I mean I could market my own project "noscrypt, you can't get pwned with bad rng because it doesn't private that API", but I don't because Im sure my single person project with even the best test coverage and paid audit is still going to miss something. I'm going to do my best to present it reasonably and be honest and up front about it's tradeoffs.

Of course not, but I don't think that's what were talking about here. I don't think many or possibly even most bugs exist out of malice or even greed. It's not feeding an ecosystem that lives in the black and white. I think it scales with the size of the organization. I don't think anyone should market their project on the faults of others. Humility goes a long way. Hubris catches up to us all eventually.

I'm saying even after all of the worlds best practices bugs still exist. Everything short of formal verification, and hell even that might still have issues.

I think it goes even beyond that into academics. You sit in a crypto class and you learn first about discrete logs, and the onetime pad. You sit through physics and learn about Descartes, then you learn about newton because decart wasn't enough, then maxwell because maybe newton fell short, and eventually Einstein because all provable physics has limitations... There is nuance to everything yet people want to hear black and white.

> A simple firmware update could fix this Sorry, it cannot fix it, but they could have created a migration path, and made the hardware usable AND probably as secure as they claimed it was.

I don't know that it had to kill their reputation. A simple firmware update could fix this. Among nostr users it's because the repeated poor behavior toward plebs, devs, competing projects, open source and the list goes on. Everyone is going to make mistakes. And it's almost always a single line of code. It's a shame that it has to be this way imho. I like to think I have all 700k loc of my main projects completely memorized, but I know even if I do, there are bugs somewhere I haven't found yet. The only perfect code is no code.

less code running on device. Smaller test/audit surface area (formal verification)

I had a bad merge somewhere and it wasn't set to anything so unlimited... Which honestly shouldn't have been an issue on my setup, but some of the backend stuff I'm running can't handle more than like 50 descriptors or it OOMs.

lol always set max_conns in your nginx upstream config.... always.

I believed the unicorn farts myself until I followed him on socials...

GM nostr. I saw an completely AI generated television ad for one of those high budget sports betting platforms.

Prediction: NVK when a CC firmware patch is published

Feishin (subsonic music player client) apparently has a leaky audio buffer somewhere. Random parts of previous songs are getting played back. At least it's a funny bug.

Your llm slop is not helping the situation. pls stop.

So here is the cool part about bitcoin. You can move your funds (as many times as you want) if you smell danger of compromise. You can't rotate your nsec. I hope you all used secure RNG for your nsec, esp if your an onchain zapper.

My electricity has increased a little over $.02/kwh since January, probably closer to $.03.

At this point I worry more about my outbound firewall than my inbound... Modern slopware blows.

Use claude to "Design and implement scalable, secure and maintainable solutions" is an oxymoron.

VeraCrypt source mirrored - https://git.vaughnnugent.com/cgit.cgi/veracrypt/veracrypt.git/