calle

DM @callebtc:matrix.org

Public Key

npub12rv5lskctqxxs2c8rf2zlzc7xx3qpvzs3w4etgemauy9thegr43sf485vg

NIP-05 Address

Profile Code

nprofile1qqs9pk20ctv9srrg9vr354p03v0rrgsqkpggh2u45va77zz4mu5p6ccppamhxue69uhkummnw3ezumt0d5qs6amnwvaz7tmwdaejumr0dsq3vamnwvaz7tmjv4kxz7fwwpexjmtpdshxuet5qy28wumn8ghj7un9d3shjtnyv9kh2uewd9hszxrhwden5te0wfjkccte9eekummjwsh8xmmrd9skcqg4waehxw309a5xjum59ehx7um5wghxcctwvshqswvd

Publishing to

Author Public Key

npub12rv5lskctqxxs2c8rf2zlzc7xx3qpvzs3w4etgemauy9thegr43sf485vg

Show more details

Last Notes

2026-09-12 10:50:26 UTC

- reply

🤘

2026-09-10 12:34:09 UTC

- reply

beautiful

2026-09-10 07:41:35 UTC

hey @nprofile…tyvq are you still there? users having issues with your mint

2026-09-10 07:35:18 UTC

- reply

🤘

2026-09-09 14:47:28 UTC

who's running a cashu mint here? tag below or say hi!

2026-09-08 12:40:26 UTC

- reply

*if you return the full amount

2026-09-08 11:47:07 UTC

- reply

it requires a second signer like a bunker though to make sense amirite

2026-09-08 11:17:19 UTC

- reply

what's the rotation rules? you lose a share and regenerate the 2 of 3?

2026-09-08 11:14:46 UTC

- reply

what's the rotation mechanism? regenerate new shares when one of them is leaked?

2026-09-08 11:13:01 UTC

- reply

I also love frost

2026-09-08 10:43:25 UTC

- reply

ah sweet, readme needs an update then!

2026-09-08 10:42:44 UTC

- reply

yeah I've been a user of that too though I liked pocket better

2026-09-08 09:23:03 UTC

- reply

do you have a viable path for releasing this on the ios app store if there was an iphone port?

2026-09-08 09:21:51 UTC

- reply

I'll contribute to this

2026-09-08 09:21:04 UTC

- reply

abso-focken-lutely
can you also add TTS?

2026-09-08 09:13:53 UTC

has anybody already built a free version of pocket, the article bookmarking and reading app that dissapeared?
- browser extension to save a link
- article text gets parsed automatically
- stored somewhere in the cloud or on nostr
- web, ios, android apps to read all your stored articles
- bonus: social features to share articles, follow other user's bookmarks
- bonus: text to speech via open source TTS models
- bonus: TTS transcriptions are shared between users once created

2026-09-07 18:06:59 UTC

- reply

your expectation is maybe incompatible with the solution that people want

2026-09-07 17:51:36 UTC

- reply

I don't think it's that different. also there are many different ways to design this, not all suffer from the same issues that you've described. you seem to have given up on this. that's ok but I hope others didn't.

2026-09-07 17:18:32 UTC

- reply

you basically said "it's not going to work because not everybody will implement it at the same time". but that's how every feature was built on nostr.

2026-09-07 15:28:44 UTC

- reply

I think it's largely a related issue.

2026-09-07 15:28:03 UTC

- reply

do you think it's possible? curious about your solution and why it wasn't considered.

2026-09-07 15:26:41 UTC

- reply

do you think there is no solution?

2026-09-07 15:26:18 UTC

- reply

no, do you?

2026-09-07 14:54:22 UTC

- reply

I'm also aware of the *NIPs

2026-09-07 14:46:55 UTC

- reply

I'm not saying this to offend you anon. You're probably a great dev, and I'm probably using your software. I'm grateful for all the work you're putting in.
This isn't meant to criticize you personally. I am simply stating an observation as a user who has been around here from the very early days. I'm pointing at a problem that has to do with how the collective works. It's not enough to sign JSONs and pray, a serious project needs direction and a vision.
Nostr, as a sum of its developers and visionaries, had this for a while. It doesn't have it anymore. I hope we can discover it again.

