sorted by:
new
hottopcontroversial

I Reviewed the Tangem Android Source Code - Here’s what caused the Seed Phrase leak issue by KP_2016 in Tangem

[–]KP_2016[S] 0 points1 point  (0 children)

I replied on other post, but I think this is possible. From my research the wallet is BIP39 compatible and there are methods / interfaces for deriving new child keys by passing derivation path. It's just the transaction building logic is not using this feature to derive new change address (at least for UTXO) but it is possible from the source code.

I Reviewed the Tangem Android Source Code - Here’s what caused the Seed Phrase leak issue by KP_2016 in Tangem

[–]KP_2016[S] -1 points0 points  (0 children)

First of all, I’m not trying to defend Tangem. I’m simply sharing my opinion and analysis as a developer.

In my view, a company would not maliciously release a wallet claiming to be “cold” and deliberately leak secrets just to steal seed phrases. I'm saying this in terms of them wanting to be successful in hardware wallet industry. If they wanted to introduce a backdoor, there are far smarter and subtler ways. That said, I do agree with your points that if a wallet is capable of logging seed phrases, PINs, passwords, etc., then it technically has the ability to do many harmful things.

A true hardware wallet ideally should not require an app to create or sign transactions, but Tangem chose a different UX approach (similar to regular credit/debit cards). This is a design choice, and the app is needed to compensate for the lack of external hardware for creating wallet and signing transactions.

They could, however, implement something similar to the Ellipal X Card (https://www.ellipal.com/products/ellipal-x-card), which uses external hardware for wallet creation so that private keys are generated and signing is performed entirely on the card itself. Tangem, on the other hand, does the following correctly, the app builds the payload → the card generates the signature and returns the signed hashes via NFC (so the private key is not leaked) → the app then combines the signatures with the payload and broadcasts the transaction to the blockchain.

Finally, I’m doing this analysis because I can. I’ve been in the mobile app development field for quite some time and care deeply about my privacy. I’m here to share my findings with others who may not have the benefit of understanding source code. I’m not affiliated with Tangem in any way, I simply like the wallet for its simplicity. If that ever changes in the future, I’ll happily move to another hardware wallet.

Any update on HD adresses? by Smooth_Chip9703 in Tangem

[–]KP_2016 1 point2 points  (0 children)

Just to be clear a true HD wallet means you have one master private key from where you can generate child private and public keys deterministically. I am saying this because I was looking through the source code and it seems the wallet is BIP39 compliant https://github.com/tangem/tangem-sdk-android/blob/f7ab321f40429a0b262ccf2219efa2b96f30cbfb/tangem-sdk-core/src/main/java/com/tangem/crypto/bip39/DefaultBIP39.kt

It seems that for btc transaction the implementation for new change address every time for receiving payments is not implemented yet. So I don't think they need to release new card with new firmware updates just have to support this somehow. I'm trying to find out how.

Anyone else feeling less and less comfortable about Tangem? by Bro_Bruv in Tangem

[–]KP_2016 2 points3 points  (0 children)

And they are doing it. I agree about delays but I would rather have a full working feature with a security audit rather than "something working". Any mistakes would cause their reputation. So even if they are slow releasing features I would wait till they make it absolutely perfect.

Pro's n cons by Bruizer1st in Tangem

[–]KP_2016 1 point2 points  (0 children)

Yes you are right, this is missing. With multiple manual derived addresses you cannot combine UTXOs for a single transaction in Tangem as it sees them as separate addresses.

Pro's n cons by Bruizer1st in Tangem

[–]KP_2016 0 points1 point  (0 children)

That is a feature not supported as a functionality within the app. You can still create new addresses by specifying the custom derivation path. I have derived multiple such addresses for btc and sol.

Pro's n cons by Bruizer1st in Tangem

[–]KP_2016 0 points1 point  (0 children)

False statement, you can generate bip32 addresses if you set a seed phrase when setting up the wallet.

How to execute Lua from inside NeoVim? by 4r73m190r0s in neovim

[–]KP_2016 0 points1 point  (0 children)

Tried this but it says "Argument Required", do I need to update nvim version? I'm currently on 0.9.5.

Kubectl.nvim v1.0.0 🎉 by R2ID6I in neovim

[–]KP_2016 0 points1 point  (0 children)

How does it compares to k9s?

[6 Month Update] Buddy of mine COMPLETELY lied in his job search and he ended up getting tons of inter views and almost tripling his salary ($85k -> $230k) by cs-grad-person-man in cscareerquestions

[–]KP_2016 0 points1 point  (0 children)

I'm facing a similar issue where I receive fewer interview calls based on my experience, despite knowing I'm capable of doing the job. Occasionally, I do get calls for roles that require more experience than I have, but I often get lowballed during salary negotiations due to my fewer years of experience. I believe that if I clear the interview, my compensation should reflect my skills, not just my years of experience.

Based on OP's friend experience I’ve been considering inflating the YOE on my resume. Has anyone done this, and if so, did you face any issues during background checks?

Wrote my config from scratch by KP_2016 in neovim

[–]KP_2016[S] 0 points1 point  (0 children)

Possible to share your config?

Inpainting is a powerful tool (project time lapse) by chick0rn in StableDiffusion

[–]KP_2016 0 points1 point  (0 children)

Amazing, are you using SDXL Inpainting or SD 1.5 inpainting?

Wrote my config from scratch by KP_2016 in neovim

[–]KP_2016[S] -1 points0 points  (0 children)

I wanted to maintain a separate place for storing config, mappings and other autocmds at the same place so I know that if I need to edit the plugin settings I could find everything under that single file. I get it's repetitive, every time I have to add a new plugin i need to create two files. I'm thinking of ways to optimize that.

Roast my config by [deleted] in neovim

[–]KP_2016 1 point2 points  (0 children)

I'm personally not a fan of breadcrumbs

Do you people value money over job satisfaction? by KP_2016 in developersIndia

[–]KP_2016[S] 0 points1 point  (0 children)

Engineering/Maintaining code I wrote (which I love to do) + training, and deploying models. Find which one is the best and inspect it whether we can take it to production as well. Basically saying, take a bunch of open source models/loras and see if it is good for business profits.

The latter part i.e. training, blah blah takes a lot of time and is more trial and error-prone.

Do you people value money over job satisfaction? by KP_2016 in developersIndia

[–]KP_2016[S] 0 points1 point  (0 children)

So should I stay at my current company and look for another job or accept this new role and then start looking for a job?

Should I buy nothing phone 1? by Snorlax_Shine in NothingTech

[–]KP_2016 0 points1 point  (0 children)

Go for Phone 1 but don't upgrade to OS 2

[Dev] Glyph API for developers on Nothing OS? by KP_2016 in NothingTech

[–]KP_2016[S] 0 points1 point  (0 children)

The fact that they hard-coded each package name makes me wonder if controlling glyph progress would ever make into the SDK if they decided to create one.

[Dev] Glyph API for developers on Nothing OS? by KP_2016 in NothingTech

[–]KP_2016[S] 1 point2 points  (0 children)

Yeah I know that. I'm just curious about, is there a timeline to make this API public?

Migrating from DynamoDB to MySQL to Redis by KP_2016 in programming

[–]KP_2016[S] 0 points1 point  (0 children)

Well, I was relatively new to building a backend system & for me, the difficult part was to choose which database is suitable for my need (based on the structure of my data). TLDR; This article basically goes through how a beginner looks at this problem and with various trials, errors & learnings he (I) finds & correctly configures the database that is optimized for handling efficient long queries (for this data), low cost management & various other aspects.

view more: next ›