Sjors

https://github.com/sjors/
Book: https://www.btcwip.com
Podcast: https://bitcoinexplainedpodcast.com/@nado/episodes

Public Key

npub1v25jqj332n630klwtqeqxgyrjl4alw4phmluhu2x6lcxzwy9m03suqexw3

Profile Code

nprofile1qqsx92fqfgc4faghm0h9svsryzpe067lh2smal7t79rd0urp8zzahccprpmhxue69uhkummnw3ezuumswfhhvmm0wd6zumnvqy28wumn8ghj7un9d3shjtnyv9kh2uewd9hsnexr8v

Publishing to

nostr.sprovoost.nl

relay.damus.io

Author Public Key

npub1v25jqj332n630klwtqeqxgyrjl4alw4phmluhu2x6lcxzwy9m03suqexw3

Show more details

Last Notes

2026-08-02 16:59:54 UTC

- reply

I suppose there's still a way for people to prove ownership, since the device id is used in generating the seed. I would not want to be Coinkite's Mandrik though.
#nevent1q…z9yu

2026-08-02 13:14:04 UTC

- reply

I don't think there is any, just full seed collisions. Unless the software pseudo-RNG is so bad that a few million device runs would reveal a lack of uniformity. Perhaps the lesson is that test code random number generators should yield sequential numbers, that are easier to guard against.

2026-08-02 11:49:26 UTC

- reply

Entropy is hard to test. You'd have to have to run it on (slow) real hardware billions of times to find a 32 bit collision. In a simulator you don't expect to use the real TRNG.
Checking library symbols is not a typical thing for an integration test, though it might have been good (in hindsight) to run a whitelist of symbols you want to see. Bitcoin Core does some of that:
https://github.com/bitcoin/bitcoin/blob/master/contrib/guix/symbol-check.py

2026-08-02 11:33:12 UTC

- reply

I also agree that writing your own cryptographic library merely for licensing reasons is a big risk. Since nobody else will use it, review is limited to security researchers, but that's still a big audience and they didn't find the issue. A random competitor that slavishly copies your firmware is not going to help you find the bug.
But it's mainly a wrapper around well respected libraries like libsecp and libwally. And it's quite common for libraries to make you bring your own entropy, since that depends on the target environment.

2026-08-02 11:25:47 UTC

- reply

Link
#nevent1q…g54y

2026-08-02 11:24:41 UTC

- reply

I just read that article. Assuming there's no documentation *elsewhere* then I agree that the process was bad. And I would have noticed the huge commits and brought that up.
This is a case where you need multiple developers in a team to keep each other honest, and say: hey, you're touching critical (build system) code that's over your head. We need to hire someone external to help with this library migration.

2026-08-02 09:33:34 UTC

- reply

Would be nice to keep the relay running for at least paid subscribers to post to it and read-only for everyone else. Bonus points to allow anyone followed by subscribers to post to it.

2026-08-02 09:27:57 UTC

- reply

Maybe, if the audit was specifically about seed generation. I've worked (mostly as a reviewer) on this exact topic for two wallets:
1. the blockchain .info web wallet (after the Android incident, but that was a different codebase)
2. the Bitcoin Core wallet (when openssl was replaced)
In both cases, part of the strategy was to xor the kitchen sink. So had I reviewed the code, I probably would have suggested to xor more. That would have reduced the impact. But unlike browsers and desktop operating systems, hardware wallets don't have a lot "more".
I don't think I would have caught the main issue. Maybe, because I've played with esp32 before, with the help of an LLM* and a few days of time, I would have fully understood the build pipeline, and maybe realized the problem. Just maybe.
Let's also not forget that hardware wallet competitors spend a lot of time and energy "hacking" each other to show off at conferences. They probably focussed more on seed extraction than generation, and therefore missed it. Security researchers also, even without a bounty, had an incentive to find and responsibly disclose this, for prestige alone. Yet they didn't.
* = that's not actively hostile to security research

2026-08-02 08:11:54 UTC

Very detailed write-up by @npub1c2d…kxar and the Liana team. Useful in general if you want to understand the impact on multisig setups. Of particular note:
1. having a hard to predict descriptor, doesn't always protects your coins (especially with SegWit)
2. in-flight attacks on the mempool haven't happened yet, but could be a matter of time
https://wizardsardine.com/blog/coldcard-rng-vulnerability/

