Avatar
Dr. Hax
d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511
Cypherpunk. Infosec veteran of about 15 years (vulnerability research, exploit development and cryptography). Cypherpunks write code. :-) Signet maintainer. Self-custody your passwords... in hardware! https://hax0rbana.org/signet Want to see wider adoption so Bitcoin can be used as digital cash and not just an investment vehicle. XMR: 44RDkTFmTeSetwAprJXnfpRBNEJWKvA5dBH5ZVXA4DofgoZ9AgjyZdSa2fo7pMD3Qe3pdKga8X22y3Lyn1xYde5kPQPzVUu

I just saw a #spam / #scam email that looks like it's linking to content on #IPFS, via a web gateway.

That's a pretty clever way to host your crap, honestly. Just pop some boxes and have them host content on IPFS. No need for forwarding ports and it's available on clearnet for victims to click on.

Plus, the URL looks like it's cloudflare (and for all I know it may actually be them), so all those products who pass judgement on domains based on how old they are and all that, they fall flat on their face.

I mean, that strategy usually falls flat on its face, but usually it is because attackers just register a recently expired domain that had a good reputation. It's a pretty standard and reliable bypass for all those crap #security products.

I'm just entertained to see something in the wild that shows the #scammers have figured out this trick.

I like having the url under the QR code. I'll type in a URL far more often than I'll scan a QR code. Having both serves everyone.

Slight preference to omit the politician part. It seems like an unnecessary jab at people who still believe their vote makes a difference. Participating in a democracy is not mutually exclusive to using bitcoin. I'd rather see people focus on things we can agree on whenever possible. But then again, I'm a corny🌽, posititivity guy. 😆

A quote from the linked page:

"More than 40 diseases and 2.8 million deaths were fully attributable to alcohol in 2016, which has aroused widespread concern and caused substantial health loss (4, 5). The American Society of Clinical Oncology (6) stated that alcohol is a cause of cancers of the oral cavity, pharynx, larynx, esophagus, liver and breast cancer."

nostr:nevent1qqs03sugmhgfmt583a590ly8763fckgkvw5dr5l63lu3ulwmk8mgghcpp4mhxue69uhkummn9ekx7mqzypqdhgyxy730935uxqckvc2fk4n3drcynz225hzzyqarjg9rm6zgxqcyqqqqqqgw7x6l5

This sounds like RFCs, W3C standards and most others. Pretty much all standards lag.

There's almost always **at least** one implementation that has been tested, they figure out what works well in practice and then write it up and submit it to the standards body.

I think that's generally fine. It becomes a problem when there's a near monopoly. When Google makes Chrome do something non-standard, convince web developers to quickly depend on it, and then users get mad when their other browsers don't work. Then others browsers implement the new thing, and at that point the standards body might as well accept it since it's already a defacto standard.

Maybe that's the case here, but I maintain that the problem is not that we have a free market of ideas where people can implement whatever they want, but that a single client has gotten enough sway to make everyone else feel compelled to immediately follow suit.

Yeah, I used to run a practice and lead a team of people who did software security audits, so I've spent a good deal of time thinking about how to go through all the relevant code as fast as possible and make sure nothing was overlooked.

I appreciate it when:

I. Code is really small, or failing that

II. It's architected in a way that I can be confident that a failure in one part of the code won't affect another part of the code

Just to be clear, I'm not recommending btcd because I don't have any experience with it, but I do think that having ecosystem diversity is a good thing.

HELP

Building a new node, planning to run latest Bitcoin Core (25.0) - never read any code from bitcoin core until now.

Looks like a massive codebase. I have rudimentary knowledge of C language. I'm clicking through a few pages of the code, wondering how can I trust a codebase I don't fully know. I guess trust is inevitable? Even in a "trustless" system?

Just the fact that it is open source, and *someone* would be double checking the DEVS?

Because what if an organization paid off all the Devs at simultaneously to plant a malicious code line deep in the code, that intelligently sabotages the security or efficacy in some intelligent, genius way, to critically or catastrophically damage the network? This is massively more practical and dangerous than the classic, infeasible "51% sustained attack".

On github it looks like literally only a handful of contributors doing the Lion's share of commits. Isn't this the most practical potential weakness of bitcoin? How can we mitigate as plebs? Is the only way to dedicate ourselves personally to reading the full code and grokking it entirely, as well as every release?

Or just run the release on my node and "trust"? Fuck, man. Is it more important to have a full node running asap (now) to be "sovereign and decentralized", and move on with other important projects, despite not having the months/years of firsthand code verification to really know it is free from potential malicious lines?

Like who has actually read the full code and understood it to gauge the integrity, besides those full-time devs on github?

Any thoughts appreciated...

First, the latest is v26

Second, I believe there are other implementations of Bitcoin (however I expect bitcoin core makes up >50% of the nodes, so a vulnerability in core would still be a huge risk)

Third, you don't have to read all the code to determine certain security properties. For example, lets say you are concerned with your private key being leaked. Just read the code that processes the private key. The code that validates blocks, doesn't matter for this purpose.

So you have to know what it is you are trying to prove, but then it becomes a much more managable task.

A quick search turned up this alternative bitcoin implementation: https://bitcoinmagazine.com/technical/btcd-a-full-bitcoin-alternative-written-in-go-1368114292

It's a centralized service... these things happen sometimes

I finally broke down and bought a new motherboard (using #bitcoin) to try to determine if the issue is #Qubes 4.2, or the motherboard. I strongly suspect the latter.

If so, I don't know if it's a UEFI firmware issue, a defective unit or if this make and model always mucks around with hidraw devices. Frankly, at this point, I don't care. This has taken up enough of my time and I'm not going to fall for the sunk cost fallacy this time.

Maybe someday, when I have copious amounts of spare time, I'll continue trying to solve this mystery. But that ain't today!

A local #bitcoiner gave an excellent technical overview of how lightning network works. It's the best explanation of #lightning that I've seen to date!

https://yewtu.be/watch?v=0X35ca9f16I

Replying to Avatar Bill Cypher

Don't forget the staying humble part. ❤️ They are welcome to join the community now, if they're ready.

We stsrted the seed sprouting lab in our house today. 15 peppers (3 different varities), 8 eggplants, some marjoram, some ginger, and some more turmeric.

I want this year to be amazing in terms of food production. It takes a lot of effort, but I think it's worth it.

#GrowNostr #gardening #food #foodstr #homestead #homesteading #prepper #prepping

In related news, I have a full node up and running, but it's not syncing any blocks because I have blocked all but a few outbound connections at the router layer. Once I open up TCP/8333 from that server to the internet zone, it should "just work".

nostr:nevent1qqsz5fgq7ywgxxewzk7g5lrp646acjd5nywth8mtdfk5hv89r3uxmwspzemhxue69uhkummnw3ezumn0dahx2uewvdhk6q3q6v82nr4xt62nlydtj0mtxr49r6enc5r0sl2f7cq2zwdw7q92j5gsxpqqqqqqzvd9crl

In related news, my outbound firewall that blocks all but a few ports (8333 being one that is blocked by default) is working perfectly.

So I'll need to add an exception for this new box.