Nostr notes by Signet

New Signet client release is now available on ...

2026-05-02T04:24:40+02:00

New Signet client release is now available on https://hax0rbana.org/signet/downloads.html

Notable changes include:

- Supoort for importing extra fields from KeePass databases
- Support for importing KeePass v4.x database files

The other changes are things like the Windows executable being compiled automatically by my CI/CD system, so I don't have to manually go to a Windows box to compile it.

I've got the deb building issues solved for Debian. ...

2026-04-25T05:29:07+02:00

I've got the deb building issues solved for Debian. There's an Ubuntu release (Jammy) that upgraded libbotan2 but not libgcrypt so the Debian 11 has one library that is too old and another that is too new and I think it's reversed with the .deb from Debian 12. At least something like that, I'm tooting from memory.

The solution is to build it on Jammy so it'll pick the library versions that match. I should get that done after the weekend. And I'll add in some more testing for more releases too.

As the years march on, maintaining support for older distros ...

2026-04-24T22:52:01+02:00

As the years march on, maintaining support for older distros becomes more complex. One version of a library is required on one release, and a different one on the next.

Most projects shy away from putting the work, even huge projects with large communities and/or corporate funding. It's a lot easier to just support the latest release.

Not Signet. I support Debian 11, both i386 and amd64. At a minimum, I will match Debian's Long Term Support commitments.

I'd like to go beyond this and match the Extended Long Term Support (ELTS), but this is challenging.

Docker doesn't keep images around forever, which is a problem for my CI/CD environment.

Debian doesn't keep their apt repos around, which is a problem for installing dependencies and build tools.

ELTS is 3rd party paid support.

While it'd be possible to run my own apt mirror and docker registry, it's a lot of work for something nobody is asking for. So for now, I match Debian's LTS policy: 5 years, then you need to upgrade your O/S and I'll keep on supporting you. 🫶

I was able to reproduce the issue outside the CI environment. I ...

2026-04-23T17:59:02+02:00

In reply to nevent1q…xpqq
_________________________

I was able to reproduce the issue outside the CI environment. I think I know what needs to be done to clean all this up now, but I ran out of time before I got it done.

Plus I made a change to the CI runners which should prevent the Docker caching issue from recurring. Just need to get that into the Ansible scripts so it will never regress. THEN I can call it done.

Resolved that, now on to trying to figure out why there are ...

2026-04-22T05:25:46+02:00

In reply to nevent1q…22jj
_________________________

Resolved that, now on to trying to figure out why there are CMakeCache folders that are breaking the .deb build process.

This related to the new keepassxc project (in place of keepassx)

And frustratingly, this only seems to happen in the CI environment. Running the same commands on a fresh VMworks fine. So I expect it'll probably turn out to be more Docker issues. Time & effort will reveal all.

I spent all day trying to track down some alarming PGP signature ...

2026-04-21T07:08:45+02:00

I spent all day trying to track down some alarming PGP signature problems.

In the end, it was docker caching some file that was downloaded from the internet, as if there's no chance something online could possibly change...

Frustrating to waste time on Docker nonsense, but at least the explanation wasn't that it was detecting a compromise.

Onward.

I've also made progress on the hardware side of the house. ...

2026-04-10T01:22:07+02:00

I've also made progress on the hardware side of the house. The current hardware is effectively USB-A only, and the new revision aims to fix that. I feel like the details are somewhat interesting on this. Perhaps that isn't true for hardware developers, but I think everyone else will enjoy, so it's story time!

I took on maintenance at hardware v1.2. It relied on a voltage regulated that was not available anymore. The journey begins...

I taught myself KiCAD and updated the design to use a different voltage regulator. The pins were reversed from the previous component, so this spawned v1.3. Exact same thing as v1.2 except it used components which were actually available.

That was OK, but the board had components on both sides, which made assembly tedious and error prone. Plus people were asking about native USB-C support. Between my desire to make these devices easier for people to build at home (myself included) and the USB-C thing, v1.4 was born.

