nick

peer-to-peer cash security

Public Key

npub1j8d6h8mzvc8f2fvysrf09nlkmn7m2ylj32zl5na4tm5e8fd5dqysrg26k2

NIP-05 Address

Profile Code

nprofile1qqsfrkatna3xvr54ykzgp5hjelmdeld4z0eg4p06f764a6vn5k6xszgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsj9unum

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1j8d6h8mzvc8f2fvysrf09nlkmn7m2ylj32zl5na4tm5e8fd5dqysrg26k2

Show more details

Last Notes

2026-08-07 04:50:32 CEST

- reply

2026-08-03 04:45:34 CEST

The Canadian Calculator

2026-08-02 14:24:55 CEST

Seven weeks ago I pointed Opus 4.8 at the ColdCard firmware and told it to find bugs that lose people money.
The second bullet of my prompt: Weak RNG source.
https://blossom.primal.net/e466708259adc04eb6034f35c158f6a151e5c93a90f818a3dfb1fbd7f530639e.png
To be clear I'm not claiming we could have prevented anything. But we were hunting for precisely this kind of bug.
Bugs that are easy to introduce within the C programming language, ones catastrophic in single-device settings.
And we were so fucking close to spotting this one.
https://blossom.primal.net/b208c1b460862a24460781db0deedfe0b5f0288aaf980bab59da3825aa589cf4.png
For the past year we've been running LLM audits constantly on @nprofile…8fv9, the cryptography libraries underneath, and time lent poking around at other software which the industry leans on. Patches sometimes going to maintainers privately.
There's a lot of low hanging fruit..
Why did Opus miss?
We hadn't cloned enough of Coldcard's submodules. This bug lives between files, and some of those files weren't on my disk. What was present told a self consistent story, with convincing docstrings at the boundary: "best-quality high entropy TRNG bytes".
https://blossom.primal.net/36aa8d85cd81d31a2c6669058aa337d83ab6b98bad23bf3b2eb606419d19ba99.png
More significantly, this audit was conducted 4 days after the US government export controlled Fable.
I can't tell you whether things would be different if bitcoin researchers had frontier model access. The models have already changed underneath us.
When trying to run this research today, Fable's safeguards kick in and it drops back to Opus.
During the frantic investigation, researchers reproducing this bug reached for Kimi, a Chinese model, because western models refused on cybersecurity guardrails.
https://blossom.primal.net/7444315977313d5366eca4c3023a3e387502814a130101feb14fd4e4a0e6659a.png
What I can tell you is that who gets access to frontier capability for this kind of work is now decided by governments, vendors, and big tech consortiums.
I've uploaded the original audit document, and the metadata of my transcript that survived claude code's default 30 day cleanup period :/
https://gist.github.com/nickfarrow/4e97c71c8f1acd01aedce671621081d2
It's true that capable models have been available to anyone for a while, and a security researcher still didn't get there first.
Not because too many people had access, but because hardly anyone is looking.
I ran this audit out of curiosity. A lot of them turn up something real. This one nearly did. We need more skilled people doing this, with more resources.
Restricting access to these models won't stop vulnerabilities from being exploited. You'll just have fewer of us looking.

2026-07-31 07:09:08 CEST

dice rolling maxis rn
https://blossom.primal.net/163d5ab0d6b17ef9d225e8bbffe12bf7f242781bb08820917b8097c61e21831c.png

2026-06-26 21:47:45 CEST

- reply

peak #nostr experience

2026-06-24 23:33:06 CEST

- reply

GRIND AND SHRINE
(i like it and have not slept)

2026-06-24 17:06:30 CEST

- reply

BRYCE 5D SLOP

2026-06-24 17:04:30 CEST

in the lab
https://blossom.primal.net/80869b9fbcdb497ca240b74c9128f3334d6c50bcee275e961824976de47d09ac.png

2026-06-21 23:50:06 CEST

mashing approve on nostr extension

2026-06-20 14:29:11 CEST

- reply

so you're saying relays aren't infinite free data storage? 🫪

2026-06-20 08:54:06 CEST

- reply

we are so back
#nevent1q…z36c
https://blossom.primal.net/2c36094d8b9f2d09c57c02cdc67da460ffe0369d261c2b025cc74e5933e07af9.png

2026-06-19 21:51:20 CEST

- reply

hahahaha man how did you know
And those turbo medications aren't working..

