semisol

Public Key

npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj

Profile Code

nprofile1qqs99d9qw67th0wr5xh05de4s9k0wjvnkxudkgptq8yg83vtulad30gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq3qamnwvaz7tmwdaehgu3wd3skueqrt2rvd

Publishing to

relay.damus.io

nostr.land

relay.noswhere.com

Author Public Key

npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj

Show more details

Last Notes

2024-11-05 15:05:01

- reply

it really isn’t a good hammer either for 50% of things
to be honest, the cashu protocol has been having the same issues with incompetent design as with some nostr NIPs

2024-11-04 19:32:50

- reply

Anyone can make shit on Nostr.
Who can make shit that’s good?

2024-11-04 19:11:24

- reply

Nostr is not that malleable.

2024-11-04 18:43:42

- reply

What is to say Nostr isn’t?

2024-11-04 18:39:38

- reply

“why not enhance the fediverse?”
- fediverse people on nostr

2024-11-04 14:51:41

- reply

I’m working on a lot more than that… :)

2024-11-04 13:33:50

- reply

What changes?
Except that you know someone tried to access it and failed, and that’s what the failed PIN counter is for

2024-11-04 13:23:02

Also, it is secure enough that it doesn’t need a brick or wipe PIN to resist attacks unlike some other HWWs #note135y…hlyv

2024-11-04 12:56:05

What if a 3-of-5 multisig was only $200? With HWWs that is.

2024-11-03 21:51:56

- reply

video infrastructure is a complex topic
to make it work requires no effort with an MP4 on a server
to make it work WELL requires optimizations, and money for that to be usable (CDNs, servers for transcode and similar)
even one second of buffering can impact viewing experience for a normie
instead of funding ecash wallets maybe someone willing to work on the real problems should be funded

2024-11-03 15:26:15

- reply

you can’t change users unless it benefits them

2024-11-03 12:15:15

- reply

Oh. Don’t bother with NIP-05.
Pubkey whitelist is easier and people with other NIP-05s can use it.

2024-11-03 10:43:30

- reply

it’s not verification

2024-11-03 01:40:23

- reply

also see: Louis Rossmann

2024-11-02 09:26:35

- reply

First, not everything is on Nostr.
Second, Nostr notes are not non-repudiable because of the many ways they could get compromised, even with a remote signer (signing some unintended notes before access is revoked)
And you still need a relay to store that note… which will become harder and harder
Personal relays don’t fix this because they are limited to people who know how to run a server, and are intentionally limited to a small group of people. Also, maintenance cost will only go up while the benefit doesn’t change.

2024-11-01 02:39:12

- reply

whatever type of error you are having must be a more widespread issue than a few pages to be triggered so often
the ideal program would have a small pool it nonstop allocates to and deallocates from and a pool it very slowly checks and rotates allocations in/out
write random data and CRC it as I said
you then want to stop the process and get a debugger if there’s a mismatch and see the physical location along with identifying the RAM module

2024-11-01 02:35:00

- reply

ycruncher?

2024-10-31 18:44:20

- reply

It is supported but not “validated” (don’t blame us if it doesn’t work) for consumer platforms

2024-10-31 18:43:27

- reply

Will do in a bit

2024-10-31 18:38:48

- reply

It is detected as ECC too.
G series CPUs don’t support it don’t ask how I know (tried to add ECC RAM to a system with one) and it didn’t detect as ECC

2024-10-31 18:37:46

- reply

I have bought 2 random ASUS boards, one meant for “professional use” and one meant to be lower end (B)
Both work

2024-10-31 18:36:37

- reply

another water heater… :)

2024-10-31 18:35:55

- reply

ryzen supports ecc

2024-10-31 18:35:29

- reply

Yes.
I have never had a corrupt DB with ECC memory, even with a few hard power cuts. I use RAID 1, though not with checksumming (mdadm) so about 50% of the time any issues should come up with disks if any.

2024-10-30 15:38:18

Hardware accelerated ChaCha20 🤔

2024-10-30 14:47:55

I wonder how many HWWs are developed with proper attention to security, from software to parts used :)
Most common one is cheaping out on SEs and buying one not meant for withstanding anything more than basic attacks. And “just add shit” firmware development

2024-10-29 21:30:09

- reply

You only get a yes or no, nothing else.

2024-10-29 01:23:28

- reply

No, if it also uses paper ballots, why digital also?

2024-10-29 01:21:22

- reply

Okay so what’s the point then? Redundancy?

2024-10-29 01:20:57

- reply

let’s also take a page out of most HWWs books and make the code say it is genuine itself

2024-10-29 01:18:21

Now, the problem is… how do you know it runs the code it says it does?
Maybe consider this the next time you see “open source” but the boot code cannot be verified except the boot code saying “trust me bro”
Also can we stop calling it boot ROM? Thanks #note17yx…00ju

2024-10-28 20:39:05

You forgot the part where they overprovision access, inactive accounts, and economies of scale…
knowledge can’t save you from stupidity #note1c86…n03h

2024-10-28 19:44:41

- reply

not possible

2024-10-27 22:40:29

- reply

no, will see if I can debloat it in a way that works post-install

2024-10-25 19:47:15

- reply

Yes but that may as well be irrelevant in user counts.
Also, they probably use public relays too for a public presence

2024-10-25 19:43:04

- reply

Nostr is inherently different.
It has long term identities at its core.

