I'm sorry for all the have lost Bitcoin, but am also sorry for what you went through with this vulnerability. I know how much of your heart and soul you have put into this plugin over the years with the best of intentions. Thank you for your contributions Dennis 🫂

I was not affected, but I read stories of those that were. They'll appreciate it he apology and the gesture. Thanks for the post mortem.

💚🫂

Thank you @Dennis. Appreciate all that you do for Bitcoin.

We appreciate everything you do for Bitcoin Dennis 💚

Thank you very much for hanging in with this and work tirelessly to identify the source of the bug and fix it asap. Thank you for developing this great plugin in the first place. It shows that we need to care more for the software we use and help reviewing code and doing more adverserial testing or help in any other way to improve it. You mention that people can donate sats to distribute to people affected, where can we do that? Zap on this post or any special lnaddress or something?

Related, can you explain why BTCPay asks for an admin macaroon in order to connect a remote LND instance? Shouldn't a read-only macaroon with invoice permission suffice?

Thank you for the recap! Indeed these things can happen, but working and solving issues in the open teaches and benefits everyone. While also being sorry for the losses I am looking forward to what more you are building! 💚💚💚

Iirc we need it to access the connection details and health status of the GetInfo call. However, by now LND support baking custom macaroons and I'll look into if and how we can leverage that. /cc @kukks @npub1zfyt...m60l

Macaroons | Builder's Guide

Macaroons are fancy cookies. You use LND to create custom macaroons that limit their permissions with great granularity, down to the exact RPC calls.

You’re the man, Dennis. Thanks for all your amazing work.

You can donate to @☣️ Hugo SuperMaxi 💎🙌 🏴‍☠️ ∞/21 via the Lightning Address hugo@wallets.fyoumoneypod.com or onchain to bc1qz8dxk6h8gha5qvsnw67rjzz3xn6t4k0wmafqz3.

fyi working on it here. Using invoice.macaroon suffices, only downside is we cannot display the connection details on the public Lightning node info page.

GitHub

Lightning: Allow LND to be used with non-admin macaroons by dennisreimann · Pull Request #5567 · btcpayserver/btcpayserver

Requires btcpayserver/BTCPayServer.Lightning#152. Using invoice.macaroon suffices, only downside is we cannot display the connection details on the...

I am setting it up with LNBank on BTCPay Server. However, in light of recent revelations, I am rethinking this decision. View quoted note →