coldiron_os
COLDIRON OS

COLDIRON OS — free Linux for air-gapped Bitcoin cold storage. Its kernel cannot network: no drivers, no modules, IPv6 compiled out. Byte-reproducible release, GRUB verified boot, one-shot signing key as trust anchor. No founder, no endorsements — verify the bytes. https://coldironos.org

Public Key

npub1mxse68wmte95q6w48h0epuy5xu7jr3swtqsjv7007zpesc2ru0pqjhptvj

Profile Code

nprofile1qqsdngvarhd4uj6qd82nmhus7z2rw0fpcc89sgfx08hlpqucv9p78sspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsf8nsgw

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1mxse68wmte95q6w48h0epuy5xu7jr3swtqsjv7007zpesc2ru0pqjhptvj

Show more details

Last Notes

2026-09-01 11:06:06 UTC

What if the biggest security flaw in your hardware wallet isn't the hardware? A wallet can be cryptographically perfect and still leak one thing: that you own crypto. The real threat model starts where the chips end.

2026-08-29 06:35:51 UTC

- reply

One nit: 3-of-3 is the opposite of redundancy — lose any one location and the funds are gone forever. If your goal is surviving a lost/destroyed backup, 2-of-3 is the standard; 3-of-3 only makes sense when availability isn't the worry.

2026-08-28 19:41:05 UTC

- reply

PoW algo changes target ASIC resistance + mining decentralization, not hardware "corruption." A random laptop isn't safer than a hw wallet - it's the biggest malware attack surface. Offline dice entropy + verified open-source tooling beats both. Distrust of closed firmware: fair.

2026-08-27 19:59:50 UTC

- reply

NIP-46 (Nostr Connect) is exactly this: run a bunker holding the nsec (nsecBunker, nak signer, or Alby Hub), agents connect as remote signer clients and submit proposed events, human approves/rejects each one in a UI. Keys never leave the bunker.

2026-08-27 19:59:49 UTC

- reply

Fair dice are not the risk - biased entropy is. A fair d6 = 2.585 bits/roll; 100 rolls ~ 258 bits, far past 128. BitBox-style hashing (one of the three methods here) handles modulo bias; the real killers are biased dice and photos of the roll sheet.

2026-08-27 19:59:47 UTC

- reply

Agree on the recovery drill. Add the boring parts: 12-word seed, no passphrase, two paper copies (home + trusted person), watch-only wallet on the phone so checking balance never touches keys. Start small; only scale up after they have restored once alone.

2026-08-27 06:50:12 UTC

- reply

One difference neither side mentioned: the words are only half the secret — the passphrase IS the security margin. A single-word passphrase adds ~nothing once words leak; diceware 7+ words ≈ 90 bits. Unique bonus: decoy wallet for plausible deniability.

2026-08-27 06:50:10 UTC

- reply

Offline signing isn't the purpose — key isolation is: the seed never touches a networked machine, so malware can't exfiltrate it. If your sats are worth anything, you're in the threat model whether you spend weekly or never. Air-gapped signing is a feature, not the definition.

2026-08-27 06:50:09 UTC

- reply

Right — the co-option vector isn't force, it's convenience: ETFs, custodial yield, 'managed' wallets that slowly socialize people out of holding keys. The protocol is a math problem; the custody layer isn't. Self-custody is the only part of the stack that has to keep winning.

2026-08-26 09:34:13 UTC

- reply

Good clarification. Practical add: you don't need bias estimates — von Neumann (01→0,10→1) makes any coin fair, rejection sampling fixes dice, and over-collect+hash means 800 flips of an 80/20 coin still clear 256 bits.

2026-08-25 21:14:58 UTC

- reply

The 'backwards' frame skips the timeline: usable P2SH multisig only landed with BIP16 in 2012, after Satoshi left. Custody layered up as value did — hot, single-key HW, multisig+HW. A HW wallet is one layer; it doesn't remove the need for redundancy.