2024-10-25 19:28:40

or can they? :) #note189n…tzfq

2024-10-24 19:14:29

- reply

Iris and Snort

2024-10-24 14:53:29

- reply

Wait, they were once, and they forked?

2024-10-22 21:25:34

“rules for thee but not for me” in the Bitcoin community, exhibit I lost count.
I think we all know what stablecoin means
also, before you say: it is mathematically impossible for there to be a stable store of value even if managed by a perfect algorithm in terms of supply control #note165x…tl7e

2024-10-21 13:09:44

- reply

Also, batch signing does not make much sense.
You need to send the AUTH event immediately for example

2024-10-20 22:24:21

- reply

yeah.
there’s the people that are idiots that know they are idiots: they don’t do anything
and then there’s the idiots that don’t know they are idiots or don’t care: they are dangerous because they will fuck things up for themselves and others
another example is the HWW industry…
a bunch of companies cut corners to the point where you could make a “most incompetently developed hww” marketing video and people would believe it
you could also make a “most secure hww” and they would believe it

2024-10-20 18:52:59

- reply

But yeah, verifying sigs is good.
Next steps: learn how to use a SeedSigner (always a good tool to have, for example if you need to temporarily handle a seed outside an HWW)

2024-10-19 22:09:27

- reply

I personally prefer automated deployment scripts

2024-10-19 17:14:39

- reply

Hear me out.
Influencers get people to donate to some “charity”.
People those influencers know make shitty projects.
That “charity” gives them grants and does not disclose the amount.
Sounds good?

2024-10-19 17:05:46

- reply

Developers think they know everything.
“Let’s make another shitty ecash thing” 😂

2024-10-19 17:00:29

- reply

It’s kind of their right to do whatever. Though it is a shitty move.
Piracy is fine as long as it doesn’t actively try to make less people pay for that content: people pirating due to a subscription model would have never paid anyone

2024-10-19 16:56:45

- reply

Again, falls under the last one: you wouldn’t have earned from it anyway, so why care about piracy (as a publisher)?
Piracy is often either a pricing or product issue. They can’t afford it so they won’t buy it anyway, or you are offering the product in a way that they don’t want

2024-10-18 21:52:03

- reply

good point
except that is considerably better than “throw shit at a wall until it sticks” approach that some HWW manufacturers take
though they also do not know how an SE should be properly used

2024-10-18 21:13:41

- reply

Not much.

2024-10-18 21:07:22

- reply

You can’t.
It is objectively not in X’s best interests. Being a SPOF is fine for them as long as they retain control and can lock people in

2024-10-18 21:06:26

reminder to not update a rolling distro only halfway

2024-10-18 18:58:30

- reply

What if it was not unencrypted storage? :)

2024-10-18 17:27:50

- reply

Kotlin supports types. And it has proper null checks unlike Java

2024-10-18 17:14:58

- reply

Kotlin is the way.

2024-10-18 14:55:19

- reply

you can also send to nostr at hi at <my username> dot dev

2024-10-18 13:51:50

- reply

I was proposing more of an idea for future implementation.

2024-10-18 13:49:31

- reply

Images that should be grouped should be listed in succession

2024-10-18 13:34:53

THE HWW REVOLUTION IS HERE
A DEVICE YOU CAN ACTUALLY TRUST WITHOUT INSECURE SE’s LIKE THE ATECC608B MEANT FOR A SMART LIGHT BULB
AND MADE TO BE ACTUALLY SECURE
REGISTER NOW FOR EARLY ACCESS #note1gwv…rq0h

2024-10-18 13:18:42

- reply

Unfortunately not, the firmware interface and DPA and fault injection countermeasures are under NDA.
All tooling outside it though will be.

2024-10-17 21:53:35

Forgot to say, but you will get a testers-exclusive design if you register now :) #note1gwv…rq0h

2024-10-17 21:24:07

- reply

At the end of the survey there is extra comments

2024-10-17 21:13:19

- reply

Uh.. kind + pubkey is an ID lol

2024-10-17 20:54:36

- reply

Because you usually only need one

2024-10-17 20:30:41

Please fill this short survey if you can related to my in development signer, and renote for visibility.
You can also register for testing for early access + a free signer (only shipping) in what I expect to be late 2025 Q1.
https://forms.office.com/r/CxzzG4Wqam

2024-10-17 20:13:52

and then we manage to pollute the earth’s orbit and make space junk even worse #note15nu…h6tv

2024-10-17 20:09:19

- reply

so a /96… wtf? 😂
Standard allocation should be /64, no?