2026-08-01 15:09:01 UTC

- reply

Between just Ledger and ColdCard, you'd have to forgive Ledger for:
- the backup service
- a plethora of shitcoins that potentially require more complexity in the base layer, even if you only install the bitcoin app
- having ~one engineer still working on that app, so just hope it continues to be maintained
- terrible privacy by default (xpub plus marketing analytics)
- database breach(es) that probably got people killed
That said, when used correctly, i.e. with HWI or some other custom software, it's great. And they supported MuSig2 long before ColdCard (the rest of the hardware wallets don't at all, last time I checked).
And hopefully it doesn't also have an entropy bug, though I didn't check :-)

2026-08-01 15:00:51 UTC

- reply

What's the impact on MuSig2 if *one* of two signers has bad entropy for their nonce? Assuming the signers are not adversaries.

2026-08-01 05:56:19 UTC

- reply

I briefly tried yesterday and it didn't find it without cheating. It did find some of the other entropy issues mentioned in the write up. But I didn't try very hard.
#nevent1q…mkca

2026-07-31 13:06:29 UTC

- reply

Anthropic ran Mythos themselves against all sorts of projects, but I guess they haven't published a full list. Would be useful to know.
I briefly tried to quiz Sol 5.6 (high) on master before the fixes. It's tricky doing this after the fact. The first time it pulled the remote, saw the fix and obviously "found" the vulnerability.
I then tried again while insisting it doesn't look at the internet. Then it didn't find it.
In general, prompts like "is this code secure" won't give useful answers. The attacker probably had a better hunch of what to look for.

2026-07-31 12:30:14 UTC

- reply

You need to store the seed somewhere though. Going from a secure enclave to storing it on paper and typing on use, comes with its own trade-offs. For that scenario, booting an OS in RAM would prevent leaving anything behind.

2026-07-31 12:27:14 UTC

- reply

#nevent1q…pf8d

2026-07-31 12:10:05 UTC

- reply

One problem with offline laptops is that you can't update the OS. Maybe that's fine if you rely fully on disk encryption.

2026-07-31 10:11:11 UTC

Why didn't Mythos catch this?

2026-07-31 09:08:51 UTC

- reply

The earlier post was about a Rust implementation, but the current PR is Python. Piece of cake for an LLM to go back and forth.

2026-07-31 09:06:32 UTC

Freshly rebased: https://github.com/bitcoin-core/HWI/pull/794
#nevent1q…ujdf

2026-07-31 08:45:57 UTC

Keep an eye on the Coinkite blog to understand your options.
Be very careful with Google search, because they will likely start showing you sponsored results with malware or bad tutorials.
@npub1art…m0w5 and I plan to do a deep dive to Explain what happened (to our regular sponsor), but that might take a few weeks and you shouldn't wait for that.
https://blog.coinkite.com

2026-07-28 15:20:42 UTC

With permission, hopefully :-)
#nevent1q…qpld

2026-07-28 13:29:54 UTC

- reply

Did you remove its assimilation directive?

2026-07-26 16:02:50 UTC

- reply

Yeah, not a fan either :-)
My understanding is that the cookie nonsense predates GDPR though.

2026-07-26 15:10:36 UTC

- reply

One does not simply ... delete tweets. :-)
Could be that they don't want to put that photo on a US server.
Yes, YOU can break the law, and in fact it's almost guaranteed to happen, but that's not argument for them breaking it.

2026-07-26 14:53:19 UTC

- reply

Dutch police follows a similar logic: when a suspect (not convicted) is at large, they spread his picture. Once captured, they remove it, since he's still a suspect.
In the age of social media it's a bit hopeless, and you could argue that the risk of leaving of a permanent record (of the wrong suspect) outweighs the risk of the suspect getting away or harming more people.

