SatsAndSports

I've been thinking about post quantum for Cashu.

There's been progress on PQ signature schemes, but blind signatures might be a harder problem.

Personally, I'm not worried about quantum computing. Maybe 100 years from now quantum computers still won't be able to factor a 3-digit number. But let's imagine elliptic curves are broken, whether by quantum computers or a classical attack.

Inflation rather than blindness is the problem for Cashu. An attacker could recover the mint's private keys and forge unlimited ecash. But I think the blindness of the signatures would remain intact; I don't see how solving the discrete logarithm problem would allow them to unblind

If Bitcoin hasn't adopted PQ signatures, Cashu is dead anyway. And if we have practical PQ blind signatures, we can just use those. Apparently, the lattice-based schemes might allow blind signing

So the interesting scenario is where Bitcoin has adopted PQ signatures but Cashu hasn't.

Suppose elliptic-curve private keys can be recovered within a month. Cashu could continue using elliptic curves, but keysets would have to expire after perhaps a week. Not just rotate to new active keysets: old ecash would become worthless.

Every user would have to come online weekly to refresh their entire balance, or lose it.

My prediction is that people simply wouldn't do that, and everyone would use on-chain Bitcoin, Lightning, or something else

As I said, I'm optimistic that elliptic curves will be fine for another century. If not, then chaumian ecash needs a quantum-safe blind signing scheme; there are no workarounds to keep elliptic curve blind signing in operation

de-slopifying protocol specs, not de-slopifying code

https://github.com/SatsAndSports/MONAD/blob/09d21f7e6fccac4b81219c1f67a7ae4c882f8a4d/docs/control-protocol.md

Now that I've started dictating a lot, never having done it before, it's strange to see my words written down.

I'm now trying to modify my speech slightly to help the transcription software to be more accurate. It's a funny experience

Maybe it's not a good idea to Star Trek while also giving voice dictation to my clanker

One of Commander's Data's statements got sent to my clanker 😀

I ran 10k yesterday, and 20k the day before that

All while kinda hungry

So I guess I'm getting hooked on running again!

(Very slow though, 6m30s per km I think)

Finally using Astra a bit more. It's good and all, but still a bit sloppy in its own way. When it writes a massive plan with lots of stuff, I really need to read carefully to suggest adjustments. It wants to add too many new things

Not really a criticism of Astra. Just an observation that, while AI has changed dramatically and models will continue to be much better than the previous models, some things kinda stay the same. The 'weaknesses' persist, but perhaps they just move to a different level of complexity

Finally just set up voice dictation

Now setting a prompt to explain to the transcriber that I'm not working with a "Chimney" protocol for moving "Cashew" around

It's Whisper, locally. Also the first time I'm doing anything useful with local AI

Just a moment ago on Twitter, Saifefean Ammous (The Bitcoin Standard) referred to "Keynes' moronic writings"

I'm sure he'll agree it's only fair, given his choice of words, to point out that Ammous's writing are worse. I tried to read his slop, but he made the classic error of thinking that inflation brought Hitler to power and therefore I had to put his book down after reading just 20% of it

https://xcancel.com/saifedean/status/2095088845230354884

Unfollowed two npubs just now because they turned out to the generic big-blocker bots that we see so much during attacks on Bitcoin

Why do so many attackers (including BIP110ers) always run out of ideas and just randomly attack Lightning and use emotional MoE arguments?

Makes me more convinced that Lightning is the correct approach 🤣, and that we have the right incentives and game theory for Bitcoin

We're making an asset that nobody wants to spend, and which can be transferred with private instant settlement. This is how you play the long game, making it the world's MoE

Maybe instead of making big PRs, especially to projects that we haven't contributed to before, we should create a high quality Issue

This issue could include the problem and also the solution, especially a high quality description of how to solve it. If the submitter (and their agent) has already implemented the solution with tests, I think I'd find the agent's writeup of the solution to be more useful then the solution (alone).

