brunswick
Brunswick

{ "id": "a5923befdd61f12c66a3821f01aa26830d534a637e5676105908c92f2e9d72fd", "pubkey": "c1e9ab3a56a2ab6ca4bebf44ea64b2fda40ac6311e886ba86b4652169cb56b43", "created_at": 1785380343, "kind": 0, "tags": [ [ "alt", "User profile for brunswick" ], [ "name", "brunswick" ], [ "display_name", "Brunswick" ], [ "picture", "https://npub1c856kwjk524kef97hazw5e9jlkjq4333r6yxh2rtgefpd894ddpsmq6lkc.blossom.band/bfa844f57b19899f1417560ca955e2fda2281f466599101a69aaa3118dd6423e.jpg" ], [ "banner", "https://upload.wikimedia.org/wikipedia/commons/thumb/a/a6/John_Everett_Millais_The_Black_Brunswicker.jpg/1280px-John_Everett_Millais_The_Black_Brunswicker.jpg" ], [ "website", "https://highlighter.com/[email protected]/articles" ], [ "about", "GM☕ since [759233](https://mempool.space/block/000000000000000000023ab241141d6cd0d0ea2f41295a830a6724407d450211)\n\nI'm not vegan, BTW.\n\n[Free Chauvin](https://alphanews.org/?s=chauvin)" ], [ "nip05", "[email protected]" ], [ "lud16", "[email protected]" ], [ "client", "Amethyst" ], [ "clink_offer", "noffer1qvqsyqjyxv6njcf5xd3rwwfcvgenye35xg6nzdmxxfjnvv3cv43nyvmpv43kyd3kxg6kgd3nxqexyetyxp3nzd3cvvunsd35v5cnyepcv4sk2drxv5mkvqg6waehxw309aehgunxwfujuumgda3kktnwv468wmmjdvqzqahdghcqe6nm43va359h6gzgfr6nr8tmjmq5plaklja24v9p84zwdz7ydt" ], [ "i", "github:BrunswickBTC", "d9124e8c3754865d4f56310c68c981a5" ] ], "content": "{\"name\":\"brunswick\",\"about\":\"GM☕ since [759233](https://mempool.space/block/000000000000000000023ab241141d6cd0d0ea2f41295a830a6724407d450211)\\n\\nI'm not vegan, BTW.\\n\\n[Free Chauvin](https://alphanews.org/?s=chauvin)\",\"nip05\":\"[email protected]\",\"picture\":\"https://npub1c856kwjk524kef97hazw5e9jlkjq4333r6yxh2rtgefpd894ddpsmq6lkc.blossom.band/bfa844f57b19899f1417560ca955e2fda2281f466599101a69aaa3118dd6423e.jpg\",\"lud16\":\"[email protected]\",\"username\":\"BrunswickBTC\",\"display_name\":\"Brunswick\",\"displayName\":\"Brunswick\",\"banner\":\"https://upload.wikimedia.org/wikipedia/commons/thumb/a/a6/John_Everett_Millais_The_Black_Brunswicker.jpg/1280px-John_Everett_Millais_The_Black_Brunswicker.jpg\",\"website\":\"https://highlighter.com/[email protected]/articles\",\"clink_offer\":\"noffer1qvqsyqjyxv6njcf5xd3rwwfcvgenye35xg6nzdmxxfjnvv3cv43nyvmpv43kyd3kxg6kgd3nxqexyetyxp3nzd3cvvunsd35v5cnyepcv4sk2drxv5mkvqg6waehxw309aehgunxwfujuumgda3kktnwv468wmmjdvqzqahdghcqe6nm43va359h6gzgfr6nr8tmjmq5plaklja24v9p84zwdz7ydt\"}", "sig": "956047c6482f8de9f2eebd008a52e26799d47225f25c91a4875c3471ecb937cccc3745ec6a4851caa35350dec6d24a2e2d23c6f1f9020b0643de06a69cc548f0" }