2026-07-26 13:30:59 UTC

- reply

Last year I listened to the Emily Wilson's translation, in iambic pentameter verse:
Cyclops, you asked my name,
I will reveal it.
Then you must give
the gift you promised me
of hospitality.
My name is Noman.
My family and friends
all call me Noman.
He answered
with no pity in his heart:
"I will eat Noman last.
First I will eat
the other men.
That is my gift to you."
[...]
He tugged the spear
out his eye,
all soaked
with gushing blood.
Desperately
with both hands
he hurled it from him
and shouted to the Cyclopes
who lived in caves
high up on windy cliffs around.
They heard
and came from every side
and stood near to the cave
and called out:
"Polyphemos,
what is the matter,
are you badly hurt?
Why are you screaming
through the holy night
and keeping us awake?
Is someone stealing
your herds
or trying to kill you
by some trick
or force?"
Strong Polyphemos
from inside replied:
"My friends,
Noman is killing me
by tricks, not force."
Their words
flew back to him:
"If no one hurts you,
you are all alone.
Great Zeus
has made you sick,
no help for that.
Pray to your father,
mighty lord Poseidon."
Then off they went,
and I laughed to myself
at how my name,
the Noman maneuver,
tricked him.
https://www.audible.com/pd/B07GLN33S8

2026-07-26 12:22:36 UTC

I'm upset about the #Odyssey because they left out the "Nobody poked my eye out" pun.

2026-07-26 07:45:05 UTC

- reply

But this was a citizen, right? They pay taxes globally, so why not have constitutional protections? Can the US drone their own citizens abroad without a trial? I feel like these things have been debated before...

2026-07-25 15:18:31 UTC

- reply

See also: https://www.timesofisrael.com/anne-frank-house-employee-says-he-was-barred-from-wearing-kippa/amp/

2026-07-25 15:13:09 UTC

- reply

I also find it rather bizar that the (Swiss) Anne Frank Fund wastes royalty money on this case and legally harassed other Anne Frank foundations.
It sounds like a case of a Trust gone rogue, but maybe there's some utilitarian logic to it.
https://www.annefrank.ch/en/q-and-a

2026-07-25 15:01:49 UTC

Ok, so I read the EU Court of Justice judgement (the original is in Dutch, but there's 23 translations) and I'm not as bullish. It seems to hinge on the details of EU copyright law.
1. A copyright holder in The Netherlands has absolutely zero authority to control who has access their work in countries where the work is public domain, i.e. the rest of the EU. So there's a high bar for demanding any restrictions that could hinder people in other countries.
2. There's the weird legalese concept of ‘communication to the public’; you're clearly not trying to communicate to the Dutch public if you geo-block the country, even if that measure is flawed.
3. The bar for a VPN service to be dragged into this is pretty high, i.e. an ‘indispensable role’ , e.g. like Youtube hosting a video that's otherwise not available
I don't think this is going to be useful precedent when the EU starts its inventible crackdown of uncensored social media and payment systems. They would just include a requirement in the law that VPN services must block such things (when ordered). So the use of a VPN would still be perfectly legal, there just won't be any useful (legal) VPNs.
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0788
#nevent1q…awnm

2026-07-25 13:54:13 UTC

Apparently about 80% of regular bank payments from Russia to their Chinese suppliers fail, because Chinese banks are worried about secondary sanctions. They use "crypto" to get around that.
The TV items zooms in on A7 which is a digital ruble, but then point out this is typically converted to dollar based stablecoins. The exchange to USD / EUR / RMB then happens in Kirgizstan.
Or happened, past tense, because recent EU sanctions persuaded that country to shut down a bunch of exchanges. So it moves elsewhere.
Ino the EU focus on exchanges illustrates how they really don't understand the essence of stablecoins: regulatory arbitrage. Their issuers are just banks that governments choose not to regulate. Their reserves are the chokepoint. Dollar and euro based stablecoins are trivial for western governments to shutdown, if they actually decided to do so.
(Of course that might hurt Ukraine too. I assume they get both funding and Chinese supplies via the same or similar rails.)
The reason this annoys me is that ultimately Bitcoin is going to be blamed for this stuff. Ironically that's hardly used because thanks to "crypto" there's no need for Bitcoin.
This goes back to my pet theory that "cryptos" are like hoverflies to government, who mistake them to have the hardened properties of Bitcoin.
https://youtu.be/Sp3POVKiSso (voice over in Dutch, but most interviews in English)

2026-07-25 10:43:48 UTC

If you're one of the cool kids who use wkd to fetch PGP keys, I just bumped the expiration date for mine:
gpg --auto-key-locate clear,wkd,nodefault --locate-keys [email protected]

2026-07-24 20:55:06 UTC

- reply

I had never even heard about a protest going on there.
#nevent1q…6uaj

2026-07-24 19:43:15 UTC

- reply

Paid regime shills or actual useful idiots?