If I was a maintainer, I think I'd find the Issue much more useful than a PR. It would be easier to review and implement - with AI help.

With a PR, there is always a fear of some error or security issue being introduced, accidentally or otherwise.

#TL/DR Show me the prompt, not the code

My language teaching bot is so good, that I'm even enjoying learning this table:

I'm having a lot of fun using and writing my new language bot.

First time in ages that I find it fun to study languages, and I really think the bot is good at remembering my preferences.

It's the first time I've ever implemented - or really though about - how to manage context. As well as the obvious stuff - like compaction - my bot also has some memory-like systems that are for language-learning specifically. For example, it keeps track of mistakes and successes in grammar topics; all labelled and categorized by the llm.

This allows it to keep a compact summary of the mistakes I'm making in vocab and grammar and so on.

And also a 'learner profile' where the llm keeps a summary of my preferences and basic life facts. For example it has learned that "Bitcoin" is one of my interests

I'm not a language teacher, so I'm making sure that I design the system such that I don't have to make a decision that might be a bad decision; everything is llm-guided

It's just for me and one friend, not planning to share

Giving up carbs (again). Plan to be very strict for six weeks, mostly just an experiment to see what longer term feels like

I have sometimes cut back drastically for a week or two in the past, and felt good after a tough first few days. Then I gradually make exceptions and end up eating multiple croissants per day again!

Something I should have built a long time ago:

Maybe I shouldn't say this, but I'd trust myself to just select words myself from a print out of the BIP-39 word list

And similarly, for dice rolls I would trust myself to do random rolls in my brain

Yeah I know what some of you are thinking.

While I'm not a professional cryptographer, I've been studying randomness and statistics in some form in my entire career, so I trust myself - if I need to select a new seed phrase really quickly - to do it with good enough entropy

We need to rethink "Bitcoin only" as a purity test. Multiple things recently have reminded me of this issue, not just the ColdCard hack.

If you genuinely understand the tech, and the economics, and all that other stuff, you can come to the conclusion that Bitcoin will win. That you should put all your wealth in it, and you should help out with freedom tech if you can

But things aren't so easy for people who don't really understand it all. They have to go on faith a lot. I've had just one long face-to-face conversation with a BIP-110 supporter. Very nice older man, but he knew essentially nothing about how Bitcoin worked. He had put all his life savings into Bitcoin, but he was very stressed and said he'd have to sell if BIP-110 didn't activate.

My point there isn't to (yet again!) criticize a BIP-110 supporter. He kept using the word "conviction", and that his "conviction" was being tested. It's like a religious person talking about "faith"

He was Bitcoin-only (on the face of it), but only because it was an article of faith for him and because he copied the opinions of people smarter than him.

If we try to bully people to take "Bitcoin only" as an article of faith, then it becomes a meaningless slogan. And it can become harmful because it means that people can't ask the hard questions that challenge Bitcoin. And if people are Bitcoin-only as an article of faith, and not because they've actually learned about it, then I don't think that does anybody any good

If the code is open, bad actors will read it and exploit it

If you want to motivate people to review and help you to improve the code, actively encourage them to use it and encourage them to depend on it in their products

Make it truly open source (MIT, GPL, BSD).

Be flattered, not angry, when people incorporate the code in their products. They are now motivated to help find and fix problems

Don't arrogantly try to say that it's "your code", as if you are perfect

I.e. don't be like ColdCard. Don't do a dumb rewrite, against the loud advice at the time, to switch all the code to a fake-open license which allows bad actors to read the code and doesn't incentivize good actors to do the same

More examples are being (re-)surfaced of Coinkite/nvk being assholes. Their anti-open attitude appears to be deeply embedded in their DNA. I say this because they can't recover from this; the root cause of this isn't just "aww shucks, this one line was unfortunate". They were mismanaged by an egomaniac who hated openness

