**Security Update**

I've got some bad news for you guys. This morning, as I was adding error handling to flotilla, I discovered that Coracle has been sending user session objects to bugsnag when reporting errors.

Who is affected: Users who triggered an error in Coracle while signed in with their private key, since December 5th 2023.

What I've done:

- I immediately released a new version of Coracle, both to web and to zap.store

- I have deleted the affected apks from my releases

- I have deleted all my error data from bugsnag

- I have deleted my bugsnag project and rotated my api key, so lingering error reports will be dropped

- I have audited my code for use of the session object to ensure nothing else like this is happening

What you should do:

- If you're logged in with your private key, log out

- Hard refresh the page to ensure you have the latest version of Coracle

The bottom line is that if you signed in to Coracle with your private key, it has been shared with me and with bugsnag. In practical terms, your keys should still be secure, since they were sent over TLS, and have been deleted. But there is no guarantee I can offer that they are in fact gone.

I take my users' privacy seriously. My error reporting implementation doesn't record user IPs, it redacts identifying data, and it allows users to opt-out. I also warn the user when they attempt to enter an nsec into a text field. In this case, I simply screwed up, and I sincerely apologize. Reply to this note if you have any questions.

What’s a song you keep going back to? #asknostr

Something I’ve noticed since I lost Phoenix wallet, is that our ability to communicate or “partner” between projects is kinda horrible.

Example: One of the best ways to get new users sats without any onboarding friction have been services like Fountain and Zebeedee. Yet literally none of the wallets will read or accept a withdraw from those services. Phoenix was the only one that would just do it.

Then the same problem with Cash App, which is easily a dominant service for buying and using #Bitcoin and now #Lightning. Yet none of my wallets will let me enter in an amount if the invoice is for zero sats… which all Cash App invoices are blank.

I thought these would just be growing pains about a year or 2 ago, but neither have changed at all in that time span. Are the wallet builders just not using their own wallets?

(I’ve had a super shitty day so if this is overly critical I apologize, but for lightning to also be a pain in my ass today is just icing on the cake. I’ve tried 5 different wallets and 2 different UI for btcpay trying to get a simple withdraw from Fountain to work)

Wise people never trusted him in the first place, the rest should have gotten the message with the bitclout thing. Saylor made a big mistake legitimizing him.

You are not really supposed to „send“ to npub.cash yourself. It acts as Lightning address for you. Like a post box for payments

Are you using nsec bunker / nip-46? Try clearing the cache.

Claiming on Cashu shouldn’t show a qr code. Just text and buttons. Animated QRs coming next week 🤙

For about seven months after publishing Broken Money, I was so burned out from writing. I had written that book within a year, while also writing public articles and private client reports as usual. So I was basically just absolutely dead in terms of writing, had pushed myself a bit too far, and was kind of phoning it in for articles and reports the next few months with gradual recovery.

But within the past couple months, my writing energy has fully returned. So many articles in the pipeline, in various states of development!

Hey! npc maintainer here 🤙

That would indeed be awesome, however your browser / system decides how to handle „cashu:“ links. You can copy the token manually by using the copy button, or selecting the token inside the text input and copy it

Claiming the token will open a wallet on your device that supports deep linking (a link that opens an app in a specific screen)

If you habe multiple wallets that supports the "cashu:" deep linking, your device will ask you which one you want to use.

However, there is a bug in eNuts during deep linking, resulting in this error "token invalid or already claimed". A workaround would be to manually copy the token and press receive in a cashu wallet of your choice.

Restoring can take up to multiple hours depending on how many signatures the mint has issued in the past.

Which version are you running?

If you already enjoy #eNuts, you will fall even more deeply in love with it soon. Here are some of the highlights we are working on:

- Simplified payment flows

- Improved seed restore process

- Support for device local-authentication (PIN, fingerprint, facial recognition, depending on the user's device settings)

- Expanded color variations for each theme, along with additional themes

- Russian and Chinese translations

- Major navigation improvements and bug fixes

- Significant UX enhancements and a fresh polished UI, providing a much smoother native experience on both Android and iOS platforms

Plus, we are enhancing the project maintainability by implementing crucial end-to-end test suites 🤓

Prioritizing improvements to existing codebase over adding new protocol elements.

👀⚡️🌰

#m=image%2Fjpeg&dim=720x1368&blurhash=%5D02r%7Bqj%5B00WB%7EqxufQM%7Bj%5Bxu00ay%7Eqof009Fjt%3Fbay9F%7Eqj%5B00WB%7Eq%7EqfP00j%5B_34nay_3of4n00f6%7Eqj%5B00%25MofIURj%25M&x=8eec8e5cc8a3046734227aa67accd4d502083d160a3039ee9d3909ac9a88123d

#m=image%2Fjpeg&dim=720x1396&blurhash=%5Di9JPOj%5BWUayju*Gjuayayj%5BVtayfjj%5Bj%5BR7ayayj%5Bj%5Bo%7Cayayj%5Bj%5BoyfQa%7BfQfjV%5Bjuj%5Bayayayjuj%5BayayoyfQfQfQa%7B&x=2e33b78ce91c4478d39ee9e8d9060957ac5e8a93423e20fa84a3502567a34c8a

#m=image%2Fjpeg&dim=720x1370&blurhash=%5D13lU6yC4%3AIU-ov%7CIB9Gxu_2%3FG%25M9GRQ%250VskBNaoyxZV%40R%25x%5DbHo0M%7DWB%25MRkMyD*ju%25LozIoE2ofxWfkIpI%40kC%251a%7BE2&x=5d74808ffa8363fcfaff694755603fd5ba6be1b272406b10bd06a09960ad277a

What if you click the "pending X sats" ( with refresh symbol)? It will show if this ecash value is still pending (not spent or at least not received)

Most likely possibility: did you (by accident) create an ecash-token of 15000 (e)sats? If thats the case you can click the outgoing '15000 Ecash' under 'History', it will open a popup with QR, (the ecash-token) click 'copy' to copy a cashu textstring, and 'close' to close the popup.

Then click 'receive' in mainscreen and paste the cashu textstring into the textbox and click 'receive' to redeem the token in your own wallet