https://xitter.cf/t.co/UssZxHjl3y / Tech Janitor 💻🖥🧼🧹 VFS, ZAM - Cardano Keystone Wallet Ambassador
Bangor, Northern Ireland
Joined November 2021
- Tweets19.4K
- Following3.2K
- Followers2.8K
- Likes31.4K
Pinned Tweet
Why I'm not a DRep anymore, by Johnny Kelly:
Once I was asked to critically read and critique ~195 Proposals, Submitted Ad-Hoc, and try to make a *truly informed* Yes/No decision on whether or not they should receive funding. Even in working areas in which I have absolutely no formal experience.
I Retired as a DRep.
It felt like the only honest option for me.
Anything else would have felt like misrepresenting my level of expertise/understanding in certain aspects of the Ecosystem (e.g. Marketing) or not being honest about how much time I'd *really* spent reading over *every* Proposal's content.
I would have been fine with having a say in what the overall list of *Work Items* to be *fulfilled* were, with that fulfilment then being worked out via specialised Groups collaborating alongside any ADA Community Member who wanted to contribute their experience and understanding towards Awarding final Funding Allocations.
I *wasn't* fine with having to weigh in on Full Allocation of Funding to Vendors across multiple aspects of Ecosystem Development and Support all in one go (in 12 days), without being able to have a say in the actual *Work Items* to be fulfilled in the first place (yes there was the Roadmap Vote, but it was superceded by what actually happened next).
We were going to have a formalised and structured Budget to be systematically worked at one point. It got replaced with a free-for-all ad-hoc submissions process.
Once that happened, I was out.
Johnny Kelly ($intertreejk) retweeted
This concern applies to devices received after October 20, 2026. If someone received their device after this date, we urge them to contact our customer support team for guidance on verifying its authenticity before using it.
Please note that we’ve temporarily paused shipments because the devices currently in our inventory use the old authentication key.
All 18,835 devices containing the old key will be destroyed and will not be sold or shipped to customers.
New orders are now available for preorder, and devices using the new authentication key are expected to ship within 4–6 weeks.
Johnny Kelly ($intertreejk) retweeted
If you receive your device after October 20, please contact our customer support team for guidance on verifying its authenticity.
P.S. We’ve temporarily paused shipments of new orders because the devices currently in our inventory use the old authentication key. All 18,835 devices containing the old key will be destroyed and will not be sold or shipped.
New orders are now available for preorder, and devices with the new authentication key are expected to ship within 4–6 weeks.
Johnny Kelly ($intertreejk) retweeted
Thanks for raising this important concern.
We recommend that anyone with an unopened device contact us at [email protected] for guidance on verifying their device’s hardware authenticity.
Johnny Kelly ($intertreejk) retweeted
Devices received before October 20, 2026, can still be verified as genuine through the device verification process.
The risk posed by the leak of the old key is that an attacker could use it to create counterfeit devices that pass verification. However, this risk does not apply to devices obtained before the leak.
Johnny Kelly ($intertreejk) retweeted
Customer wellbeing and security come first. Destroying 18,835 devices is a costly decision, but we believe it’s the right one to protect our users 🙏
Johnny Kelly ($intertreejk) retweeted
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
Man's got a solid point.
The process is actually pretty straightforward:
1. Find a vulnerability affecting the Cardano blockchain.
2. Submit a GHSA report. This is handled privately between you and the repository maintainers.
3. Create a private branch and work on a fix.
4. Once the fix is ready, instead of slipping a “trojan horse fix” into "main" without properly explaining to SPOs what it addresses, click the aforementioned Request CVE button and complete a proper vulnerability disclosure.
The result? SPOs get a clear explanation of the vulnerability, understand what has been fixed, and have a compelling reason to update their nodes promptly.
You know, the kind of transparent, responsible vulnerability disclosure that you'd expect from any serious open-source project.
Security through obscurity is not a disclosure strategy. And silently shipping security fixes while leaving SPOs in the dark isn't exactly best practice either. IMHO.
Johnny Kelly ($intertreejk) retweeted
Tbh, the Ledger incident has shaken all of us and raised serious concerns about self-custody.
Amid all this, we've also seen people wondering if there's a worthy alternative to Ledger, with some even considering giving up on self-custody altogether.
That's why we started sharing tweets highlighting the advantages of our product over Ledger, without speaking ill of them. We wanted to help people understand their options at a time when they needed them most.
We don't think there's anything wrong with that, as long as we're factual and respectful.
Johnny Kelly ($intertreejk) retweeted
IceBreakers is closing. Operators can turn their nodes off.
When we started, a community-run network serving real Cardano traffic was a theory. Over 100 operators proved it works, and works at scale.
Thank you, everyone 💙
UPDATE:
3 months and 1 week since my Diabetes Diagnosis with an HBA1C of 110 mmol/mol (12.2%).
I have lost 24.9 lbs and my latest HBA1C Blood Test, taken 3 days ago, has come back with a result of 40 mmol/mol (5.8%).
This puts me squarely in the NORMAL Blood Sugar Range, i.e. no longer diabetic levels.
Johnny Kelly ($intertreejk) retweeted
For anyone who had not migrated their monitoring setups prior to 11.1.1 and 11.1.2, check out the "new tracing system" quick start guide here: developers.cardano.org/docs/…
The old system was finally completely removed in 11.1.1 and above after a progressive switch over the past year.
Johnny Kelly ($intertreejk) retweeted
We're live now with No Agenda episode 1888 #@pocketnoagenda l.curry.com/fV0