Last Notes

2026-08-04 00:50:54 UTC

- reply

Security - meets in Vegas
Not good opsec

2026-08-03 19:26:21 UTC

The coldcard event motivated me to spin up a replacement bitcoin node, this time with BIP-110.
If you can't now see the enemies within all are lined up against BIP-110, including NVK, you never will.
If you aren't personally effected by this coldcard disaster, take your time and energy and protect bitcoin from the likes of those who stand against it and are too fearful to take a stand.
This isn't a big ask, it's nothing compared to our soldiers who die to protect our way of life. Be a bitcoin warrior and defend the vitality of what is yours.
#nevent1q…7qx5

2026-08-03 19:18:07 UTC

- reply

A grown man going on camera to publicly cry is not believable. He had 5 days to figure out what to say, and this is what comes out?

2026-08-03 18:37:20 UTC

- reply

"Emergency RHR" 5 days later...

2026-08-03 18:36:28 UTC

- reply

Anyone on the board of opensats should be considered a pariah, including odell, for participating in whatever they were doing in conjunction with NVK.

2026-08-03 18:27:25 UTC

- reply

Why did he buy it in the first place?

2026-08-03 15:31:59 UTC

- reply

If you want to make more rolls, I suppose you could do that. It would give you one bit of entropy per roll. You might also say even is a 1 and odd is a 0. But you can't hand-calculate your seed phrase from only that. The checksums still need to be calculated.

2026-08-03 15:28:37 UTC

- reply

Not necessarily. I don't know his religion

2026-08-03 15:08:36 UTC

- reply

Now we know what he meant by "DETERMINISTIC OPTIMISM"

2026-08-03 14:59:35 UTC

- reply

An esp32 is not a general purpose computer. Is this guy even an engineer?

2026-08-03 14:54:03 UTC

- reply

#nevent1q…a852

2026-08-03 14:20:43 UTC

- reply

At a minimum

2026-08-03 14:06:53 UTC

- reply

Follow the money

2026-08-03 13:56:20 UTC

- reply

Sorry for your loss. Cutting that cord is consequential.

2026-08-03 13:50:48 UTC

- reply

No lies detected

2026-08-03 13:31:15 UTC

- reply

There will be different interest rates. Low rates on low inflation currencies, high rates on high inflation currencies.

2026-08-03 12:31:44 UTC

- reply

Could be worse

2026-08-03 12:30:58 UTC

- reply

"Net worth" lol. Looks like inflation to me

2026-08-03 12:23:24 UTC

- reply

I didn't mean because of the closed-source nature, or of the supply chain problem, though those are also issues. I mean how they are intended to be used is an unnecessary use-case. Your cold storage should be inconvenient to use, not impossible, but you should have to put some effort in before gaining access to spending it. For example, your savings account at your bank used to have withdraw limits. We have become accustomed to those limits being lifted, but it was in the interest of the depositor to have this limitation. The concept of keeping your cold storage seed in a secure element is contrary to it.
What is a secure element good for? Good question!
A hot wallet like a lightning node is a perfect use for a secure element. Even though the software could theoretically drain the funds at any time because it has access to the secure element, at least it wouldn't have access to the seed itself, unlike software wallets.
Once a seed phrase is entered into a computer, it should immediately be placed into a secure element and erased from RAM. This way it can not be read back out. Even better, the seed should be entered into a separate hardware wallet, and access to the key should be provided over a USB or physical hard-connection. A signing-session should be established between the PC software and the hardware wallet with physical-intervention authorization, akin to the nostr-bunker model. This way signing can be throttled and limited to the needs of the software that need access to it.
This model could provide some assurances of seed-privacy on day-to-day spending at L2.
When I say hardware wallets are a bad idea to begin with, I mean they are being used to solve a problem that shouldn't be solved.

2026-08-03 04:16:26 UTC

- reply

Uh I guess 18

2026-08-03 02:55:44 UTC

If you are overwhelmed by the idea of rolling dice for entropy and stamping your seed words in steel, before posting about how horrible it feels to be expected to act like an adult, find someone with testicles to help you out. Those soybeans you have floating in that wrinkled sack hanging between your voluptuous thighs don't count. Find someone with more testosterone than you flowing through her veins like @nprofile…cvt8

2026-08-03 02:47:51 UTC

- reply

You can't invite demons in the room where you are generating a seed otherwise remote-viewers will be able to watch from the future.