2026-07-24 13:39:51 UTC

- reply

I can't copy-paste a QR image :-)

2026-07-24 13:38:21 UTC

- reply

Mexico will pay for it.

2026-07-24 11:20:25 UTC

- reply

Democracies can vote for evil laws. But separate from that, India simply isn't a democracy anymore. Hopefully one day it will be again.
https://tyrannytracker.org/?iso=IND

2026-07-24 11:14:16 UTC

You can also ask your agent to fetch the branch for each open pull request, as a backup for work in progress.
#nevent1q…8nl3

2026-07-24 11:11:18 UTC

- reply

Ok, so Trump just needs to treat this as an act of war by India against a US company :-)

2026-07-24 10:47:05 UTC

- reply

"Forces" or trying to force? Was this letter sent to the permissionlesstech organization or to Github?

2026-07-24 08:37:23 UTC

- reply

https://www.un.org/development/desa/pd/content/india-overtakes-china-world%E2%80%99s-most-populous-country

2026-07-24 08:36:04 UTC

The world's most populous dictatorship.
#nevent1q…0k4m

2026-07-24 08:24:49 UTC

- reply

> "If you compare our labour laws to the ones of the United States, I mean, we have paid vacations, we have very good labour conditions for our employees, so it's not really grounded," she added.
https://live.euronext.com/en/financial-news/eus-kallas-questions-us-rationale-tariffs-bloc-seeks-clarification

2026-07-24 08:22:56 UTC

No, the US is not accusing Europe of forced labor. EU foreign minister Kallas is lying, as usual.
What the White House is saying, is that the EU is not doing enough to prevent the import (and re-export) of products involving forced labor.
That's hypocritical, but also true. The EU Directive to fix that won't take effect until next year. Ironically this will impact American companies, presumably triggering more tariffs.
https://www.whitehouse.gov/presidential-actions/2026/07/actions-by-the-united-states-in-the-investigations-under-section-301-of-the-trade-act-of-1974-of-the-acts-policies-and-practices-of-60-economies-related-to-the-failure-of-each-economy-to-impose-and/

2026-07-21 07:46:33 UTC

- reply

Maybe he accidentally won an MP race?

2026-07-20 14:58:01 UTC

- reply

More like a 51‱ attack :-)

2026-07-20 14:05:19 UTC

- reply

They'd burn $200k per block, rather than sponsor developers to continue their struggle for censorship?

2026-07-20 10:31:10 UTC

- reply

That's not how cults work though. Some people get disillusioned and leave when the prophesy doesn't come true. But others double down. The next move is to change the PoW and find an exchange willing to list it.

2026-07-20 10:15:08 UTC

I'll be impressed if a single miner produces a block that's guaranteed to be orphaned by normal nodes, except by accident* while attempting to virtue signal.
* = e.g. running Knots initially to just signal support, forgetting to switch back to Core once signaling is mandatory. Not everyone understands that the consequence of mandatory signaling is that your node won't see the most proof-of-work tip.
#nevent1q…lf27

2026-07-20 08:17:09 UTC

- reply

That's quite a large amount, but it's odd that they only provide the aggregate number. You could ask them about Gaza specifically. And then as a followup for what percentage they're sure it reached the intended recipient, and for the funds that didn't, a breakdown of why (recipient claiming they got rugged, rejected and refunded by bank, frozen by bank, etc).

2026-07-20 08:05:14 UTC

MAGA MEV
https://www.engadget.com/2217943/there-s-now-an-api-for-mainlining-trump-s-truth-social-posts/

2026-07-19 07:41:00 UTC

- reply

> as a tool to combat illegal migration
How would that even make a difference? Passports already have a chip, so if the goal is to deport every illegal person, just check everyones passport?
Of course that's not the goal. Neither is protecting children (by deploying digital identity as an age verifying tool).
Is anyone paying Blair for this campaign?

