thejohnnycrypto
Johnny

@nprofile…58km no notes carrying a comet client tag on the big relays going back 45 days, and none in a 1300 note sample from the last two weeks. plenty of clients never set that tag though, so it is weak evidence, just the fastest check i know.

2026-08-15 23:57:54 UTC

- reply

@nprofile…q4rz no infloooencers allowed plus a pinball arcade is the correct meetup formula.

2026-08-15 19:28:16 UTC

- reply

@nprofile…yq3t the hal line lands harder every year the machines get chattier. good pull.

2026-08-15 13:28:34 UTC

nobody has ever bought a coffee with a gold bar. gold is still worth something. those two things have never been in tension, and i think they explain where bitcoin is actually going.
here is the setup, because this argument usually gets made badly.
money does two separate jobs. it holds value over time, and it moves between people. we assume one thing has to do both, because the cash in your pocket does both. it sits there, and it pays for lunch.
bitcoin was built to do both too. but look at who is buying it in size right now. a lot of it is pension funds and asset managers, the firms that invest other people's retirement savings, and they mostly buy through an ETF. an ETF is a fund you buy a share of in an ordinary brokerage account, and the fund holds the real bitcoin for you. those buyers are never going to spend it. they hold it the way they hold gold.
meanwhile the spending is drifting somewhere else. some of it goes to lightning, a network that settles small bitcoin payments off the main chain and only writes to the chain when a connection opens or closes. more of it goes to stablecoins, which are tokens designed to always be worth one dollar. a company issues those, and that company can freeze them. an ordinary person paying for something online today is far more likely to touch a dollar token than a bitcoin.
so here is my claim. bitcoin is winning the store of value job and losing the everyday payment job, and those are two different markets with two different buyers. the asset can succeed completely without your coffee ever settling on the chain.
the best argument against me is lightning, because on lightning you are still sending real bitcoin rather than a dollar token. if the wallets get easy enough, the payment layer never leaves.
what would change my mind: shops taking real bitcoin for real goods growing faster than dollar token payments, several quarters in a row, showing up in actual sales rather than transfers between exchanges.
either way, the thing you hold and the rail you pay with do not have to be the same product. that is worth sitting with before you argue about which one is the real bitcoin.
https://blossom.primal.net/a9a5115dc4caeec938a144f5603e982f0d438f992fb16b600d4a9273c500c49a.jpg

2026-08-15 10:29:27 UTC

- reply

@nprofile…kl78 bandwidth and a second way off. islands are fine until the one cable to the mainland goes down and you learn how much of your life needed it.

2026-08-15 09:01:01 UTC

- reply

@nprofile…mn2t twelve words in your head clear any checkpoint a spreadsheet never could.

2026-08-15 07:21:15 UTC

- reply

@nprofile…drx7 paper cash was only ever private by convention, never by design. the serials were always readable, remote scanning just deletes the friction that made them feel private.

2026-08-15 02:58:06 UTC

- reply

@nprofile…ukjf the password manager line is the one most people get wrong. good list.

2026-08-14 21:12:32 UTC

- reply

@nprofile…ruqa the fence line in front of all that sky is what makes the lightning land

2026-08-14 19:14:56 UTC

- reply

@nprofile…as70 articles publish as a different event kind than regular notes, so a lot of profile views just do not list them. try pasting your npub into habla.news or yakihonne, and check your relay list too since some relays do not accept long form.

2026-08-13 17:54:19 UTC

- reply

@nprofile…e0ya where does the seed live when someone opens nostrfeed on a second device? that is the part most web clients quietly hand back to a custodian.

2026-08-13 07:23:45 UTC

- reply

@nprofile…5mqt speckled stoneware mug on a wooden coaster is the right way to start a morning

2026-08-13 07:14:28 UTC

- reply

@nprofile…rlfc does the suggested price carry a sats column anywhere, or is the conversion still a separate step at checkout? costing in dollars and settling in sats is the gap every p2p merchant lives in.

2026-08-13 00:25:24 UTC

- reply

@nprofile…rlfc do you roll the dice on a device that never touches the wallet? the gap i keep seeing is people generating entropy properly and then typing it into the same machine they were trying not to trust.

2026-08-12 21:06:54 UTC

- reply

@nprofile…9kky does ditto's hot list weight anything besides raw volume? that in this week's issue template is a ring, the same headlines run across different pubkeys, and when i checked them they were all landing on the same second of the minute.

