Nostr notes by provoost

Mandatory normy post for new accounts m?

2026-04-02T16:17:14Z

In reply to nevent1q…5f77
_________________________

Mandatory normy post for new accounts m?

It's not just employees, also any regular private investor in ...

2026-04-02T12:39:01Z

In reply to nevent1q…p0pl
_________________________

It's not just employees, also any regular private investor in a seed round might not know in advance what the tax treatment will be.

Institutional and corporate investors are not affected by this, they fall under completely different taxation rules - they don't pay until the asset is sold.

Dutch bureaucrats trying to come with a "solution" for ...

2026-04-02T12:35:59Z

Dutch bureaucrats trying to come with a "solution" for startup equity holders in the upcoming unrealized gains tax system.

A bureaucrat is going to decide if it's sufficiently innovative and if the innovation is scalable.

Totally unclear if foreign startups can apply for this for Dutch employees. And what if they don't, or it after years of legal procedings the application is denied?

Then the employee is just fucked and has to pay 36% of the paper gains the moment a funding round bumps the completely illiquid stock price. And will not get it back if it subsequently drops to zero.
https://www.bnr.nl/nieuws/ondernemen-werk/10597781/nieuwe-definitie-startup-moet-box-3-probleem-oplossen-pas-betalen-bij-verkoop-aandeel

I prefer to clone the repo and then ask, it can more easily grab ...

2026-04-02T10:30:48Z

In reply to nevent1q…nsm9
_________________________

I prefer to clone the repo and then ask, it can more easily grab context and even try things.

It reminds me of the 2018 supply chain attack on Copay, but that ...

2026-04-02T09:00:38Z

In reply to nevent1q…eesy
_________________________

It reminds me of the 2018 supply chain attack on Copay, but that targeted end users in the browser, not developer machines.

I briefly covered it in my book in the chapter about Guix.

Yet another npm supply chain attack, though of course this can ...

2026-04-02T08:32:38Z

Yet another npm supply chain attack, though of course this can happen elsewhere. It was detected quite quickly. Seems to be aimed at developers, of which there are a lot more now thanks to LLMs.
https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

(not saying it should replace e-cash, but that's definately ...

2026-04-01T17:54:18Z

In reply to nevent1q…7ugg
_________________________

(not saying it should replace e-cash, but that's definately not the case for all wallets - but I would like to see it)

I guess I should have said: until you've spec'd and ...

2026-04-01T17:53:24Z

In reply to nevent1q…vcgy
_________________________

I guess I should have said: until you've spec'd and implemented bolt12 zaps :-)

My lightning node is never offline, unless it's under DDoS or ...

2026-04-01T17:51:31Z

In reply to nevent1q…mgaa
_________________________

My lightning node is never offline, unless it's under DDoS or a bug.

Temporarily holding received zaps, until you get around to ...

2026-04-01T17:49:22Z

In reply to nevent1q…mwpq
_________________________

Temporarily holding received zaps, until you get around to implementing bolt12 zaps.

So far I only read section "VIII. Dormant Assets" of the ...

2026-04-01T17:45:14Z

So far I only read section "VIII. Dormant Assets" of the Google quantum whitepaper. Although I wish they used a two column layout, it's an interesting analysis.

The National Security Response might actually be the easiest path, and there's nothing we can do about it. But it does require a president with diamond hands. They could issue an executive order, stating the United States shall be the first country to build a quantum computer, as publicly demonstrated by burning any coin that hasn't moved yet.

By the time lawyers get to object, the transactions are already confirmed.

The OP_RETURN statement would read: "EO 21400: fork your bitcoin if you want fork"

https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/

This would have made an excellent April Fools newspaper headline. ...

2026-04-01T10:41:59Z

This would have made an excellent April Fools newspaper headline.

quoting
nevent1q…j7fn
Today’s headline in #Zimbabwe.

„Your USD is very safe“. Whenever the central bank says your money is safe, trust that it’s the opposite.