2026-08-03 00:46:38 UTC

- reply

Same

2026-08-03 00:32:12 UTC

- reply

Why would I go there?

2026-08-02 23:28:11 UTC

- reply

Not my problem. Secure element hardware wallets are a bad idea to begin with.

2026-08-02 21:32:30 UTC

- reply

The OS must be reproducible and traceable. Drilling through the source packages and should be enough. I don't know enough about how seedsigner set up their port, but I've done a fair amount of platform development with Debian. If its buildroot or yocto, being roll-your-own isn't quite the liability you imply.
3 months of two people should be sufficient to follow these rabbit holes. You can dispute the amount, but I do this kind of thing all the time. I'm bidding on three projects of this size right now
Maybe some security firms would be more efficient, and that's why I'd get several bids from firms that serve different industries. Yes, of course it would need to be a mix of experts. I did say swag. I'm sure some would say my estimate is way too low. Thats not the phase of discovery we are at. I'm only trying to give an order of magnitude to set up the contractual infrastructure appropriate for this task.
The actual fundraising goal would come after a firm is selected and they have provided a proposal with itemized task-list, SOW and phase-gate payment agreement that can be shared publicly.

2026-08-02 21:14:51 UTC

- reply

Are the criteria that the replacement is a coretard and they must wash the balls of whoever is the biggest doner?

2026-08-02 21:13:00 UTC

- reply

I watched the most recent episode of my favorite Hollyslop crew, haven't watched any pedowood productions for about a year, and I noticed myself feeling so demoralized by the story arc, narrative and premises. Then the commercials came on, even though I thought I paid to not have to watch that shit, and it was even worse. No wonder people are cutting off their genitals

2026-08-02 21:09:23 UTC

- reply

Steel

2026-08-02 18:05:49 UTC

- reply

@nprofile…4dl5
@nprofile…u2rf

2026-08-02 17:18:02 UTC

- reply

Hardware wallets are convenience devices.
Hardware wallets are not able to improve your security.
The most secure you can be is having a fireproof stamped-in-steel multisig keyset geographically distributed.
Spending your cold storage shouldn't be convenient.
L2 is for day-to-day spending, and right now, the best option is lightning, and if you don't want to self-custody your lightning wallet, run one with an LSP that provides some guarantees like reimbursement insurance.
Self-custody is hard. If you aren't up for it, trust coinbase with your bitcoin.
In any case, buy insurance if you're worried.

2026-08-02 16:49:51 UTC

- reply

If your only copy of your seed is stored in a secure element on a hardware wallet, you are seriously, seriously fucked.

2026-08-02 16:41:07 UTC

- reply

999 out 1000 chance coinkite won't refund or replace the devices they bricked.

2026-08-02 16:38:41 UTC

- reply

#nevent1q…jkvx

2026-08-02 16:29:57 UTC

- reply

We are on the bleeding edge of money, self-reliance, theology, self-defense, stewardship, truthful measures and honest exchange, and winning in the most important way: lovingly raising new godly bitcoiners

2026-08-02 14:59:26 UTC

- reply

Context. It's laid out in the first two short chapters. Satan is the god of this world. This is why he has any authority at all.

2026-08-02 14:54:58 UTC

https://github.com/SeedSigner/independent_custody_guide/raw/main/images/era_3.png
https://seedsigner.com/seedsigner-independent-custody-guide/

2026-08-02 14:47:35 UTC

- reply

Why would an open source nonprofit like seedsigner pay for that? Yes, certainly coinkite should pay for their own review.

2026-08-02 14:41:55 UTC

- reply

The devil did those things to Job. God don't promise Job protection, he granted it, but withdrew it because he knew Job could survive it. That's the whole point of the book. If Job had no trials, we would have never heard of him. We have a promise of protection only through Christ, not a promise of paradise in this world, but a promise of challenges to overcome.

