raph

code sculptor and ordinal theorist

[raph @raphjaph]

@wooknponub @Rob1Ham https://t.co/YSdySE0VCi

[raph @raphjaph]

This is the equivalent of a bouncer checking your ID for holograms, special UV ink and correct microprints but then failing to check that the picture on the ID is actually you...

[raph @raphjaph]

@realizingerin More like saved by AI. My stupid human mind couldn't see the tautological comparison across the call chain.

[raph @raphjaph]

This is the equivalent of a bouncer checking your ID for holograms, special UV ink and correct microprints but then failing to check that the picture on the ID is actually you...

[raph @raphjaph]

Critical vulnerability in the bip322 Rust crate: BIP-322 proofs for P2WPKH and
P2SH-P2WPKH addresses could be forged with any attacker key. Full
address-ownership bypass. Fixed in 0.0.11, affected versions yanked. If you
verify Bitcoin address ownership, please upgrade now.

[raph @raphjaph]

Full advisory: Full advisory: https://t.co/hDkOeUIKsr

[raph @raphjaph]

Critical vulnerability in the bip322 Rust crate: BIP-322 proofs for P2WPKH and
P2SH-P2WPKH addresses could be forged with any attacker key. Full
address-ownership bypass. Fixed in 0.0.11, affected versions yanked. If you
verify Bitcoin address ownership, please upgrade now.

[raph @raphjaph]

Timeline (continued):

- 08/02/26 @ 13:35: Maintainer acknowledges disclosure receipt
- 08/02/26 @ 14:51: 0.0.11 released, 0.0.6-0.0.10 yanked from https://t.co/UXILfZugoO
- 08/02/26: Private outreach to anyone using bip322 crate
- 08/14/26: Public disclosure

[Casey @rodarmor]

Not to add further chaos to the timeline, but the degenerate runes gambling feature that I added in 0.28.0 can cause users to lose runes, so I just released 0.29.0 which reverts it.

It was not a bug, per se, but a different kind of oversight 🧵

https://t.co/AgUPRjlEMD

[lifofifo ◉ @lifofifo]

You can now contribute to the Open Ordinals Institute @ordinalsorg when buying on @ord_net ⚡

A simple way to support the protocol while you collect.

[lifofifo ◉ @lifofifo]

Ordinals are now BIP-110 ready.

https://t.co/87qBMp0wRm

[Casey @rodarmor]

Inscriptions now have social media image previews and it only took three and a half years 😅

https://t.co/gt63Un2UXy

[Craig Raw 🐦 @craigraw]

My attempt to protect users from scam apps on the @AppStore has gotten my Apple Developer account flagged for termination - ironically, for "dishonest activity".

Unless it's reversed by June 30, all new installs of Sparrow Wallet will fail, and development on macOS will end.

The context: since 2023, more than a dozen fake "Sparrow" apps have appeared on the App Store, as recently as April this year. Users have contacted me after losing their savings, in some cases their life savings, to these impersonators.

I'm the developer of the real Sparrow Wallet, a desktop app, and I hold the registered US trademarks for the name and logo. I have publicly warned @Apple and the community about these fake apps from early 2024, but they keep appearing.

The app @Apple flagged was a placeholder that was never published. Its only purpose was to warn users that Sparrow is desktop-only and that other "Sparrow" apps aren't mine. This approach may have been misguided, but there was nothing dishonest about it.

I'm confident this is an automated misclassification that Apple would reverse on review - but I may be terminated before a human ever looks at my appeal. The cost would fall on @Apple's own users: blocked installs and no updates for a tool people rely on, which opens the door for more fakes.

If you value Sparrow, a repost would help. @AppleSupport

[raph @raphjaph]

@rodarmor If only there was a BIP number they could refer to