I haven’t seen any ZIG banknotes around, it’s only being used digitally (card payment or EcoCash). I am using USD cash only and everyone’s trust is on the USD.

Now the RBZ wants to push ZIG banknotes upon people they will issue new banknotes on Apr 7. I will keep you posted!

Thursday, Rotterdam, be there: ...

2026-03-31T07:51:23Z

Thursday, Rotterdam, be there: https://bitdevsamsterdam.org/2026-04-02-april-bitdevs-rotterdam

Version bit grinding? :-)

2026-03-30T17:00:58Z

In reply to nevent1q…lm99
_________________________

Version bit grinding? :-)

Though in that case it'd be easier to just pay her to record ...

2026-03-30T09:10:41Z

In reply to nevent1q…83e9
_________________________

Though in that case it'd be easier to just pay her to record this.

Could be an information campaign to throw off Iranian ...

2026-03-30T09:09:45Z

In reply to nevent1q…v6tl
_________________________

Could be an information campaign to throw off Iranian intelligence of course, just send a bunch guys to a strip club with government money.

Also not too great OpSec if this operation was supposed to be a ...

2026-03-30T09:07:52Z

In reply to nevent1q…nm0j
_________________________

Also not too great OpSec if this operation was supposed to be a secret. I assume intelligence agencies monitor strip club revenue carefully, and then TikTok does the rest.
Loose lips sink ships.

Doesn't look fake to me* and it seems plausible that a ...

2026-03-30T08:59:44Z

In reply to nevent1q…vd2a
_________________________

Doesn't look fake to me* and it seems plausible that a stripper doesn't know military jargon.

It's her interpretation that the soldiers are "kinda depressed" and I don't think she meant "all their money" literally.

Seems reasonable that they're a bit anxious and need some extra entertainment because there's no strip clubs on Kharg (yet).

* = not an expert in spotting AI slop videos though

Every six months there's this recurring discussion about ...

2026-03-30T06:40:06Z

Every six months there's this recurring discussion about daylight savings time. It's a nice opportunity to learn new historical tidbits. E.g. I already know that the Nazis put us on Berlin time, but always wondered why we didn't switch back to London time.

Well, that's because we didn't use London time, we stubbornly kept using Amsterdam time (yellow on the map). Still doesn't explain why France and Spain didn't revert.

I also still want to go back to per city timezones (using UTC under the hood). Should be no problem with smartphones.

Then there's this constant recurring argument that we have adjust the clock for health reasons. I find that pure nonsense. Obviously it's non-issue for people who work from home on their own schedule. But you can also just change the times schools and office jobs start. You don't have to change the clock for that.
https://youtu.be/1ph_PqrUlRc

Reviewer (on a different project): this looks weird, must be LLM ...

2026-03-29T13:36:56Z

Reviewer (on a different project): this looks weird, must be LLM generated?

Me (not out loud): I'm sure it does, to someone who doesn't lint their whitespace

Why manually order a few books in two minutes, if you can spend a ...

2026-03-29T12:10:51Z

Why manually order a few books in two minutes, if you can spend a day automating it?
https://github.com/Sjors/cloud-print-rs

Well then you also don't need the de minimis.

2026-03-28T17:55:22Z

In reply to nevent1q…rjlx
_________________________

Well then you also don't need the de minimis.

Why do household chores on a Saturday if you can instead ask your ...

2026-03-28T13:43:49Z

Why do household chores on a Saturday if you can instead ask your agent to get rid of WooCommerce and just use simple BTC Pay Button links on a static website (the book is open source anyway, so no need for securing the download links, though that would be a nice feature): https://www.btcwip.com

We know that since at least the Blocksize Wars. But I do want to ...

2026-03-28T09:38:37Z

In reply to nevent1q…p3k8
_________________________

We know that since at least the Blocksize Wars.

But I do want to give them credit for any contribution to legal defense of developers.

So this law is just to pump their stock price?

