I have created a donation page to support my work: donate.joinstr.xyz

This would help me continue to work on joinstr and other projects.

Responsible disclosure often turns out to be a waste of time, effort and tokens.

Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).

Check out their awesome writeup here: github.com/KillaBoi/Steal…

New Cuprate blog post on RPC Hardening, Monero HTTP stack mitigations and its past vulnerabilities, including the 2025 zero-day DoS campaign:
cuprate.org/blog/turns-out…

They are paying 0.21 BTC to play Mario. So, I assume there must be rewards for reporting vulnerabilities as well.

.@walletofsatoshi Do you have a bug bounty program and a contact email address for reporting bugs in the WoS app?

Man discovers Edward Snowden's work 14 years later

‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.

In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.

We owe you an apology.

On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.

Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.

We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.

Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.

NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.

A detailed report is coming soon.

Until then, trust only our official channels. If anything feels off, email support@keyst.one. We'd rather hear from you than have you take a chance.

Again, we're truly sorry to everyone affected.

@brian_trollz @1440000bytes has a project named Goldfish to identify the fingerprints. It's viewable as a fork of @BitcoinExplorer

My hope is highlighting the differences helps developers clean up their privacy leaks.

Agreed this is necessary for payjoin to have any effect.

New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today. (note: Windows Defender may show a warning about ZXing.dll, ignore that, it is a false positive)

Theft via RBF in @cakewallet. Already reported and its not fixed. The team is too busy with the marketing.

I have found bugs in lot of bitcoin projects. They did not pay me anything.

I need some money. Can you donate some sats?

@1440000bytes Paykit is a strict improvement to BIP21/353

DNS and BGP hijacking will be used for bitcoin again.

You are not ready for the attacks that will make BIP353 look dumb. But use it because of its author until you lose money.

Cc: @BitcoinErrorLog

This overconfidence in some developers will eventually prove to be misplaced.

I get paid zero sats for reporting a vulnerability to the team who maintains bitcoin core. How many people rely on bitcoin core maintainers to secure their bitcoin?