The last time nvk posted something in X it was to kinda maybe sorta apologize for writing software that lost people thousands of Bitcoin.
Today, he posted "This is not a drill" urging people to turn on autoupdates and do a bunch of somewhat normal "best practices" stuff.
I'm trying to figure out why I find this so irritating. Possibly it is because of nvk's past blowhard attitude or perhaps because he was unreasonably mean to many Bitcoin projects.
But if I'm honest, that stuff didn't bother me so much. What has pissed me off is this absolutely stupid attitude he's bad since a bunch of his users got absolutely wrecked.
I suppose it is true that he can't talk about anything for legal reasons, but if that is the case I expect absolute fucking silence. If he wants to weigh in on things, the only thing he should be saying is how he is going to try to fix things and how he understands that his company screwed up about as badly as possible.
Help me understand this. I don't like being angry.
Auto updates just expose you to other threats.
There's this js library I shall not name (because its just one example out of 100s). The solo maintainer doesn't like slop. Then someone filed an LLM generated security issue (in public, ugh) and a CVE (before it was fixed, ugh ugh ugh) and a ton of bots started proposing patches.
Except the details of both the issue and the CVE are wrong. So he (correctly) challenged the report, did some unrelated work, but also didn't fix the root cause of the issue. Bumped version with a release. Now everyone that trusts the CVE industry will:
The problem is that this package has a couple 100 million installs. Yet the only thing that happened is that an unrelated version bump hid the actual vuln, which still exists, but isn't visible to anyone except those that:
Luckily the known impact of the vuln is not high, but that doesn't mean much anymore these days - a small vuln can make a long exploit chain viable. And this has been discussed fully in public. There are thousands upon thousands of security reports where it is omitted, I see it happening every day. All you need to do to no longer be aware of the issue is what the tool tells you to do: autoupdate.
Yes. This is some of what really ticked me off. I think in the past nvk has even extolled how wise it is that bitcoin core does not even have an option for auto updates, and now here he is giving mindless hype advice to people.
I'm personally grappling with what to tell (normie) people, except that things like being conservative in what you install, and running firewalls and using things like app sandboxing can make a real difference now. Is auto-update useful when we know that most of the stuff that gets updates is vibe coded now and the amount of published bugs alone has done almost a 3x? I see the opposite in the field (and I literally live in this field at the moment.)
I haven't seen anyone speaking with an air of authority yet convincing me that the dangers from autoupdate have lessened - in fact I have seen quite the opposite happening, and the bleeding release edge is dangerous - to a point where people are putting several day delays on updates, which again is fucking awful if we're talking security updates because the aggressor won't wait several days with completely fucking you up - as we've also seen reports here on SN, with real loss.
Personally, my solution is to:
I won't read that but I'll take a guess that he's playing helpful as a previous victim of AI hacking.
He really needs to disappear and Coinkite needs to either be bought out or go bankrupt.
The guy is an asshat.
I used to think he was a smart asshat.
This
Slop.
very irritating.
It's the inconsistency... arrogance backed up by competence is acceptable. Arrogance backed up by pride followed by an extreme fall? Well, that's a different story!
I used to listen to his podcasts back in around 2023, but it reached the point where I found his ego and imperiousness tough to take. I don't think he's capable of just going away. He enjoys attention too much. It started with his demise, but I just can't can't listen to any of these supposedly brilliant devs and influencers any more who feel the need to prattle on and on, puffing themselves up while hawking products.
It’s disappointing but not surprised. Maybe he’s a narcissist and has no humility.
If he can’t speak on it he should come out and say so. And have some compassion. Get on the podcast circuit he loved to do own it and tell his side of the story. But I doubt that will ever happen.
He's trying to rehabilitate his image now that a class action lawsuit has been filed in Canada
Isn’t NVK supposed to be addressing the funds people lost due to the COLDCARD incident first? Security advice is important, but shouldn’t accountability to affected users come before moving on to the next crisis? People deserve answers.
balzac!
surprised hed continue to have a public persona. But then again, maybe not surprised...