Zero-Knowledge Goof

Yes I knew this! https://github.com/LLFourn/dlc-sec/blob/master/main.pdf
It seems I found Dryja’s scheme is actually sound if you come up with a reasonable definition of oracle security which matches your claim.
I later found though there’s a bunch issues if you try and combine events from the some oracle (treat the some of anticipated signatures as a conjunction of the two outcomes).

2026-05-09 00:21:19 UTC

- reply

This is the first time I’ve heard the importance of conflict in the development of money touched upon. Interesting listen!
https://fountain.fm/episode/ByGugoFYLU0uFDPI6Z2t
#nevent1q…5j62

2026-05-01 02:06:09 UTC

- reply

This guy fucks!

2026-04-30 23:08:20 UTC

- reply

Don’t trust verify is a good strategy actually. What can we learn from chiming in that we don’t know already? The fundamentals are all established by now. What remains is to make a quantum computer.

2026-04-30 21:36:42 UTC

- reply

Nah no need for anyone to chime in. Compute something with a quantum computer or stfu.

2026-04-27 03:25:41 UTC

- reply

Put those jpegs in op returns and we’d have come full circle.

2026-04-24 02:08:24 UTC

So even though claude is better now you still need codex just to read it's output. I'm not reading all that.

2026-04-21 08:41:28 UTC

New meta: run claude code and codex side by side on the same project and tell codex what claude is doing in the other terminal and ask it "how fucked am I?" so you are emotionally prepared when it breaks everything.

2026-04-18 04:44:17 UTC

- reply

That would help. I still think designing prediction markets would reveal the perceived probability over time and so would be a big improvement over pure donations. Doing them on-chain cleanly so you can sell the position is impossible to do without sophisticated covenants though.

2026-04-18 03:25:44 UTC

- reply

Aren’t you proposing that dormancy does abdicate ownership? Since if a quantum computer takes them they will certainly no longer be the owner.

2026-04-17 21:09:08 UTC

- reply

who funds the on-chain reward in your mind? I was suggesting facilitating prediction markets as the best way becuase it conveys information about what speculators think while also providing a reward.

2026-04-17 02:20:58 UTC

- reply

Wut lol?

2026-04-16 22:45:24 UTC

My 2 sats of quantum slop.
In Bitcoin, signature schemes are there to authenticate the owner of coins. If there is a quantum computer they don't work. Code that doesn't work should be disabled and removed. Removing broken things is not confiscation but leaving them in is since it allows confiscation by the quantum computer operator.
The plan:
- Soft fork in SHRINCS into a tapleaf. Require both internal key BIP340 signature + SHRINCS signature.
- People slowly migrate to addresses that include taproot + SHRINCS (but don't actually use it to spend other than to test).
- Set up 200 bit ECC puzzle as part of bitcoin consensus. If solved, ECC is disabled in Bitcoin and it auto triggers the availability of pure PQ address SHRINCS (or whatever this can be changed as we go).
- Encourage the development of prediction markets on the 200bit ECC puzzle so that QC developers have a nice incentive. A liquid or other sidechain prediciton market would be good but you could add an OP on main chain to inspect whether it had been solved or not.
- You could add challenges in a range from 150-200 bit to keep things interesting for prediction markets. Solving 160 bit would be a major red flag. Only 200 bit solution triggers the ECC disabling.
- After ECC disables, over time plan a hard fork so people who hadn't migrated to taproot+SHRINCS can get their coins back via guy fawkes signatures or ZKPs etc.
- sunset the disabling after 40 years (the quantum question is assumed to have been sorted out by then).
Why:
- QC developers will almost certainly not use their capability to attack bitcoin as a first step.
- If honest researchers pull it off we have an incentive which gives them money and prestige
- QC may never happen. Sunsets or anything relying on a social assessment is misguided.
- In the unfathomably unlikely event that a QC is kept secret and developed just to attack bitcoin AND no honest party can hit 200bit before them then we'll have to manually do the emergency ECC disable softfork and perhaps roll back the chain a bit. Still in a better position since all the code is already in there and most people have migrated to taproot + SHRINCS
- Hashed keys are just as vulnerable. The first QC that can solve secp256k1 DLOG given our current state of knowledge will be able to do it quickly -- few seem to understand this. If they are going to attack bitcoin with it they might as well set up a few of them and steal every mempool coin they can to cause maximum panic. Would be better than stealing satoshi's coins.