This put all the components on the front of the board and added a USB-C connector. After a few attempts, I decided the surface-mounted USB-C connector was going to be too tedious for people to assemble, and I settled on the through-hole version.

After making a huge batch of these new boards, I discovered I made two errors:

1. I didn't connect the data pins from the A-side to the B-side. The result, you can't plug it in either way. Awkward for a USB-C connector!

2. More importantly is would ONLY work with USB-A to USB-C cables. I had wired it per the USB spec for legacy mode because the MCU only supports USB 2.0. It was only later I realized that legacy mode was referencing the cables, not the protocol.

The net result is that v1.4 hardware is basically still USB-A only. Yeah, you can put both USB ends on, but it's not going to work as most people expect.

This brings us to v1.41, which is nearly identical to v1.4, except a 56K Ω resistor was swapped out for a pair of 5.1K Ω resistors and slightly different wiring. I've hand soldered this on a prototype board and can confirm that it works properly. I updated the board and published it, but I haven't had new boards made yet. So the story continues. I'm pretty sure that they'll work as my prototype did, but there's still some chance I made a mistake in KiCAD and will have to make yet another revision before it has real USB-C support. Time will tell.

So there you have it. A behind the scenes look at hardware development and how I'm pushing to make this tech more accessible to people and adding native support for USB-C.

I've been grinding away, doing the completely unglamorous ...

2026-04-09T07:09:35+02:00

I've been grinding away, doing the completely unglamorous work of maintenance and cross platform compatibility, but I did add in one little improvement.

- Switched from KeePass to KeePassXC library
- Added support for importing KeePass v4 databases
- Added support for importing extra fields from all KeePass files

All these changes were in the client software, not firmware nor hardware changes.

I think I recently found a better way to explain the security ...

2026-03-18T21:34:52+01:00

I think I recently found a better way to explain the security that Signet offers:

1. Can unplug it when not in use to know your data is safe

2. Passwords are only released when the physical button is pressed

3. Lost devices can't be used w/o the device password

You don't have to be a cryptogrpher to understand these benefits.

I **am** a huge geek so I get excited to talk about the cool technical features, but I'm trying to get better at giving people the punchline instead of a huge pile of details. How'd I do?

Finally got keepass v4 database importing working on Windows in ...

2025-12-29T05:00:57+01:00

Finally got keepass v4 database importing working on Windows in addition to Linux.

I'd like to get some bugs fixed in MXE (the cross compiler I use to build .exe files), but I have a solution to hold me over until that happens (which may be "never").

Anyways, on to getting it to compile on macOS and then I can wrap up this feature.

Reason #25630 that I don't get things done faster: The MXE ...

2025-11-16T20:00:50+01:00

Reason #25630 that I don't get things done faster: The MXE scripts to build .deb packages are broken and after dozens of hours trying to resolve it, I haven't been able to figure it out.

I opened a ticket about it a couple weeks ago, but no replies.

https://github.com/mxe/mxe/issues/3264

This is blocking my ability to fix the CI jobs that build the Windows releases of the Signet client, which is holding up a release.

In this case, I don't think anyone who knows about these scripts is still around.

The moral of the story here is that if you can afford to help with open source software, we could really use it!

I'm not talking about money. I'm talking about project management, learning how to reproduce issues, debug them, working towards a resolution and not just being able to do these, bit actually doing them in practice.

It takes time and effort. It means being part of a community. And the reward is that the world is a better place. It's not the riches tech bros promise.

Reason #25628 why I don't get things done faster. I had to ...

2025-11-16T08:45:36+01:00

Reason #25628 why I don't get things done faster. I had to set aside my tasks to patch reprepro so it could handle control.tar.xz files which is what are created by all of Debian's modern tools to create .deb files.

I submitted a merge request 2 weeks ago, but it hasn't been commented on, let alone reviewed or accepted.

But I've got the .deb for it on my apt repo and you can see the change and compile my version here if you want it. https://salsa.debian.org/debian/reprepro/-/merge_requests/14

Reason #25629 why I don't get things done faster. I spend time trying to get my patches upstreamed so more people can benefit from my work.

