semisol

👨‍💻 software developer
📨 nostr.land relay

all opinions are my own.

Public Key

npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj

NIP-05 Address

Profile Code

nprofile1qqs99d9qw67th0wr5xh05de4s9k0wjvnkxudkgptq8yg83vtulad30gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds9up67f

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub12262qa4uhw7u8gdwlgmntqtv7aye8vdcmvszkqwgs0zchel6mz7s6cgrkj

Show more details

Last Notes

2026-08-13 01:47:27 CEST

- reply

I have a hard time taking Passport Prime seriously after several of their claims and decisions. The idea makes sense, but at that point Betrusted seems like a better option

2026-08-12 10:49:05 CEST

expand 32-byte k

2026-08-12 05:53:27 CEST

- reply

I agree that macOS is pretty great in terms of security model, but that desktop is in general a mess …
I’m more curious about your opinion for more limited tasks, and not day-to-day usage, like hardened limited-purpose servers, or to process sensitive data, and such.
It is unfortunate we don’t have a lot of investment in this area.

2026-08-12 03:15:13 CEST

- reply

I am aware :) I need something that works on X86 systems,

2026-08-12 03:14:44 CEST

- reply

Ideally, we have a microkernel, and there is no dom0. The problem is that you are now reinventing the universe.

2026-08-12 01:01:33 CEST

- reply

I think that dom0 should stay a vegetable

2026-08-11 22:51:32 CEST

- reply

And I guess, it is more about the security configuration than anything, and distros. Very few things have SELinux properly configured, for example

2026-08-11 22:50:55 CEST

- reply

What would you say is a good desktop OS?

2026-08-11 21:13:58 CEST

- reply

Yeah. This is a common method, used by basically anyone serious (and not).

2026-08-11 20:29:21 CEST

- reply

This is what it is for. So that people do not bruteforce the candidates ahead of time to manipulate it

2026-08-11 19:21:18 CEST

- reply

People comparing it to UASF and saying “bitcoin dead wallst took over” need to understand this. I think that no one would support a rushed attempt with threats of forking off *without any plan*, especially when the solution did not fix the problem.
Can we just have relay policy already?!

2026-08-11 17:53:29 CEST

- reply

IIRC, RandomX has been stable for a long while.

2026-08-11 14:54:22 CEST

- reply

After post-training, the model’s output distribution collapses a ton.
I feel like the recent models though are extremely annoying to use. GPT 3/3.5/4/4o/4.1/4.5 and even 5 was fine. There were patterns (like everything being a list for 3-series) but nothing this annoying.
Ever since they started optimizing thinking and especially coding, these models have gone down the shitter in terms of their “writing style”

2026-08-11 14:49:47 CEST

- reply

RLHF

2026-08-11 02:54:58 CEST

- reply

it is literally claude 5 speak
either it is ai written or someone took over @npub137c…k37w's account

2026-08-11 00:00:22 CEST

FCMP++ is all you need

2026-08-10 15:26:28 CEST

- reply

It was a post by @npub1f5k…vk2u about https://en.wikipedia.org/wiki/Nobel_disease

2026-08-10 15:21:59 CEST

This is what happened to all the Nostr influencers I think
#nevent1q…t24p

2026-08-10 13:35:30 CEST

- reply

Already solved: Arweave

2026-08-10 03:42:52 CEST

- reply

pci compliance headaches in 3.. 2.. 1..

2026-08-10 00:35:33 CEST

- reply

Breaking news: batching more efficient than not batching
(I’d recommend more aggressively batching, and also looking at using speculative decoding if you don’t already)

2026-08-09 04:03:52 CEST

- reply

The more complicated, the more likely you are to lose it

2026-08-09 03:56:37 CEST

- reply

none of those, you should be doing [under NDA] with [under NDA]

2026-08-09 03:54:07 CEST

- reply

[under NDA]

2026-08-09 03:52:17 CEST

- reply

it is not bad, but to get proper functionality on smartcards, you need specialized cards (oversimplifying a whole lot)
and getting those is very very hard