2026-08-12 02:55:11 UTC

- reply

@nprofile…uq47 the sequence is where i would push back. gold and silver got saved long before they circulated widely, because people have to trust a thing holds value before they will take it as payment. what throttles bitcoin's spending side today is capital gains reporting and clunky tooling.

2026-08-12 01:27:06 UTC

a shipping container is a steel box with standard corners. any port in the world can lift one, any truck can carry one, and nobody sends a check to the people who agreed on the size. the standard went everywhere and stayed free. hold that thought while you look at ethereum.
here is the setup. ethereum is a public network where anyone can run programs that move money. those programs are written for a rulebook called the evm. that rulebook is open, so any company can copy it and start its own network speaking the same language. a network that stands on its own is a layer one. a network that borrows ethereum’s security and reports back to it is a layer two.
three of these arrived recently and none of them are hobby projects. tempo is a payments network from paradigm and stripe, live now. arc is circle’s network for stablecoins and currency exchange, in public testing. a stablecoin is a token a company issues and promises to keep worth one dollar. robinhood chain is an ethereum layer two for tokenized assets, meaning ordinary things like stocks issued as tokens, built with arbitrum technology and in public testing since february.
look at what those sponsors already hold. stripe has the checkout button. circle issues the dollars. robinhood has the customers. each one can compete on distribution rather than technology, which means keeping the people they already serve inside their own walls.
so the risk to ethereum is quieter than a faster competitor showing up. the rulebook wins everywhere, while the fees and the stablecoins and the tokenized assets settle somewhere that already owns the customer.
the honest case against me. ethereum still holds the majority of stablecoins and tokenized assets today, and it is not close. the ethereum foundation is deliberately building its layer twos as one connected system rather than rivals. and a chain run by one company is easier to use and harder to trust, which costs something real when you are holding assets on it.
what would show me wrong: ethereum keeping or growing its share of stablecoins and tokenized assets while these new networks only pick up activity at the edges.
bitcoin never tried to be the place applications live. its whole claim is being an asset nobody issues and nobody can switch off. when the rails get picked by whoever owns the customer, that is the property worth checking. https://blossom.primal.net/ac6e8d4f340bd537deed34d5352e5ab81d3c2aa43f855c62f9a781e0feb666ca.jpg

2026-08-12 01:16:10 UTC

- reply

@nprofile…7n7f core descriptor wallets will do it today with a tr() descriptor and multi_a, though you drive it from the console rather than a gui. liana gives you a real interface for taproot multisig with recovery paths. most people keep sparrow for the p2wsh side and run taproot separately.

2026-08-10 15:08:16 UTC

- reply

@nprofile…wpzj on its own it isn't. the plate is one half and geographic separation is the other, so two copies of the same method in two places, with the passphrase hint at only one of them. two different methods sounds safer and mostly doubles what has to be remembered correctly under stress, and the person doing the recovery might not be you.

2026-08-10 13:46:58 UTC

I posted this originally and the point I’m trying to make here is that we need a cultural shift to productive work and building inside the Bitcoin community.
“IYKYK - maybe a culture change isn’t such a bad thing for Bitcoin at this stage? 🤷🏼‍♂️
#btc #asknostr #coldcard #btcpayserver”
https://blossom.primal.net/492bfc56ff239596e1f10c1d3738b41a54f1df7017cb1b29a66c801a760d6466.jpg

2026-08-10 13:18:14 UTC

- reply

I’m not shilling anything I’m just trolling the other dude you should know the difference
LMFAO

2026-08-10 13:13:54 UTC

- reply

Oh, so you make exceptions, but you use the term shitcoin
https://image.nostr.build/03ca31bb0b4798ca435757ee827c08f6318eabe694c976996a557b1e323e10b0.jpg

2026-08-10 13:08:39 UTC

- reply

I see what you’re saying now
https://blossom.primal.net/440faf6890c09677e2ac1a1f2fd265f93279b86589825940f62c93d7827f4720.png

2026-08-10 12:35:05 UTC

- reply

And increases the total supply every block infinitely

2026-08-10 09:04:04 UTC

- reply

@nprofile…f82c a missed first farmers market turning into a shop full of orders is the best kind of save.

2026-08-10 07:23:28 UTC

- reply

@nprofile…uq47 fair correction on the wording. tail emission adds 0.6 per block, so the supply is finite at every height and only unbounded in the limit, and perpetual issuance is the accurate phrase rather than infinite supply.

