I have created a donation page to support my work: donate.joinstr.xyz/ This would help me continue to work on joinstr and other projects.

I love marketing posts on bitcoin twitter. Provides me an opportunity to review their claims.

An unexpected learning: it turns out emailing vulnerability proof-of-concepts (PoCs) gets your email rejected, so most of the reports we first sent bounced. We think mail filters flagged these PoCs as malware. We already sent encrypted reports when maintainers provided us a key. Now, all reports arrive encrypted.

I don't need lessons about responsible disclosure from teams that sit on some known, unfixed vulnerabilities for weeks or months and fail to respond in time.

More evidence of a HWW company sweeping evidence of compromised devices under the rug. These companies are highly incentivized to under-report legitimate risks so the sales machine continues on. zetter-zeroday.com/trezor-wa…

Reported multiple vulnerabilities in cake wallet today that could lead to loss of funds. One of them affects only bitcoin users. Still waiting for an acknowledgment or response.

Starlink is the USA equivalent to Russian natural gas, a form of economic power used to leverage policies favorable to the controlling foreign power. I always hope Europe will get wise to it because they talk big but they rarely follow through.

fascinating. feds used the IP addresses of etherscan email notifications to locate an ethereum node operator in the southern district of new york to satisfy a venue requirement to prosecute someone else

i rebuilt satoshi's 2009 bitcoin.exe byte for byte! afaik nobody has been able to perfectly recreate the executable published in 2009 from source, because we didn't know the exact build environment that was used. using opus 5.5, i reverse-engineered satoshi's build machine from the binary. it now outputs an exe with the exact same sha256 as the 2009 release!

If you seriously believe that events in France are a result of *immigration* you are actually human cattle and will believe literally anything.

In August 2026 I reminded @Ledger again about the hardware tampering issue in Vietnam & that I already reported it to @DonjonLedger. So no one at Ledger can claim they were NOT aware of the device tampering & Supply Chain Attack issues starting in Vietnam where Ledgers are made.

Claude figured out the origin of the NIST curve parameters. Turns out to have been timestamps! anthropic.com/research/ecdsa…

Cancelled my Adobe subscription today.

This is Bitcoin Core 👀

This is the first HIGH severity curl vulnerability in years. It is cool, but take note of the report format. This is the level of detail you should aim for when disclosing vulns hackerone.com/reports/403033…

🚨 RCE in curl (CVE-2026-92392, HIGH Severity) 🚨 A malicious HTTP/2 server can turn a use-after-free during uploads into remote code execution. Prerequisites: ● curl -T <file> over HTTP/2 to an attacker-controlled server ● <file> is ~135KB+ and contains <word> <word> <any>\n\n anywhere ● -Z / --parallel for exploitation when PIE/ASLR is on Affected: 8.12.0–8.22.0 Fix: 8.23.0 (or 8.20.2 / 8.16.2 / 8.14.3)