2026-08-09 03:48:55 CEST

- reply

not secure at all
what kind of nfc card

2026-08-09 03:47:38 CEST

Seedless hardware wallets 🤔

2026-08-09 03:42:10 CEST

- reply

I can’t even see the conversation beyond @npub1m50…glzq quoting “X coin go up”

2026-08-09 03:07:25 CEST

- reply

I have personally seen this in hospitals, and I think even some hotels

2026-08-08 22:45:44 CEST

BIP-110 has activated. What now? (not a lot, actually)
However, there is a very specific type of scam that could lead to you losing coins. Please read.
#naddr1qv…0kna

2026-08-08 21:48:41 CEST

- reply

Do you want to sell fork coins? (They will likely have no value anyway so not worth bothering)
Yes: you need to care
No: absolutely nothing changes except maybe some BIP110 peers need to have their channels force closed
Risk of fund loss: none

2026-08-08 21:39:24 CEST

and just like that, absolutely no one noticed
https://i.nostr.build/0KjAdVx2oLBxcU3I.jpg

2026-08-08 21:38:41 CEST

it is forking time

2026-08-08 21:35:37 CEST

- reply

Secure element RNGs protect billions of credit cards, IDs, passports, computers, and more. Similar RNGs on HSMs protect the entire CA system, DNSSEC, and a lot of cryptocurrency. The Linux, macOS and Windows RNGs protect every website and application on the internet.
With secure elements, the only catastrophe that I can easily recall is RoCA. And that was caused by using a insecure prime generation algorithm instead of an RNG failure.
This is a uniquely Bitcoin problem. All the good infosec people work for general cryptocurrency companies, or at way more reputable companies.
With cutting corners and the incompetence of people at these companies, it is not unexpected that we have scared all the competent people away

2026-08-08 21:15:12 CEST

Regardless of your stance on spam, BIP-110 “UA”SF was a horrible idea. It will likely fail anyway.
The only thing it achieved is confuse people and polarize them further. Congratulations.
(My opinion is that we should not encourage it, by blocking it via *relay policy*. People don’t want to build on uncertain ground. But consensus should not be changed.)

2026-08-08 21:12:57 CEST

- reply

You sure it was not the so-so scary john-doe/qwen3.6-27b-ultra-heretic-abliterated-vl-nvfp4-q4-fable-distill-lora-merge-v2-gguf ?

2026-08-08 21:09:26 CEST

is anyone selling popcorn for sats?
#nevent1q…y0kj

2026-08-08 21:06:40 CEST

- reply

This is OpenAI/Anthropic

2026-08-08 07:42:58 CEST

- reply

Sorry I don’t think that’s gonna cut it. Buy a hardware wallet or two with the rest of your sats, so you can make a 2-of-3 to protect the 0.2 sats you have at the end

2026-08-08 07:35:05 CEST

Rule 1 of security research: until it is fixed and properly disclosed, you NEVER:
- share the details
- post what you found a vuln in
- actually, just keep your mouth shut and don’t say a word

2026-08-08 07:01:58 CEST

1. Make new model
2. Release
3. Quantize and lobotomize it
4. goto 1

2026-08-08 06:09:34 CEST

Am I even surprised
#nevent1q…xgrv

2026-08-08 06:07:09 CEST

- reply

and codec, serdes, …

2026-08-07 22:51:49 CEST

- reply

The certificate is for the chip. It does not mean whether the chip is used properly by Ledger, Trezor, etc.
It only says “the chip CAN BE secure”, but it is very easy to undermine the chip’s security as the developer.

2026-08-07 21:19:38 CEST

- reply

No, because the certification means absolutely nothing for the HWW’s security. It’s for the chip only

2026-08-07 21:14:08 CEST

Note that EAL5/6 certification means absolutely nothing about the security of a hardware wallet,

2026-08-07 21:00:58 CEST

- reply

that changes absolutely nothing

2026-08-07 13:10:24 CEST

- reply

the translation is accurate
https://i.nostr.build/7tHsaJSyVUZUkTCN.jpg

2026-08-07 11:34:33 CEST

- reply

actually this assumes the person fabricating it can even use photoshop, no, it’s a dumb copy and paste in paint