2026-03-28T09:29:25Z

In reply to nevent1q…y2au
_________________________

So this law is just to pump their stock price?

Wait for nostr developers and relay runners to get arrested, give ...

2026-03-28T09:25:08Z

In reply to nevent1q…y6wa
_________________________

Wait for nostr developers and relay runners to get arrested, give them legal support? Or maybe something more preemptive :-)

De minimus de schmiminus, this is more important. ...

2026-03-28T09:19:01Z

De minimus de schmiminus, this is more important.

quoting
nevent1q…ev94
we still need to free samourai

> Without de minimis for Bitcoin, every small Lightning ...

2026-03-28T09:12:40Z

In reply to nevent1q…2k6a
_________________________

> Without de minimis for Bitcoin, every small Lightning payment or sat transaction still forces cost-basis tracking and IRS headaches. Paying your plumber in sats or grabbing lunch with Bitcoin remains a taxable event.

Just to play devils advocate: just vibe code a tool that calculates this stuff and fills out your tax form. Let IRS deal with the headache.

Why would USDC even need a de minimis exception? They're no ...

2026-03-28T09:09:35Z

In reply to nevent1q…c7hs
_________________________

Why would USDC even need a de minimis exception? They're no cost basis or gains.

Like Draghi said: "a euro is a euro, today, tomorrow, in a month, it's always a euro"

Or are they worried about slight deviations from the peg?

https://youtu.be/wztu8yyCPZQ

Ironically the porn company probably also knows who you are based ...

2026-03-28T08:35:47Z

In reply to nevent1q…xa4s
_________________________

Ironically the porn company probably also knows who you are based on that stuff, but they're just discrete about it and they protest age verification because it ruins this we-pretend-we-don't-you game.

Some Dutch news article about EU age verification on porn ...

2026-03-28T08:33:11Z

Some Dutch news article about EU age verification on porn sites... of course someone in the replies brags about how a VPN protects him. Then I feel obliged to point out that the VPN company knows which sites he's visiting and that if you paid them with fiat they also know your identity. And since creditcards are to get for minors, pretty much also your age.

(and otherwise there's plenty of marketing databases with your name, ago, browser fingerprint, advertising id, etc)

So you've opted in to age verification before the EU made you.

Sounds like the Tornado Cash prosecution argument. Why protect ...

2026-03-27T20:29:53Z

Sounds like the Tornado Cash prosecution argument. Why protect encrypted speech when we don't protect encrypted money? Or some such dystopian logic.

quoting
nevent1q…25a4
Oooffffff

Or the presence of really extreme ones that the internet gives ...

2026-03-27T20:17:13Z

In reply to nevent1q…mjtu
_________________________

Or the presence of really extreme ones that the internet gives access to?

Or the lack of mass conscription for war? (a good thing, I'll take the manosphere trade-off)

I just let it struggle on a task and then ask it to write a skill ...

2026-03-27T13:44:52Z

In reply to nevent1q…csd2
_________________________

I just let it struggle on a task and then ask it to write a skill based on that.

There's a potential privacy issue there for the volunteers. ...

2026-03-27T07:56:50Z

In reply to nevent1q…7dvp
_________________________

There's a potential privacy issue there for the volunteers. But you could have one key per polling station, and they could upload only the counting tables to Blossom and the rest to municipal servers - where they get deleted after a few months.

The next thing I'd like to do someday is OCR the forms, with ...

2026-03-27T07:54:20Z

In reply to nevent1q…szjk
_________________________

The next thing I'd like to do someday is OCR the forms, with local models this time, and try to reproduce the election result. But with 13k+ different handwritings, that seems rather daunting.

In fact, I already wasted a long, doom-coding session on it.

That said, the table itself and party names are printed, and the numbers have to add up. There's also a separate count per candidate that needs to match the count per party. And the CSV files with totals are also available. So that would give a model some constraints to work with when deciphering individual glyphs.

https://github.com/Sjors/verkiezingen-processen-verbaal/pull/115

You can now ask Claude to check the #OTS timestamp for the Dutch ...