2026-09-07 14:41:40 UTC

While I'm at it – another proof that nostr devs aren't serious about adoption is still the lack of key rotation.
I get it. It's a big task and can't be solved by any individual client, it needs to be addressed on a protocol level. I'm also aware of the that were put forward. But you know what? Writing markdown and pushing it to the nips repo isn't enough. It's step 0.
This is a typical issue that would require devs to come together and all pull in one direction. It likely would have needed a champion who is willing to push for this change, talk to people, explain it to everyone, and actually care. Similar to how we push for bigger changes in the Bitcoin protocol. It takes time, and it takes a serious effort. Once again, nobody has taken over that role because nobody really cared enough.
Back in the day, there were massively big users who would've loved to join nostr – but didn't do it because of a lack of key rotation. Why would anyone with so much to lose join a protocol that can permanently rekt your identity with a simple XSS bug that exposes your nsec? Nobody listened to them.
This was brought up over, and over, and over again. Nobody cared enough.

2026-09-07 14:29:15 UTC

@nprofile…uz3y has a serious issue with muting users – it can't be that hard. The only client I haven't had issues is @nprofile…4hdy
Many nostr kind-0 devs don't realize how big of an issue this is for their users because they don't put themselves into the shoes of ordinary users who don't want to deal with this shit.

2026-09-07 14:26:41 UTC

- reply

which clients allow this?

2026-09-07 12:23:51 UTC

- reply

cool!

2026-09-07 11:33:21 UTC

- reply

you realize that liquid is a 11 of 15 federation?

2026-09-07 11:32:51 UTC

- reply

of course it makes sense

2026-09-07 09:37:23 UTC

Liquid hack explained.
Liquid has confidential transactions that hide the amounts for improved privacy. A bug in how these transactions are validated caused inflation of Liquid BTC (L-BTC) and allowed hackers to empty the entire side chain.
Liquid nodes don't see the amounts of a confidential transaction, so to make sure that the transaction is still valid and doesn't cause inflation nodes check something called a balance proof and a range proof.
The balance proof establish that sum of the input amounts equal the output amounts, i.e., that "x L-BTC going in and x L-BTC going out". But there's a catch. Only relying on a balance proof isn't enough. You also need the range proof.
The range proof establishes that a hidden output amount falls within a positive range. That means a valid output must be at least 1 L-sat and at most 2^64 − 1 L-sats. Range proofs make sure that you can't mint "negative L-BTC".
Why is this even necessary? Remember, the amounts are hidden and a hidden negative amount would allow extra positive outputs to balance against it. Without a range proof, a transaction could say "I've put 1 L-BTC in, and I'm taking two outputs out: one with 4000 L-BTC and one with -3999 L-BTC)."
This is going to cause a disaster in a little bit.
Once the balance proof, the range proof, and other validations pass, a transaction is regarded as valid and can pass consensus. However, because especially the range proof is computationally expensive, Liquid nodes cache the result of a successful range proof in memory. Essentially, the node remembers "I saw this range proof before and it was valid, all good!".
In order to recognize the same range proof later on, you need to assign a label to it. This is called a cache key. This cache key is the actual cause of the bug.
The way this cache key was constructed allowed two different transactions to collide on their cache key. Essentially, one valid transaction (1 L-BTC in, 1 L-BTC out) had the same cache key as an invalid transaction (1 L-BTC in, 4000 L-BTC out).
Here's the hack: the attackers submitted the valid transaction (1 L-BTC in, 1 L-BTC out) first. Liquid nodes verified this transaction successfully, created a cache key called REKT and stored it in their cache. Then the attackers carefully crafted a second invalid transaction with (1 L-BTC in, 4000 L-BTC out) that created the same cache key REKT.
Instead of validating the second transaction and realizing that it printed money out of thin air, Liquid nodes found it in their cache and said "hey I saw this transaction before, everything is fine" and that caused the inflation.
The attackers then took their 4000 L-BTC and withdrew 4000 BTC onto the Bitcoin base chain.

2026-09-06 12:27:04 UTC

- reply

Luke hates many things

2026-09-06 12:00:13 UTC

- reply

this just shows how little you understand what normal users care about

2026-09-06 11:51:58 UTC

I'm amazed someone would buy this crap but hey, I'm all for it, hope the price goes up a little more
#nevent1q…2pah

2026-09-06 11:49:38 UTC

- reply

the problem is it doesn't work reliably

2026-09-06 11:47:00 UTC

- reply

send butt, I'll sign

2026-09-06 11:46:33 UTC

- reply

personally I don't care about how the block works as long as it works reliably.

2026-09-06 11:45:36 UTC

- reply

helth

2026-09-06 11:45:17 UTC

- reply

tbh I don't know. I mute psychotic sickos but every now and then they reappear across clients, like STDs.

2026-09-06 08:23:54 UTC

- reply

yes it barely works though :/

2026-09-06 08:23:38 UTC

- reply

gm mostly

2026-09-06 08:23:30 UTC

- reply

40 hpw?