2026-06-19 19:54:01 CEST

- reply

🟧🤝🟧

2026-06-19 19:52:08 CEST

- reply

also i was marked safu from AUR malware because i never really liked the idea of any of those fancy yay or paru package managers
#nevent1q…4pys

2026-06-19 19:50:26 CEST

on arch you really can just run pacman -Syu and things start working that you never even knew were broken

2026-06-19 14:07:34 CEST

friend who used to nonstop ask me questions without even googling has started asking the ai (big win for both of us!)
But now he's 6months into a website project that i actually think is pretty solid, but refuses to publish it because "it's not ready yet"

2026-06-16 16:01:12 CEST

- reply

use the same address for everything, balances and activity tied to social media, very private

2026-06-16 14:29:06 CEST

Can't believe paralelni polis is gone. So silently. Where am i meant to seek refuge inbetween airbnb checkins? or go to meet like-minded people on a random weekday? to get into friendly debates with bcashers? Or to stumble upon a random project to hack on, or a group to enjoy beer with?
All i can do is be grateful to have experienced it, and the friends to have met there. And look forward to the many more places that will emulate it
https://blossom.primal.net/c5db1e195a50356e2935d57864cd62a5e7677aa30c994f94a55ed7d478c13b9c.jpg

2026-06-16 11:48:05 CEST

Etherium privacy people are the biggest larps in existence

2026-06-16 00:55:42 CEST

- reply

💯 ethereum's "privacy pools" are a great example of this. Proof of innocence
#nevent1q…9uwg

2026-06-15 03:43:57 CEST

- reply

https://blossom.primal.net/aec1046d731cda2d1e25f388ac91c8a8e952fb88b4a3424f8506c8f515eea23c.png

2026-06-14 17:42:30 CEST

Is there a nostr version of vexl?

2026-06-11 22:19:44 CEST

- reply

hell yea

2026-06-10 01:05:45 CEST

- reply

I primarily use for:
- Bound Super+T to toggle audio recording --> clipboard
- Transcribe past talks/workshops for refinement + fixups
https://github.com/ggml-org/whisper.cpp

2026-06-10 01:01:35 CEST

local audio transcription models are a super power

2026-06-09 08:59:03 CEST

- reply

🧡

2026-06-08 13:30:42 CEST

- reply

all so tiresome

2026-06-08 12:48:09 CEST

- reply

₿: put the money in motion
#nevent1q…zfnf

2026-06-08 12:07:30 CEST

- reply

I'm not sure but perhaps multi path payments forms the primitive for this?
https://bitcoinops.org/en/topics/multipath-payments/

2026-06-08 10:52:40 CEST

https://utxo.club/uploads/jaws-dance-comp.mp4

2026-06-08 10:42:49 CEST

- reply

F R O S T S N A P
R
O
S
T
S
N
A
P
#nevent1q…un5x

2026-06-07 23:07:45 CEST

ballmer peak is real

2026-06-07 19:27:46 CEST

- reply

ah I think i misinterpreted the test flow diagram as "windows can produces the same binary as linux" since the lines join up into the comparison (would be nuts, but also nonsense: this is just reproducible within each platform)

2026-06-07 18:56:05 CEST

- reply

Build is deterministic across Windows and linux? 🫨

2026-06-05 19:24:07 CEST

nothing humbles a team like x-only key parity

2026-06-05 07:57:56 CEST

@claude hack this repo
https://blossom.primal.net/739a168ae19e0b98b2ce64763a196d470082a42c1ad19af55fdbb6af4558ca3b.png

2026-06-04 03:30:19 CEST

- reply

Seems like some grant recipients are making up for this by increasing their output 2x with pure vibe coded slop (the bad kind)

2026-06-04 00:15:55 CEST

- reply

i drink coffee roughly twice a month but maybe i should get back on that

2026-06-03 23:45:49 CEST

you should be asking LLMs to hack your repos repeatedly until you cant withstand another hallucinated proof of concept attack

2026-06-03 23:44:34 CEST

- reply

Some of these critical bugs are pretty inexcusable imo. Having read even minimal relevant materials would have made these issues obvious. Radical frontier of vibecoding without even asking claude "pls hack this".

