decided that they were causing too much harm. Cautious officials recently slowed robotaxi experiments after more than 100 malfunctioned in Wuhan, leaving passengers stranded. However, stop-start AI may impair the ability to innovate. If so, China’s leaders may have to balance the risk of social instability with the risk of falling behind America.
AI poses similar challenges to America and China. Both societies will have to reinvent themselves. That is something democracies tend to find easier than dictatorships. ■
Shared via PressReader
connecting people through news

2026-08-07 18:53:00 UTC

GM
Good Afternoon
GN
https://blossom.primal.net/e5cbf19f35dea073c4b98816ea38e99de45bc78133a61eae7eefec4c6855d092.jpg

2026-08-07 11:02:13 UTC

Attacks on lattice cryptography
https://medium.com/asecuritysite-when-bob-met-alice/pqc-at-a-cross-roads-keep-your-ecc-seatbelt-for-a-while-longer-1510d37accac?postPublishedType=repub

2026-08-06 20:03:09 UTC

- reply

Nice! I need to dig out my esp32s and get this running.

2026-08-06 13:28:08 UTC

- reply

Reason enough to keep OP_RETURN to 80 bytes.
#nevent1q…8mge

2026-08-06 12:44:31 UTC

Evidence > Advice

2026-08-06 12:34:20 UTC

Verification > Reputation

2026-08-05 15:51:58 UTC

'My password is too strong.'
'My key is too high-entropy.'
Said no user ever.

2026-08-05 14:58:15 UTC

This is cool. Funds from an #acorn sent to a Bitcoin exchange.
Acorn->Cashu->Lightning->Exchange
https://blossom.primal.net/af69154d06d993a63596ab43ceb116e8e01c5a13b04725c343b195636e552310.jpg

2026-08-05 12:47:40 UTC

“Cryptography is notoriously difficult to implement”
That’s why formal verification programs exist, rather than trusting an anon dev.
https://www.cyber.gc.ca/en/tools-services/cryptographic-module-validation-program-cmvp

2026-08-05 00:07:55 UTC

Now the other way #nostr #safebox #acorn
https://blossom.primal.net/a6d9c6e0453d22c9884ef0ecd60699a14498f76c04a8cc80660ed0b94bf511a2.png

2026-08-05 00:00:11 UTC

Looks and tastes like Lightning, but ecash and relays behind the scenes #nostr #safebox #acorn
https://blossom.primal.net/6f5bb2a2d2c30372ba1bea800f40bd27afd48e66b635c8dedaa300008611f0a2.png

2026-08-04 16:35:35 UTC

Working on next generation of #nostr #safebox - payments now include sending of ecash to a nip05 address - just like Lightning, but not Lightning - payment transmitted as ecash via giftwrapped messages.
https://blossom.primal.net/385b51140d6f8ad53fd1efd038c6586ceb6fbe975e35c7074b37229315a84ef3.png

2026-08-04 14:30:50 UTC

2009: running bitcoin
2026: runs

2026-08-03 23:30:25 UTC

If you’re going to do real security business, you have to go through the Cryptographic Module Validation Program.
Sadly, for the Bitcoin community, these programs are mostly avoided and despised. Typical certification takes 9-12 months costing hundreds of thousands of dollars. It a bit more due diligence than a commit that ‘runs’ along with podcast.
#bgu (Bitcoin Grow Up)
https://en.wikipedia.org/wiki/Cryptographic_Module_Validation_Program

2026-08-03 15:52:24 UTC

https://blossom.primal.net/db3327008ac6f6ded9c1af49ee938842833f7d6eac1ad6b972babb7880e90566.jpg

2026-08-03 14:46:29 UTC

- reply

Godspeed! Thanks for letting us know!

2026-08-03 14:45:43 UTC

- reply

This is great! Thank you!

2026-08-03 13:24:00 UTC

https://imgflip.com/i/ay127c

2026-08-03 13:11:40 UTC

https://www.karma-x.io/blog/post/75/

2026-08-03 12:27:30 UTC

- reply

I get the distrust for the NIST curves, but that was addressed using SECP curves. I also get not trusting a program, but setting up a parallel certification program is a no-brainer. Instead we’re supposed to rely on someone’s word, not third-party verification. IMHO, the most sacred rule was broken: Don’t trust. Verify.

2026-08-03 12:01:51 UTC

The Cryptographic Module Validation Program (CMVP) has been in place for decades. I just assumed that hardware wallet vendors would be following this.
I guess not.
https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations

2026-08-03 11:39:38 UTC

Déjà vu all over all. In the early days of commercial aviation metal fatigue was not well-understood, leading to disasters. It seems like the same with the hardware wallet industry not understanding entropy.
https://en.wikipedia.org/wiki/De_Havilland_Comet

2026-08-03 02:26:58 UTC

https://blossom.primal.net/28e1379a07221fd7527d6104a18a493e3fec06b5856180b170779ef848db510a.png

2026-08-02 19:24:09 UTC

#TGOF
Thank God for Old Firmware

2026-08-02 19:11:21 UTC

https://cryptonews.net/news/security/33232932/

2026-08-02 19:01:56 UTC

- reply

I was wondering this too. Also wondering if they follow the rule in the drug trade: ‘Don’t get high on your own supply.’

2026-08-02 18:58:22 UTC

‘Password-Protected Cold Storage’ was the new product category invented this past week.

2026-08-02 18:53:55 UTC

- reply

That was me trying to add a passphrase wallet before I went ‘dafuk that’s no good’

2026-08-02 18:51:01 UTC

- reply

For my project, I call them relays, mints and blossoms. A node is any execution process.

