Notes on security, systems, and the things that were not, in fact, an accident. The blog of @inverse_hanlon.https://blog.inversehanlon.com/https://blog.inversehanlon.com/posts/entropyboogaloo/https://blog.inversehanlon.com/posts/entropyboogaloo/ Did switck place a bug in the entropy generation for later retrieval? Was the bug really a feature written by CoinKites CTO under a nym?Thu, 06 Aug 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/bitkey-hardware-wallet-for-normie-friends_1/https://blog.inversehanlon.com/posts/bitkey-hardware-wallet-for-normie-friends_1/TLDR: Block published the Bitkey source. I read it. The 2-of-3 is real, privacy is decent, coin control is built but wired into nothingWed, 05 Aug 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/they-named-it-first/https://blog.inversehanlon.com/posts/they-named-it-first/Ten weeks before Coldcard's entropy bug shipped, Coinkite's CEO waved off the idea that a vendor would ever run a retirement attack, and suggested dice. His CTO wrote the bug under a pseudonym. Two people warned them. The answer was: if something was wrong, we'd already know about it by now.Tue, 04 Aug 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/coldcard-the-timeline-is-the-tell-v4/https://blog.inversehanlon.com/posts/coldcard-the-timeline-is-the-tell-v4/A config flag nobody checked for five years cost Coldcard users $88 million. The bug is just a footnote. What matters is who got to decide when the rest of us found out.Sun, 02 Aug 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/cloned-paperboy-in-an-afternoon/https://blog.inversehanlon.com/posts/cloned-paperboy-in-an-afternoon/One prompt turned into a playable Paperboy clone in under two hours.Wed, 29 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/why-bitcoin-goes-up-eventually/https://blog.inversehanlon.com/posts/why-bitcoin-goes-up-eventually/A no hype look at supply mechanics, institutional plumbing, and holder behavior.Fri, 24 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/friend-group-fallen-off-twitter-edition-v3/https://blog.inversehanlon.com/posts/friend-group-fallen-off-twitter-edition-v3/Ten telltale signs that a friend group has quietly migrated from a group chat to a timeline, ranked roughly by how far gone it is.Thu, 23 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/flow-round-guy/https://blog.inversehanlon.com/posts/flow-round-guy/Every gym has one: the training partner who treats every roll like a title match. He hurts himself more than anyone else, and how to fix it if it's you.Wed, 22 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/bip-110-the-threshold-is-the-tell/https://blog.inversehanlon.com/posts/bip-110-the-threshold-is-the-tell/BIP-110 needs 55% to change Bitcoin's consensus rules; SegWit and Taproot needed 95%. That gap is not a rounding error. It's a decision about how many people you're willing to strand.Tue, 21 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/hackingisdead/https://blog.inversehanlon.com/posts/hackingisdead/The most devastating breaches of the decade required almost no technical skill. It's a return to hackings original social and adolescent form. And this time it comes with a body count.Tue, 21 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/case-for-orthodoxy-inversehanlon/https://blog.inversehanlon.com/posts/case-for-orthodoxy-inversehanlon/Running the Orthodox Church through the same incentive analysis I run every failing institution through and watching it keep passing tests it should fail.Mon, 20 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/the-5-am-guard/https://blog.inversehanlon.com/posts/the-5-am-guard/Training and competing in jiu jitsu around a full time job and three kids and why the hardest opponent isn't the guy across the mat, it's the calendar.Sun, 19 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/storytime-ai-bedtime-story-generator/https://blog.inversehanlon.com/posts/storytime-ai-bedtime-story-generator/Storytime generates an original, illustrated bedtime story in one click, running end-to-end on Cloudflare and Groq. Built in an afternoon, on purpose kept that small.Wed, 15 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/the-vibe-coding-ick/https://blog.inversehanlon.com/posts/the-vibe-coding-ick/The app didn't change when you learned it was vibe coded. Your opinion of it did. A look at what that reflex is actually measuring.Wed, 15 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/hello-world/https://blog.inversehanlon.com/posts/hello-world/Why this blog exists, what the inverse of Hanlon's razor actually means, and why 280 characters stopped being enough.Tue, 14 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/reading-a-breach-notification/https://blog.inversehanlon.com/posts/reading-a-breach-notification/A field guide to the passive voice, the abundance of caution, and other load-bearing phrases of incident PR.Tue, 14 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/sometimes-it-is-a-typo/https://blog.inversehanlon.com/posts/sometimes-it-is-a-typo/The inverse razor cuts both ways: a note on not becoming the thing you mock.Tue, 14 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/synergy-session/https://blog.inversehanlon.com/posts/synergy-session/Introducing Synergized Solo Execution: the bold new format where ten engineers clear their calendars so one of them can do the work.Tue, 14 Jul 2026 00:00:00 GMThttps://blog.inversehanlon.com/posts/the-dog-and-pony-show/https://blog.inversehanlon.com/posts/the-dog-and-pony-show/Corporate cybersecurity is a theatrical production for auditors, regulators, and insurance underwriters. The hackers are extras on set.Tue, 14 Jul 2026 00:00:00 GMT