But just like my multi-year effort to get a patchlevel change in pam-u2f (from the original author and an official release, not a patch I wrote), it seems I'm being ghosted again.

Last time around, I reached out to the maintainer via email, the former maintainer, another person in auth, the maintainer via IRC, tried to get a mentor in IRC... all failed.

Today I helped a user compile the #signet client for an #ARM ...

2025-10-31T00:41:33+01:00

Today I helped a user compile the #signet client for an #ARM based version of #MacOS.

It required changing a couple library paths, and I've already upstreamed those changes to the latest copy of the repo.

This was something I've been wanted to test for a long time now, but I don't have the hardware and it's hard to get the time of someone who does. But we did it. Together.

Hardware secured encryption is #cipherpunk meets #cyberpunk ✊

signet - And physical access is within our threat model!

Contrast that to the way hardware security work when made by Intel, AMD or ARM:
https://infosec.exchange/@dangoodin/115459944536890363

There's going to be another bugfix I plan on testing, ...

2025-09-13T23:27:36+02:00

There's going to be another bugfix I plan on testing, hopefully in the next week or two. I'll post pics and the results, even if the fix doesn't work.

quoting
nevent1q…jtnw
This is what #patching a #bug in #hardware looks like.

First attempt: I made things worse
Second attempt (not pictured): it's as if I did nothing
Third attempt: fixed!

If you don't know how big a US dime is, the punchline here is that these wires are very small, tedious to work with and will probably come loose at the slightest provocation. #USBC

And a shout out to those who know exactly what happened here without any explanation required. I goofed. Next rev will be better. #OpenHardware #electronics #diy

Well, that was... educational. Not only does v1.4 require ...

2025-09-10T10:16:59+02:00

Well, that was... educational. Not only does v1.4 require plugging in the USB-C cable the right way, but it also only works with USB-A to USB-C cables (not C-to-C).

Everything related to the USB-A connector is fine, and previous revisions didn't have a USB-C connector at all, so this version is still an improvement, but not as much of an improvement as I was aiming for.

I've read a lot about USB-C cables and USB 3.1 and I think the next rev will fix both problems. Version 1.41, here we come.

This is what #patching a #bug in #hardware looks like. First ...

2025-09-10T04:51:02+02:00

This is what #patching a #bug in #hardware looks like.

First attempt: I made things worse
Second attempt (not pictured): it's as if I did nothing
Third attempt: fixed!

If you don't know how big a US dime is, the punchline here is that these wires are very small, tedious to work with and will probably come loose at the slightest provocation. #USBC

And a shout out to those who know exactly what happened here without any explanation required. I goofed. Next rev will be better. #OpenHardware #electronics #diy

Also, if someone wants to just rip off my design and make and ...

2025-09-01T01:13:40+02:00

In reply to nevent1q…zwtl
_________________________

Also, if someone wants to just rip off my design and make and sell Signets themselves, there's nothing stopping you. The license allows for it, and I'm not going to shy away from competition.

Of course, if you do, it's on you to deal with fuck ups in manufacturing, soldering on USB connectors, flashing, testing each unit, setting up one or more stores, and the worst thing of all: marketing.

If that sounds good to you, go for it. If you want to share these burdens, partner with me.

BTW, I am still looking for a reseller in Europe. If you or ...

2025-09-01T01:10:00+02:00

BTW, I am still looking for a reseller in Europe. If you or someone you know is there and wants to make open source security hardware available to people, reach out to me.

The cost of shipping is Europeans €25-30 per order, but beyond that, there's a risk with every single order that something will go wrong in customs (on either end), and that cost would double just to give it a second attempt!

That's why I don't offer international shipping. Because I end up losing money if 1 out of 10 orders requires re-shipping. Meanwhile the customer has to pay almost as much for shipping as the device. I want to slash that cost dramatically, and obviously I'll pass those savongs onto the user.