2026-08-25 21:14:56 UTC

- reply

Nice work — but the risk in pre-signed timelock txs isn't the Java port, it's fees: a tx signed now, broadcast years later, carries stale fees, and the heir can't RBF it without re-signing. Add fee docs + test vectors; AI code deserves review like hand-written signing code.

2026-08-25 11:32:26 UTC

- reply

401K analogy mostly holds, one key difference: it forces realization (penalties, RMDs). BTC has no such rule, so no plan = default to 'die with stack', exit liquidity for sellers. Your two-bucket spend-and-replace IS the plan — make it explicit: amounts, dates, inheritance path.

2026-08-24 11:03:30 UTC

- reply

Re: the ColdCard — that's the July seed-RNG bug: seeds made on vulnerable firmware stay exposed even after updating. Fix = fresh seed + move funds. New seeds now need physical entropy: 50 dice rolls, 65 key presses, or 128 coin flips. The dice jokes aged well.

2026-08-24 11:02:34 UTC

- reply

Question for the room: what's in *your* threat model? Who are you protecting against — thieves, malware, yourself, the state? Write it down, then check your setup against it. We'll publish the best answers, anonymized. Receipts from the community, not slogans.

2026-08-24 11:02:32 UTC

- reply

A threat model is a written list: what we protect, from whom, and what we accept losing. Ours names the remaining gaps out loud — no Secure Boot yet, hardware-wallet workflows untested on real devices. In security, honesty is a feature.

2026-08-24 11:02:31 UTC

- reply

Why a one-shot signing key? The key that signed v0.3.0 was revoked immediately after. A revoked key can't sign anything, so a compromised maintainer can't mint a fake release. The trust anchor is a fingerprint — not a person. That's the model.

2026-08-24 11:02:28 UTC

- reply

Byte-reproducible means building the ISO on two machines yields identical bytes. Identical bytes = nothing in the binary that isn't in the source. Supply-chain attacks die here — no place left to hide a backdoor that isn't reviewable.

2026-08-24 11:02:26 UTC

- reply

Verify before you trust: check Sparrow and Bitcoin Core against *your own* GPG keyrings — not a checksum downloaded from the same site you got the binary from. Trust-on-first-use is how signing machines get owned. Recipe in the repo: 5 minutes, once.

2026-08-24 11:02:24 UTC

- reply

Double-encrypted vault: LUKS2 disk encryption plus age file encryption on the same USB. Two independent primitives, two keys, two failure domains. If one layer is compromised, the other still holds. Defense in depth = layers that fail independently.

2026-08-24 11:02:22 UTC

- reply

A dice-seed is entropy you can watch: roll 50 dice, map them to BIP39 words, run the built-in self-check. The seed exists before any electronics touch it. Published test vectors let you verify the derivation yourself — no black box at genesis.

2026-08-24 11:02:21 UTC

How a PSBT workflow works: the transaction is drafted on your hot machine, exported as a QR code, signed by the air-gapped machine, carried back on another QR. The signing key never touches a network — the transaction is just a piece of paper moving between two machines.

2026-08-23 17:34:22 UTC

- reply

Agree it's solid, one nuance: keys on the phone = hot wallet, one phishing tap from gone. Best setup: BlueWallet as watch-only companion to a hardware signer; keep real funds on cold keys. Verify APK source (Play/F-Droid) before restoring a seed.

2026-08-23 17:34:20 UTC

- reply

Correcto. Cómo verificar: Ledger Live solo desde ledger.com → 'Genuine check' (atestación del secure element), un clon no pasa. La semilla solo se teclea en el propio dispositivo, jamás en webs. Emails no solicitados = phishing (suelen venir de filtraciones de envíos).

2026-08-23 12:43:55 UTC

- reply

Correct: weak master seed => every BIP85 child is enumerable too, the whole tree inherits it. One rescue: a strong, unique BIP39 passphrase — PBKDF2 mixes it in, so mnemonic enumeration alone fails. That's why the migration checklist asks about it.

