Thread

I'm glad that this personal attack on me raised awareness to try to fix the vulnerability before others lose their funds.. Pity that I had to lose both my money and my hope for the community for it to happen... nostr:nevent1qqsy66aynuese7y5f43aaqhvulz8g4297gl0v7tk7qcltfxjqtp22cgzypr90hlgjed73xq2jvrjhna4ukdx2yjyqmdslqvjzhh83wj8jd9nuqcyqqqqqqglchr32

a lot of apps have this kind of silly pattern, but they are usually trivial and non-valuable things especially before you set them up. the default should be that it writes a token to the terminal, that you have to use to set the password. unless the SSH connection is breached this prevents this kind of bootstrap snipe attack. if you have ever set up SSH on a VPS and looked at the logs, you will see there is probably tens of thousands or more bots on the internet scanning and probing everything they can find. they now have claude, to help them with this, not sure if you caught the news but they discovered that some clever guys were using claude to automate breaching of servers on the internet, that were far more sophisticated and fast than any such exploit ever seen before. at this point, it's pretty much game over. nothing should be open to connections on the internet without a back channel lock.

All projects get attacked; be it open-source freedom tech like cashu or alby the key is to remove any attack surface nostr:nevent1qqsy66aynuese7y5f43aaqhvulz8g4297gl0v7tk7qcltfxjqtp22cgdwyee4 nostr:nevent1qqsy66aynuese7y5f43aaqhvulz8g4297gl0v7tk7qcltfxjqtp22cgdwyee4

you could have omitted the last paragraph. in your business you must expect adversaries and build defensively. nice to see the linked PR.

Yes that is indeed sad. But maybe it’s a timely reminder. As an Alby customer who has been exposed to software risk analysis for a long time, I see a transition happening from technically very savvy cypherpunks on the base layer to higher level projects supporting more regular users (like me). Old security assumptions may no longer apply. So, those project developers should take an equally vigilant, adversarial mindset as the cypherpunks always have. I suggest that solution developers apply rigorous and transparent risk management best practices: FMEA analysis, security threat analysis and so on, going forward. The community could probably help with review of that analysis as we have a vested interest that projects like Alby succeed.