I'm very happy to see these vulnerabilities fixed in a timely fashion, but Mercury went public releasing a patch and publishing my report without even asking me for a review first. The first I heard about this patch was Tom Trevethan's twitter post a few hours ago.
Mercury's bug bounty program offers only 800 GPB for a critical loss-of-funds vulnerability. Rather than chasing Mercury down again for another mediocre payout, after this experience i'm more inclined to just hold onto any new vulns I might find and exploit them later, if mercury ever sees wider use.
Oh well, it's their code i suppose. To be fair, Tom made clear they treat Mercury Statechains as unsafe prototype software, and clearly tell people not to use it with mainnet funds. Vulns like these are why.
Remember kids, if a dev tells you not to use their own code with real money, you should listen!
References:
nostr:note13jcuax3zmupdld2egn8ew9n0jru4p4fd0e82csz499ugnyrj8jvs4vhqmw
https://x.com/mercurylayer/status/1832062894428545114
The vulnerabilities are described in detail on my blog here: https://conduition.io/code/mercury-disclosure/
I just found out... there's a NIP for publishing discreet log contract messages on Nostr?? This is a crucial step for DLCs on Bitcoin. The present bottleneck for DLCs seems to be: How do I become an oracle? How do I find trustworthy oracles? NIP-88 would let us build apps which answer those questions.
https://github.com/nostr-protocol/nips/pull/919
Combine this with ECash DLCs and we could have scalable, instant, completely private micro-contracts, which are discovered over Nostr and settled in ECash.
https://github.com/cashubtc/nuts/pull/128
But even if you don't like ECash, this NIP is still incredibly important. Kudos nostr:npub1u8lnhlw5usp3t9vmpz60ejpyt649z33hu82wc2hpv6m5xdqmuxhs46turz
cool post from nostr:npub1l6uy9chxyn943cmylrmukd3uqdq8h623nt2gxfh4rruhdv64zpvsx6zvtg
https://conduition.io/coding/ticketmaster/
My friend sent to me,
"Wait I know this person, they wrote some incredible FROST posts and are on nostr!"
Articles like this are what happens when the "bored cipherpunk" and "frustrated customer" venn-diagrams overlap 🐒
Journalists have recently been contacting me about this article because of the big Ticketmaster hack recently. It's silly that they need some amateur like me to fact-check the erroneous PR statements issued by a multi-billion company.
Had an idea for scaling submarine swaps into a multi-party protocol, and got some interesting results. Have a look:
https://conduition.io/scriptless/multi-party-submarine-swaps/
I made a PR into electrs to improve transaction broadcasting privacy.
I couldn't find any reliable spec-compliant DLC oracles for real-world events, so I made my own. Meet Cassandra 🕵️♀️
Announcing: Harbor, an ecash desktop wallet for better bitcoin privacy.
https://blog.mutinywallet.com/harbor/
Privacy for the common person is a value worth fighting for. When we see a lack of freedom tools, we must build them into existence. They don't appear on their own.
Much has been said about privacy at the Bitcoin protocol level. For now, we build it on higher layers where we can be more nimble.
Ecash is a tool available today that combines with Bitcoin to bring new levels of common privacy. Cashu and Fedimint are two existing implementations we're interested in.
Harbor Privacy: All communication runs over Tor. Mutiny is not in the middle of any connections or transactions. Funds in the wallet get a Privacy Score to show how the mints provide privacy over time. More to come on this in the future.
Harbor Multi-mint: Instead of relying on a single mint with your funds, spread the risk over dozens or more. Harbor manages this for you, showing you a single balance while connecting with mints for you. A mint can go offline with minimal impact on you.
Harbor Automation: Running as a desktop app unlocks ability to do long running processes in the background. Move money in and out of mints on your preferred schedule to maximize your desired level of privacy. Harbor makes suggestions, but you are in control.
Move money in and out of Harbor using Lightning or on-chain. We love Bitcoin, and we love privacy. We hope Harbor gives everyday people more privacy and peace of mind.