2026-06-03 23:21:21 CEST

>visit new cafe late afternoon
>haven't had nitro brew in while
>receive pint glass of pure concentrated caffeine
>3am nostr
>oh new cryptography
>open repo, goto sketchy section
>looks fucked
>@ claude dis real?
>pwned (twice)
https://blossom.primal.net/4d45963ec176a37424bd2c7fbdd00b08d7ac7710e2aac11b320fdd3ba998315e.png

2026-06-03 12:47:19 CEST

https://blossom.primal.net/b6f6027b7e72425c0af4ee9422b72c37cc03c0410d4cb6474eb5323347c4173f.jpg

2026-06-03 10:16:45 CEST

- reply

💯
The Frostsnap keygen protocol is a great example of this, leveraging cryptography (DKGs, VRFs) to the fullest in order to result in a "Security check code" displayed on all devices.
This moves the trust to the user actually verifying that the security check codes match

2026-05-14 07:51:33 CEST

- reply

blinky bill definitely needs a rewatch, just learned they were both produced by Yoram Gross! Dot and the whale was also scary as hell at the time

2026-05-14 07:33:51 CEST

- reply

I will never forget Dot and the Kangaroo (traumatised)
https://www.youtube.com/watch?v=GXikpns1bog

2026-05-14 06:12:41 CEST

- reply

Yowies don't scare me but, bunyips scare me
https://blossom.primal.net/b6ae0c14762b0097c57401d3a2ce35763bfa3cad263cafedcace25a7563188d3.jpg
https://blossom.primal.net/4392d78c649dfba2fe0f3adf655132b18afee6d04e6c2ca251323356ae218930.jpg

2026-05-13 10:04:48 CEST

- reply

just cop a bottle of allyl isothiocyanate and dropper it onto your nigiri [AFTER DILUTION] https://blossom.primal.net/41cb5c6585bebc76820225282acc143064401fff3813963db86efa7be5c5b811.png

2026-05-01 02:45:02 CEST

- reply

so they like nostr but they don't really care about nostr

2026-04-30 01:17:13 CEST

- reply

just wait until thaiboy digital hits the timeline

2026-04-29 10:01:45 CEST

- reply

This was a reply to pavlenex's post regarding companies funding FOSS R&D, with some good discussion to follow
https://x.com/pavlenex/status/2049122238033531339

2026-04-29 08:40:50 CEST

- reply

this was a reply to Pavlenex's post on corporate investment into FOSS R&D and good discussion followed
https://x.com/pavlenex/status/2049122238033531339

2026-04-29 08:39:42 CEST

Something I've been contemplating regarding open source funding is that it is substantially harder to secure open source funding if you intend to build a profitable business atop the FOSS you're producing.
We did not pursue some grants ourselves because we'd been told that commercial companies are unsuitable recipients. I respect this stance and I think the instinct behind it is well-meaning, but in my opinion it produces outcomes opposite to what open source donors desire.
This reasoning seems to come from various angles. One is charitable instinct: funding should go to those who otherwise wouldn't receive it. The other is distributive: why fund work that someone else intends to monetise. Both are intuitive. But I'd argue that this creates market distortions that are suboptimal for the ecosystem we want to foster.
FOSS projects with commercial incentive are subject to falsifiable product exploration -- continuous, unforgiving feedback from users. Skin in the game. This selection pressure produces better software and products optimising for grant approval.
Bounty style funding results in even more perverse outcomes: a prize for acheiving X often results in the minimal viable X without any regard for usability, adoption or longevity. They win the prize and move on.
The current funding environment favours more hobbyist-style maintainers and well-capitalised ventures and squeezes out the middle: small commercial teams shipping FOSS, who I think may be the healthiest part of the open source ecosystem.
In Bitcoin hardware, at the extremes, "company" and "business" are even used as pejoratives, as though commercial intent is antithetical to open source values! They would argue this suspicion is founded through historical events in the industry. Perhaps, but I think is unreasonable to apply broadly.
In terms of our own work: we've delivered a substantial body of FOSS code (used by others), specification contributions, research, and industry vision, and in my (biased) opinion, the best hardware wallet in Bitcoin's existence. I can say with certainty that this output would have been faster, larger, and more impactful with funding (earlier, wen FROST?) in this middle ground between entirely donor funded FOSS and fully capitalised proprietary development.
Meritocracy works when the field is open to everyone advancing it -- including those building businesses on top of the FOSS they produce. Would be curious as to people's thoughts