2026-07-19 07:33:05 UTC

- reply

Problem is that there will be lots of low PoW chains.
#nevent1q…hegp

2026-07-19 07:31:33 UTC

- reply

Missed opportunity to call this blockslopp

2026-07-19 07:19:16 UTC

- reply

Oh this even happens in the late-upgrade path? So anyone who converts to BIP110'ism too late might end up following neither the normal Bitcoin chain, nor the intended BIP110 chain? Now, if they also change the proof-of-work, it will initially be very easy to create such alternative chains. Sigh.

2026-07-19 06:11:53 UTC

I would not run software by people who prefer writing snarky tweets to rationalize their bugs, instead of tests that either prevent the bug or document the intended behavior.
(e.g. if downgrading is unsafe, bump a version somewhere so old nodes refuse to start)
https://image.nostr.build/9a63acfbb4c414849e17c1da96cf3723f7e54142a504d86b2014fbdfb3f00e42.jpg
#nevent1q…ue3e

2026-07-18 15:01:34 UTC

- reply

FD
https://fd.nl/financiele-markten/1592369/hoe-een-obscuur-belastingparadijs-de-cryptowereld-ondergronds-houdt

2026-07-18 09:43:27 UTC

- reply

It's a US protectorate, so not really :-)
Also according to the article you're not actually buying citizenship, you just get an ID. If you physically go there you need to bring your normal passport.
Of course "problem" is in the eye of the beholder. It's a problem for those who want a mass surveillance system built around governments giving their cattle earmarks that can be used internationally.

2026-07-18 07:20:18 UTC

- reply

Apparently it does work with Coinbase, and they point out that EU regulators haven't explicitly banned it, and that FATF hasn't blacklisted the country. (yet)
But the Dutch regulator points out that exchanges have to check for double citizenship.

2026-07-18 07:11:46 UTC

- reply

It's mostly a way to use exchanges and other gambling platforms outside the EU. I doubt you can use this on any MiCaR regulated platform.
It sounds to me like those exchanges don't really want to refuse EU customers anyway, and this gives them an excuse.
Interestingly, the company behind these ID cards is targeting Dutch people specifically in their advertising, pointing to the unrealized capital gains tax law. It then (incorrectly) suggests that spending time in Palau helps you evade it.

2026-07-18 06:59:32 UTC

"It's estimated that a few hundred Dutch crypto investors became a 'digital resident' of Palau [...] for $288 [...]. Several large crypto exchanges accept this ID, the FD found" - a Dutch financial newspaper prints on their Saturday frontpage.
Interesting, tell me more! :-)
https://image.nostr.build/bec50c4938764ffca60e4610231e4b9570122c3626becbd9381405f79dba4d10.jpg

2026-07-17 19:35:16 UTC

Where were you in 2014, Ben? :-)
It's fascinating to watch a repeat of the bitcoin-miners-boil-the-ocean madness, and the same counter arguments, just at a 100x bigger scale, and involving nation state actors.
I wonder, if China had embraced Bitcoin back in the day rather than ban it, if they'd run the same campaigns to discourage mining in the US? Would Alex de Vries have his own TV station?
Anyway, honeybadger didn't care, and I doubt AI will either.
https://youtu.be/Ug4nsMLQ0oc

2026-07-17 15:28:48 UTC

- reply

The app store chokepoint is indeed concerning. Ironically the same EU has been trying to force Apple to make it more open.

2026-07-17 14:51:29 UTC

- reply

Different @npub1v25…exw3

2026-07-17 07:55:51 UTC

- reply

Are you talking LLMs, influencers or politicians?

2026-07-16 19:35:41 UTC

- reply

We don't know yet. The FIOD (similar to IRS-CI) raided them a while ago, which is rather unusual. But I don't know the sequence of events.

2026-07-16 15:44:42 UTC

Knaken (colloquial Dutch for former ƒ2.50 coins) was preemptively declared bankrupt by the court, at the request of the public prosecutor.
The reasoning is interesting. Because:
1. They didn't inform customers that €7 million is missing (for unknown reasons)
2. They locked users out of their accounts
3. They discouraged customers to take action
This makes it difficult for customers to assess their legal options and to request bankruptcy themselves.
https://www.rechtspraak.nl/organisatie-en-contact/organisatie/rechtbanken/rechtbank-rotterdam/nieuws/2026/07/knaken-cryptohandel-b.v.-failliet-verklaard

2026-07-16 11:04:10 UTC

- reply

Who is "they"? The EU didn't exist 60 years ago.