2026-09-06 08:23:03 UTC

- reply

🙏

2026-09-06 05:08:36 UTC

- reply

god I wish
#nevent1q…ewgx

2026-09-06 04:21:30 UTC

- reply

I'm probably in nostr's top 0.01% users but this is one of the reasons I come back less frequently than I used to.
you can talk about permissionlessness as much as you want, but you can also simply choose not having to deal with a bunch of assholes on a daily basis.
#nevent1q…9e9h

2026-09-06 04:18:21 UTC

- reply

I have a dozen sad little lonely fucks (grown men) that are obsessed with me like little gay school girls – but with paranoid schizophrenia.
I imagine this happens to anyone with more than a few followers.

2026-09-06 04:16:20 UTC

- reply

nostr is full of reply-guy psychopaths that you can't block and there isn't a single client where muting works reliably, let alone across apps
#nevent1q…9x70

2026-09-06 04:15:47 UTC

- reply

nostr is full of reply-guy psychopaths that you can't block and there isn't a single client where muting works reliably, let alone across apps

2026-09-01 09:58:57 UTC

10 likes gets you into the primal 24h trending list now!

2026-09-01 06:59:52 UTC

gm
https://blossom.primal.net/407cb2b9876e09c32db40b831733fec33ff7d0f1ec31fe4e6f32850e047605fc.png

2026-09-01 06:38:12 UTC

gm
https://blossom.primal.net/f952c2fa354ea5c89fdb3eb029186db25f7ba13a5fe021dcfb9ad094adc8844f.png

2026-09-01 05:58:47 UTC

Gm @nprofile…nj27, just curious, do you sometimes still write Bitcoin stuff?

2026-08-28 20:39:09 UTC

runs on nostr https://blossom.primal.net/f39f5c3637dce519ffa0f77cd08ca7120fa0febd2c37d9a49f5f4f788280df52.png

2026-08-28 09:28:45 UTC

- reply

so nice

2026-08-28 08:18:36 UTC

anyone still here?

2026-08-28 07:45:50 UTC

- reply

did i do anything to offend you buddy?

2026-08-28 07:43:30 UTC

2026-08-27 15:56:19 UTC

- reply

starting in 5 mins!
#nevent1q…wlrr

2026-08-27 14:47:09 UTC

- reply

are you running the latest version? this should've been fixed

2026-08-27 13:42:49 UTC

- reply

looking into it!

2026-08-27 13:42:20 UTC

- reply

join our open community call for this months' nutty updates!
#nevent1q…wlrr

2026-08-27 13:40:16 UTC

Without Lightning, none of the Layer 2s make sense.
Without it, every Layer 2 would be a useless silo and a centralization vector.
Maybe Lightning was Bitcoin's Layer 3 all along.
https://blossom.primal.net/e8efb658494ae4cdea50ceb367faa38028fb80e22609b54ba1afc9185c53463f.png

2026-08-27 08:53:34 UTC

- reply

if you can update it within a couple days, it should be ok to temporarily shut down

2026-08-27 08:52:30 UTC

- reply

cloud hosting, having no way to ssh into your node's box, being away from home etc

2026-08-27 07:29:00 UTC

- reply

you’ve certainly been mislead by people who have no idea what they’re talking about

2026-08-27 07:26:21 UTC

CLN action priority list:
- restart with —offline
- if you can’t, turn off
- if you can’t, pray

2026-08-27 07:07:03 UTC

If you can, restart with `--offline`.
If you can't, I would turn it off instead of doing nothing.
#nevent1q…qwn4

2026-08-27 07:05:57 UTC

- reply

Thats still safer than not doing it 😂

2026-08-27 07:04:46 UTC

Restart your CLN node with `--offline` and keep an eye out for updates.
Note that shutting it down for too long can expose you to force closure risk. Starting it with `--offline` will still observe the chain for malicious channel closures.
#nevent1q…v2uz

2026-08-27 07:00:01 UTC

- reply

added as comment!

2026-08-26 19:07:48 UTC

this too shall pass 🟥

2026-08-26 18:46:43 UTC

- reply

Restart your CLN node with `--offline` and keep an eye out for updates soon.
https://stacker.news/items/1555439?commentId=1555585

2026-08-26 18:46:06 UTC

🟥 URGENT: Critical vulnerability in Core Lightning
Blockstream developers urge users to shut down CLN Lightning nodes right NOW!
Please let everyone know!
https://blossom.primal.net/6bed280f966703baf8642602c70bfeada9730129e30890e6a41a1ec72820e03f.png

2026-08-26 13:43:25 UTC

- reply

how am I supposed to send this shit out?