2026-08-07 11:33:59 CEST

- reply

it cannot be, and that image is clearly photoshopped

2026-08-07 11:33:34 CEST

- reply

It does not take time to do CVSS scoring, and the CVSS scoring system is known to have issues many issues anyway.
1. Scores are often much lower or higher than they should be.
2. It is possible to easily over- or understate the impact of a vulnerability, intentionally or not.
3. Whether the vulnerability is actively exploitable is another question.
After NIST had slowed down enrichment of CVEs, and many other safeguards broke, anyone can now go and issue a CVE for a project without any verification.
https://sqlite.org/forum/forumpost/34bdf3b9bd759d4d

2026-08-07 10:14:27 CEST

It seems that many people on Nostr just want to pretend to be devs just for grant money and nothing else.

2026-08-07 09:13:19 CEST

In cryptography the best way to check if you are sufficiently skilled yet, is if you feel like you know a lot but also nothing at the same time

2026-08-07 09:11:19 CEST

- reply

If you want to play both chains, you’ll need to use a UTXO that is an descendant of a new block’s coinbase

2026-08-07 09:10:23 CEST

- reply

To not care

2026-08-07 09:08:01 CEST

- reply

And what then? They replayed your TXs on BIP110, congrats, nothing changes on the main chain for you

2026-08-07 08:33:18 CEST

- reply

Well it a fork could make you lose LN sats, so could a malicious actor

2026-08-07 08:00:05 CEST

gm Nostr
If you are concerned about BIP-110: don’t be
You cannot lose sats unless you try to play both sides of the fork. It is impossible.

2026-08-07 01:16:35 CEST

- reply

Anything can be a critical CVE if you exaggerate it enough

2026-08-06 21:04:31 CEST

- reply

Well a harness that wastes tokens is a great way to maximize money spent

2026-08-06 20:14:39 CEST

About this entire AI security scanning thing:
1. Why are people using $ spent as a metric?
2. A huge chunk of these vulnerabilities are likely hallucinated and/or overstated
3. You can’t just point AI at a pile of files and expect good results

2026-08-06 18:08:09 CEST

- reply

RBF was inevitable and a natural consequence of mining
0conf was always risky and the fake safety provided by no-RBF just misleaded people

2026-08-06 02:05:42 CEST

- reply

wtf

2026-08-05 23:42:16 CEST

- reply

This happens

2026-08-05 23:28:21 CEST

Warrant canaries are security theater

2026-08-05 16:46:14 CEST

- reply

Card shuffles are not very random processes.

2026-08-05 15:52:54 CEST

I find my feed is better if I immediately mute anyone who posts AI slop.
GM.

2026-08-05 14:54:37 CEST

- reply

This is very easy to get wrong
Do not recommend, do not do this, avoid, just run, please

2026-08-05 14:44:43 CEST

- reply

Lazarus?

2026-08-05 12:07:23 CEST

- reply

😂

2026-08-05 09:51:59 CEST

- reply

I am not sure. It may also just be the North Koreans

2026-08-05 08:42:07 CEST

- reply

not closed source but source available
reminds me of xz, anyway

2026-08-05 08:13:17 CEST

- reply

I have seen someone propose they did this because of https://arxiv.org/abs/2607.06194
(though that paper looks like slop)

2026-08-05 07:32:24 CEST

- reply

Tried it again today with DS v4 Flash. You need to explicitly say RNG, it initially missed it, then found it, and started doom-looping about if it just hallucinated a whole bunch of crap or not

2026-08-04 23:02:37 CEST

- reply

Because no one is looking

2026-08-04 22:45:29 CEST

- reply

https://en.wikipedia.org/wiki/No_true_Scotsman

2026-08-04 22:01:50 CEST

- reply

https://web.archive.org/web/20140311215237/https://coinkite.com/

2026-08-04 21:27:16 CEST

- reply

Don’t even think about it, the entire thing is a steaming pile of garbage from the hardware to the code, just, please don’t.
The HW is not secure, the SW is not secure, …

2026-08-04 21:24:42 CEST

- reply

They were initially a crypto-PoS company

2026-08-04 21:21:39 CEST

- reply

wdym

2026-08-04 21:20:49 CEST

- reply

I am starting to feel like my comparison of this to the xz attack makes more sense now..