Just one example

https://thecharlatan.ch/COLDCARD-Supply-Chain/

I guess I'm lucky that I had a slightly "icky" feeling about Coldcard. Their device looked really cool, and they had some good marketing, but that all felt kinda sus to me. So I don't think I really considered it

And, of course, in the 'Fork Talk' Telegram group, their main attack dog there is trying to find a way to blame Core for the Coldcard thing

I'd buy a device which simply did this:

I enter 11 (or 23) BIP-39 words that I selected randomly myself, and then it computes the checksum and 12th (or 23rd) word and displays it to me

Then I'd enter these 12 (or 24) words in a separate conventional hardware wallet

The device could come with dice and a table of the words

I'm suggesting this because this checksum is the only part of seed generation that isn't easily done manually

Are there tools to download the list of all the songs I've liked on Spotify or Youtube Music?

I'm not asking for the actual audio itself, just to backup the lists of songs

#AskNostr

The number theorists keep talking about Jacobins

Are they anything like the Fabians that are attacking Bitcoin right now?

I'd be inclined to support this, if it was applied to everybody regardless of age

What do you think?

A 'Senior Principle Engineer' in my fiat job thinks that the role of AI is to infer the spec from our existing codebases (they are unmaintainable, underspecified, untested, human slop), so that every time a new 'vastly superior' model appears we should ask it to rewrite the code from scratch using this inferred spec as the guide

#NGMI

"... extract a spec (product, engineering) from an existing codebase, force an isolated AI agent to rebuild it from scratch, and measure the divergence. The goal is to discover the minimal codebase practices we must adopt today so that when vastly superior models release tomorrow, we can confidently hit “re-generate” on entirely AI-generated codebases and guarantee the output is strictly better."

Trying to ban myself from working on freedom tech today, as I've been neglecting my fiat-mining obligations

I've been obsessed by my open source stuff, because it's much more fun and important, but I need to do other boring stuff to pay the bills

I think I finally fully understand Ark, and will try to explain it here:

(The swapping from the old round to the new round was what I didn't fully understand until I asked AI a few questions this morning)

Lightning already shows how two users can share one UTXO; both parties have a pre-signed transaction that they can broadcast at any time to spend the onchain 2-of-2 UTXO. That transaction spends that one UTXO and creates two new UTXOs which give each party their balance.

In Ark, it's basically the same, but with any number of users. The onchain UTXO is an n-of-n multisig instead of just 2-of-2. All parties have the necessary transactions which they can broadcast at any time. So every user has 'unilateral exit', they can broadcast these transactions at any time and get a single onchain UTXO with their balance belonging just the them.

These are the VTXOs (Virtual UTXOs). You can exercise your unilateral exit at any time by broadcasting your VTXOs.

(Pedantic detail that you don't really need to know: if there are 5 users, it's not a single transactions that spends the 5-of-5 directly to five different UTXOS, one for each of the five users. There is a tree of transactions, and each user has a copy of the chain of transactions that are necessary to get their balance out to a single UTXO under their control)

It's possible to receive payments at any time from another Ark user. But it requires a bit of trust (because the Ark Service Provider [ASP] and the sender could collude to take payment money that they sent to you) and therefore I won't discuss it in detail. Ark doesn't use the cool Lightning tech for instant settlement with commitment transactions. Therefore, I'll ignore this slightly-trusted part of Ark, and I will focus on the fully trustless parts, i.e. where Ark users have unilateral exit

If you already have 1000 sats locked up safely in one 'round' onchain, and you receive another 500 sats and you want those to be locked up safely, then you will need to take part in another round. This is where things get really interesting, and this is the bit I only just fully understood today ...

