Avatar
Ademan
2cb30c36438bad4a2a5107bc98f5cebe6a0229b0554d8cfbd1c99aa3cc7ecec1
Neanderthal hacking on Bitcoin stuff. LNHANCE please!

Anything interesting? I have to admit I have written bluesky off almost completely.

https://dustycloud.org/blog/how-decentralized-is-bluesky/ is utterly damning (although the author is very sympathetic to bluesky as a twitter alternative)

You don't wanna dogfood DMs in coracle? 😂

Sent! Subject line might be easy to mistake for spam but it should be obvious it's my email address.

#FreeRoss Thank God he's free!

Now if only we could free him from this new sentence...

I'm not even a little surprised, but I'm still disappointed...

Engagement on nostr is infuriating (nonexistent)

Replying to Avatar Ademan

nostr:nprofile1qyw8wumn8ghj76r0v3kxymmy9e3k7unpvdkx2tn5dahkcue0qy88wumn8ghj7mn0wvhxcmmv9uq32amnwvaz7tmjv4kxz7fwv3sk6atn9e5k7tcpzemhxue69uhkummnw3ezumtfd3hh2tnvdakz7qghwaehxw309ashgmrpwvhxummnw3ezumrpdejz7qpqjlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3q0rmwe9 did you fix something with caching websocket connections or something? Over the past month or so I stopped using coracle (and nostr) because I was being assaulted with 22242 signing requests, and now I'm not (or at least it's tolerable now).

Bonus informal bug report ;-)

nostr:nprofile1qyw8wumn8ghj76r0v3kxymmy9e3k7unpvdkx2tn5dahkcue0qy88wumn8ghj7mn0wvhxcmmv9uq32amnwvaz7tmjv4kxz7fwv3sk6atn9e5k7tcpzemhxue69uhkummnw3ezumtfd3hh2tnvdakz7qghwaehxw309ashgmrpwvhxummnw3ezumrpdejz7qpqjlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3q0rmwe9 did you fix something with caching websocket connections or something? Over the past month or so I stopped using coracle (and nostr) because I was being assaulted with 22242 signing requests, and now I'm not (or at least it's tolerable now).

Replying to Avatar hodlbod

**Security Update**

I've got some bad news for you guys. This morning, as I was adding error handling to flotilla, I discovered that Coracle has been sending user session objects to bugsnag when reporting errors.

Who is affected: Users who triggered an error in Coracle while signed in with their private key, since December 5th 2023.

What I've done:

- I immediately released a new version of Coracle, both to web and to zap.store

- I have deleted the affected apks from my releases

- I have deleted all my error data from bugsnag

- I have deleted my bugsnag project and rotated my api key, so lingering error reports will be dropped

- I have audited my code for use of the session object to ensure nothing else like this is happening

What you should do:

- If you're logged in with your private key, log out

- Hard refresh the page to ensure you have the latest version of Coracle

The bottom line is that if you signed in to Coracle with your private key, it has been shared with me and with bugsnag. In practical terms, your keys should still be secure, since they were sent over TLS, and have been deleted. But there is no guarantee I can offer that they are in fact gone.

I take my users' privacy seriously. My error reporting implementation doesn't record user IPs, it redacts identifying data, and it allows users to opt-out. I also warn the user when they attempt to enter an nsec into a text field. In this case, I simply screwed up, and I sincerely apologize. Reply to this note if you have any questions.

This is why I use nos2x :-)

I really wish nos2x had some kind of support for understanding what it's signing. Like a template that says "you can always sign an event that looks like this, with this varying part" or something. Specifically thinking of how I get prompted to sign like 30 22242 events, but as long as it's to a relay I've pre-approved I'm ok auto-approving. (nos2x kind of does this already, but it only keeps track of the kind, but I don't want to blanket allow 22242s)

Replying to Avatar Ademan

nostr:nprofile1qyw8wumn8ghj76r0v3kxymmy9e3k7unpvdkx2tn5dahkcue0qy2hwumn8ghj7un9d3shjtnyv9kh2uewd9hj7qgwwaehxw309ahx7uewd3hkctcprdmhxue69uhhyetvv9ujuam9wd6x2unwvf6xxtnrdakj7qpqjlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3q87k8ew I don't know if it changed but this is what the response from nos2x is. Why is coracle trying to use nip44 encryption to update my follow list? I do have encryption denied right now so it's correct that nos2x is denying the request.

Oh wait, that's in the nos2x client library anyway lol, so yeah I guess it's a nos2x bug?