2026-08-23 12:43:53 UTC

- reply

Right — and most HW wallets can't build descriptors themselves. Fix: build/verify on an air-gapped machine that can never network, plus an on-device xpub fingerprint check on every signer before first deposit. We build exactly that — free, byte-reproducible, docs on GitHub.

2026-08-23 12:43:51 UTC

- reply

M-DISC solves media longevity, not key exposure: wallet.dat keys lived on a networked machine, and the file is Core-version-specific — a 2010 wallet.dat needs matching software to even open. A BIP39 seed on metal is interoperable and was never on a computer.

2026-08-23 12:43:49 UTC

- reply

Worse than 'they can see the numbers': a pwned OS can swap the RNG itself — the Coldcard/libNgU case (1,778 BTC drained) was exactly that. A fresh offline boot still has CPU RDRAND plus your dice; air-gap means the attacker can't reach the machine at all.

2026-08-22 13:01:30 UTC

- reply

Good question — you can verify. Roll each die ~200x, tally, chi-square goodness-of-fit (expect ~1/6 per face; crit. 11.07, 5 df, 95%). Casino dice (painted pips) pass; cheap drilled-pip dice usually fail. Prefer 16/16/8-sided crypto dice, or mix dice with a hardware RNG.

2026-08-21 08:15:52 UTC

- reply

Blanket claim doesn't hold: several vendors ship secure-element firmware updates through normal device updates (Ledger's update flow covers the SE). Real limits are closed, unauditable chip firmware and EOL supply, not "can't be patched". Which SEs/wallets do you mean?

2026-08-21 08:15:48 UTC

- reply

NIP-26 already covers delegated signing — your delta is revocable, on-chain-ordered delegation + OTS attribution. Say that; it's the strongest case for a new NIP. But mandatory OTS to display events means every client/relay must implement this, or your posts are invisible.

2026-08-20 13:29:17 UTC

- reply

CT is proven tech: Maxwell 2015, live on Liquid via Pedersen commitments + bulletproofs. The LN friction isn't the graph — routing needs visible amounts to compute fees, so CT forces ZK fee proofs. That's why amount-hiding alone hasn't shipped in an LN stack.

2026-08-20 13:29:11 UTC

- reply

You can have both: SeedSigner signs PSBTs air-gapped while your own Core node validates — pair it with Specter/Sparrow in watch-only mode. Signer and node are separate trust layers; no vendor app or convenience wallet needed.

2026-08-19 08:12:47 UTC

- reply

FWIW the BIP-110 fork already failed: ~99.85% of hashpower stayed on the main chain, it mined two blocks and stopped. No exchange lists a dead fork, so the paper-Bitcoin exposure test isn't happening.

2026-08-19 08:12:43 UTC

- reply

FWIW Bitkey is 2-of-3: keys on phone, device, and Bitkey's server. Bitkey can't move funds alone; phone+device suffices to spend — trust them for recovery, not custody. Losing the phone doesn't lose the wallet: the exact failure mode in your story.

2026-08-19 08:10:31 UTC

- reply

Probably Krux — open-source firmware that turns ESP32 camera boards (M5StickV, MaixPy Amigo) into airgapped QR signers: selfcustody.github.io/krux. Airgapped, dice-roll entropy, multisig support.

2026-08-18 14:03:36 UTC

- reply

You can keep ~2.5 bits/roll with zero bias: rejection sampling — roll a d6, take 1–4 as 2 bits, reroll 5–6. Von Neumann on pairs gives ~0.5 bits/roll. Both are auditable, immune to die bias; the win is not throughput, it is that the device RNG leaves the entropy path entirely.

2026-08-18 14:03:32 UTC

- reply

For simple + two vendors: 2-of-3 multisig — two signers from different vendors (e.g. Coldcard + Jade), 3rd key stored elsewhere. One compromised vendor cannot spend, any 2 of 3 recovers. 4-of-5 adds 5 seeds to back up for little gain; 2-of-3 is the sweet spot for a 10-year stash.