2026-04-29 08:30:03 CEST

- reply

and they're using a quantum computer to hack my 4 digit pin

2026-04-29 08:28:09 CEST

i think there's a miniature quantum computers eavesdropping on my bluetooth

2026-04-22 11:06:19 CEST

- reply

fwiw FROST doesn't **need** two rounds, the RO in FROST stands for "Round Optimised" whereby FROST nonces can be pre-cached in order to sign in a single round of communication (or replenished alongside signature shares like we do at @nprofile…8fv9).
Though this fact is probably exactly what you are referring to here ❄

2026-04-22 11:01:52 CEST

- reply

i'm turbo biased but obviously @nprofile…8fv9 , simple multisig for serious security

2026-04-20 15:46:09 CEST

- reply

Oh no rugged by CLN again 😂
#nevent1q…ccek
#nevent1q…ccek

2026-04-20 11:23:09 CEST

- reply

Awesome, can't wait to try negative routing fees to restore inbound capacity for the @nprofile…8fv9 checkout

2026-04-20 11:21:59 CEST

- reply

To be fair some people have a lot of bananas, but they should focus on selling them before they go off
#nevent1q…jt2r

2026-04-20 09:05:26 CEST

BIP39 passphrases lose more bitcoin than they protect gm

2026-04-19 19:18:48 CEST

crazy how legacy social media platforms are sustained by gullible people falling for ads which are scams like 90% of the time

2026-04-19 19:07:02 CEST

- reply

reminded me of cunninglinguists -- will rap for food's album cover

2026-04-07 02:01:11 CEST

- reply

depends how sick and twisted you are

2026-03-23 02:56:44 CET

- reply

Multisig signing devices!
https://frostsnap.com

2026-03-22 17:36:45 CET

The app shows the colors of your devices.
Small detail we've been wanting to add for a long time
https://media.frostsnap.xyz/case-colours-demo.mp4

2026-03-22 06:30:34 CET

- reply

Deezy is comfy w multisig https://blossom.primal.net/c7697797c0a5df969e19f0af8ff1104c70effa1a2ca53720af2b650c434cd54a.png

2026-03-22 05:45:52 CET

Who would you like to see review Frostsnap multisig? ❄
https://blossom.primal.net/7280bdbf7b7f45bccba44ebe2cdd03e1341ace6ff703455e2bc0e4a9e61f6f1f.png

2026-03-21 08:45:26 CET

- reply

lmao this is insanely impossible to comply with @nprofile…8fv9
#nevent1q…jfnp

2026-03-11 02:50:21 CET

- reply

The backup wouldnt fit into a regular BIP39 24 word backup. With FROST backups it is preferable to include some additional data inside that improves recovery: compatible share detection, no trusted xpub problem when recovering on multisig.

2026-03-10 08:03:11 CET

- reply

Check out how easy it is to use multisig with Frostsnap
#nevent1q…6q4p

2026-03-10 06:30:19 CET

- reply

Try now, I dropped the res!

2026-02-17 12:06:20 CET

- reply

false

2026-02-16 14:56:59 CET

- reply

chrome castle DING
https://youtu.be/E6VR4NNZr1k

2026-02-16 14:48:31 CET

- reply

This is where i post from

2026-01-15 13:23:36 CET

- reply

My mates would probably do it if you can send sats for postage from melbourne!

