josh's avatar
josh
josh@westernbtc.com
npub1pc57...dmza
Loved by Jesus Join the https://westernbtc.com relay if you want all your notes backed up. nostr:nevent1qqspstxd0rrl9ymfg53g70p0xucj7t8y6a4wn793m3prpaa37hrhgdc5w723t nostr:note1etztafg2td6e7fal9373qj88ykuuvdyzdlaqm59ttcqamga5nr3sh9xgry
josh's avatar
josh 2 weeks ago
"Just wait until..." My wife and I have been hearing this negative sentiment towards the future ever since we started dating. "Just wait until you're married 5 years", "Just wait until you have kids", "Just wait until they're toddlers", "Oh you're doing RV life? Just wait until you're boxed in together 24/7" Guess what? My wife and I have not only survived all of these phases of life, but thrived. Our marriage has gotten happier with more trust established. Maybe it's not the phase of life that contributes to success or failure, but the people involved? 🤯 Rant over.
josh's avatar
josh 2 weeks ago
@0xchat is there a way to enable notifications on my phone when I receive a NIP-17 message? That would be incredibly helpful for npubs that alert me to certain services I have.
josh's avatar
josh 2 weeks ago
This will be significant. Make centralized sources obsolete. If you know the signing key of the developer, you can audit apps transferred to you via bluetooth. If you don't have the developer keys, you should be able to trust the person you're side loading the app from. View quoted note → View quoted note →
josh's avatar
josh 2 weeks ago
UPDATE: Regarding my loss of ~0.2 bitcoin, I believe I found the attack vector used by the perpetrator. In March of 2025, a K8 vulnerability was disclosed: IngressNightmare (CVE-2025-1974). This allows an attacker to gain full RCE of a pod, and therefor, gain access and control of the internal network. A CVSS 9.8 vulnerability. I feel slight relief knowing that this is *likely* how the attacker gained access to my internal network. There were many mistakes on my part, and those will be what I focus on significantly improving.
josh's avatar
josh 3 weeks ago
What do you use for your personal laptop and personal phone? I'm contemplating switching.
josh's avatar
josh 3 weeks ago
Helpful tip: use a virtual card for every subscription. If any service makes it difficult to cancel, simply delete the virtual card.
josh's avatar
josh 3 weeks ago
“Don’t sin by letting anger control you. Think about it overnight and remain silent. Interlude” ‭‭Psalms‬ ‭4‬:‭4‬
josh's avatar
josh 3 weeks ago
Yesterday was brutal. From this point, I see two paths forward. Sit in self pity and stay down. See this as an opportunity from God. It could have been worse. This is an opportunity to look inward and see my flaws. Not leave it there, but be honest. I was careless with security. I thought: "this probably won't happen to me". I didn't have: alerts in place, proper logging, kill switches, separation of responsibility, on and on. I pray this won't be a lesson I ever have to learn again. Learn this lesson from me: it CAN happen to you.
josh's avatar
josh 3 weeks ago
I still have no idea how the attacker was able to get access to my lnd node. I messed up a in few ways with protecting my admin macaroon, but the unknown is what bothers me the most. View quoted note →
josh's avatar
josh 3 weeks ago
This morning, my grandma died and I lost ~0.2 bitcoin. I feel devastated and embarrassed. My grandma was old and lived a good life. She was a follower of Jesus. She was in a lot of pain and I'm glad she found relief. The hard part is watching my family grieve. With the bitcoin loss, I only have myself to blame. Someone got a hold of my my lightning admin macaroon. They closed the existing channels and swept the funds to their bitcoin address. I'll list the attacker's addresses below if anyone is interested. Although my systems were meticulously locked down, I wasn't as careful with passing around my admin macaroon between systems / different computers. It shouldn't have been an admin macaroon I was using in the first place -- another reckless mistake. I also didn't have enough monitoring in place. One silver lining is I happened to sweep quite a bit of funds out of my lightning node about a month ago. It would have been closer to 0.4 bitcoin had I not. I had quite a few services that used the admin macaroon: BTCPay, a cashu mint, my website, etc. I'm so sorry to anyone who had any amount of bitcoin with my mint. I will try to make amends, just reach out to me. This is my fault and I only have myself to blame. Not just for my own losses, but for any losses by those who held bitcoin in my mint. I'm not sure when I'll be ready to spin up my lightning node / cashu mint again.
josh's avatar
josh 3 weeks ago
@the axiom I got your message but can’t send one back to you. I tried it with others users and it’s working fine. Not sure what’s up.
josh's avatar
josh 3 weeks ago
The WesternBTC is now a trial relay (https://westernbtc.com). How it works: When a pubkey is first seen, it's given a trial whitelisting of n days (30 in my case). After the trial period has elapsed, any notes created by the pubkey are deleted. If the pubkey is officially whitelisted at any point before the expiration of the trial period, the pubkey is promoted to full whitelisting and removed from the trial whitelisting. What this enables: - sign ups without users having to pay first (terrible UX previously) - gift wraps now work (NIP-17) - clean up relay space automatically View quoted note →
josh's avatar
josh 3 weeks ago
Trial period relay: notes have a time-to-live unless the npub is whitelisted. If an npub gets whitelisted by the relay, we remove the ttl on any existing notes.