2026-08-02 14:37:35 UTC

- reply

If you believe God kills, then you have a right to be angry with him

2026-08-02 14:04:20 UTC

- reply

Yes, the word taken out of context is deceit. Matt 4:5-10

2026-08-02 14:00:34 UTC

- reply

If you think jumping off a building is God killing you, then I suppose you can think that. By following God's laws, you being God's protection from evil, which is everywhere. "Executing judgement" is no different than living with consequences for your own actions. Only an atheist would twist those verses into God killing people.

2026-08-02 13:54:25 UTC

- reply

Yes, it was way too late to make any difference. It was pure CYA

2026-08-02 13:53:06 UTC

- reply

I got an email from coinkite mid-2024, about 6 months after I created a profile on their website. The email indicates they delete my "personal" data but "preserved the email address for now," implying they will delete my email address. So much for that plan, because I also recieved the security advisory email from them.
https://npub1c856kwjk524kef97hazw5e9jlkjq4333r6yxh2rtgefpd894ddpsmq6lkc.blossom.band/a86a33ccb3a67bcce52a09def6b66185270476929d861a1f570594e5f9c88efe.jpg

2026-08-02 13:42:12 UTC

- reply

God doesent kill

2026-08-02 13:41:44 UTC

One can get a reasonable code audit performed on the @nprofile…u2rf firmware with 2 FTEs for somewhere between 2 and 3 months, that is from 1000 to 1250 hours. The going rate for US-based firmware engineering firm for a small project like this is between $150 and $200/hour. I swag it should cost between $150,000 and $250,000 to audit the code and produce a report for seedsigner.
#nevent1q…pu6x

2026-08-02 07:01:46 UTC

Remember to be thankful, especially in your darkest hour. God will reward you for your loyalty

2026-08-02 06:47:10 UTC

- reply

Casualty of war

2026-08-02 01:39:50 UTC

- reply

A Leo. I should have known 😘

2026-08-02 01:37:23 UTC

- reply

You don't need a brand. You need @nprofile…u2rf. One you build yourself. You use it with Sparrow on desktop. Write down your seedwords on paper, and eventually stamped in steel. Nobody is going to do the right thing for you. Bitcoin is for adults.

2026-08-02 01:03:32 UTC

- reply

Why do you think you need a vendor?

2026-08-02 00:59:29 UTC

- reply

Scott Horton is amazing

2026-08-02 00:27:43 UTC

- reply

With 2-of-3 multisig, it turns into 48 words.

2026-08-01 23:43:07 UTC

- reply

If I were sold on the idea of the coldcard and I forked out the bucks for one, I probably would have convinced myself that it is superior to a laptop or a Linux kernel in regard to randomness. And throwing dice was "just another measure of security".
But, that wasn't me. And because it wasn't, I get to dance a jig for seeing the train coming from a mile away before getting off the tracks and watching everyone I kindly asked to get off the tracks get crushed.

2026-08-01 22:36:29 UTC

- reply

The miners profited. That's all that matters, right?

2026-08-01 22:35:09 UTC

- reply

The fact that a hardware rng was intended to be used shows it was understood my the architect that randomness is a crucial element of the coldcard. That this principle element was not instrumented for test and validated with after each build implies neglect.

2026-08-01 22:22:54 UTC

In case you're wondering, a certain Canadian is from São Paulo. Most of these ambiguously Germanic/Jewish surnames first appeared in the major metropolitan areas of Brazil about 70 to 80 years ago, were from the Ashkenazi diaspora. Of whom the men tended to mix with the women of the region and produce children akin to a light-skinned native. These children, naturally, tend to be very educationally oriented and technologically competent.
#nevent1q…6r65

2026-08-01 21:16:37 UTC

- reply

Given that you were advised to *NOT* roll dice is where the injustice lies. I never trusted a hardware wallet, no matter how securely it is shipped, no matter how "reputable" the supplier. There can be no guarantee the hardware isn't compromised upstream of manufacturing. But I wouldn't expect the average techie to have this level of paranoia. The claim "you should have rolled the dice" is directed at techies who know better, and their bad advice to those who don't.