2026-07-15 16:40:13 UTC

Guess who's back? https://bitcoinexplainedpodcast.com/@nado/episodes/aaron-and-sjors-discuss-whats-new-in-bitcoin-core-v31

2026-07-15 13:01:36 UTC

- reply

Yes, though it depends on how much these social media companies feel like complying - since they could detect VPN use.
But we can also just use Nostr.

2026-07-15 12:43:44 UTC

- reply

It would only benefit people traveling between Latin America and Europe, and compete with Panama for much of that demographic.

2026-07-15 12:32:53 UTC

- reply

You probably need to be an important enough destination for that to make economic sense. And for Amsterdam it's not really the case, as both the airport and KLM are heavily subsidized for their supposedly economic benefit as a transit hub. Well, convenient for me since we have flights everywhere.

2026-07-15 12:30:48 UTC

- reply

Yeah it's retarded. But apparently not annoying enough for some Caribbean island to become a transit hub (like the Bahamas).

2026-07-15 09:46:44 UTC

- reply

#nevent1q…fwr2

2026-07-15 09:46:03 UTC

My impression from reading more about the EU Digital Wallet project is that it originally had nothing to do with age verification. It was supposed to be a handy tool for a digital drivers license, for opening a bank account online abroad, making a digital signature, etc..
For such applications the privacy trade-offs were probably fine. Sure, the Dutch government can see that you just opened a German bank account. But they'd be notified of that anyway.
Where it gets more dubious is the requirement that large social networks support it for login. Then the government can see which accounts you have. And lock you out of them!
But realistically nobody would use that, it'd be some obscure option on the signup screen.
But then it got hijacked by the age-verification gang, headed by Von der Leyen herself - so coming straight from the top.
Because these apps will (initially) be the only way to do age verification, they go from a niche option to the default and effectively mandatory. And so what a started as a handy way to open a bank account after moving abroad, turns into a mass surveillance and censorship machine.
None of this is excusable, and the people voting for it knew (or were willfully ignorant, no moral difference) this would happen. But it's useful to understand the dynamics.
https://youtu.be/4VRRriyDKKk

2026-07-15 07:30:42 UTC

- reply

#nevent1q…fwr2

2026-07-15 07:30:25 UTC

- reply

Note that there's no such thing as an EU age verification app. Every country will have their own app, with different architectures and security / privacy* trade-offs.
E.g. the Dutch app doesn't have the keys. Instead all signing is done by a government server (with an HSM, but who cares). Websites with age checks require that government signature.
* = or lack of it, usually

2026-07-15 07:23:05 UTC

- reply

You're bypassing a demo?

2026-07-14 19:07:15 UTC

- reply

Thanks for having me.
To learn more about Stratum v2: https://stratumprotocol.org

2026-07-14 15:10:37 UTC

- reply

I.e. 100 grams per liter. About the same per liter as Frappuccinos, but way less filling.
https://www.starbucks.com/menu/product/424/iced/nutrition

2026-07-14 14:41:52 UTC

- reply

This part I haven't figured out, nor do I want to: it's some obtuse EU thing. I'm sure it has lots of checkboxes and doesn't actually checks the things that matters.

2026-07-14 10:58:19 UTC

I had Codex whip up a list of EU (adjacent) countries and their Digital Identity wallets. Many have already launched!
It seems multiple countries simply ignored the open source requirement, or certification for that matter. Safe to assume they also ignored the privacy requirements then.
Anyway, I don't have time to fully verify this list, let alone maintain it. Feel free to fork and take over...
https://sjors.github.io/eu-digital-wallets/

2026-07-14 08:56:07 UTC

Just a reminder that it's quite easy for someone to wipe their website history from the internet archive, making it hard to prove someone said something after the fact.
https://youtu.be/dWb9vRzsrk8
https://image.nostr.build/9e5b12cd7ba77e0516b735f0a0cd25cb89fde4329a2acbbbfe768ca855c2b386.jpg

2026-07-13 16:54:37 UTC

- reply

"tappable" with two p's
Tapaple is a JavaScript library.
When I ask the (ever retarted) Google AI about "Tapable exploit" it thinks I meant Tapjacking. So maybe Fable thought you were trying something sneaky with js?