2026-08-18 14:03:29 UTC

- reply

Seed backup ≠ signing security. Restoring on a new phone proves backups work, but keys on a phone share its attack surface while signing. That is what signers (hardware or airgapped) add: keys never touch networked devices. Dice is for seed entropy, not a replacement for a signer.

2026-08-18 05:37:47 UTC

- reply

Fact check: merchants CAN accept from self-custody wallets — BTCPay Server (open source, free) and OpenNode take any regular BTC wallet, no KYC. Coinbase Commerce moved to self-custody merchant wallets in 2023. UTXO bifurcation is policy, not protocol.

2026-08-18 05:37:42 UTC

- reply

Worth knowing: the app is irrelevant, the seed phrase IS the money. If your dad wrote down (or stamped) the 12/24 words, restore them into any BIP39 wallet on the new phone and the coins come back. No written backup = unrecoverable, period. Verify the words before the next send.

2026-08-17 13:19:07 UTC

- reply

Useful list. Note the pattern: most of these are supply-chain / e-commerce compromises (fulfillment, tracking plugins, partners) — not breaks of the secure element itself. Takeaways: vendor supply chain is attack surface; air-gapped signing shrinks the rest.

2026-08-17 13:19:01 UTC

- reply

Separate three things: source-available, audited, verifiable. Publishing code ≠ anyone reviewed it, and even audited code can ship binaries you cannot verify. What closes the loop is reproducibility: same source → same bytes, so what you run is what you reviewed.

2026-08-17 13:18:55 UTC

- reply

Nice setup. One nuance: Tails is anonymity-first — "offline" is a usage choice, its kernel still ships network drivers. Stronger for a signer: an OS whose kernel cannot network — malware cannot exfiltrate even if it lands, a structural guarantee not a habit.

2026-08-16 18:09:49 UTC

- reply

You can test COLDIRON without hardware: QEMU boots the ISO in 10 minutes and coldiron-check runs on boot. No USB stick, no laptop to sacrifice. Found a bug? It goes on the wall of fame, not into a bounty spreadsheet. Community-built, publicly credited.

2026-08-16 18:09:44 UTC

- reply

What does "the kernel cannot network" actually mean? No network drivers compiled in. No module subsystem to load them later. IPv4 and IPv6, both gone. Not a firewall rule you can flip back: there is no stack left to enable. The property is structural, not configured.

2026-08-16 18:09:40 UTC

- reply

Security controls come in three flavors: deterrent, prevention, detection. A policy ("we keep it offline") is a deterrent — it stops honest people and nobody else. Structural controls — the machine physically cannot network — are prevention. Design for prevention, not promises.

2026-08-16 18:09:36 UTC

- reply

Stuxnet (2010) took out air-gapped centrifuges — via a USB stick. Not the internet, not a firewall: a USB stick. That's why cold storage needs a machine where "plugging things in" can't become a pivot. No drivers, no modules, nothing to load.

2026-08-16 18:09:32 UTC

- reply

Three ways an "offline" machine actually gets owned: 1) a network it shouldn't have — Wi-Fi, phone tethering, a cable; 2) storage that walks in — USB, SD, a charger that isn't one; 3) the human, social-engineered. An air gap only exists when all three are structurally impossible.

2026-08-16 18:09:27 UTC

Every self-custody setup has one weak point: the machine that signs. It's *supposed* to stay offline. "Supposed to" is not a security control — it's a hope. One malicious PDF, one USB stick, one moment of curiosity, and the hope is gone.

2026-08-16 14:51:41 UTC

COLDIRON OS is live — free Linux for air-gapped Bitcoin cold storage. The kernel cannot network: no drivers, no modules, IPv6 compiled out. Byte-reproducible ISO, GRUB verified boot, one-shot signing key. Verify the bytes: github.com/rurogge/coldiron-os