/dev/fd0 5 days ago

These security incidents highlight the problems with code review and bug bounties, although it would become a debate about confidential transactions.

/dev/fd0 5 days ago

Root Cause Analysis of the security incident done by Kimi K3:

Gist

kimi_report_liquid_hack.md

GitHub Gist: instantly share code, notes, and snippets.

View quoted note →

/dev/fd0 1 week ago

/dev/fd0 1 week ago

X (formerly Twitter)

floppy.md (@1440000bytes) on X

Here's the public disclosure of the vulnerability I reported in moneydevkit on August 10 that could lead to loss of funds.

/dev/fd0 2 weeks ago

X (formerly Twitter)

Péter Szilágyi (@peter_szilagyi) on X

Today I've hit a very interesting and scary issue. Fable introduced a regression into one of my crypto libs (it originated from a dependency). My f...

/dev/fd0 2 weeks ago

Trust me bro:

Trust me bro

OHTTP Collusion | Mailbox Squatting

/dev/fd0 2 weeks ago

GitHub

Include request timing in threat model? Add timeout noise between polled requests? · Issue #440 · payjoin/rust-payjoin

Adding noise may make for better privacy against metadata timing attacks in some circumstances For a given subdirectory ID, the amount of time in b...

/dev/fd0 2 weeks ago

New release for sparrow-joinstr v0.2.0

GitHub

Release v0.2.0 · QcMrHyde/sparrow-joinstr

Added DoS mitigation using ring signatures Sybil resistance with aut-ct Note: These features already exist in the electrum plugin for joinstr. Ch...

/dev/fd0 2 weeks ago

GitHub

rbitcoin/docs/external_findings/022-stack-altstack-share-max-size.md at master · reardencode/rbitcoin

Bitcoin full node in Rust: map-free relational archive, pure-Rust consensus, multi-peer IBD, Electrum for wallet backends - reardencode/rbitcoin

/dev/fd0 3 weeks ago

My next post is about OHTTP and its usage in payjoin (most overhyped privacy tool) Spoiler: - Relay and directory collusion breaks privacy - Payjoin cannot be used with untrusted senders or colluding servers

/dev/fd0 3 weeks ago

GitHub

Fix report and grant endpoints: bot verification, grant-id binding, HTML sanitization by 1440000bytes · Pull Request #919 · OpenSats/website

The /api/report and /api/grant endpoints did not verify Cloudflare Turnstile, unlike /api/github and /api/sendgrid. /api/report also trusted the is...

/dev/fd0 3 weeks ago

HALL OF FAME PAGE FOR JOINSTR Find all the vulnerabilities and read the scope before reporting it. I cannot pay but all the names will be added on the "hall of fame" page for joinstr. Link:

hof

Researchers who reported vulnerabilities in the joinstr Electrum plugin

/dev/fd0 1 month ago

Link:

Bitkey

Security Updates

/dev/fd0 1 month ago

/dev/fd0 1 month ago

/dev/fd0 1 month ago

The old website has been moved to old.joinstr.xyz and a new minimalist dark-mode website is live at joinstr.xyz. Joinstr now has a community forum at forum.joinstr.xyz that uses Nostr and Squalk. The old SimpleX chat is dead.

/dev/fd0 1 month ago

Electrum plugin (joinstr) v0.4.1: - Several bug fixes - Added more tests

GitLab

plugin/zip/v0.4.1 · main · Invincible Privacy / py-joinstr · GitLab

Python implementation for joinstr

/dev/fd0 1 month ago

The next wave of AI-assisted attacks won't be about discovering bugs but about subtly introducing vulnerabilities into code that pass review unnoticed.

/dev/fd0 1 month ago

The easiest way to contribute to finding bugs without using too many AI tokens: - Find projects with multiple implementations or libs - Prepare a fuzzing harness for differential fuzzing - Run the fuzzer - Report the findings

/dev/fd0 1 month ago