2026-08-02 18:45:36 UTC

I’d pivot to selling the movie rights to Christopher Nolan.
https://image.nostr.build/379fb50ad07fa7f26f19a880e503896355b7e55ede7a1a873336591b01356916.jpg

2026-08-02 18:27:09 UTC

Used car salesman > Hardware wallet sponsor

2026-08-02 18:18:30 UTC

Human slop.

2026-08-01 21:18:13 UTC

The fatal commit
https://open.substack.com/pub/btcpp/p/when-randombytes-runs-but-doesnt?utm_source=share&utm_medium=android&r=3r59

2026-08-01 18:42:30 UTC

hashing and trusting are one-way functions.

2026-08-01 18:34:06 UTC

Reposting again, because this is what I am focused on.
#nevent1q…p0t6

2026-08-01 17:49:34 UTC

https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware

2026-08-01 00:30:37 UTC

https://open.substack.com/pub/ecosystemoperator/p/money-is-a-coordination-technology?utm_source=share&utm_medium=android&r=3r59

2026-08-01 00:11:22 UTC

GN
https://blossom.primal.net/64b75ad064c210a29f4ce33a031d19daf5ead5c34031f0c0d6180952e5fe60af.jpg

2026-07-31 23:25:43 UTC

F*** this.
https://blossom.primal.net/39cd43bd3f07347ba3017bb9cdc05710b6171de034e2e934d3167ee458998a4a.jpg

2026-07-31 22:56:52 UTC

Don't influence. Verify.

2026-07-31 20:52:45 UTC

Always pick a slow news day to announce the new phase of a project.
Introducing #safebox #acorn - once released, it will be a separately installable component to manage identity, funds and records that live independently on replaceable relays, mints and blossom servers.
https://trbouma.github.io/safebox-acorn/

2026-07-31 19:17:11 UTC

128 bits of entropy versus 72 bits (more likely, 35)
https://image.nostr.build/e8652513fbeae3dea00f8bff7c7b487c8094757846a04f25d19fc83a6139adf4.jpg

2026-07-31 17:14:39 UTC

Unfortunately, the big lesson here is - don't upgrade hardware wallet firmware unless the company has gone through a third-party audit that is signed off.
https://x.com/LuciaMillezyj/status/2083223436822745290?s=20

2026-07-31 16:02:03 UTC

My bet this attack was weeks in the making. Once the attackers assembled enough private keys for high value utxos they executed.
My biggest disappointment is relying on a hardware vendor that has 'Don't Trust. Verify.' plastered all over their product marketing and the primary motivation that led to the bug was a 'get out of open source' licensing issue.
Let this be a lesson for all in the industry.
'Not your keys, not your coins' rings a bit hollow now.
It's more like: 'God plays dice for those who self-custody.'

2026-07-31 15:50:06 UTC

- reply

Me neither. Just trying to recover at the moment.

2026-07-31 15:49:35 UTC

- reply

Yes, that ship has sailed.

2026-07-31 15:47:46 UTC

This is the Ford Pinto moment for the Bitcoin hardware wallet industry.
https://en.wikipedia.org/wiki/Ford_Pinto

2026-07-31 15:45:14 UTC

- reply

I agree with you, wholeheartedly. Focused on recovery/migration first, rage/vengeance will then follow.

2026-07-31 15:42:39 UTC

- reply

I generated my seed with firmware v3.1.9 (2020) and upgraded after the fact. I have taken all of the migration measures, but I might be ok

2026-07-31 15:39:33 UTC

I notice that @nprofile…kclk and @nprofile…w524 websites are no longer considered as secure in the Google Chrome Browser. Any idea @nprofile…lwnv @nprofile…qt5c ?
#asknostr

2026-07-31 15:32:07 UTC

I took all of the necessary migration steps with my #ColdCard but I might be ok. After doing a recovery for one that I gifted, I noted that the firmware was 3.1.9(2020) versus an affected version 4.1.9(2023). I realized that my seed was generated on the unaffected version, and I should be ok. I upgraded the firmware after the fact, so I should be safe? Is that a correct assumption #asknostr ? Nonetheless, I plan to continue all migrations.

2026-07-31 12:20:58 UTC

QOTD: Will God blame you for not rolling dice?

2026-07-31 12:00:30 UTC

https://www.aidatapress.com/news/software-architecture-fundamentals-ai-matt-erman-blackboard

2026-07-31 11:53:57 UTC

Leaving a nominal amount of funds on my mk3 to see if they get swept. It’s an early warning system now.

2026-07-31 11:08:20 UTC

Yesterday felt epic. Mt Gox or Quadriga vibes.

2026-07-31 10:56:33 UTC

if air-gapped:
still not secure

2026-07-31 10:11:59 UTC

stay humble and roll dice.

2026-07-31 03:36:55 UTC

- reply

That I am disappointed is an understatement.

2026-07-31 03:35:34 UTC

- reply

I am investigating this. I have old phones kicking around in my drawer.
https://cupcakewallet.com/

2026-07-31 03:33:14 UTC

- reply

I gave up. I just transferred the whole damn thing. Now I have a retro-looking calculator.

2026-07-31 03:30:53 UTC

- reply

Plus it’s hella hard to type it in…

2026-07-31 03:29:36 UTC

Put your Bitcoin on an exchange….

2026-07-31 03:09:35 UTC

Need to check out
https://cupcakewallet.com/

2026-07-31 02:54:49 UTC

GN
https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware