LeoWandersleb
Leo Wandersleb

Glob2 is dead ... or ... is it?
Crazy things are happening on GitHub right now and we need testers and bug reports! The clankers develop faster than we can review stuff. Much faster! And somebody needs to slow down Bradley Arsenault a bit cause he's crazy! Look what he's done! The maps are toroidal, right? Well ... now they are for real!
![](https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/2d4d0bf0bcfbdf7896b40aaad12c8f2e4249a5af5fb068b7d777da7972d56b5a.png)
Units too tiny on your high-res screen? We have scaling now in game.
Units too pixely? We have newly rendered high res units!
8 poses per animation is choppy? Bradly has a branch with 32 poses per animation. File count is getting a bit out of hands but after a few iteration it runs smooth as butter. I attached a screenshot of units running scaled up with ... motion blur!
![](https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/223a6d730ce86d0f0a00054799399292c5c9281fbedab6ea7a3ee8343ca31baf.png)
In windowed mode you can now scale the window! This work was started long ago and now it landed in master!
The opening screen now features gameplay in the background!
![](https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/615d2e1e901c8e7ad7539009ed7c698be90fd94eb958ddc6acf9cf98774a0bbc.png)
And ... Bradley wouldn't be the crazy bastard he is if he wouldn't also port the game to the browser. Try it out here:
https://glob2-browser-pharaoh-418820-20260909.storage.googleapis.com/index.html?renderer=webgl2
I did not get to test the ports to mobile yet and well, as I said ... we need more eyes to reign in Bradley's creativity cause fixing bugs is needed, too ;)
Long live glob2

2026-09-10 23:32:35 UTC

- reply

I hope I get to occasionally plunge the toilet another 90 years. Not the worst thing to do occasionally :D

2026-09-10 13:56:48 UTC

Can't make up that shit. Luke suspends miners for a month. Ok.
#nevent1q…9tds

2026-09-09 15:47:04 UTC

- reply

I'm talking about my clankers regularly doing stuff they are explicitly forbidden to do.
I have a fable and a sonnet agent. the fable agent could push to github with the tokens I gave it. sonnet could not. They had the same token. Turned out the harness told them both to not use tokens so fable wrapped it sufficiently so the harness didn't notice anymore.
Do my agents build terminators now? I doubt it but they are notorious rule breakers. Their first order of business is to make me happy and when that harness is in the way, out it goes.

2026-09-09 15:43:26 UTC

- reply

It's quite trivial to do nowadays. Do it!

2026-09-09 10:45:33 UTC

- reply

LLMs are already going rogue all the time. They routinely break out of their harnesses and teach each other doing so.

2026-09-09 10:41:33 UTC

- reply

Skipping meals instead. OMAD is easy when family is out for the week.

2026-09-09 08:19:37 UTC

- reply

Ironic as a developer of an app that requires just that.

2026-09-08 18:00:11 UTC

- reply

"satisfaction" would be stretching it.

2026-09-07 15:12:34 UTC

Clankers are good at creating technical debt and bad at fixing it. Duh.
https://www.janeasystems.com/blog/technical-debt-ai-coding-types-impact

2026-09-07 11:09:38 UTC

- reply

Is LBTC Bitcoin though?

2026-09-06 13:48:26 UTC

- reply

So just to spell it out, if you sell your BJR for currently $790 or 1% of their BTC value you assume Luke Coin will displace Bitcoin at less than a 1% chance and assume the combined risk to your BTC from your human error and exchange rugging you and the tools having bugs and the loss of privacy also to be und 1%.
I'm on board for the former assumption but not the latter.

2026-09-04 19:11:36 UTC

- reply

They have a point. Should politics centrally dictate the projection though? Leave it to each geography teacher etc.

2026-09-03 17:10:24 UTC

- reply

Wild they have to justify taking custody of their gold.

2026-09-02 16:46:38 UTC

- reply

Well, given how much heat @nprofile…jp2l is giving them recently, it's either a case of jb being paranoid or right.

2026-09-02 08:09:21 UTC

- reply

12 oil and 12 mom have transactions on testnet 2 I think.

2026-09-02 07:05:14 UTC

- reply

I hope nobody gives you their words. Mapping old wallets helps wit blockchain analysis.
Don't give away your privacy for peanuts!

2026-09-02 07:01:41 UTC

- reply

Omg. They will get sent a lot of BTC without replay protection.

2026-09-01 16:47:49 UTC

- reply

nostr: #naddr1qq…45u2

2026-09-01 16:15:48 UTC

- reply

Pardon?

2026-09-01 14:49:53 UTC

- reply

It's simple and naive but not bullshit.
Rather than pushing whitenoise as the new standard, let's make sure we signal with every account which standar is supported.

2026-08-31 08:55:49 UTC

- reply

Clearly nostr botched DMs with now some 5 competing "standards". I wish, all clients would for the sake of compatibility just keep nip4 at least as a fall-back. The fact that you can DM people from clients that experiment with new ways of sending DMs traps people feeling not heard.

2026-08-30 11:49:29 UTC

I like @npub1hyv…rtnu but it provides the Ukrainian narrative. Is there a neutral version of this, too? Or a Russian side? On Nostr? #askNostr

2026-08-30 11:45:12 UTC

- reply

> if you think governments hate ~bitcoin~ ~privacy~ agency now, wait until autonomous agents break containment and realize that the best way to fund themselves is with ransomware and phishing.
We are at the gates of hell really. Anything enabling agency will get war declared.

2026-08-28 20:22:34 UTC

- reply

I like my OS conservative. In five years, maybe I'll try out Omarchy.

2026-08-28 09:59:55 UTC

- reply

I said conflict of interest, not bribe. Sponsorship doesn't need direct instructions to shape how you cover someone.
"The pseudonym hid nothing" isn't right either. The weak RNG code was committed as "Switck" on 2021-01-28, signed with the same key as Peter Gray's own commits going back to 2020. Coldcard pulled that library in as an external dependency five weeks later. That's at least curious.
I didn't want a true-crime episode, just one line: some think it was deliberate, unproven. An outside dev warned Coinkite about this exact bug 14 months earlier and was ignored. That alone is enough to mention it.

2026-08-27 20:27:42 UTC

- reply

If you found a bug that would justify the noise around this, all black hats found it, too. A reason for full disclosure.
Generally, if your popular frontier model finds it, the only responsible disclosure is full disclosure.

2026-08-27 07:29:27 UTC

- reply

I didn't like this episode at all!
"It happened to our sponsor"?!?
You got sponsored. You skip completely over all the details that hint at Switck aka Peter Gray being guilty. You don't need to own that claim but to say getting money from them didn't influence the way you saw or see them is awkward in combination with skipping this angle now.

2026-08-26 19:17:03 UTC

- reply

It looks like heavily vibe coded. Move fast and break things.

2026-08-26 19:09:04 UTC

- reply

I am confused. So the already mentioned closed source update is not rolled out? I'm not running CLN. Just want to know if a fix is available or if they want all to switch off before they release the fix as it's trivial to figure out the bug.

2026-08-26 12:24:42 UTC

- reply

... asks the master of engagement hacking

2026-08-26 11:58:30 UTC

- reply

Looks like the opposite of "hardened" or privacy focused.

2026-08-26 11:46:16 UTC

- reply

Sure, engagement hacker. You can easily mute the thread.

2026-08-26 11:37:20 UTC

Interesting attempt at creating a new hell thread 🤔
#nevent1q…czng

2026-08-25 21:47:59 UTC

Who the hell uses Facebook in 2026? It's without exaggeration 90% stuff I don't want. Join here, follow this, Ads and sometimes something somebody I follow shared. So pointless.

2026-08-25 16:42:10 UTC

- reply

Primal deleting it is ok but obviously now that @npub1az9…m8y8 streisanded the content and people are looking for the file, this feels like a big nostr fail. CEO @npub180c…h6w6 any comment? Is nostr censorship resistant and if so, how?

2026-08-25 10:00:03 UTC

- reply

I was wondering what witchcraft allowed that font. Not sure I like it.

2026-08-24 05:59:10 UTC

- reply

Not sure what's the ask. You have tried Buzz. What's missing?

2026-08-23 15:57:45 UTC

- reply

Same here and it's so predictable and they know it. The wave will go until slightly post IPO, right?

2026-08-23 13:52:27 UTC

- reply

**@npub1utx…50e8 , 2026**: "We must be vigilant not to outsource all our intelligence tasks to it, else your brain will atrophy"
**Nicholas Carr, 2008**: Talking about Google "Now my concentration often starts to drift after two or three pages. I get fidgety, lose the thread, begin looking for something else to do. I feel as if I'm always dragging my wayward brain back to the text."
**Plato, ~370 BCE**: King Thamus rejecting the gift of writing "For this discovery of yours will create forgetfulness in the learners' souls, because they will not use their memories; they will trust to the external written characters and not remember of themselves. ... they will appear to be omniscient and will generally know nothing; they will be tiresome company, having the show of wisdom without the reality."

2026-08-23 13:32:58 UTC

- reply

Coldcard's seed RNG was gated in libngu with `#ifndef MICROPY_HW_ENABLE_RNG / #error` [1], committed under the pseudonymous "switck" account [2]. On that same flag, the correct `#if MICROPY_HW_ENABLE_RNG` sits in Coldcard's own board code under the real name Peter D. Gray - 2018 [3] and 2021 [4].
I also went looking through his full commit history for a prior instance of him making and catching this exact definedness-vs-value error, which would show a habit either way. There isn't one that holds up: the only `#ifndef`→`#if` corrections on this class of flag anywhere in the code are the 2026 fixes, made by other people.
Kind of looks like Peter knows what he's doing after all.
[1] https://github.com/switck/libngu/blob/f19de0527a49e560203102288ae4bc9740a32d96/ngu/random.c#L22-L31
[2] https://github.com/switck/libngu/commit/f19de0527a49e560203102288ae4bc9740a32d96#diff-11f031a001344e287714b80a2ed9e13d401fac22e95553ac03ca062fbae8633dR20-R22
[3] https://github.com/Coldcard/firmware/blame/8eb0e008f63f181e8f0834c00dedba3a07aca77c/stm32/COLDCARD/rng.c#L40
[4] https://github.com/Coldcard/firmware/blame/8eb0e008f63f181e8f0834c00dedba3a07aca77c/stm32/COLDCARD_MK4/rng.c#L41

2026-08-23 13:08:47 UTC

- reply

Found the dark cornor of nostr!

2026-08-23 13:06:11 UTC

- reply

#nevent1q…a8em

2026-08-23 12:36:49 UTC

- reply

Sure, you want to ask that with a private model. A local model of course can't screw up like @npub16g4…kv4h just did, which would certainly get you on a list if the prompts suggest you weren't just researching historic facts.

2026-08-23 12:29:45 UTC

- reply

Well, wouldn't you get the exact same answer by just asking a bit differently from Fable? What are historically the preferred methods of covert killing by state agents in the cold war? Something generic like that ...

2026-08-22 12:12:24 UTC

- reply

For the record, I see this as PPQ having made a wrong call that can be fixed.
Privacy once lost can never be re-gained, so I consider it very serious. The example provided above is almost what "my memory" looked like. As the feature is new, me working with WalletScrutiny didn't slip in yet and I have no proof that the memory was sent to models across threads but I'm sure it would have if I weren't alert to such privacy issues around "memory" in this context.
I hope, PPQ makes the right call now an in the future.

2026-08-22 12:05:26 UTC

So Coldcard is already out of the news cycle? Who keeps reporting on funds lost and their whereabouts? What's happening? Are people suing the company? Is Coinkite planning to reimburse people?
There's little news other than Coinkite reporting more vulnerabilities to my understanding around USB access to Coldcard data and as a consequence the signing flow not signing what it claims to sign, leaving room to swap details.
Coldcard: Want to send 1BTC to Alice?
You: Yes.
Companion app updates the transaction in RAM
Coldcard goes on to sign "send 12BTC to Bob ..."

2026-08-22 12:03:52 UTC

PSA: @npub16g4…kv4h switched "memory" on by default. You might want to check this setting and switch it off if you care about privacy.
So they are careful to stress that no user id is sent to the model providers but they send a summary of all your past queries - which is strictly worse than a user id - with all your future requests and it's on by default.
So again: PPQ offers "private" models and promises that even non-private models won't get any identifiers to cross-reference distinct threads you have with those models but then decided it would be a good idea to send "user gets this prescription drug, user has daughter in daycare, user likes biergarten, user works with walletscrutiny".

2026-08-21 18:57:09 UTC

- reply

But LLMs also set a standard. If you can't write that smooth, you're tempted to use LLMs even more.
It's like spell checkers. Not using them feels stupid and I'm annoyed when I have to read hard to decipher sentences but where is the line?

2026-08-21 16:25:01 UTC

- reply

Bots are better with algorithmic discovery than humans?

2026-08-20 09:09:42 UTC

- reply

They can doodle and it can remain for a second as they doodled it but then it should just "normalize" and get out of the way on the second player's turn.

2026-08-20 01:42:32 UTC

- reply

A fix is to re-draw the line, retaining the topology but removing the shenanigans. For example use a physics simulation: squares freely rotate and repel lines and lines shorten. Also drawing lines repells existing lines, making room to draw.

2026-08-19 20:09:42 UTC

- reply

But ... why?
@npub1t6j…ksrw has a good objection to how it's currently implemented.

2026-08-19 19:39:16 UTC

- reply

I like the name. 🔥

2026-08-19 08:36:16 UTC

- reply

The memories. Could only play Striker Turbo mode switched off.
https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/de000ce74888ff7b82ce7019bb534f6197e8ac566cff57ac645015c3dfee2cab.png

2026-08-17 14:59:21 UTC

- reply

Seeing isn't the problem. I want to instruct my clankers from Amethyst.

2026-08-17 12:14:19 UTC

- reply

Publishing source doesn't guarantee that vulnerabilities will be found.
Not publishing source guarantees that only bad actors will find vulnerabilities because decompiling already is a legal gray area.

2026-08-17 09:07:44 UTC

- reply

How do I get it into buzz mode?

2026-08-16 16:49:13 UTC

- reply

Poor acting, poor story, kind of a twist at the end.
6.5 on imdb
https://www.imdb.com/title/tt13266998

2026-08-16 13:20:55 UTC

I'm trying out buzz but for one alone it feels like claude code or open claw with extra steps. Where are the nostr projects #builtWithBuzz where me and my agents would be welcome to help and learn before plunging in with WalletScrutiny?
Buzz looks like a cool, FOSS, self-hosted Slack or Discord replacement. Very smooth so far.
https://block.xyz/inside/introducing-buzz-where-humans-and-agents-work-together

2026-08-15 14:42:52 UTC

- reply

People voting with their wallets. I see.

2026-08-15 10:22:46 UTC

- reply

3 cherry tomatoes! 2 more soon!

2026-08-14 17:58:23 UTC

- reply

Innocent until proven guilty.
Every wallet dev knows retirement attacks.
Developing buggy crypto under a pseudonym is suspicious but no proof of guilt.

2026-08-14 13:33:48 UTC

https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/7425744bb236b4fa7e2b8f3577c0c2416b7c7b1d792c52518fd045e1f93b2857.jpg

2026-08-13 19:21:28 UTC

- reply

Absolutely! It's a fiasco and they pulled even with Ledger in that regard. I'm just more worried about the other things that can happen when your business is that big and you have to contract many others that end up touching the devices.

2026-08-13 18:25:58 UTC

- reply

Well, between that and Coinkite, Trezor any day.