2026-03-26T23:18:06Z

You can now ask Claude to check the #OTS timestamp for the Dutch municipal elections! :-)

More interestingly though, the data collection does really benefit from LLMs. This is the second election where I've been using them. Still not a smooth ride, but I'm getting better at the process. And the tools are getting better too.

There are 13k+ polling stations in the Netherlands. Volunteers count the votes (70x100cm paper ballots) and fill out a form by hand. After that, the computers take over to accumulate the results. But these paper forms are scanned and uploaded on 300+ municipal websites, creating an audit trail.

My project then tries to download these PDFs. I don't re-publish the documents themselves, just the list of URLs, their SHA256 checksums, and a timestamp. The repo has scripts that make it easy to redownload and compare checksums.

Collecting the URLs, however, is incredibly tedious. Every municipal website is different, the documents are named after the polling station, etc. The first time back in 2023, I spent days collecting the URLs, with scripts and with a few other people helping out. You'd think that for the next election, you just find and replace the year? Nope, all different again.

There are a couple of common CMS systems used. Some are easy, at most requiring some rate limiting and a fake user agent to prevent getting blocked. Still, other municipalities use some JavaScript frameworks or even Google Drive— until recently, those required a manual download.

This task can't be fully automated by scripts, yet it's too much work to do by hand. That makes agents a great fit. For 80% of the work, I was able to just say "Pick 25 municipalities and divide them over 5 sub-agents," and I'd end up with 25 commits half an hour later. Or a rate limiting error from GitHub Copilot :-)

I struggled more with the remaining ones, though I think I'm in good shape for the next election. As a rough guideline: GPT5.4 and Claude Sonnet (both at medium effort) can do most of the heavy lifting, of course with constant "encouragement", whereas subagents with GPT5.4 mini can call a script to fetch documents, do some sanity checks, and commit the result.

I briefly tried a local model (nemotron-cascade-2 with Ollama), but it started hallucinating PDF names. I might also try PayPerQ.

https://github.com/Sjors/verkiezingen-processen-verbaal/

Here you go: #nevent1q…rmkt

2026-03-26T20:13:55Z

In reply to nevent1q…mf8d
_________________________

Here you go:

quoting nevent1q…rmkt
Maybe not #ProductionReady but I vibe coded an iPhone node based on the kernel the other day.

Just signet for now, because the kernel can't prune yet. Oh and it syncs from mempool.space :-)

https://github.com/Sjors/kernel-i-node

Maybe not #ProductionReady but I vibe coded an iPhone node based ...

2026-03-26T20:13:12Z

Maybe not #ProductionReady but I vibe coded an iPhone node based on the kernel the other day.

Just signet for now, because the kernel can't prune yet. Oh and it syncs from mempool.space :-)

https://github.com/Sjors/kernel-i-node

But it's video? https://github.com/divinevideo/divine-mobile ...

2026-03-26T18:22:49Z

In reply to nevent1q…8dxe
_________________________

But it's video? https://github.com/divinevideo/divine-mobile

I'm a boomer, I only do photos.

Don't look at the wallet screen, just zap. ...

2026-03-26T17:41:20Z

In reply to nevent1q…d6xh
_________________________

Don't look at the wallet screen, just zap.

Oh wow, NWC between @npub18m7…q955 and @npub1xnf…lpr5 ...

2026-03-26T17:39:55Z

In reply to nevent1q…792m
_________________________

Oh wow, NWC between damus (npub18m7…q955) and ZEUS (npub1xnf…lpr5) actually worked, nice!

Claude: avoid the word "very", make very few mistakes. ...

2026-03-26T17:36:58Z

Claude: avoid the word "very", make very few mistakes.

quoting
nevent1q…2mwh
a detail you probably didn't know: nowhere in any #curl documentation do we use the word "very". It is a banned word enforced by a CI check. This rule encourages us to rewrite and instead use more appropriate words. Makes us write better English.