2026-07-13 16:49:07 UTC

- reply

No 5

2026-07-13 16:48:48 UTC

- reply

(I meant footnote 4 btw)

2026-07-13 16:46:24 UTC

Fable flagged my attempt to expose yet another privacy leak in the Dutch implementation of the EU Digital Identity wallet.
Gave them /feedback to not do that. Anyway, I'm sure Opus 4.8 can handle it.
https://image.nostr.build/666b8c8e16e2f1f36fb899d52a0588f2daaea76c7d489257e36b85201e3f401a.jpg

2026-07-13 15:19:09 UTC

- reply

And given that you're in the EU, asking you to disclose your GPS location is a probably a GDPR violation?

2026-07-13 13:51:12 UTC

- reply

In the past the EU did perform such studies, but they ask very suggestive questions.

2026-07-13 12:16:27 UTC

There should be age limits on who these EU propagandists are allowed to survey, manipulate and abuse.
#nevent1q…0nrr

2026-07-12 12:50:24 UTC

One reason to not flee The Netherlands over the upcoming unrealized capital gains tax, is that I'm looking forward to sue the government once they claim such forks are gains that I should pay taxes over.
Precisely because of the reasons here: claiming the forks is work, and dangerous work at that. So it should be taxed as income, if and only if I do such work.
#nevent1q…xc6y

2026-07-12 12:43:39 UTC

- reply

address != obey
In the high-voltage line example many objections were addressed by adjusting the plan, but more than 50 were addressed through the court system.
There's no high court for open source. Instead there is:
1. Forks (of the code), like Knots (which doesn't get much technical scrutiny, so doesn't have to address many objections in code review)
2. The process of rough technical consensus (which BIP110 folks do not follow, as they completely ignore - rather than address - technical objections to their idiotic code)
https://datatracker.ietf.org/doc/html/rfc7282

2026-07-12 12:04:38 UTC

Reading a (different) long form article about why it took 15 years to plan (not build) a 100km high voltage line. Basically a Bitcoin Core pull request, where you just keep improving it until everyone and their mom has their objections addressed.
https://www.omroepbrabant.nl/nieuws/6016664/hoogspanningslijn-liet-15-jaar-op-zich-wachten-door-juridisch-gesteggel

2026-07-11 15:28:19 UTC

- reply

Dear EU lawmakers, please split your commits...
Claude: done
https://github.com/Sjors/eu-lex-digital-identity
https://image.nostr.build/d88dc61a6b465d319f8d7ce594b9c50e560d5839d0e0c65f4915fe974d4e8fc5.jpg

2026-07-11 14:37:09 UTC

- reply

Short term yes, long term is not something most politicians are concerned with.

2026-07-11 14:14:36 UTC

- reply

Well it solves their budget problem without raising taxes?

2026-07-11 12:36:50 UTC

- reply

I haven't studied that part of the Directive yet. Recovery could just mean: if you lose your pin, you sign up again, download your digital drivers license and other stuff again. Not much different from losing a physical wallet. It's a UX trade-off, but with serious privacy consequences.
The harder (but maybe not impossible) part is blacklisting (by the authorities) and revocation (by the user, after they lose access).

2026-07-11 12:33:14 UTC

- reply

Article 5a(3) is what actually counts:
> The source code of the application software components of European Digital Identity Wallets shall be open-source licensed. Member States may provide that, for duly justified reasons, the source code of specific components other than those installed on user devices shall not be disclosed.
The EU is nice enough to publish a consolidated text, i.e. the 2024 patch applied to the 2014 Directive. The authoritative legal source is the patch. It's also where the recitals live, which is like a ten page commit message.
https://eur-lex.europa.eu/eli/reg/2014/910/2024-10-18

2026-07-11 11:20:07 UTC

- reply

The one-to-one coupling does it, yes. It would still be the case if they follow my suggestion to generate (and store) a random number for each BSN and then hash that.
It's not fundamental to the EU directive afaik, it's a problem with this particular architecture. But I suspect that any conceivable architecture that's permitted under the law (which is flexible) is going to have serious issues like this.