Excited to see how it turns out! Ecash is a great opportunity to create a layer of fungibility on top of lightning. I for one will be ready to come aboard 🧑🚀
I wrote a draft NUT for Discreet Log Contracts settled on Cashu
You can settle Discreet Log Contracts with Chaumian ECash!
https://conduition.io/cryptography/ecash-dlc/
nostr:npub12rv5lskctqxxs2c8rf2zlzc7xx3qpvzs3w4etgemauy9thegr43sf485vg and other ecash devs: Do you think this would make a candidate NUT extension on the cashu spec?
Feedback appreciated 😎
Lol, Tim Ruffing did a funny and I don't think anyone noticed:
[1] It's so bad, we can't even agree on a spelling. BIP340 spells it "X-only", some people write "x-only", and some write "xonly", probably in order to save a byte
😆
https://github.com/jonasnick/bips/issues/32#issuecomment-1177725159
I've been working on FROST+taproot lately and the xonly nonsense easily accounts for 90% of the complexity.
https://github.com/ZcashFoundation/frost/pull/584
I'd be curious if anyone has actually done the math to compute how much xonly has saved us in block space.
...only for the inscription meme lords to slide in and use 100x that space for jpegs.
If you can, i would suggest running your own lightning node. Then you can use a remote access wallet like Zeus to interact with it.
Privacy and self-custody services with a central point-of-failure are not stable long-term.
https://www.nobsbitcoin.com/agoradesk-localmonero-shutting-down/
https://www.nobsbitcoin.com/zksnacks-to-suspend-its-coinjoin-coordination-service-on-june-1st/
https://www.nobsbitcoin.com/samourai-dojo-v1-25-0/
https://www.nobsbitcoin.com/phoenix-wallet-to-be-removed-from-us-app-stores-on-may-3/
https://www.nobsbitcoin.com/sparrow-wallet-v1-9-0/
https://www.nobsbitcoin.com/samourai-wallet-founders-arrested-and-charged-with-money-laundering/
The cull we're seeing in the past couple weeks is just the beginning, but it's a good sign: They're pushing back because we're gaining ground.
If you want to run a privacy business, i see 3 choices:
- Decentralize your business (no single PoF)
- Mask yourself (build pseudonymously)
- Comply (by KYCing)
Did they seriously upload entire xpubs? Not just addresses?
Can i see a source on that?
PayPal Proposes Scheme To Selectively Mine With ESG Compliant Miners
The paper proposes routing transactions to whitelisted 'green miners' using low fees and a 'locked' BTC reward in a multisig payout address.
https://www.nobsbitcoin.com/paypal-proposes-scheme-to-selectively-mine-with-esg-compliant-miners/
This scheme doesn't scale.
If every TX used paypal's approach, the 'green miners' would end up with thousands of dust UTXOs which they would need to clean up, every single block. Network throughput would drop significantly.
With standard bitcoin fee subsidy, all miner fees are automatically consolidated in the coinbase transaction: No dust to clean up.
Not to mention the fact that this approach doesn't necessarily require the miners to use green energy to mine the TX - it just incentivizes a particular arbitrary set of miners to mine the TX. Those miners could pay off a different non-green miner to mine the TX, because it is still consensus-valid.
Paypal's idea is just a roundabout way of reinventing the same open fee market which already exists, but with a lame attempt at green-washing.
nostr:npub1hea99yd4xt5tjx8jmjvpfz2g5v7nurdqw7ydwst0ww6vw520prnq6fg9v2 How do you feel working on Sparrow Wallet, now that we're seeing the US government prosecute the Samourai devs?
No problem 😁 great choice
BREAKING: Samourai Wallet Founders Arrested & Charged with Money Laundering, Unlicensed Money Transmitting Offenses
- The charges include conspiracy to commit money laundering and conspiracy to run an unlicensed money transmitting business.
- The Samurai Wallet website has been confiscated, and a seizure warrant for Samurai's mobile application has been submitted to the Google Play Store.
https://www.nobsbitcoin.com/samourai-wallet-founders-arrested-and-charged-with-money-laundering/
Responded on github about this. For your particular case, using --no-rest-tls is unsafe. However generally speaking, i should probably add a flag to allow plaintext connections as there are some cases where it is safe