josh's avatar
josh
josh@westernbtc.com
npub1pc57...dmza
Loved by Jesus nostr:nevent1qvzqqqqqqypzqr3falp286mfveqrarrpew975mtc2fa0tczktg465re38ml3g2hjqy2hwumn8ghj7un9d3shjtnyv9kh2uewd9hj7qghwaehxw309aex2mrp0yh8qunfd4skctnwv46z7qpq7zajjjnzqkf4ag3pk3wj2v7p9nlpv3zaq4475rnjjrl696yh853qptp758
josh's avatar
josh 1 month ago
@0xchat is there a way to enable notifications on my phone when I receive a NIP-17 message? That would be incredibly helpful for npubs that alert me to certain services I have.
josh's avatar
josh 1 month ago
UPDATE: Regarding my loss of ~0.2 bitcoin, I believe I found the attack vector used by the perpetrator. In March of 2025, a K8 vulnerability was disclosed: IngressNightmare (CVE-2025-1974). This allows an attacker to gain full RCE of a pod, and therefor, gain access and control of the internal network. A CVSS 9.8 vulnerability. I feel slight relief knowing that this is *likely* how the attacker gained access to my internal network. There were many mistakes on my part, and those will be what I focus on significantly improving.
josh's avatar
josh 1 month ago
What do you use for your personal laptop and personal phone? I'm contemplating switching.
josh's avatar
josh 1 month ago
Helpful tip: use a virtual card for every subscription. If any service makes it difficult to cancel, simply delete the virtual card.
josh's avatar
josh 1 month ago
“Don’t sin by letting anger control you. Think about it overnight and remain silent. Interlude” ‭‭Psalms‬ ‭4‬:‭4‬
josh's avatar
josh 1 month ago
Yesterday was brutal. From this point, I see two paths forward. Sit in self pity and stay down. See this as an opportunity from God. It could have been worse. This is an opportunity to look inward and see my flaws. Not leave it there, but be honest. I was careless with security. I thought: "this probably won't happen to me". I didn't have: alerts in place, proper logging, kill switches, separation of responsibility, on and on. I pray this won't be a lesson I ever have to learn again. Learn this lesson from me: it CAN happen to you.
josh's avatar
josh 1 month ago
I still have no idea how the attacker was able to get access to my lnd node. I messed up a in few ways with protecting my admin macaroon, but the unknown is what bothers me the most. View quoted note →
josh's avatar
josh 1 month ago
This morning, my grandma died and I lost ~0.2 bitcoin. I feel devastated and embarrassed. My grandma was old and lived a good life. She was a follower of Jesus. She was in a lot of pain and I'm glad she found relief. The hard part is watching my family grieve. With the bitcoin loss, I only have myself to blame. Someone got a hold of my my lightning admin macaroon. They closed the existing channels and swept the funds to their bitcoin address. I'll list the attacker's addresses below if anyone is interested. Although my systems were meticulously locked down, I wasn't as careful with passing around my admin macaroon between systems / different computers. It shouldn't have been an admin macaroon I was using in the first place -- another reckless mistake. I also didn't have enough monitoring in place. One silver lining is I happened to sweep quite a bit of funds out of my lightning node about a month ago. It would have been closer to 0.4 bitcoin had I not. I had quite a few services that used the admin macaroon: BTCPay, a cashu mint, my website, etc. I'm so sorry to anyone who had any amount of bitcoin with my mint. I will try to make amends, just reach out to me. This is my fault and I only have myself to blame. Not just for my own losses, but for any losses by those who held bitcoin in my mint. I'm not sure when I'll be ready to spin up my lightning node / cashu mint again.
josh's avatar
josh 1 month ago
@the axiom I got your message but can’t send one back to you. I tried it with others users and it’s working fine. Not sure what’s up.
josh's avatar
josh 1 month ago
The WesternBTC is now a trial relay (https://westernbtc.com). How it works: When a pubkey is first seen, it's given a trial whitelisting of n days (30 in my case). After the trial period has elapsed, any notes created by the pubkey are deleted. If the pubkey is officially whitelisted at any point before the expiration of the trial period, the pubkey is promoted to full whitelisting and removed from the trial whitelisting. What this enables: - sign ups without users having to pay first (terrible UX previously) - gift wraps now work (NIP-17) - clean up relay space automatically View quoted note →