https://xitter.cf/t.co/UssZxHjl3y / Tech Janitor 💻🖥🧼🧹 VFS, ZAM - Cardano Keystone Wallet Ambassador
Bangor, Northern Ireland
Joined November 2021
- Tweets19.4K
- Following3.2K
- Followers2.8K
- Likes31.4K
Pinned Tweet
Why I'm not a DRep anymore, by Johnny Kelly:
Once I was asked to critically read and critique ~195 Proposals, Submitted Ad-Hoc, and try to make a *truly informed* Yes/No decision on whether or not they should receive funding. Even in working areas in which I have absolutely no formal experience.
I Retired as a DRep.
It felt like the only honest option for me.
Anything else would have felt like misrepresenting my level of expertise/understanding in certain aspects of the Ecosystem (e.g. Marketing) or not being honest about how much time I'd *really* spent reading over *every* Proposal's content.
I would have been fine with having a say in what the overall list of *Work Items* to be *fulfilled* were, with that fulfilment then being worked out via specialised Groups collaborating alongside any ADA Community Member who wanted to contribute their experience and understanding towards Awarding final Funding Allocations.
I *wasn't* fine with having to weigh in on Full Allocation of Funding to Vendors across multiple aspects of Ecosystem Development and Support all in one go (in 12 days), without being able to have a say in the actual *Work Items* to be fulfilled in the first place (yes there was the Roadmap Vote, but it was superceded by what actually happened next).
We were going to have a formalised and structured Budget to be systematically worked at one point. It got replaced with a free-for-all ad-hoc submissions process.
Once that happened, I was out.
It's because we just this week switched from timer only based heating to Thermostat driven heating.
Trying to track how long temps take to drop or rise when heating is at a setback lower temperature or a target higher temperature, in order to optimise.
The product: amzn.eu/d/0abY4HNe
Johnny Kelly ($intertreejk) retweeted
We’re working on a page where you’ll be able to check whether your personal information was affected by this incident. We’ll share more details in the coming days.
Johnny Kelly ($intertreejk) retweeted
The 180-day retention period was intended to give us sufficient time to address customer support issues related to their devices and orders.
We agree that we failed to adequately verify that our automated deletion tool was working as intended. We relied on the tool without sufficiently checking whether the deletion process had been completed successfully. This was a failure in our internal processes, and we take responsibility for it.
We’re tightening our data retention procedures and implementing additional safeguards to ensure that customer data is reliably deleted within the specified retention period going forward.
So, @KeystoneWallet just messaged me thanking me for my continued support.
I... replied 😅
Johnny Kelly ($intertreejk) retweeted
You're right, and we genuinely fell short here. We should have made sure the tool was working as intended instead of assuming it was. We take full responsibility for that and are sorry we let you down. We'll work to do better.
Johnny Kelly ($intertreejk) retweeted
We understand your concern. To reduce the risk, we've paused shipments and will destroy all 18,835 devices in our inventory that use the old authentication key. None will be sold or shipped.
Customers who received devices after October 20 will be advised to contact our support team for guidance on verifying their device's authenticity.
New orders will be fulfilled with devices using the new authentication key, with shipping expected to begin within 4–6 weeks.
Johnny Kelly ($intertreejk) retweeted
This concern applies to devices received after October 20, 2026. If someone received their device after this date, we urge them to contact our customer support team for guidance on verifying its authenticity before using it.
Please note that we’ve temporarily paused shipments because the devices currently in our inventory use the old authentication key.
All 18,835 devices containing the old key will be destroyed and will not be sold or shipped to customers.
New orders are now available for preorder, and devices using the new authentication key are expected to ship within 4–6 weeks.
Johnny Kelly ($intertreejk) retweeted
If you receive your device after October 20, please contact our customer support team for guidance on verifying its authenticity.
P.S. We’ve temporarily paused shipments of new orders because the devices currently in our inventory use the old authentication key. All 18,835 devices containing the old key will be destroyed and will not be sold or shipped.
New orders are now available for preorder, and devices with the new authentication key are expected to ship within 4–6 weeks.
Johnny Kelly ($intertreejk) retweeted
Thanks for raising this important concern.
We recommend that anyone with an unopened device contact us at [email protected] for guidance on verifying their device’s hardware authenticity.
Johnny Kelly ($intertreejk) retweeted
Devices received before October 20, 2026, can still be verified as genuine through the device verification process.
The risk posed by the leak of the old key is that an attacker could use it to create counterfeit devices that pass verification. However, this risk does not apply to devices obtained before the leak.
Johnny Kelly ($intertreejk) retweeted
Customer wellbeing and security come first. Destroying 18,835 devices is a costly decision, but we believe it’s the right one to protect our users 🙏
Johnny Kelly ($intertreejk) retweeted
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
Man's got a solid point.
The process is actually pretty straightforward:
1. Find a vulnerability affecting the Cardano blockchain.
2. Submit a GHSA report. This is handled privately between you and the repository maintainers.
3. Create a private branch and work on a fix.
4. Once the fix is ready, instead of slipping a “trojan horse fix” into "main" without properly explaining to SPOs what it addresses, click the aforementioned Request CVE button and complete a proper vulnerability disclosure.
The result? SPOs get a clear explanation of the vulnerability, understand what has been fixed, and have a compelling reason to update their nodes promptly.
You know, the kind of transparent, responsible vulnerability disclosure that you'd expect from any serious open-source project.
Security through obscurity is not a disclosure strategy. And silently shipping security fixes while leaving SPOs in the dark isn't exactly best practice either. IMHO.
Johnny Kelly ($intertreejk) retweeted
Tbh, the Ledger incident has shaken all of us and raised serious concerns about self-custody.
Amid all this, we've also seen people wondering if there's a worthy alternative to Ledger, with some even considering giving up on self-custody altogether.
That's why we started sharing tweets highlighting the advantages of our product over Ledger, without speaking ill of them. We wanted to help people understand their options at a time when they needed them most.
We don't think there's anything wrong with that, as long as we're factual and respectful.