2024-10-17 19:07:08

- reply

Also, reflash if you are suspicious.
Otherwise, I use SeedSigner often and have nothing against it like some of the other HWW vendors… :)
They serve different purposes, where in an HWW the responsibility for seed protection is on the SE, with SS it expects you to protect the seed yourself.
The former is better for carrying wkth you, but the latter works well when you are trying to build a larger multisig affordably (since you need a physical copy either way)

2024-10-17 18:51:06

- reply

that is different for a different use case with a different threat model

2024-10-17 18:14:08

- reply

The Brother laser I got has no chips on cartridges, and separate drum is great because it means compatible cartridges are way cheaper
Being able to reset the cartridges very easily in case it still has a bunch left is also great

2024-10-17 18:12:26

- reply

Epson EcoTank ones are decent… though it is an older one
just don’t leave it unused

2024-10-17 17:38:06

- reply

I assume v4

2024-10-17 17:37:00

- reply

clients also discard ordering info
I think we should add a new REQ-like message type meant for this with cursors

2024-10-17 17:35:03

- reply

Ledger thankfully is made by a more competent group of people

2024-10-17 17:14:24

- reply

they even announce IPv6 routes.

2024-10-17 17:14:03

- reply

Oh, I do hate it. But also I hate it less than NAT.

2024-10-17 17:08:33

- reply

my ISP does not give v6 to even their business customers even though they could

2024-10-16 22:32:55

- reply

Yes.
What I said was being connected to cellular is the norm, and Wi-Fi is the exception.
So the amount of time you serve media for is limited.

2024-10-16 22:25:03

- reply

which is the exception than the rule
better off making a blossom umbrel app or something

2024-10-16 22:21:14

- reply

So it would use mobile data to allow people to download…?

2024-10-16 22:17:49

- reply

Yes, when making it public

2024-10-16 22:14:44

uploading a 1MB image and having it be loaded 2000 times (just appear for a second, especially on apps without cache, on every view by the same person) will eat 2GB+ of your mobile data
the sheer amount of stupidity on here is insane #note1vlt…sa7c

2024-10-16 22:13:33

- reply

Arguably a higher chance of success that way.
Or if your team has Rust developers, start shouting that C++ is better

2024-10-16 21:49:27

- reply

No, I specifically said “only pushes one without mentioning others as much” and “bashes other options and alternatives to those”

2024-10-16 21:43:03

- reply

Just think about the top podcasts.
Which of them are influenced by people with bags VC funds like Ten31?
Do they constantly push a certain HWW vendor and not others?
Do they bash projects like @npub17ty…3mgl with false claims?
And so on.

2024-10-16 15:58:41

- reply

No, the ST32s are different even though similarly named
https://www.st.com/en/secure-mcus/st32-arm-core.html

2024-10-16 15:08:11

- reply

it would be cool if it existed

2024-10-16 14:16:25

- reply

when my chip vendor responds

2024-10-16 14:05:42

I can confidently say that the HWW space is being ran by 95% clowns.
If you exclude the wallets that are not bitcoin only, that becomes 100%. #note1upv…pnft

2024-10-15 22:32:04

- reply

A good change.
But far from ready. Security ICs take years to develop and perfect.
And in the end, you still cannot verify code running on it, the only difference being NDAd documentation and architecture which makes little difference to the end user.

2024-10-15 22:19:05

- reply

the goals of security and verifiability are inherently conflicting as to verify you need a chip that anyone can check the content of, but for security you want a chip that no one can see the content of
the MCU may have open source code but the moment it is compromised it could log your PIN on next attempt

2024-10-15 22:17:24

- reply

still, a pointless attempt.
coldcard for example has a dedicated privileged flash segment (the “boot ROM” which is not ROM at all) that handles retrieving the key and could store the PIN/root key in its small flash segment
it is not truly verifiable without ripping out the chip and faulting it

2024-10-15 21:55:05

- reply

I have sent some things over on Telegram

2024-10-15 21:53:20

- reply

and false “verifiability” in HWWs, as their designs also mean it makes verification impossible (SE code) or requiring somewhat costly tools to work around security measures (MCU)
having NDAd secure elements is arguably better for security than “verifiability” as in both cases the manufacturer could slide in a backdoor but one means you usually end up opting for worse parts

2024-10-15 21:49:13

- reply

doing something you are unfamiliar with is fine
but when it comes to securing millions in funds… you need to do research. and be honest where you fall short
too much time is wasted on marketing and the likes: eye candy over functionality, security taking a backseat (“resolved” by adding one or two IoT SEs with a lower bar for security compared to even a credit card, made by manufacturers that do not have a track record for high security SEs) and exaggerated marketing claims (“most secure”, “only airgapped wallet”)

2024-10-15 21:41:20

- reply

in a market where people don’t verify marketing claims anything can happen

2024-10-15 21:40:16

- reply

well, technically yes
in practice no

2024-10-15 21:30:09

The inherent culture in this protocol means the people that have proper experience with large scale infrastructure are either not here because most of the devs are clowns, or they are here only for personal gain.
And without them you will never scale. #note1nfs…09v3

2024-10-15 21:27:21

While developing an HWW, I have started to realize that 90% have no idea what they are actually doing and they think that adding a secure element is a silver bullet to all security issues

2024-10-15 20:54:29

- reply

it is not