2026-08-01 20:45:11 UTC

https://npub1c856kwjk524kef97hazw5e9jlkjq4333r6yxh2rtgefpd894ddpsmq6lkc.blossom.band/2a11826b35111987b2ee5786b7ce05213ff585d3732b5a122cdd6f250861255a.jpg

2026-08-01 20:30:30 UTC

- reply

Multisig is complex because you need to keep more than just the keys and the derivation path. If you lose one of your keys, you also NEED the xpubs of the keys you don't have access to. Normally this is a piece of paper with a giant QR containing all of your wallet information (minus the actual seed phrases).
It took me a few tries to realize this limitation. It is not explained clearly enough by the tools. One should be "forced" by the key generation process to save this somehow along with your keys, and backed up in secure storage. Your heirs need to understand this too.
Just sayin. If you understand this, you are ready for multisig.

2026-08-01 20:19:18 UTC

- reply

I don't have a coldcard, so I'm a little disconnected from this trauma. I'm mainly concerned about identifying the problem and the solution.

2026-08-01 20:12:37 UTC

The core group should be all-in on this hack because it increases miner revenue, and that's the whole point of bitcoin, right? I mean, 30 sat/vbyte? That's some very profitable blocks.
#nevent1q…a0qc

2026-08-01 20:01:24 UTC

AI is beginning to expose how shitty the code is we all rely on. Maybe soon, after 45 years, we will have computers that actually work?

2026-08-01 19:53:56 UTC

- reply

My primary concerns are to have a way to validate whether a darkskippy attack could be present and whether the key generation actually guarantees sufficient entropy.

2026-08-01 19:40:19 UTC

I propose fundraising to have @nprofile…u2rf given a formal third party independent code review.
How is this done properly? Is this something @nprofile…4dl5 is interested in?
#nevent1q…qfxm

2026-08-01 19:37:49 UTC

https://foundation.xyz/blog/passport-prime-security-audit

2026-08-01 19:00:44 UTC

@nprofile…4vwu twisted "open for inspection" into an excuse to not pay for a third party independent design review. This bug, hanging out there for years, proves nobody will look at your code if they don't have an incentive to do so.
- Your customers are paying for your product and relying on your credibility for having done due diligence before releasing code, therefore an honest customer has no incentive to audit your code for you because they are paying you for security.
- Coinkite has an incentive to pay for an independent audit and review, but they failed to do so, therefore damaging their credibility, which is their primary bluesky asset.
- A hacker has an incentive to audit your code, particularly if there is a large pot-o-gold sitting there if they find a vulnerability.
- A developer who branches your code and bases their own product on it has an incentive to audit your code, merely to understand it enough to use it for his own purposes.
I hope NVK carries a large liability insurance policy. I do not wish him harm.
Therefore coinkite has demonstrated a lack of due diligence, and given NVK's leadership and public displays of arrogance, protectiveness, dismissing of criticism; to "lose" him as an "asset of the community" is no loss at all, and it is reasonable to ostracize anyone who would grant him immunity.
He should, however, be welcome back after a complete repentance and substantial recompense to those he has harmed through his corporation.

2026-08-01 18:32:03 UTC

- reply

I gave up evangelizing. I let the 4-year cycle do the work.

2026-08-01 17:48:58 UTC

If you made a mistake by not throwing dice when setting up your coinkite, and put your life savings in a single-signature wallet, blame yourself.
Don't lose sight of the goal, bitcoin is still bitcoin.

2026-08-01 17:20:08 UTC

NVK is short for Novak, apparently.
Novak means "newbie"
https://surnamedb.com/Surname/Novak
#nevent1q…sddv

2026-08-01 15:46:57 UTC

- reply

You can't prove all the effected bitcoin were stolen except those addreseee that were all transferred immediately before disclosure. Just want to point that out.

2026-08-01 13:10:57 UTC

- reply

My grandad always said "you can buy insurance for anything". Vitor has a great point.

2026-08-01 03:42:31 UTC

Its pretty disgusting that people will reject @nprofile…u2rf because of bullshit on-sides politics

2026-08-01 03:40:59 UTC

- reply

My condolences. Lost mine 7 years ago next month.

2026-07-31 18:24:49 UTC

- reply

Using Aai to audit code is better than nothing, but it doesent replace a professional third party audit. I would have caught this.