The half-yearly #chatcontrol zombie returned and was rekilled. ...

2026-03-26T13:45:45Z

The half-yearly #chatcontrol zombie returned and was rekilled.

quoting
nevent1q…t9ud
European Parliament has just rejected the Chat Control proposal again! 🫶🚀

Your voice always matters! Stay ready and keep standing up for your rights!🫶

As a follow-up, ask your MEP to investigate:
📌 Why are EPP MEPs following the agenda and timelines set by Google, Meta, TikTok, and other big platforms, instead of defending the fundamental rights of EU citizens?

📌 On what legal and political basis was this vote reopened, and who requested it — was it driven by the public interest or corporate lobbying? Ask EPP’s MEPs to show their proposal publicly!

📌 If this vote can be reopened once, does that mean it can be reopened again whenever the outcome pleases powerful actors — but not when citizens and civil society are dissatisfied with the result?

They always had the power to do this, we need to deal with that ...

2026-03-26T10:14:23Z

In reply to nevent1q…pxqu
_________________________

They always had the power to do this, we need to deal with that problem sooner or later.

Sounds like they're opting for later though?

Thanks to browser fingerprinting and general profile collection ...

2026-03-25T21:46:24Z

In reply to nevent1q…38pl
_________________________

Thanks to browser fingerprinting and general profile collection practices by payment processors you might however already be cursed.

Sadly paywalled so you can't read it without an approved creditcard: https://www.nytimes.com/2019/11/04/business/secret-consumer-score-access.html 🤡🌎

A VPN connection to whatever country the bank thinks you belong ...

2026-03-25T21:41:23Z

In reply to nevent1q…fxme
_________________________

A VPN connection to whatever country the bank thinks you belong in can help. Except they also tend to block known VPN IP addresses, so you'd need to tunnel to your own home or a friends place ideally.

Or use Bitcoin.

Or both :-)

I assumed they already did this.

2026-03-25T21:31:23Z

In reply to nevent1q…f485
_________________________

I assumed they already did this.

Nostr event nevent1qqs2ma7tftcvt9m94hg9vfpe5p3czh5q46rs0yweumzy4svu742p9qqzyp32jgz2x920297maevryqeqswt7hha65xl0ljl3gmtlqcfcshd7xws5xke

2026-03-24T21:32:23Z

Is Olas still a thing is there a new thing?

Zullen de Basis Registratie Persoonsgegevens maar gewoon openbaar ...

2026-03-24T12:33:47Z

Zullen de Basis Registratie Persoonsgegevens maar gewoon openbaar maken? Half Nederland kan er legaal in grasduiden en de andere helft zit al in diverse datalekken. #zucht
https://hrif.eu/2026/03/banken-in-brp-hrif-eu-zegt-geen-goed-idee/

And it didn't turn off constant timeness to speed things up? ...

2026-03-24T11:34:18Z

In reply to nevent1q…ktzp
_________________________

And it didn't turn off constant timeness to speed things up? :-)

I think of it more as a verb than a noun: an experienced ...

2026-03-23T12:05:10Z

In reply to nevent1q…94v7
_________________________

I think of it more as a verb than a noun: an experienced developer can also vibe code, as long as they resist looking at the result :-)

Does anyone still use mixed case on X?

2026-03-23T12:03:03Z

In reply to nevent1q…tlza
_________________________

Does anyone still use mixed case on X?

It didn't let me move my life savings. ...

2026-03-22T21:55:18Z

In reply to nevent1q…j8vn
_________________________

It didn't let me move my life savings.

I would add that "care" should be more directed to the ...

2026-03-22T19:34:07Z

In reply to nevent1q…cedp
_________________________

I would add that "care" should be more directed to the reviewer and potential future co-developer, rather than a reflection of how important the project itself feels.

For example, I might write something for my own use that really needs to behave correctly. Because nobody else needs to look at the code, I can just compensate for the fluff with good manual testing and test coverage.