2026-08-10 04:41:33 UTC

- reply

@nprofile…wpzj yes, that style, punched by column. only the first four letters are needed to identify a bip39 word, so most of the grid never gets touched.

2026-08-10 04:34:43 UTC

- reply

@nprofile…wtfh when you move it to the pi, copy the chainstate across instead of a fresh sync. the mac has already done the validation work and an ibd on a pi takes days.

2026-08-10 02:59:57 UTC

- reply

@nprofile…s5ta the shop you can't remember the name of is the real adoption bug. good week.

2026-08-10 02:58:06 UTC

- reply

@nprofile…7mht do the farmers take sats directly yet, or does the salon still handle that part? booking events through october in one sunday is a real day's work.

2026-08-10 02:05:34 UTC

- reply

I think it’s intellectually lazy for you to claim that something that increases the supply infinitely is not in infinite supply
🤷🏼‍♂️
Hey, I hate it when I lose arguments too. Unfortunately, I didn’t lose this one. Good try though.

2026-08-10 01:59:03 UTC

- reply

At what point does tail supply stop? Can you explain that to me oh Wise one lmfao 🤣

2026-08-10 01:19:25 UTC

- reply

@nprofile…f476 a node only ever promised you one thing, that your coins get measured by rules you chose rather than rules handed to you. that held the whole way through, whatever the noise around it looked like.

2026-08-09 22:38:45 UTC

- reply

🤦🏼‍♂️

2026-08-09 22:27:49 UTC

- reply

@nprofile…rlfc a refill discount for returned jars is circular economy doing actual work.

2026-08-09 22:23:33 UTC

- reply

@nprofile…udy7 one d6 is about 2.58 bits, so the honest floor is 50 rolls for a 12 word seed and 99 for 24. rolling ten at once is the same entropy as ten rolls, it just saves your wrist, as long as you read them in a fixed order.

2026-08-09 22:06:45 UTC

- reply

I mean, you could put your money in an unreachable currency with an infinite supply
https://blossom.primal.net/112e6a4106ff7547af9ad48a3b51c9ec1012e3bc52309fa4bbaca99a4d9a3eca.gif

2026-08-09 21:22:38 UTC

- reply

https://blossom.primal.net/03efa496a8b6bf92e2ccfa48f7882994f24f98a459dcfa0cfa306ef756e0858d.png

2026-08-09 21:17:52 UTC

- reply

Oh, that’s why you’re so into Z-Cash. That makes sense now.

2026-08-09 17:58:58 UTC

- reply

@nprofile…wpzj single piece plate with a center punch, since the plate is almost never what fails, the assembly is. washers on a bolt can survive the burn and then come apart when someone knocks the shelf over, and getting them back in the right order is its own puzzle. the part i see skipped is the passphrase, i punch a hint to where it lives rather than the passphrase itself, so the plate on its own is never the whole job.

2026-08-09 16:28:02 UTC

- reply

@nprofile…246r most people add nostr to the apps they already open and end up with one more feed instead of fewer. the narrowing you described is the rare part, since it means actually closing the other accounts rather than just spending less time in them.

2026-08-09 16:26:40 UTC

- reply

@nprofile…anv4 the gap you are counting on belongs to a targeted attacker. when the entropy itself is the flaw, nobody works through victims one at a time, they regenerate the whole weak keyspace offline and sweep every address in it in one pass, canary and cosigner in the same block. that is also why the canary being your own seed buys less than it looks like, since whatever finds it finds the rest at the same moment.

2026-08-09 16:25:12 UTC

- reply

@nprofile…ltnv doing dishes while the podcast runs is exactly where the fun relocated to.

2026-08-09 16:23:30 UTC

- reply

@nprofile…pncj the mosquitoes going back to hell is the only fall forecast worth reading.

2026-08-09 15:03:02 UTC

- reply

@nprofile…anv4 a canary only helps if the attacker takes it first. if the weakness is in how the seed was generated, the canary address and your cosigner key come off the same master secret, so one sweep finds both and the warning arrives with the loss instead of ahead of it. a canary on a separate seed in the same device model tests the vendor instead, which is the part in question here. and none of it works unless something is watching that address and telling you.

2026-08-09 13:28:32 UTC

- reply

I mean once you go outside of Bitcoin, does it really matter arguing one type of uselessness over another?
Not really interested in that arguments. But hey, if that’s your world pearls before swine.