2026-07-31 17:21:58 UTC

- reply

Blame everyone else for not auditing the coinkite code rather than blame coinkite for having their code audited.

2026-07-31 16:53:39 UTC

- reply

You, sir, have earned a spot on my coretards list

2026-07-31 16:41:33 UTC

- reply

He says "the hard stuff is the security".
Ironic.

2026-07-31 14:42:43 UTC

- reply

Bullshit

2026-07-31 14:41:09 UTC

- reply

I am not thinking anything. Simply stating a fact. The product design required trust in the developer and the company. Granted, very little, but still some. This randomness issue should have been a central focus of the dev, and if it couldn't be proven, the feature should have been removed. This is evidence of architectural failure. Whether flaws were designed-in to be exploited at some plausibly deniable distance-in-time, or if they were pure mistakes, still shows an architectural failure in the system and design goals.
A product like this should retain zero "trust me bro" in the design. I was never comfortable with recommending it to friends and family. When they would ask about it, I would say "I'm not sure, but it looks like a good option". Never would I saw "This is provably secure with generating and storing your keys". There were too many unaddressed concerns, where there should have been none. I treated them as newbie devices.
When you pile on the pattern of behavior of the developer when confronted with criticism, that adds to the concern.
Now that a bug has been exposed that, from a design perspective, in my opinion should have been left out as a feature because of pure uncertainty around lack of audit, the evidence points to the direction that coinkite's judgment should be questioned and treated adversarially. This should have already been understood even without evidence to the effect. One should always verify and not trust. When you cannot verify, then your alternative is still not to trust. Your alternative is to find a way to eliminate trust.
I'd like to know why people should entertain less secure alternatives as a replacement when there is @nprofile…u2rf

2026-07-31 14:22:36 UTC

- reply

By @nprofile…2szn ?

2026-07-31 14:21:30 UTC

- reply

I never had a good feeling about the coldcard. To require even a modicum of trust in the supply chain the developer or the design is too much trust. Coinkite spent too much time with security theater and not enough time designing all trust out of the product.

2026-07-31 14:17:54 UTC

- reply

There is no way to prove the bug was unintentional

2026-07-31 14:13:16 UTC

- reply

No mention of @nprofile…u2rf 🤔

2026-07-31 05:58:54 UTC

I am not happy with what happened with coldcard.

2026-07-31 05:29:37 UTC

@nprofile…u2rf

2026-07-31 05:14:14 UTC

- reply

Apparently not. I did get it to partially work, but the agent is so damn slow processing the bot's 16k prompt, it becomes unresponsive.

2026-07-31 04:49:06 UTC

- reply

I just spent 10 hours trying to get it working with a local agent. I'm about to give up and connect it to openai or something.

2026-07-30 15:03:32 UTC

- reply

A nostr replacement for discord is actually of itself pretty important development. Something that replaces github and adds dev bots and admin bots in-channel with meat devs and meat admins is mindblowing

2026-07-30 03:08:56 UTC

I am getting curious about buzz

2026-07-30 02:55:54 UTC

If you are afraid because your encryption is not quantum resistant, you are dumb.

2026-07-30 00:55:36 UTC

- reply

That's an old one

2026-07-29 19:34:15 UTC

@nprofile…eqct doesent get enough credit for what he does
#nevent1q…5r50

2026-07-29 14:41:48 UTC

I think I figured out who Paul was talking about when he said he had a thorn in his side

2026-07-29 12:07:00 UTC

- reply

#nevent1q…xajt

2026-07-29 11:56:07 UTC

- reply

He was put down so they could attack Iran

2026-07-29 11:40:08 UTC

- reply

This is a bizarre story. "Whitehouse spokesperson" I never heard of with an Indian name cites "Anonymous sources" is the first red flag. AJ can do better than this.

2026-07-29 11:30:55 UTC

- reply

Eventually all women dabble in witchcraft

2026-07-29 11:19:37 UTC

- reply

I'm starting to think he doesent believe the BS he spouts

2026-07-28 21:51:17 UTC

- reply

yes 🐍