Whereas a far less important pull request to a project I'm not passionate about will need way more polishing because I don't want to bother the reviewer.

There's also a third category: "this is entirely vibe coded, feel free to close". And then it gets merged anyway. Probably best reserved for projects you're familiar enough with to at least know the change is:
1. Useful and not already being worked on
2. Harmless even if ugly

With code, I tend to think of it as polishing. The time spent on ...

2026-03-22T19:13:27Z

In reply to nevent1q…q3y2
_________________________

With code, I tend to think of it as polishing.

The time spent on polishing might be near zero if something isn't very important, and not bothering anyone. E.g. a Python script that generates a plot from a log file that helps me debug something. I might not even look at it.

But especially when something needs review by another human, the polishing phase easily takes 90% of the time— and probably even more of the tokens.

The LLM is called "generative" for a reason; you need to keep chipping away at the stuff it generated. There's also a constant hunt for weirdness hiding in corners, the you’re-absolutely-right waiting to happen.

The key here is to relive your why-phase on steroids on every single line in the diff.

> If I had more time, I would have written a shorter pull request.

It does raise the question whether it would have been more efficient to just write the initial version by hand. For me, the jury is still out on this when it comes to high-care situations.

But generating code myself also involves quickly producing something that roughly works and gradually polishing it. With the LLM, I just spend more time wearing my grumpy reviewer hat and less time wearing my "I don't feel like writing a test for this" hat.

Two hours is not #doomcoding, try two days!

2026-03-22T18:35:16Z

In reply to nevent1q…aknc
_________________________

Two hours is not #doomcoding, try two days!

Just rig it with self driving capability so can drive it a few ...

2026-03-21T17:20:05Z

In reply to nevent1q…8y6t
_________________________

Just rig it with self driving capability so can drive it a few feet back and forth remotely?

Especially if the npub was generated by Damus :-)

2026-03-20T12:59:14Z

In reply to nevent1q…nmkd
_________________________

Especially if the npub was generated by Damus :-)

I like the idea of just allowing any new npub to claim the ...

2026-03-20T10:19:26Z

In reply to nevent1q…l2pf
_________________________

I like the idea of just allowing any new npub to claim the history of any other npub. It's web-of-trust anyway.

Could even be an enumeration of specific events you care about, leaving any stupid remarks plausibly deniable :-)

@npub18m7…q955 smooth! :-) ...

2026-03-20T09:37:26Z

damus (npub18m7…q955) smooth! :-)

So is there a NIP yet for marking an account as do-not-trust ...

2026-03-20T09:26:49Z

So is there a NIP yet for marking an account as do-not-trust after a certain block hash? Of course that only works if every previous event is timestamped...

It's quite easy to click "sign up" instead of ...

2026-03-20T09:17:37Z

In reply to nevent1q…wzk7
_________________________

It's quite easy to click "sign up" instead of "login" and end up becoming Mr Nsec. Then you click sign out and try again, before or without realizing that now you don't have access to that new self-doxxing account either (and maybe could have reduced the risk by changing the username and hoping nobody stores the original).

Soon(tm)

2026-03-20T09:10:15Z

In reply to nevent1q…0hs5
_________________________

Soon(tm)

Also cinnamon adds a nice touch to an Espresso Martini. ...

2026-03-20T05:02:21Z

Also cinnamon adds a nice touch to an Espresso Martini.

Well I'm not going to enter my previous nsec into a Python ...

2026-03-20T02:56:22Z

Well I'm not going to enter my previous nsec into a Python script to see if it's actually compromised, but it's quite possible it got Mr Nostr'd in the past(e).

Nostr event nevent1qqsdwakrd34p5vfz74va35d4ngml8lzzm3qzlnp2x8h2d594traaw2czyp32jgz2x920297maevryqeqswt7hha65xl0ljl3gmtlqcfcshd7xvdxq2g

2026-03-20T02:46:34Z

GM, time for a new nsec.