The ASP creates a new 'round', i.e. a new multsig output onchain that includes all the users who wish to take part. In this round, you will be assigned 1500 sats. i.e. you now have unilateral exit allowing you to take 1500 sats

But you still have the VTXOs from the first round, and so it seems like you could implement both exits and thereby claim 1000+1500 = 2500 sats, stealing 1000 sats from the Ark Service Provider

The solution is a 'forfeit' transaction. The ASP won't include the 1000 sats in the new round unless you first sign a 'forfeit' transaction and give that signature to the ASP. This gives control of your original 1000 sats to the ASP; if you broadcast the original VTXOs, then the ASP can use the forfeit to claim those 1000 sats for itself. There is a timelock in the VTXOs, in order to give the ASP sufficient time to broadcast the forfeit transaction

The forfeit therefore protects the ASP, because it stops the user from 'double exiting'. There can then be multiple on chain 'rounds', and you have a balance in all of them, but you are practically able to access only one of them [the latest one]. 'Your' money in the older round UTXOs isn't really yours any more.

But we must also protect the user! You, the user, don't want to forfeit your balance in the 'old' onchain UTXOs before the new 'round' is confirmed on chain. The solution here is 'connector outputs'; the forfeit transaction depends on outputs created in the new round and therefore the forfeit is ineffective until the new round is confirmed.

So now both the user and the ASP are protected. The user has a balance on-chain in the 'old' round, with full unilateral exit via their VTXOs, and they can trustlessly and atomically 'move' that into a 'new' onchain round. It's not instant, because the new rounds need to be confirmed on chain, but it is unilateral exit

So Ark is great at scalability, but it has a few downsides for the various parties:

It's not private

If you insist on full sovereignty, i.e. you don't trust the ASP, then Ark is slow like on-chain. If you want instant trustless final settlement, then Lightning is still the only option

From the ASP's point of view, they have to lock up a lot of liquidity. If a given user has a balance of 21,000 sats and there are five rounds with that balance, then the ASP actually has to lock up 105,000 sats on chain. Each round therefore has an expiry time built in, where all the funds go back to the ASP after that expiry time; this motivates all users to take part in a new round - or exit or otherwise spend their funds - before the expiry.

This sounds like I'm being quite critical of Ark. It sounds like I'm saying that it's as slow and as non-private as on-chain, and the only advantage is scale because many users can share a single UTXO.

However, this is where Lightning comes in again. Lightning shows how you can take a slow and transparent system, and then build private instant settlement on top of it

In the vision of 'Ark as a channel factory for Lightning' that René Pickhardt and others have been talking about for a couple of years, everyone can have a full Lightning node. They haven't channels with other people, doing (blind) routing over the Lightning network. They'll be paying for preimages in the usual way. They'll be sending 'commit transactions' over and back in the usual way. Fully Lightning in every way, no compromises. In this vision, everyone gets private instant settlment because they directly use Lightning

The subtlety in this approach is that, instead of Lightning channels being backed by conventional already-confirmed on-chain funding transactions, the funding transaction that backs the Lightning channel is instead an Ark VTXO. You and I can set up a Lightning channel without broadcasting that funding transaction; we are both satisfied that either of us can - at any time - broadcast the Ark VTXOs to get the funding transaction on chain. This allows us to do all the Lightning stuff as if the funding transaction is already on chain.

In this context, you would have to 'exit' twice in order to get your funds. The first 'exit' is the Ark exit, where you broadcast the VTXOs in order to create the 2-of-2 funding transaction for the Lightning channel, and then the second exit is where you broadcast your latest Lightning commitment transaction in order to split the the 2-of-2 into the final on chain balance for you and for your channel partner

In the 'channel factory', Lightning is still the Layer 2. All payments fully go through Lightning, giving us private instant settlement. Ark is like 'Layer 1.1', offering a wrapper over Layer 1 that is still slow and somewhat transparent, but which allows us to scale up the number of users that can fit on chain

The British sense of fun around elections is great. This is a genuine photo from last night of the UK's likely next prime minister with other candidates for the seat that he has just won. In every election, fun candidates run against the high profile politicians

I ran twice today. 7.5km each time

It's nice to suddenly be addicted to jogging again

I really want to buy some STRC now, it's just $86. Partly to troll the maxis, just buy a small amount for fun

But I bought too much BTC already this month and can't afford it!