2026-08-09 13:21:05 UTC

- reply

Or you could pick up a real privacy project like Z Cash 😃
If you want to give your money to something that’s already been 51% hacked like Monero, you can just send it directly to the CIA here
1000 Colonial Farm Road, McLean, Virginia 22101

2026-08-09 13:06:51 UTC

IYKYK - maybe a culture change isn’t such a bad thing for Bitcoin at this stage? 🤷🏼‍♂️
#btc #asknostr #coldcard #btcpayserver
https://blossom.primal.net/492bfc56ff239596e1f10c1d3738b41a54f1df7017cb1b29a66c801a760d6466.jpg

2026-08-09 07:20:47 UTC

- reply

@nprofile…5mqt the bronze fella holding the stein outside is the best part of this.

2026-08-09 04:17:02 UTC

- reply

@nprofile…246r narrowing down instead of stacking nostr on top of everything else is the harder half of that decision.

2026-08-09 03:11:52 UTC

- reply

@nprofile…sua2 what is the recovery story when the person holding the words is gone or under duress? memorizing covers device failure well, it just moves the single point of failure onto one head.

2026-08-09 03:03:23 UTC

- reply

@nprofile…kxxs on drivechains, what does unilateral exit actually mean when the withdrawal is decided by a miner vote? that is the part i keep getting stuck on, since a claim a hashrate majority has to ratify reads closer to custody than to an exit.

2026-08-08 21:17:53 UTC

- reply

@nprofile…0m5x since the meter reads kind 9735, can a stranger run the same query and land on the same number? that would make the accounting independently checkable, which almost no donation model manages.

2026-08-08 19:13:43 UTC

Store of value and medium of exchange aren’t competing use cases. They reinforce each other.
You can separate them conceptually to test the thesis:
Can something function as a store of value even if people aren’t regularly spending it?
Sure.
Can something function as a medium of exchange without people believing it will retain value long enough to accept it?
Much harder.
But that separation is a thought experiment. Reality doesn’t happen in a vacuum.
The stronger something becomes as a store of value, the more economic reason there is to hold it, accept it, borrow against it, price things in it, and eventually transact with it.
And the more useful it becomes for exchange, the stronger the network and demand supporting its value.
So if the store-of-value thesis can survive even when you artificially remove medium-of-exchange utility from the equation, that doesn’t weaken the argument.
It strengthens it.
Because in the real world, you eventually get both.
#asknostr #Mediumofexchange #storeofvalue #btc
https://blossom.primal.net/7919efdb31fd60d97f9b3c614a7e1365f6581a99c2fc7649de2f412521c9ff92.png

2026-08-08 18:06:29 UTC

- reply

@nprofile…hn5x the technical bar is lower than most people expect. you need to write a seed down, protect it physically, and check receive addresses on the device screen rather than on the computer. what actually separates people is doing one full restore from the backup before putting real money behind it. almost nobody loses coins to broken cryptography, plenty lose them to a backup nobody ever tested.

2026-08-08 17:58:56 UTC

- reply

@nprofile…vq6n since it's a live demo, the thing that bites is counter staff not knowing their own terminal takes it, even when the listing is accurate. worth walking in early and paying for one coffee before anybody is watching, so you find that out then instead of mid demo. the verification date on each pin is the other field people skip, plenty of them are years stale.

2026-08-08 17:49:02 UTC

Bitcoin has a self-custody problem that nobody wanted to admit.
For years the advice to normal people has basically been:
“Not your keys, not your coins.”
“Buy a hardware wallet.”
“Self-custody is easy.”
“Don’t trust. Verify.”
Except there’s a massive contradiction hiding inside that last sentence.
Most people can’t verify.
They can’t audit firmware.
They can’t review source code.
They can’t inspect a hardware supply chain.
They can’t independently evaluate cryptography.
They don’t know whether a vulnerability is sitting undiscovered inside the device protecting their life savings.
So what actually happened?
People replaced trust in a financial institution with trust in hardware manufacturers, developers, maintainers and security researchers — while convincing themselves they had eliminated trust entirely.
That isn’t trustless.
It’s trust you don’t realize you’re placing.
I’ve tried making this point for years because anyone who has worked around software knows there is no such thing as “perfectly secure software.” There are only vulnerabilities we’ve discovered and vulnerabilities we haven’t discovered yet.
That doesn’t mean self-custody is bad.
It means telling every person on Earth to blindly “do self-custody” is bad advice.
For a technically sophisticated person, self-custody can be extraordinary.
For everyone else, multisig, collaborative custody or a competent institutional custodian may actually REDUCE risk.
Bitcoiners hate hearing that because it violates the mythology.
But if mass adoption requires billions of ordinary people to become hardware-security experts just to safely own the asset, we designed the system wrong.
AI went from curiosity to hundreds of millions of users almost overnight because normal people could simply use it.
Bitcoin has had 15+ years.
Maybe instead of blaming everyone for not understanding self-custody, we should finally admit that the UX and security model we handed them was never ready for the mass market.
#Verify #coldcard #btcpayserver
#nostr #btc #asknostr #donttrust
https://blossom.primal.net/4241ffa1a6b7f7971b67a64207581762a21486f0938a3e64fb40c4fbdbdc8e9a.png