2026-08-26 13:42:00 UTC

- reply

are you a bip110 retard?

2026-08-25 08:31:06 UTC

nostr on the front page of Hacker News
and of course it's funny
https://blossom.primal.net/3be52708a95b0cd6c257a45538b01550f31b39bed4a67bf154a947dd99cd2997.jpg
https://news.ycombinator.com/item?id=49399722

2026-08-23 09:26:44 UTC

- reply

as a non-routing node powering a cashu federation though....

2026-08-22 17:02:49 UTC

insane
#nevent1q…wzmw

2026-08-21 09:27:57 UTC

@nprofile…4nqj can you use this for your brain?
#nevent1q…vcm0

2026-08-20 08:21:24 UTC

we're all bitcoin red team
#nevent1q…3uts

2026-08-19 08:13:25 UTC

- reply

166 Mhz

2026-08-18 19:07:40 UTC

- reply

https://divine.video/u/tacobell

2026-08-18 19:07:28 UTC

https://divine.video/u/tacobell

2026-08-18 19:05:15 UTC

@nprofile…qwuj has an npub omfg

2026-08-16 16:04:46 UTC

- reply

can you share a link?

2026-08-14 11:11:12 UTC

cashu .me is now fully integrated with the latest version of npub .cash – that means your lightning address now works across all mints
settings -> Lightning address -> choose your mint
thank you @nprofile…umhn
https://blossom.primal.net/04f752672ab90a8d46bb22a639703668041fedafa6a8476738fffa19fa1ebc5e.png

2026-08-14 07:38:24 UTC

- reply

He didn't

2026-08-14 07:37:54 UTC

- reply

2026-08-14 07:36:02 UTC

- reply

bip110 micropenis found and blocked for excessively gay obsessiveness with my me and my posts

2026-08-14 07:28:41 UTC

nuts on the radio
#nevent1q…a8jd

2026-08-14 07:16:28 UTC

- reply

I mean Perl

2026-08-13 12:17:22 UTC

- reply

why humans should not code in c: we're finding memory-safety vulnerabilities in c projects that are prevented by default in many other languages.
in the past, finding a simple buffer overflow wasn't enough. you'd need a highly skilled hacker to turn the vulnerability into a working end-to-end exploit.
today, that's a single prompt.
#nevent1q…dvcy

2026-08-13 11:35:46 UTC

- reply

oh boy 😂

2026-08-13 11:05:05 UTC

gained a ton of new insights working in bitcoin red team 🟥 that i wish i could share without vague posting. but this is what i got anon.
- we’re experiencing a massive collision between decades of human open source slop against 2 weeks of kimi k3 (not good)
- everything is broken, bitcoin is burning
- bitcoin is becoming stronger through this
- bitcoin is the obvious first target but the rest of the world will follow shortly
- sometimes old things need to burn so new things can grow on healthy soil
- humans should never code in c (just stop)
- lightning is complicated and is more broken than the average (sorry)
- verification is free. we used to complain about slop PRs. then about slop security audits. if you can’t handle the information overload, stop complaining and use AI to sort through it.
- those projects that started AI audits months ago are in a completely different position than those who didn’t
- projects need their own AI audit pipeline going into the future
- the burden for a developer to keep software safe and secure is pretty stressful and not for everyone. it has become a lot more stressful now.
- unmaintained projects are most probably broken, don’t rely on them. i’d rather one-shot it myself with a modern AI
- multiple concurrent, diverse human approaches have proven to be the best vulnerability search method
- external red teaming will probably have to continue forever
- we’ve basically completed a basic scan of virtually the entirety of bitcoin open source. the low hanging fruit is done.
- we’ve reported a ton of real critical and high vulnerabilities. project maintainers across the board have validated our findings.
- response speed is very different across projects and shows how healthy each project is. i recommend acting fast these days.
- red team etiquette matters. if you don’t disclose responsibly, boast on twitter about your findings on a particular project, or make indications about the nature of particular findings, you’ve disqualified yourself as a serious security researcher. trust is the most important factor in this game. if you lose it, it’s very hard to win it back.
- did i mention that humans should not code in c?

2026-08-12 10:04:28 UTC

- reply

Everything is broken!

2026-08-12 10:04:01 UTC

- reply

never use a cold car ever again, how did you not get the message?

2026-08-11 21:29:35 UTC

- reply

mac + linux

2026-08-11 09:17:39 UTC

- reply

bip110 retard detected, opinion dismissed, added to mute list, have a nice day

2026-08-11 09:16:16 UTC

- reply

all I hear is sad fucking bip110 noises