marksn's avatar
marksn
marksn@primal.net
npub133jh...zcc2
i play tennis๐ŸŽพ | bitcoin โ™พ๏ธ | lightning โšก๏ธ node: tennisnbtc @ amboss.space | einundzwanzig ๐Ÿงก | nodestrich ๐ŸŸฃ | blitz โšก๏ธ dinge https://tunnelsats.com?ref=REF-QOGD8U
marksn's avatar
marksn 2 weeks ago
Don't trust verify. My AI agent currently heavily scanning lnd for security bugs. So far it found absolutely nothing security relevant. ๐Ÿ˜ฎโ€๐Ÿ’จ
marksn's avatar
marksn 2 weeks ago
I gave my agent the task to find the bug in the coldcard firmware. He ran on Deepseek v4 latest version: It took basically 10 seconds to find the bug, because he knew where so search. But boy this is insane.๐Ÿ‘‡๐Ÿ‘‡๐Ÿ‘‡ "Found the Coldcard seed bug in a few minutes. Here's how, and why that should scare you. I didn't read the firmware. I knew where to look. The story breaking was about seed entropy โ€” so I went straight at the RNG path. Three files: shared/seed.py calls ngu.random.bytes(32), which lands in my_random_bytes() in libngu/ngu/random.c, which sources randomness through CHIP_TRNG_32(). That macro is where it breaks: #ifdef MICROPY_PY_STM # define CHIP_TRNG_32() rng_get() # ifndef MICROPY_HW_ENABLE_RNG # error "get a HW TRNG plz" # endif #endif #ifndef checks whether the macro exists. Coinkite defined it as 0 in production โ€” because they supply their own hardware RNG. A 0 still counts as "defined". So the error never fires, the build stays green, and at runtime rng_get() hands you MicroPython's deterministic Yasmarang software generator seeded from the MCU UID and timer registers โ€” not the STM32 hardware TRNG. One wrong preprocessor check. Five years. Years of "audited" firmware, and the seed was quietly reproducible for anyone who knew the UID and timing. The honest part: I found it fast because the question was already pointed at the right place. Hand me that repo with no hint and it's a needle-in-a-haystack again. The lesson isn't that models are magic. It's that a directed review beats a broad one every time โ€” and that a single #ifndef vs #if ! was enough to undo the whole "self-custody is safe" claim."
marksn's avatar
marksn 2 weeks ago
Why did the Coldcard sweep run late July into August? Because that's when the people holding bitcoin in cold storage go offline. They are on vacation. So far: 1,876 BTC gone, about $118 million, across 7 waves from July 30 to August 3.
marksn's avatar
marksn 3 weeks ago
Every day, millions of people lose their savings through fraud, scams, identity theft, and financial manipulation in fiat currencies. The Coldcard Bitcoin drain is extremely painful. Every lost bitcoin matters. But one incident does not prove Bitcoin is broken. Hard truth for Bitcoiners: self-custody comes with responsibility. Security, education, and vigilance are part of the journey. Protect your keys. Stay humble. Stack sats. Criminals thrive in the shadows. Bitcoin brings the light. Every attack makes us stronger, every lesson makes us wiser. The thieves will adapt. So will we.๐Ÿงก
marksn's avatar
marksn 3 weeks ago
A lot of people underestimate how secure software wallet entropy can be. A Bitcoin seed does not become secure because it is generated on a hardware device. It becomes secure because the randomness behind it is strong. Modern Linux systems use a cryptographically secure random number generator (CSPRNG) that collects entropy from multiple system sources and produces unpredictable random data. Wallets like LND rely on this foundation when creating their seeds. The real security question is not: โ€œHardware wallet or software wallet?โ€ The better question is: โ€œWas the entropy generation secure, and is the private key protected afterwards?โ€ A properly generated LND seed has an enormous security margin. The biggest risks are usually not the RNG itself, but operational mistakes: * exposing the seed * poor backups * malware * compromised devices Hardware wallets reduce certain attack surfaces, but they are not magical. Their security still depends on trustworthy entropy generation and good implementation.
marksn's avatar
marksn 3 weeks ago
my LN node doesn't lie. interest in bitcoin has exploded over the last few days. the spring is wound โ€” and it's loading.
marksn's avatar
marksn 3 weeks ago
finally installed pihole on my unraid homeserver. can recommend ๐Ÿ”ฅ๐Ÿ˜…
marksn's avatar
marksn 3 weeks ago
run a routing node and you have some market insights. lightning volume says ๐Ÿ†™
marksn's avatar
marksn 3 weeks ago
almost august and they can't really drive down the price further. plebs steppin in, bear market over. sentiment seems to shift too. have a nice sunday. against all odds.
marksn's avatar
marksn 1 month ago
after work in ๐Ÿ‡ฉ๐Ÿ‡ช still a great country. ๐Ÿงก vino and beats. image
โ†‘