
A web UI for your LND/C-Lightning/Eclair node⚡Devs: @Suheb__ @ShahanaFarooqi⚡UX: @diogorsergio⚡ #Bitcoin Nostr: npub1yz94p8f8xxg7y9nkjuhlw9a2k6e2279zn6t79gdrs
Offchain
Joined January 2019
- Tweets1.5K
- Following81
- Followers6.9K
- Likes7.1K
Pinned Tweet
⚡ RTL v0.15.14 is out!
🔗 Eclair 0.14 supported
💸 LND payments: default 5% fee limit, shown before sending
🔁 Eclair rebalance gets a fee limit
₿ on-chain sends confirmed in sats
🧹 deps updated; prod audit at 0
Operators encouraged to update 🙏
github.com/Ride-The-Lightnin…
New Eclair release 0.14.5 with security fixes
Node operators: upgrading is strongly advised
github.com/ACINQ/eclair/rele…
Odd one on my Core Lightning node this weekend:
- an unannounced peer opened a channel
- routed a burst of payments through the channel
- spliced
- then forced a close
Looks like a failed exploit attempt. Node was already on v26.06.8, funds are safu
If you run CLN, upgrade now
⚡ RTL v0.15.13 is out!
🛡️ Stricter request validation for LND, CLN, Eclair & Loop
🔑 First-login fixes: CSRF & multi-node dropdown
🧹 Boltz integration removed
📦 Deps updated; prod audit at 0
Operators encouraged to update 🙏
Release details:
github.com/Ride-The-Lightnin…
LND v0.21.4-beta and v0.20.5-beta are out 🚀
Maintenance releases with key bug fixes, incl. one for HTLCs that could be left pending and trigger unnecessary force closes.
All node operators are encouraged to upgrade.
github.com/lightningnetwork/…
github.com/lightningnetwork/…
Release candidates for lnd v0.20.5-beta.rc1 and v0.21.4-beta.rc1 are now available.
Both are maintenance releases with bug fixes. If you run lnd in a test or staging environment, please try them out and let us
know how it goes.
github.com/lightningnetwork/…
github.com/lightningnetwork/…
⚡ RTL v0.15.12 is out!
🔒 Login lockout: now expires, no X-Forwarded-For bypass (proxy? set trustedProxies)
🔑 Settings API can't re-point credentials
💰 LND: open a channel with the whole wallet balance
🧾 Eclair: paged invoices, honest failed opens
github.com/Ride-The-Lightnin…
⚡Ride-The-Lightning App⚡ retweeted
Latest Strikes is (finally) out! In this issue:
- @BtcpayServer vuln
- @ZeusLN attack
- LND Vulnerability disclosure @lightning @realtbast
- @lightningdevkit release
- @RTL_App release
- @arkade_os and @secondhq LN-related updates
- new channel jamming proposal
& more! 👇
⚡ RTL v0.15.11 is out!
🔒 New SECURITY.md: private vulnerability reporting + [email protected]
🔑 LND: peer alias lookups no longer cross node credentials
🧹 Deps refreshed, prod audit still 0
🔐 2FA code autofills
Release details:
github.com/Ride-The-Lightnin…
cc: @callebtc
Thanks for the nudge to improve the security reporting on the project 🙏
⚡Ride-The-Lightning App⚡ retweeted
Running LND in production means knowing when to upgrade. The new published policy gives you that clarity.
Lightning Labs maintains the two most recent release lines, and both get security fixes. A line reaches end of life when the second major release after it ships, so support tracks releases, not a calendar date. Once a line reaches end of life, it gets no further fixes.
Run the latest minor of a maintained line to keep getting LND security fixes. As of today, the latest minors of maintained lines are v0.21.2 and v0.20.3.
For more details: security.lightning.engineeri…
⚡Ride-The-Lightning App⚡ retweeted
A self-custodial Bitcoin Lightning ⚡️ wallet inside Telegram. Proof of concept on signet, built on Lightning Labs' Wavelength SDK.
The full Wavelength〰️ daemon runs in the browser via WASM, so the keys never leave your device. No app install, no account.
Test coins only!
Try it: t.me/wavewalletsignetbot
Build your own solutions: wavelength.lightning.enginee…
Feedback and bug reports very welcome.
⚡Ride-The-Lightning App⚡ retweeted
I think the Lizard People have surrendered to Bitcoin Core, which, if true, means that we have an extremely powerful tool in popular open source software, categorically. It's too hard to slip in corruption with all the world's most competent eyeballs watching.
The Lizards are now trying to centralize keys. We need to make self custody as realistic as possible and not let them reach whatever tipping point of keys they calculated.
Notice, that while the details differ, they are running they same playbook as they did with centralizing gold. Gold failed because it's various properties made it vulnerable to capture by central bankers. Gold was too expensive/burdensome/risky to self-custody.
Notice, again, the narratives emerging from the CC heist.
"Screw it, self-custody is too hard, I'm moving to an exchange."
"They did everything right."
"Death of self-custody."
Each hack/heist encourages the average Bitcoiner to conclude that self-custody isn't worth the risk. That their odds are better with a "well-trusted" institution holding their keys instead. That an institution is the easy button.
If you were a lizard, you'd attempt to introduce critical bugs in specialized HWWs (and their related software stacks) to encourage this migration to institutions.
Each bot repeating that Core is too hard to learn, that something like Yeti Cold is too tedious, advances the Lizard's goal of key centralization.
Call to action: make self-custody as realistic as possible. Reject specialized HWWs. Take one Saturday to learn how Core actually works, it's just software. Learn how to secure generational wealth, it's not beyond you. And pass the knowledge you learn onto the next pleb.
Follow these anons to learn more.
@JWWeatherman_
@heavilyarmedc
@BenWestgate_
@LibertyMugs
@epic_curious
To everyone trying to contribute by finding vulnerabilities in Bitcoin applications, even if you're not an experienced researcher and aren't confident in your findings: learn and practice RESPONSIBLE DISCLOSURE before taking any other action.
⚡Ride-The-Lightning App⚡ retweeted
There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.
If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.
⚡ RTL v0.15.10 is out!
🔒 Credentials kept out of node logs & API responses
🔑 Hardened login validation + server-side auth pinning
⚡ LND alias lookups bounded — no request storms
🧹 Production deps clean at 0 vulns
Operators encouraged to update 🙏
github.com/Ride-The-Lightnin…
⚡Ride-The-Lightning App⚡ retweeted
If the thief has a conscience, they can return my family’s 2.476 BTC to this address:
3M2DTZW9WaXMVYztuJ9s37iQwCzeZTLB27
⚡Ride-The-Lightning App⚡ retweeted
1/ Block’s engineering and security team found another set of transactions that could be a part of the Coldcard drain. We’re still working to vet these completely, but given the situation, we feel it’s important to share early.
⚡Ride-The-Lightning App⚡ retweeted
COLDCARD Mk3 Security Advisory
If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk.
Mk4, Q and Mk5 are not affected based on our early analysis.
Read the advisory and migrate carefully:
blog.coinkite.com/coldcard-m…