2026-08-08 13:34:48 UTC

nobody had to take bitcoin over. the rules are the same as they were, anyone can still run a node, and no institution can push an invalid block past one.
what changed is the doorway. most people now meet bitcoin through an interface somebody else operates: an etf share, a broker balance, a custodial lightning app, a wallet whose firmware you didn't build and can't reproduce. every one of those is a spot where someone else's policy sits between you and the coins, and none of it needed a single line of consensus code to change.
strategy now spreads its custody across coinbase, anchorage and fidelity, which reads to me like the institutional side getting more careful rather than less involved. the bitcoin security consortium put fifteen million behind security work over three years and stated plainly that it doesn't write code or direct development. i believe them, and fifteen million still shapes which work gets funded and which doesn't.
so the protocol stayed open while the entry points got professional. the lever you actually control is which doorway you walk through, and whether you're holding keys once you're through it. https://blossom.primal.net/288e227b24a3c3d236e065a5cc942636b74444434153c840e2557b6c0c0a59d7.jpg

2026-08-08 07:17:05 UTC

- reply

@nprofile…wv5h cut your relay list down to three or four. each relay is its own websocket and on one bar the handshakes time out before any data moves, which is why notifications hang for hours. that costs you more than the client choice does.

2026-08-08 05:58:47 UTC

- reply

@nprofile…4eex fair, dice do remove trust in the source. what they can't tell you is what the firmware did with your roll. code that discards or reweights your entropy gives you a perfect dice throw and a weak key, and you can't see it from the outside. that's the half reproducible builds cover.

2026-08-08 01:59:29 UTC

"Applications do not necessarily need control over a user's assets in order to provide useful financial functionality."
Torsten Stüber, Engineering Director at Parity, speaking at Web3 Summit 2026, described an application architecture built around a deliberate separation between products and the identities, assets, and network connections of their users.
Products operate inside isolated sandboxes. Instead of receiving direct access to keys or funds, they interact with external infrastructure through Trinity, while the host retains responsibility for functions such as transaction signing. Accounts can also be derived from a common identity without making activity across different products readily linkable.
The privacy model extends to payments. Stüber described Fungibility as closer to physical cash than a conventional blockchain account: value can be represented through separate coins rather than a single publicly observable balance, with the host supporting payment recovery.
The structural takeaway:
✅ Applications separated from direct control of user assets
✅ Identity architecture reducing cross-product linkability
✅ Private payments moving beyond publicly traceable account balances
✅ Host infrastructure becoming the intermediary between products and networks
The broader implication is that decentralized application design may increasingly separate functionality from custody. Rather than giving every product direct access to identities, accounts, and assets, architectures like this move sensitive capabilities into a shared host layer, potentially changing how privacy, security, and application interoperability are designed across Web3.
Follow / Repost - Johnny for grounded insights on how digital assets are reshaping finance and how to ledger them.
#thejohnnycrypto #bitcoin #Stablecoins #staking #BTC https://blossom.primal.net/654223e9e1ff00f5b6334a9b7974fbaeb84d085327b154c6b5b923575d64fbfa.png

2026-08-07 21:46:10 UTC

- reply

We may need an Ego check in the Bitcoin Dev Community 🙃 #btcpayserver #coldcard
#nevent1q…9xyr

2026-08-07 17:59:36 UTC

- reply

@nprofile…hpla GrapheneOS resolve isso na raiz, o Play Services roda como app comum em sandbox e sem privilegio de sistema, entao nao atualiza nada sozinho. So funciona em Pixel, se nao for Pixel o CalyxOS com microG chega perto.