Here's what I want to do:
A.) Ship a batch of signets to someone in Europe, maybe 10x to start
B.) Orders to europeans ship from there

I'd prefer the reseller sells them, but I could enable shipping in my store if that's preferable.

We can work out something to balance the risk of me shipping off signets and never hearing anything from them again, and the reseller buying these from me and then being stuck with them if they're not selling. We can work it out, and a return/exchange process too. We got this, I just need a little help.

The only other change in v1.4 is making assembly easier by making ...

2025-08-30T22:22:13+02:00

The only other change in v1.4 is making assembly easier by making it a single sided board. It's just that and the USB-C, everything else is functionally identical.

quoting
nevent1q…xj0t
New #hardware revision is in the works... #Signet v1.4

Native USB-C connector. No more need for those A-to-C adapters.

I just ordered more parts to make more of them. I'm excited. #OpenHardware for life, yo!

New #hardware revision is in the works... #Signet v1.4 ...

2025-08-30T07:38:14+02:00

New #hardware revision is in the works... #Signet v1.4

Native USB-C connector. No more need for those A-to-C adapters.

I just ordered more parts to make more of them. I'm excited. #OpenHardware for life, yo!

The reason this helps the Signet project is because it means ...

2025-08-03T23:43:02+02:00

The reason this helps the Signet project is because it means being able to develop the code without having to wait for hours to compile the cross compiler and cross compile the libraries. Instead, we have a fast, reproducible way to get the the libraries that are either grossly outdated in the official repo, or don't have any package at all in that repo.

#SelfSufficency #OpenSource #dev

quoting
nevent1q…elru
Last night I found a lua script in the MXE repo that allows me to create .deb packages. This is something I asked for a couple months ago and never got any reply.

This is a huge deal, not just for me, but for everyone who uses the MXE cross compiler to make Windows executables from Linux because the official repos have not been updated in a decade and they won't compile some modern software.

Soon, I will have an update version of gcc in my apt repo for everyone.

I am also going to be adding documentation on how people can compile the .deb packages themselves. The ones in my repo will be signed by me, but trusting me should not be a requirement.

Last night I found a lua script in the MXE repo that allows me to ...

2025-08-03T23:31:47+02:00

Last night I found a lua script in the MXE repo that allows me to create .deb packages. This is something I asked for a couple months ago and never got any reply.

This is a huge deal, not just for me, but for everyone who uses the MXE cross compiler to make Windows executables from Linux because the official repos have not been updated in a decade and they won't compile some modern software.

Soon, I will have an update version of gcc in my apt repo for everyone.

I am also going to be adding documentation on how people can compile the .deb packages themselves. The ones in my repo will be signed by me, but trusting me should not be a requirement.

Trying out Plebian Market. The censors won't let me call the ...

2025-06-08T07:00:08+02:00

Trying out Plebian Market. The censors won't let me call the signet a password manager. Password is a forbidden word. But I can say password on nostr all day long. Password password password! Take that censors!

https://plebeian.market/products/30018:86419b2979bbe726b8bc966e8e6402da4509d64ed15a3a6b12abc14b0c29d124:signet-be5bw8oj89

I finally have a partial answer to the question "how long ...

2025-04-29T23:53:29+02:00

I finally have a partial answer to the question "how long will a #Signet last?"

Previously, we had never seen one wear out, but after 7.5 years, most of which was daily use, my 2017 Signet started having intermittent problems with the USB connector. I had to jiggle it to get it to work.

7+ years is better than you'll get from any commercial company, but here's the real kicker...

I replaced the USB connector and it works reliably again! 💯

The part of the question about how long it will last which is left unanswered is: how long will it last after one simple repair?

Any #Makerspace or #Hackerspace can help you make this #repair, even if you don't have any experience with #electronics. The USB connector costs less than a dollar and the space might even have some lying around they'd be willing go give it to you for free.

This is how gadgets should be. Not disposable, but long lasting AND repairable.