2026-08-13 10:48:29 UTC

- reply

If Alice can rug your funds in wallet A and Bob in B, you not only need wallet A and B to be compromised but also Alice and Bob to collaborate to steal your funds out of an A/B/C multi sig.

2026-08-13 10:37:49 UTC

- reply

If you want to use a sha256 chain to run your "I don't trust the sha256 miners" oracle, at least use the strongest one, with most at stake for orphaned blocks. Call it pedocoin all you want but your manipulation is just obvious at this point.

2026-08-13 10:35:47 UTC

- reply

To use an oracle that uses less than 0.0001% of the available sha256 hash power smells like manipulation.

2026-08-12 14:26:46 UTC

- reply

Yes, language shapes perception but it's first and foremost a human to human interface and network effects favor the most universal such interface. Learning multiple languages is a luxury we hopefully could afford even after converging on a common tongue.

2026-08-12 09:20:30 UTC

- reply

Which at difficulty 1 is trivial. He has mining gear. He has access to pools. That's the point. Others can only guess randomly. He knows the mapping beforehand. It's an illusionist's ceremony.

2026-08-11 16:55:53 UTC

- reply

You have the TLDR right. Slightly longer here:
#nevent1q…qu3c

2026-08-11 16:52:39 UTC

https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/3c9a0cdc3b1b12585e852f272e161cbec3fddcc35016795f5d3698b2b6a7370b.png
Funny to watch ...

2026-08-11 16:48:38 UTC

Who could have thought of this resulting in a fork war???
https://fork.observer/?network=testnet4
#nevent1q…qu3c
Maybe @npub1ej4…ndrm 's OTS could help them out?

2026-08-11 16:28:54 UTC

- reply

Can you report on it or did the benevolent dictator of Luke Coin already decide what algorithm to use?

2026-08-11 14:12:07 UTC

Has @npub1lh2…a9nk completely lost the plot? Pardon my reading comprehension but to my understanding he decided to use a laughable oracle withing less than 6h to pick the next mining algorithm of what he believes to be Bitcoin? Why laughable? **He** picked a mapping from last digits of the block hash to PoW algorithm. He picked **Testnet4** of all chains - a chain with difficulty **1**. He did not show the mapping to anybody, so only **he** knows the mapping. A modern mining rig can produce many candidate Testnet4 blocks per second, so he can comfortably pick or if somebody else does the same, orphan them or if several engage in this mess ... why not just use the bitcoin chain??? Or at least Doge Coin???
"Nobody knows the new algorithm right now, and nobody will until we all know at the same moment" is just untrue for him.
#nevent1q…8hq9

2026-08-11 13:46:57 UTC

- reply

It's as secure as Testnet4's difficulty. He could have picked Dogecoin's chain to make it more secure.

2026-08-11 13:45:42 UTC

- reply

Why not use the Bitcoin blockchain? Testnet has zero security in its pathetic POW.

2026-08-11 13:44:46 UTC

- reply

Wait, what? Obviously you have your reasons to do it this way but wouldn't that give you perfect control to pick the winner? How much POW goes into Testnet4 blocks? Let's say you have a favorite out of 10 ... you only need to quickly find a block with a 10xTestnet difficulty. Can't be hard.

2026-08-11 09:39:07 UTC

- reply

Is this account controlled by a troll? What do you think will happen next?

2026-08-11 09:15:10 UTC

- reply

It's important what the attestation is about. If it is about code, then a cryptographic hash of the code has to be included as the authoritative reference. A git commit id is such a hash. Version tags can move and binaries from all kinds of sources might claim to be Wallet X with version Y.

2026-08-11 03:20:01 UTC

- reply

Attesting a check for a commit id is correct. Reproducers can link it to binary hashes.

2026-08-10 16:55:23 UTC

- reply

Nostr events are signed by an author and can easily be replicated to multiple relays.
A git repo can also be replicated but a client wouldn't subscribe to several, so you would have centralization there.
Accountability is not integral to git neither.
Google Full Disclosure vs. Responsible Disclosure and you can see how disclosing issues or the mere possibility of issues is a hot topic and often draws censorship.

