Avatar
openoms
aac07d95089ce6adf08b9156d43c1a4ab594c6130b7dcb12ec199008c5819a2f
Bitcoin | Lightning | Blink | RaspiBlitz on RPi and more | Self-hosting | Enjoyer of Linux Desktops and GrapheneOS | building hardware at diynodes.com

Loading the Satochip java applet to the javacard is what I refer to as the DIY version of Satochip. It takes seconds to prepare them. Here are my notes, follow the links and readmes in the linked repos for more details: https://gist.github.com/openoms/510b2876cab19e15c4190456ea8aad82#file-satochip-javacard-applet-install

It does store the private key and does the signing also.

It only not capable of generating the seed itself so that is needed to be loaded once from an external source using Sparrow Wallet, Electrum Wallet or the modded Seedsigner.

Once the seed is in the card it cannot be exported and the signing is protected by a 4-16 character PIN.

Replying to Avatar openoms

Planning to show this setup tonight:

Truely FOSS Satochip javacards https://github.com/Toporin/SatochipApplet initialized with an airgapped, stateless nostr:npub17tyke9lkgxd98ruyeul6wt3pj3s9uxzgp9hxu5tsenjmweue6sqq4y3mgl .

The cards act as a hardware wallet without a display, but with a PIN protected secure element. Mess up the PIN 10 times and the card is bricked. Blanks cost ~2 dollars with chip, ~5 dollars with NFC support. Can compare with #TapSigner, #BitKey and alike.

Find the modded images supporting the smartcard readers here: https://github.com/3rdIteration/seedsigner/releases

Parts:

- a generic smartcard reader (here ACR39U https://a.aliexpress.com/_EzkLWc9 + microUSB adapter)

- can use the same cards as the SpecterDIY

Notes: https://gist.github.com/openoms/510b2876cab19e15c4190456ea8aad82

nostr:note1hatuatxl5hajvh6xdfy3pqkuc0hna2azaap3y6sza3nc6jnpk7lsz7tlkv

Wrote a quick guide about using an initialized Satochip smart card with Sparrow Wallet: https://github.com/openoms/bitcoin-tutorials/tree/master/satochip#get-started-with-satochip

As these javacards are essentially $5 hardware wallets (with no screen, but using a Secure Element) are great to give bitcoin in a physical form.

This short guide is for the ones receiving them.

To initialize the cards one could use TailsOS offline with Sparrow Wallet or Electrum or a modded version of Seedsigner: nevent1qvzqqqqqqypzp2kq0k2s388x4hcghy2k6s7p5j44jnrpxzmaevfwcxvsprzcrx30qyw8wumn8ghj7mn0wd68ytngw4eh5mmwv4nhjtnhdaexcep0qy38wumn8ghj7mt4d36xjurvv4ux2u3wdp6hx7n0dejkw7fwwahhymry9uqzpaca0y00n4qs4k5drhwaz99vuy78r6ddqxu7hwxy8xghj45knkh5jgfqlz

To work with Bitcoin Core v28.0 LND needs to have

deprecatedrpc=warnings

set in the bitcoin.conf

https://x.com/roasbeef/status/1842956355516223824

Electrs needs to be updated to the latest version: https://x.com/roman_zeyde/status/1842937024967327932

Tracking issue in Bitcoin Core: https://github.com/bitcoin/bitcoin/issues/31039

H/t Ketominer of https://nodl.eu for reporting the issues.

Testing to use renepay instead of the default pay plugin with CLN v24.08.

Payments got much more reliable with nostr:nprofile1qqsrf5h4ya83jk8u6t9jgc76h6kalz3plp9vusjpm2ygqgalqhxgp9gpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qzrthwden5te0dehhxtnvdakqz8thwden5te0dehhxarj94c82c3wwajkcmr0wfjx2u3wdejhgjaa6xr and nostr:nprofile1qqs8u5uf0rd2p9wmdxxaznpn54tkq8wwspmljy0cjqw6jdgm5kv84dspp4mhxue69uhkummn9ekx7mq20qgpe

Might make it an option in the #Raspiblitz: https://github.com/raspiblitz/raspiblitz/issues/4777

You can just download a small translator plugin to try.

Let me know if it is useful.

Headscale is a coordinator server, it needs to be publicly exposed for the tailscale clients to be able to connect out to it.

Your node at home is typically behind a router NAT and firewalled. It should remain that way.

Tailscale can be used as a VPN if you advertise an exit node on any other client and connect to it. Your IP address would appear as the public IPaddress of that exit node. This is independent from using Headscale or the Tailscale coordinator.

First step to be added: https://github.com/raspiblitz/raspiblitz/issues/4756

Was planning to try for myself anyway. Wonder how all functions work as an onion service? Tunnelling it to a VPS serving a clearnet domain is not that trivial task, but

Tailscale makes it easily as possible if one has a VPS and (sub)domain to use.

Noted! Was just working on adding Styrfry https://github.com/raspiblitz/raspiblitz/pull/4721 and Bostr2 https://github.com/raspiblitz/raspiblitz/pull/4724 recently.

Moving to 2 TB disks suddenly opens new possibilities.

Replying to Avatar steepdawn974

I hear you. But It is one thing to trust the binaries (apk) represent the published code on GitHub;

at least there are people like nostr:nprofile1qqsydl97xpj74udw0qg5vkfyujyjxd3l706jd0t0w0turp93d0vvungppemhxue69uhkummn9ekx7mp0qy08wumn8ghj7mn0wd68yttsw43zuam9d3kx7unyv4ezumn9wshsz8thwden5te0dehhxarj9ekh2arfdeuhwctvd3jhgtnrdakj70vc385 who check the builds for us.

Yet not even having the v0.2.3 and v0.2.4 code on GitHub, while binaries of these versions are being distributed via app stores for quite some time.... is pretty meh.

At the very least, unprofessional.

And yes, everybody should install from GitHub/Obtainium 👍

PS: I wished more projects publish Dockerfiles for builds, so regular normies can build themselves. The Build process is oftentimes so poorly documented, and/or requires manual steps that it's just a pain in the ass to build apks yourself, so ppl just trust whatever is published.

Agreed, it looks unprofessional and leaves space for potential malice. They should do better. We all should strive for better.

The code can be shared while the internal development is kept private. Testing, iterations etc are not needed to be shared. It is a scale, but always the open process is preferred.

Until there are reproducible builds the apk-s cannot be checked anyway.

The Google Play versions cannot ever be reproducible due to the signature being part of the apk (correct me if I am wrong).

Reviewing the code and building for myself would be better, but until then I at least use Obtainium to grab the binaries from github.