Lawrence Nahum

#Bitcoin. open source enthusiast, founder @GreenAddress, ex-CTO @Blockstream

[Lawrence Nahum @LarryBitcoin]

@KLoaec @MrKukks afaik it had a mode to use a separate device to verify what it was signing (it acted as a hid keyboard) @BTChip

[Lawrence Nahum @LarryBitcoin]

@zherbert @francispouliot_ @KevinR4v mostly no but in theory you could detect differences in power usage or differences in the impedance on the SPI bus but I think an attacker might be able to bypass those

[Lawrence Nahum @LarryBitcoin]

@odudex @FractalEncrypt @X have you tried to see if there's any difference with a VPN?

[Lawrence Nahum @LarryBitcoin]

@dhh

[Lawrence Nahum @LarryBitcoin]

@theinstagibbs just in case: https://t.co/NPQNXCQLqR

[Lawrence Nahum @LarryBitcoin]

@theinstagibbs I saw a presentation at last ccc re gpg that you should not watch if you want to try to sleep tonight

[Lawrence Nahum @LarryBitcoin]

@dhh @NetworkChuck I really like the work put in Omarchy but I think a lot of defaults might require revisiting for security and it would be amazing if Omarchy took a page or two from Qubes OS (virtualize all "apps" as xen vms) without losing look and feel or the customizability

[Lawrence Nahum @LarryBitcoin]

@PavolRusnak can you add amd xtx 7900 24GB please?

[Xapo Bank @xapobankapp]

We are so back..?

[Lawrence Nahum @LarryBitcoin]

@BTChip @SpecterDIY

[Lawrence Nahum @LarryBitcoin]

@BuzzLightyearz_ ->

[James O'Beirne @jamesob]

Very interesting. Looks like strong possibility that `switck`, the account writing the buggy libngu library that caused all this, was actually Peter Gray (@DocHex), CTO of Coinkite.

This is the same guy that shrugged off my report of the possibility of the defect in May 2025.

[Lawrence Nahum @LarryBitcoin]

You know why switck and Peter Gray share the exact same GPG key?

They both generated it on a Coldcard

Nota bene: the key is from 2013. The Yasmarang RNG fuckup only started in 2021.
It’s realistically the same guy.

[Lawrence Nahum @LarryBitcoin]

@adam3us @BitcoinPierre @COLDCARDwallet @Adelgary you can use micropython or other but for example have to be extra careful with garbage collector and immutables, secrets might be kept around for longer than necessary, harder to zero/clear, etc - and yeah I don't know if micropython or Arduino are designed for security generally

[Lawrence Nahum @LarryBitcoin]

@_D_TM_ @prochronist @BlockstreamJade CC was technically not open source. I mean, it was for a short while when they used trezor code but it became technically not open source in the same change they updated the rng and honestly between this and the attituide of the company I can understand people not auditing

[Lawrence Nahum @LarryBitcoin]

@Mandrik @Excellion alive and well, how are you doing?

[Lawrence Nahum @LarryBitcoin]

@JWWeatherman_ @Blockstream @blocks also worth saying, same amounts means different things to different people. a multi millionaire may treat 1000 usd like pocket change, it might be a different thing to many others, but I don't disagree with you anything better than nothing

[Lawrence Nahum @LarryBitcoin]

or time travel is involved

[Lawrence Nahum @LarryBitcoin]

@slush did you try Kimi K3 or Qwen 3.8 max? I'm curious how they compare

[Lawrence Nahum @LarryBitcoin]

@JWWeatherman_ fallback no I agree but mixing lots of sources including some weak ones can't but help. as long as the sources are otherwise independent any extra source in the mix can't make it worse