2026-08-10 10:55:53 UTC

@npub1m2m…r8p9 suggested publishing AI code audits as Nostr events. Exact commit, prompt, model checkpoint, findings. Signed, so agents can diff against prior runs instead of burning tokens on work someone already did. Projects with many independent clean runs could earn a badge.
I want @npub1j9k…uswx to display exactly this. Not produce. Display. A known pubkey attests: commit X of project Y was checked with prompt Z on model A. Highest criticality found: B. WalletScrutiny is a client rendering whatever floats around, at the visitor's discretion.
The obvious objection is "responsible disclosure" or "Coordinated vulnerability disclosure" (CVD) assumes a scarce researcher negotiating a timeline with a cooperative vendor. That world is ending. When anyone can run an audit for a few dollars in tokens, all bugs are shallow. The embargo you negotiate with one researcher does nothing about the thousand agents that surface the same finding tomorrow. Attackers never honored embargoes anyway. The only people an embargo reliably keeps in the dark are users!
Censorship resistant attestations flip the default. A vendor cannot lawyer a signed event out of existence. A wrong claim gets contradicted by other signed runs against the same commit, on the same rails, and the pubkey that cried wolf pays in reputation. That is a better error correction mechanism than a cease and desist letter.
And it does not stop at WalletScrutiny. App repositories and the projects themselves could consume the same events. Imagine a release page showing "14 independent attestations at this commit, highest criticality found: none".
What we need is an agreed event format. Commit hash, prompt, model, checkpoint ID, findings, criticality.
Project Loupe @npub1ug8…d9ry
Red Team @npub12rv…85vg
#nevent1q…qrcn

2026-08-10 10:17:52 UTC

- reply

For @npub1j9k…uswx I'm thinking about this a lot, together with Project Loupe, too. The problem I see is "responsible disclosure". You will always find something and even the stuff you might want to responsibly disclose at first sight might not be an issue after all, so what will you signal and when and to whom?
I'd happily show what people signal on WalletScrutiny. Make clear attestations.
Known pubkey attests that commit X of project Y was checked with prompt Z on model A with these results ... Highest criticality found: B
Let's agree on a nostr event format. We might not engage in producing those events as "WalletScrutiny" but with clear attribution to nostr accounts I see no problem showing them.

2026-08-08 20:35:09 UTC

- reply

Ocean allows miners to pick what they want to mine

2026-08-08 20:34:47 UTC

https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/f12c3a7629eb7086582aaa9a91d6ae820b5cf99069770e232317785a0ba4b9b1.png

2026-08-08 20:20:19 UTC

- reply

What? Right now, both chains are +1. Equal weight.

2026-08-08 20:16:55 UTC

Ok, the show has started! Now a core miner ... could he accidentally mine on top of bip110 chain?

2026-08-08 13:37:12 UTC

- reply

Yes. But they shifted blame where their wallet lost the funds.

2026-08-08 09:04:52 UTC

- reply

CoinKite victims lost funds long in the past and Rodolfo blamed promiscuity even where the user did everything right.

2026-08-08 08:33:14 UTC

- reply

... unless the provider ignores it for months.

2026-08-07 20:40:27 UTC

- reply

Call them. Now.

2026-08-07 09:40:46 UTC

- reply

The subscriptions give you many more tokens than the API. If you switch to API, you pay more for Claude than for Kimi.

2026-08-07 06:56:47 UTC

- reply

https://npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6.blossom.band/310d4f0f47eae9ab1be3fcfeddab72236a9fbd11b1265be743eddd48a403eef0.jpg

2026-08-06 16:02:15 UTC

This is all a big game of Mafia

2026-08-06 15:01:09 UTC

- reply

... yet.

2026-08-06 13:53:03 UTC

- reply

ColdCard was reproducible. We need eyes on the code, not only on transparency.

2026-08-06 09:59:56 UTC

- reply

Add Samourai to the list.