Browsing to Nostr websites from @Amethyst is great, but please update the NIP-44 support.

BetWithFriends

BetWithFriends — friendly betting pools over Nostr ⚡

Create a private betting pool, share a link, and let friends bet with lightning zaps. No server, no signup — just Nostr.

#dev #devstr #bug #bugstr

Hardware wallets are hard to hack but can have disasterous bugs. Hot Phone wallets are safer against bugs (can be fixed via online update), but can have disasterous hacks. For example, while creating a 2-of-2 multisig on a hot phone wallet, the phone can show you a fake seed unrelated to the its declared xpub, and hide the real seed internally. At some random point, the phone can get a remote command to blackmail you, and only then you will realize you don't really have the real seed. People won't buy more than 1 hardware wallet, and I don't know how to solve this issue. Maybe UX for the Phone Wallets that shows a seed + xpub, and let you decide whether to use it or pick another one? You could enter a few seeds that the phone generated into the hw wallet just to verify that the phone didn't try to cheat, then use the last one without entering it to the hw wallet. Or maybe covenants?

vibe-coded a tool to test your air-gapped wallet ( @SeedSigner , @npub1j0dm...lwm0 ) against basic #DarkSkippy attempts: create fake PSBTs with a fake seed, and see if the HW wallet returns the expected signature and does not try to leak data:

Basic Exfil Tester

Generate fake PSBTs, sign them with an air-gapped hardware wallet, and compare the result against expected deterministic signatures to detect nonce...

Obviously you should also verify the firmware's pgp, and this tool does not cover sophisticated #DarkSkippy attacks (i.e. that try to leak data only in certain conditions, like in transactions of specific amounts, or multisig setups). Thanks to @Frostsnap for building darkskippy.com and creating a real-world example.

Mood 😅 View quoted note →

I've added a SECURITY.md file to

GitHub

GitHub - oren-z0/holesail-switchboard

Contribute to oren-z0/holesail-switchboard development by creating an account on GitHub.

repo of the Umbrel app

Holesail Switchboard | Umbrel App Store

Discover Holesail Switchboard for your umbrelOS home server. Learn more, see screenshots, and discover other self-hosted Networking apps available ...

- can you please scan the repo (and the holesail project that it wraps) for vulnerabilities? @Rob Hamilton @calle @npub1h5t3...45z5 @Umbrel ☂️ #RedTeam #BitcoinRedTeam #dev #devstr

Fixed the redirection: runs(dot)wtf

GitHub

Blaming firmware/stm32/COLDCARD_MK4/mpconfigboard.h at 37e4af5451c260c1e7d429fe8972c4cb5e68ee59 · Coldcard/firmware

❄️ Firmware and simulator for Coldcard Hardware Wallet - Blaming firmware/stm32/COLDCARD_MK4/mpconfigboard.h at 37e4af5451c260c1e7d429fe8972c4c...

View quoted note →

Bought the domain:

GitHub

Blaming firmware/stm32/COLDCARD_MK4/mpconfigboard.h at 37e4af5451c260c1e7d429fe8972c4cb5e68ee59 · Coldcard/firmware

❄️ Firmware and simulator for Coldcard Hardware Wallet - Blaming firmware/stm32/COLDCARD_MK4/mpconfigboard.h at 37e4af5451c260c1e7d429fe8972c4c...

Coinkite code review process 🇨🇦

#meme #memestr #iykyk

So far, around $72 million has been stolen from #Coldcard wallets. That’s equivalent to a whole 31 minutes of growth in the U.S. M2 money supply!

Quote of the day

#lol #lolstr

If you are going to make bets with your friends on the next 🇦🇷 Argentina vs 🇪🇸 Spain game, check out my new website:

BetWithFriends

BetWithFriends — friendly betting pools over Nostr ⚡

Create a private betting pool, share a link, and let friends bet with lightning zaps. No server, no signup — just Nostr.

Login with your Nostr profile (or create a temporary nsec), design your page, add betting options, and share the page with friends. Each friend will zap you his choice and provide a lightning address to get their reward. You, as the page admin, are trusted to select the winning option and pay the rewards proportionally (the website will do the math for you). The bettors don't even need a Nostr profile. Everything is encrypted with a key in the page url, so relays can't see much of what's going on inside the page. #dev #devstr #WorldCup #football View quoted note →

Would appreciate a review:

GitHub

NIP-X: Encrypted Betting Pools (BetWithFriends) by oren-z0 · Pull Request #2415 · nostr-protocol/nips

Implemeted at https://betwithfriends.niot.space (currently with the prefix "bwt-" for some internal data, which hopefully will be replace...

BetWithFriends

BetWithFriends — friendly betting pools over Nostr ⚡

Create a private betting pool, share a link, and let friends bet with lightning zaps. No server, no signup — just Nostr.

#dev #devstr #nostrdev

Having to use #nostr as a backend database, to avoid legal risk when you want to publish an open-source website/app, is basically the government telling you: "It's ok to publish this project but only if the database is unreliable." 🤔 #showerthoughts #dev #devstr

Just finished fabelling this over the weekend:

BetWithFriends

BetWithFriends — friendly betting pools over Nostr ⚡

Create a private betting pool, share a link, and let friends bet with lightning zaps. No server, no signup — just Nostr.

Create private gambling pools for friends (who trust you not to steal from them). Bettors don't even need a Nostr profile, just a lightning wallet. Beta version - don't use with large amounts, and don't invite unknown users. #dev #devstr #nostr #nostrdev #lightning #fable #ai #vibecoding Let me know what you think! View quoted note →

If you want to make #Nostr app developers lose their mind, open their latest app and post the message "[object Object]". 😈 #devstr

What @Paul Rosenberg 's talk on @FreedomTechSummit felt like: #FreedomTechSummit

If you're worried that the world is getting dumber, remember that it was always kind of dumb. (From Prague's Communism Museum)