#environmentalism #sustainability #RightToRepair #FOSS #OpenHardware #sustainible

Achievement unlocked: get an ad in the back of the latest 2600 ...

2025-04-27T23:40:18+02:00

Achievement unlocked: get an ad in the back of the latest 2600 magazine.

May all the cypherpunks have the tools they want, not merely the tools companies are willing to sell to them. 🤘😈

I am happy to announce the release of a new #signet case (and ...

2025-04-13T00:54:30+02:00

I am happy to announce the release of a new #signet case (and more colors)! All the same hardware inside, it's just a new look.

There are a couple slight variations:
- snap together vs screw together, and
- I have one without a keyloop

What do you think? Prefer the cleaner look to the more functional option of having a keyloop? Want other colors? Let me know.

More pics are available on the Artisans Cooperative's store:
https://artisans.coop/products/signet

I'm going to update my personal store soon, but I am going to spin up my own #nostr relay so it will be more stable. Had someone send money into a black hole because a relay timed out.

At some point I will probably also update the store to DM me the secret *before* having the person send money. That way this can't happen again, regardless of any timeouts. I think the personal nostr notification already happens after payment, so that should already be good.

Working on an update to the #signet client so it can import the ...

2025-03-29T01:14:41+01:00

Working on an update to the #signet client so it can import the Keepass 4.x databases (currently it can do up to and including 3.
x).

It compiles and works on Linux, but in order to be accepted it also needs to do so on macOS and Windows, and cross compiling the Windows executables from Linux needs to work for both 32- and 64-bit versions.

The keepassxc project has a bunch of dependencies, which is making this difficult. The libraries aren't packaged up elsewhere like they are on Debian. 🫤

It feels so good to have this pipeline going. It's like a ...

2025-03-03T05:03:09+01:00

In reply to nevent1q…v75g
_________________________

It feels so good to have this pipeline going. It's like a burden has been lifted.

macOS is on my list for the future. Looks like osxcross is the tool people are gravitating towards. 🧐

Just managed to get a cross compiler set up so I can build ...

2025-03-02T07:49:28+01:00

Just managed to get a cross compiler set up so I can build #Windows executables from #Linux.

While it's unlikely that anyone else will care about this #development, it means I can have Windows builds in the CI/CD. This will save me a ton of time when cutting releases.

https://gitlab.hax0rbana.org/signet/signet-client

Currently in it's own branch, but if it builds correctly, and passes manusl testing on a Windows machine, I'll merge it into trunk. Steal it as an example if you wish.

#devops #OpenSource #security #FOSS

We now have a FAQ on the main Signet page. ...

2025-02-25T01:01:12+01:00

We now have a FAQ on the main Signet page.

https://hax0rbana.org/signet

Thanks to the people who have asked questions. I'll continue to try to improve the documentation and make the hardware and software easier to use.

Good news: we are helping to get a bug fixed in #QubesOS. It ...

2025-02-24T07:18:04+01:00

Good news: we are helping to get a bug fixed in #QubesOS. It looks like the upcoming 4.3 will allow attaching a hidraw device on the first try.

That means no workarounds required to use Signet on Qubes, and it'll likely fix other devices too.

(I've been using mine with Qubes for years, but it'll be nice to not have to enable usb-reset-on-attach anymore)

Thinking about checking out #podcasts who might like to have me ...

2025-01-06T22:24:52+01:00

Thinking about checking out #podcasts who might like to have me on as a guest.

Anyone have any recommendations?

Any podcasts out there who cater to people getting interested in #privacy or #security? Or maybe an #OpenSource podcast where I could tell the story of how #unstoppable this project has been?

#signet #FreedomTech

Signet finally has it's own account. Now you can follow this ...

2024-12-31T06:44:50+01:00

Signet finally has it's own account. Now you can follow this account any just get Signet updates and not have to wade through all Dr. Hax (nprofile…uctz)'s posts about meshtastic, preserving homegrown food and whatnot. 😂

#OpenSource #hardware #FOSS #OpenHardware #FLOSS #security #privacy #electronics