On Twitter, I'm starting to unfollow people that give too much attention to BIP-110

I generally enjoy the content of folks like

and

, but BIP-110 is now so boring to me that I unfollow them until this is all over and until they stop giving oxygen to BIP-110 and to unrealistic relay policy generally

The "debate" died long ago, and we (the tolerant minority) have won

Even the Bugle

are running out of funny things to say about it; surely a sign that this topic is long dead

I first got properly into Bitcoin only last summer, and I had great fun arguing with Knotzis as I learned more about the topic. But there is nothing to be gained any more. Shinobi, it's time to accept that you won't get any satisfaction from Hodlonaut

I'm not sure if I'll engage with any replies; but of course I'll engage in good faith if I have met you in person and know that you're in good faith

Great story

I'll go to Bitdevs tomorrow. I missed it the last few months, sometimes from laziness and sometimes because I was out of town

Looking forward to it!

The next interesting step for MONAD (Tor/VPN, funded by Cashu Spilman channels) is adding a nice management API; then I hope to have a nice dashboard web-app (maybe a PWA) to monitor and manage the wallet and the client and the relay.

I've been adding a lot of smaller things recently, like blinded paths and more stress testing and other little improvements. But it's time to wrap this up into something easy to use, like a Docker container with easy configuration and monitoring. Then I can start asking people to do some testing

Stop pretending that the UK's problems around internet freedom are because it's "left wing" or "communist" or "woke"

The current UK Labour party are famously quite right wing compared to previous Labour governments, and the UK generally is a bit more right wing than many European countries such as France

This isn't a left versus right issue. It's a mixture of (Epstein) evil, and incompetence

The manipulators want you to think that it's a left versus right issue, so that they can distract you with culture war crap. Engage your brain, and keep your eye on our real goals

I keep trying to do my fiat job, but I keep getting drawn into freedom tech instead

I've been busy with MONAD (cashu-funded Tor) in recent weeks. Various protocol improvements, and general stress testing under hundreds of simultaneous connections and hammering the payment channels

I started using KImiK2.7 and I like it so far. I'll use it for at least a few more days before trying to make a final judgement on it

reading Montaigne's essays

A longer-term idea to minimize prompt injection:

Hopefully, the future will be all open models and they'll all be running on commodity server farms (using something like

to buy and sell)

I know there is randomness when predicting tokens, but we should make it deterministic, i.e. pseudorandom

Each server should sign every response. We should send a small fraction of our requests to two servers simultaneously.

If two servers give a different response to the same request, then it's likely one has cheated. With the signatures, we can then prove which server farm misled us

I guess this is a bit complex, but it's a fun problem to think about

Good read, on how Liquid keeps amounts private, while also being immune to the kind of issue that affected zcash recently

(Not very much technical detail though; I should follow the references here to learn more)

BTC Yield will continue until morale improves

I'm reading a Culture novel again now, for the first time since getting properly into Bitcoin and AI

There is a lot of AI in those stories, so it's interesting to read it now that it seems more realistic

And they're always pointing out that the Culture isn't so "organized"; no hierarchies and laws and so on. I guess it's what some anarchists would hope is possible

(They still have extraordinarily powerful armed forces though)

"Just transitory"

, monitoring the STRC de-peg

I enjoyed this much more than I expected I would.

I love Steve Keen's work, he's excellent on economics and it's history, especially on how fiat works.

I was a bit worried that Peter McCormack would be too ideological, but he was willing to learn and you can see that they both enjoyed this discussion.

Keen isn't a bitcoiner (yet); they didn't really discuss bitcoin here. We need a way to combine his expertise with the facts about the world today (e.g. the existence of bitcoin)