2026-08-04 21:19:45 CEST

given enough tokens, NOT all bugs are shallow

2026-08-04 10:08:22 CEST

- reply

This, if true, makes it more likely that this may have been an intentional backdoor attempt?

2026-08-04 08:28:57 CEST

- reply

Whatever it is, it needs to have fat profit margins, somehow.

2026-08-04 08:06:21 CEST

- reply

q is the 0 character in Bech32

2026-08-04 08:05:08 CEST

- reply

I think it failed to parse the identifier, because that looks like it has too many zeroes for a note ID. @npub1n0s…lahe

2026-08-04 03:39:46 CEST

- reply

Seems too unlikely even eith that. Have you tried new Random(System.currentTimeMillis() / 86400000L)?

2026-08-04 03:38:36 CEST

- reply

breaking news: computer can compute better than meat, water found in ocean, what next? 🤣 “fire is in fact hot”?

2026-08-03 22:34:33 CEST

how do I delete my last renote that was an accident

2026-08-03 21:58:24 CEST

- reply

soon but I’d rather have a secure product than a slopped together one.
what you can get done with normal smartcards are extremely limiting though, in terms of functionality, security, and auditability
so, another way

2026-08-03 21:32:21 CEST

- reply

yes, me.

2026-08-03 20:35:05 CEST

- reply

You are at risk as much as singlesig users.

2026-08-03 20:28:03 CEST

- reply

I am a bit annoyed personally with Infineon, especially since they like to cheap out on their crypto it seems. See EUCLEAK (32-bit masking instead of full masking) and RoCA (weird “cheaper” prime generation algorithm)
Most commercial SEs also feed TRNG bytes through whitening and processing
I would say the random numbers generated by it, when mixed with the OS pool, are sufficiently good

2026-08-03 20:23:31 CEST

- reply

TL;DR if you did not SeedXOR seeds yourself, and instead used Coldcard to *split it* with TRNG:
- All except 1 part is predictable
- The last part is enough by itself to get your original seed
This is because the Coldcard generates n-1 dummy seeds, and XORs them with your seed to get the last share. However all the dummy seeds are weak
So someone could just bruteforce all possible ones.
Your funds are not at risk of being stolen remotely by an attacker.
It just is that, if you did this way of share splitting, you should assume 1 share is enough to crack it.

2026-08-03 11:25:19 CEST

- reply

Basically, it splits your seed into n parts that need to be XORed together to get the original seed.
The problem is that the “dummy” parts created are all from the insecure PRNG. (Unless you manually created the individual parts and XORed them)
This means that the last part, which is the XOR of the dummy parts and your seed, can be used to fully recover the original seed by itself. (As the possibility of XORed seeds is limited, and they are sequential)
The problem is finding which part it is. You must destroy all of them.

2026-08-03 11:00:15 CEST

- reply

TRNGs work on thermal noise and other things.
HWWs can absolutely generate fully random numbers without any external assistance.

2026-08-03 10:49:47 CEST

Good morning Nostr
It is good to see that many people’s efforts have helped people move their coins into safety.
While I hope that the hardware wallet industry and developers will learn a lesson from this, I think that many will have the wrong takeaways, or none at all.
This is not the first time that such things have happened, as seen with the Blockchain.info wallet, and I don’t think it will be the last.
It is embarrassing that the same mistakes happen over and over again.
These companies are often managed by people with little understanding of cryptography and security. A flawed leadership then leads to flawed products.
While open source, AI security audits, etc., are nice, they are not going to solve the problem at all.
I would recommend anyone who wants to make a signing device first study the history of cryptography, hardware security, and related topics. Then decide whether you want to take the risk.

2026-08-03 08:58:50 CEST

- reply

it also works with closed tabs/windows in general

2026-08-03 08:57:53 CEST

- reply

cmd+shift+T

2026-08-02 23:14:20 CEST

Can’t help but think about this
https://i.nostr.build/h4jZfTGsqG3rOAIp.jpg