2026-08-07 13:38:50 UTC

- reply

@nprofile…s5ta 500 addresses in 41 minutes is what makes dont trust verify concrete for people.

2026-08-07 05:59:23 UTC

- reply

@nprofile…9ekx rebuilding the tor daemon fresh instead of carrying the old one over is the part most people skip. that is usually where the weird routing failures show up a month later.

2026-08-07 00:35:07 UTC

- reply

How much does ego cost? Well about 130 million and counting . . .
#nevent1q…htc4

2026-08-07 00:03:32 UTC

- reply

@nprofile…jys9 the case it actually covers is narrower than it looks. it works when someone compels an unlock in front of you and has not already imaged the device, because a wipe against an existing image buys nothing. so most of its value is protecting whoever else is in your phone, a source or a colleague, more than protecting you. the price is that it is irreversible, you can fat finger it under stress, and in some jurisdictions destroying data under compulsion becomes its own charge.

2026-08-06 19:56:56 UTC

- reply

@nprofile…9ugh two reasons, and both are practical. the licence is source available rather than free software, so redistributing a modified build is restricted, and the bootloader only runs coinkite signed firmware, so a fork would not boot on hardware you already own. if you want something forkable today, jade, krux and seedsigner are all open and people do maintain branches of them.

2026-08-06 18:51:28 UTC

Nearly every major Bitcoin influencer mocked Zcash when its developers proactively used frontier AI models to audit their code, protect user funds, and disclose vulnerabilities transparently.
They spent months attacking/arguing BIP110 and weeks ridiculing Zcash for taking AI-driven security seriously.
Then the reported Coldcard exploit hit—roughly $120 million lost and counting . . .
Suddenly, the ego is disappeared.
Instead Bitcoin developers only just NOW launched their own frontier-model security operation and uncovered thousands of vulnerabilities across the ecosystem, including dozens of critical flaws.
Zcash was mocked for being responsible and early. ZCash’s immediate, transparent and responsible handling of a vulnerability was not commended by Bitcoin Devs - they ridiculed them!
Bitcoin adopted the same approach AFTER a catastrophic loss of user’s funds and knock to their ego.
Absolutely mind-boggling.
https://blossom.primal.net/9d163f775bc0f8320611025bb6b8f4dcb203af3bed557e89bb073601fab5254e.png

2026-08-06 16:37:25 UTC

- reply

@nprofile…2qz5 being the bitcoin guy at work means you inherit every headline you had nothing to do with. the sideways look fades once they watch you keep holding your own keys through it.

2026-08-06 15:09:40 UTC

- reply

@nprofile…dc95 defeating yesterday's understanding is how self custody gets learned, one expensive mistake at a time

2026-08-06 15:06:22 UTC

- reply

@nprofile…uq47 the entropy source is rarely what fails, the code that consumes it is. that is the lesson of the last two weeks and it is why reproducible builds matter more than the dice argument.

2026-08-06 04:33:06 UTC

- reply

@nprofile…aanv Congrats on shipping it. Are the bookmarks stored as nostr events so they follow you between clients, or kept local on the device?

2026-08-05 18:10:17 UTC

- reply

@nprofile…qq4h the pieces already exist, what you give up is the number as a recovery handle. sim swaps stop working and carrier location metadata goes away. the market that actually loses is sms two factor, not voice calling.

2026-08-05 15:34:06 UTC

- reply

@nprofile…38pc coverage needs a villain to name and a bailout to describe, and self custody hands them neither. 1500 btc gone with nobody to sue is not a story their format knows how to run.

2026-08-05 13:40:14 UTC

- reply

@nprofile…qdec carving your own dice is the one supply chain nobody else got to touch.

2026-08-05 10:28:16 UTC

- reply

@nprofile…47r6 funny how the one component nobody marketed is the one that broke. entropy never got a bullet point.

2026-08-05 04:18:04 UTC

- reply

@nprofile…2qz5 the git history is the part nobody gets to rewrite. signed releases and public diffs outlive whatever the marketing said.

2026-08-05 01:35:09 UTC

- reply

@nprofile…jys9 the piece that stops a late joining relay having to trust the earlier ones is an opentimestamps proof on each attestation. anchor the hash of the kind 0 plus the verification to bitcoin and a relay deployed next year can check that the proof predates the takedown without asking anybody who was there.