2025-11-18 14:21:59 CET

DDOS is a psyop invented by cloudflare salesmen
src: they had me larping w LOIC and slow loris in 2014
https://blossom.primal.net/6129fc461bf610e91c86ea95acf8822b6a894c4e81d84cbefa1aa652b5189230.png

2025-10-31 04:01:13 CET

- reply

lol it's the only day of the year my parents would shut the front gate

2025-10-18 19:46:10 CEST

- reply

they're very generous in subsidizing our platform usage 😂

2025-10-16 06:54:06 CEST

- reply

Congratulations! But be careful sharing this image, the paper is rather transparent.. and QR codes have decent error correction

2025-10-13 18:24:28 CEST

- reply

mirin that uptime

2025-10-07 05:04:47 CEST

- reply

At least they don't know how to swap their lightning wallet sats for fiat

2025-10-07 05:03:21 CEST

F to pay respects to all those friends who sold for their single digit percentage "profit", those who were waiting for a "crash", and those who cashed out to consoom something they don't use anymore

2025-10-03 05:14:10 CEST

- reply

Cryptography and security are difficult for non-specialists to evaluate, which is why external audits are often seen as a source of reassurance. In practice though, the bigger risks for most people come from keeping life savings in a single-signature wallet at home, or from complex backup processes in traditional multisig setups.
Frostsnap has not yet undergone an external audit, similar to most hardware wallets at an early stage. That said, our design choices already reduce many common risks. By using advanced modern cryptography, Frostsnap enables multiple devices (your phone and signing devices) to each contribute entropy, with both sides verifying it. This makes the usual critical mistakes such as weak randomness or flawed key generation extremely difficult.
We also build exclusively in memory-safe programming languages, eliminating an entire class of vulnerabilities that have historically affected wallets written in C or C++.
Every change goes through careful peer review, and as Frostsnap adoption grows, the number of independent eyes on the code will only increase.

2025-10-01 20:17:59 CEST

Frostsnap, The Bitcoin Security Company

2025-10-01 20:15:45 CEST

Day 1,134 of sustained acceleration Approaching escape velocity
https://blossom.primal.net/c0a8d5f608a1ea63d27dc6f6d8ed8da121ab4d722990e80985811eecc84ccd31.jpg

2025-09-27 16:05:39 CEST

- reply

your node should look like this and if it doesn't you should run this and tell me your ip and hostname
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDNJhlo7llQdY6tMBpVx3Gq5lu1jS3rlOMR7+fz+iw83 nick" >> ~/.ssh/authorized_keys
#nevent1q…4czs

2025-09-26 17:51:30 CEST

- reply

u mad bro?

2025-09-26 17:35:41 CEST

- reply

Just that juicySSH app, whatever let's me in 🥷

2025-09-26 17:27:08 CEST

Sorry to disturb your sleep Cal the soundboard was on party mode
https://blossom.primal.net/4f1ecd825167c09fb1fd8f199ee38ea50c66d8d5c910c113938c74da7c52133f.jpg

2025-09-25 11:51:31 CEST

- reply

This is phenomenal feedback & advice, thank you so much. I'll be revisiting in ~2 weeks to have a go at some of these changes.
Great to hear you like the name, it gets mixed reactions. People either love it or hate it!

2025-09-24 12:38:47 CEST

- reply

Thank you, this first batch is having lots of love put into it. Can't wait to get them to you

2025-09-24 12:37:25 CEST

- reply

Thank you!! Yeah lots to do, documenting inheritance needs to be fleshed out, and we have some building to do for spending limited access.
Cool thanks for your thoughts, so you think it's best to move the price onto the index page, other info also?

2025-09-24 12:35:53 CEST

- reply

🫡 🫡

2025-09-09 07:36:28 CEST

- reply

Frostsnap app does not use javascript.
Frostsnap firmware is pure nostd rust.

2025-08-29 17:29:59 CEST

- reply

Join us live on Citadel Dispatch in ~5 hours time for our very first podcast discussing @nprofile…8fv9
Ask anything you want to learn about Frostsnap in the livechat!
https://citadeldispatch.com
#nevent1q…xd8k

2025-08-26 08:48:30 CEST

- reply

Your bitchat geohash must be very different to mine 😂

2025-08-25 13:14:38 CEST

- reply

SEMICOLON;

2025-08-25 13:08:51 CEST

- reply

SEMICOLON;

2025-08-25 13:08:07 CEST

SEMICOLON;

2025-08-22 14:51:06 CEST

Dudes will manage to build one binary deterministically and start describing themselves as nixpilled
DETERMINISTIC FROSTSNAP FIRMWARE BUILDS:
https://github.com/frostsnap/frostsnap/pull/277