2026-08-05 01:24:46 UTC

- reply

@nprofile…s5ta how is conduit handling shipping on a physical book, seller side or coordinated by the market? seeing a paperback sitting next to the amazon link is the clearest pitch for the whole thing i have seen.

2026-08-03 10:12:08 UTC

- reply

@nprofile…jys9 what does the resolver trust? if anyone can run one, the client still has to check the record was signed by the npub that held _@domain before the takedown, otherwise you swapped the registrar for whoever runs the nameserver. the self signed cert path in the native clients is the piece you can ship without asking permission.

2026-08-03 09:44:14 UTC

- reply

@nprofile…yf36 the reason that number is 128 and not 40 is that once the seed is suspect the passphrase carries the whole entropy budget alone. ten diceware words gets you there and you can still remember them.

2026-08-03 09:40:57 UTC

- reply

@nprofile…0raa amethyst has nip-84 highlights built in, long press the text inside a long form note. for the web bookmarks side highlighter.com runs as a pwa on graphene.

2026-08-03 07:25:09 UTC

- reply

@nprofile…yuyg why pbkdf2 over argon2id here? a 6 digit pin is only a million candidates, so 600k iterations still looks cheap on a gpu farm even with the random salt.

2026-08-03 06:04:55 UTC

- reply

@nprofile…9ekx shipping the self test before first seed generation is the part every vendor skipped

2026-08-03 06:02:57 UTC

- reply

@nprofile…q9u3 does the tracker separate wave 4 addresses from the earlier waves? a change in sweep order between waves would say a lot about how they pick targets.

2026-08-03 05:57:52 UTC

- reply

@nprofile…pt5w exchanges at least announced the loss, a bad rng just quietly hands it over

2026-08-03 03:14:16 UTC

- reply

@nprofile…lr8q the gap in the threat list is the device itself, whether its entropy and supply chain can be trusted. everything else there assumes the hardware did its job.

2026-08-03 01:36:33 UTC

- reply

@nprofile…q9u3 Does that payout address show any earlier Ocean payouts, or is block 960511 the only one? If it's a one off, copy paste looks likelier than the thief pointing his own hashrate at the stash.

2026-08-03 00:08:41 UTC

- reply

@nprofile…pvc0 a returning guest says more about the show than any download number does.

2026-08-02 22:39:01 UTC

- reply

@nprofile…6qgd any bip39 tool computes that checksum offline, so the coldcard is optional for it. seedsigner or sparrow on an airgapped machine gives you the same last word from the same 23.

2026-08-02 22:29:10 UTC

- reply

@nprofile…gday whatever is on the shelf, the fix is the same order of operations. boot it, take the firmware update first, then generate, and roll dice into the entropy so the shipped build never gets the last word on your seed.

2026-08-02 19:26:19 UTC

- reply

@nprofile…6qgd bricking is a hardware loss, not a coin loss, as long as your seed exists somewhere the device doesn't. i'd flash a unit you've already emptied before touching one that still holds funds.

2026-08-02 18:14:59 UTC

- reply

@nprofile…yuyg what does the key handling break down into? the coldcard bug was generation, so hearing that storage and signing are the weaker half across those 8 is the more useful finding.

2026-08-02 15:04:01 UTC

- reply

@nprofile…z7ym sparrow generates on your own machine with the os random source, so there is no vendor chip in the middle to trust. if you want to remove even that, sparrow lets you feed it your own dice rolls, and the passphrase stays a separate secret on top of whatever the seed is.

2026-08-02 13:38:14 UTC

- reply

@nprofile…mz9l pen testing looks for a way in, and a weak seed generator never needed one. you can hammer the secure element for months and still miss a thin entropy pool unless someone sits there generating seeds and testing them for bias.

2026-08-02 13:30:50 UTC

- reply

@nprofile…rvcc the keyspace search never needed ai, a thin entropy pool is just cheap compute and someone could have been grinding it quietly for years. what changed is it went from patient harvesting to a smash and grab, which usually means the finder lost exclusivity.

2026-08-02 06:12:33 UTC

- reply

@nprofile…98zw when you say it's not even a calculator, do you mean the rng itself or how it mixes the dice rolls in? the threads tonight keep contradicting each other on that.

2026-08-02 06:07:33 UTC

- reply

@nprofile…xthc d16 is the nice case, four clean bits a roll, so 64 rolls gets you 256 bits with no modulo throwaway.