2026-04-15 01:20:20 UTC

https://blossom.primal.net/da3e843deb45a3651114590d5cad3c140735370110d682deca44efef15a749fd.png
In the middle of a long and complex task codex decodes to figure out the answer to 1+1. When asked why:
"I accidentally invoked the web tool with a trivial calculator call while thinking through the review. It had nothing to do with your repo or the
task, and it should not have happened."
please un-nerf claude code

2026-03-30 10:33:56 UTC

- reply

Thanks for having us on!
https://fountain.fm/episode/ALELUwcGyBtZsGTbQzc6
#nevent1q…9aqn

2026-03-27 22:49:03 UTC

- reply

I’ve listened to about 5 of them and they were all great!

2026-03-24 08:45:08 UTC

- reply

Nice interview. BitMEX sounded like a fun place to work.
https://fountain.fm/episode/8WwIFs1pqvwujS0rqZNo

2026-03-21 08:58:42 UTC

- reply

The way I read it, frostsnap is the only complaint one. This is about the manufacturer helping users recover funds by bypassing the device pin in some way. We don’t have a pin so we’re fine.

2026-03-10 09:56:33 UTC

And just like that your bitcoin is no longer stored in your house, there's no descriptor backup you can lose and anyone with 2-of-3 devices can restore the funds. Once you obtain this level of peace of mind you can never go back.
#nevent1q…sx8x

2026-02-14 01:25:40 UTC

- reply

Nice I am working on something like this for myself. Where’s the code?

2026-02-14 01:23:48 UTC

- reply

Everyone with conviction has to pay these tuition fees at least once mate. The classic mistake is making big plans at a certain BTC price and having to execute them at a lower one. Sounds like you’ll make it through ok.

2026-01-14 04:07:58 UTC

- reply

haha I was trying to find you not make a note. Oh well follow npub1r89krrt3u2cugr6aje5n8e0f9jtp6awqj7czhx0t5ga5v5x6gq6s90z95r everyone!

2026-01-14 04:06:27 UTC

npub1r89krrt3u2cugr6aje5n8e0f9jtp6awqj7czhx0t5ga5v5x6gq6s90z95r

2025-12-29 00:49:43 UTC

52 years later, only known copy of Unix v4 recovered from randomly found tape, now up and running on a system — first OS version with kernel and core utilities written in C
https://www.tomshardware.com/software/linux/unix-v4-recovered-from-randomly-found-tape-at-university-of-utah-only-known-copy-of-first-os-version-with-kernel-and-core-utilities-written-in-c

2025-12-12 01:43:11 UTC

- reply

Yeah it’s Jan 12. Go for it!

2025-12-11 23:17:32 UTC

To all those people who ask me how to get involved in bitcoin open source, here’s the best way:
https://bosschallenge.xyz

2025-11-30 19:05:12 UTC

- reply

Opus is much better for me. It’s got a better tempo and takes less effort to get it to go in the right direction.

2025-11-19 21:33:14 UTC

- reply

Wtf is wrong with the uk

2025-11-19 20:56:43 UTC

- reply

It works for me!

2025-11-16 07:17:19 UTC

- reply

Haha that sentence was extremely slurred but it sounds like you got the idea!

2025-11-15 07:11:16 UTC

- reply

Yeah that’s a feature. You can forge the PoK on related keys. If a key has a known key then you can’t sub-exponential data with it or any related keys either.

2025-11-11 23:42:49 UTC

- reply

Cool. I think a first step is just to figure out the actual data embedding rate for a few different approaches/assumptions. Has anyone even figured this out for BIP444?

2025-11-10 22:57:35 UTC

- reply

Oh also public derivation could work with the BLS scheme I think. Just don’t commit to the public key in the hash to curve for the PoK and it becomes malleable.

2025-11-10 22:55:22 UTC

- reply

Haha BLS everything of course. I can’t even imagine how you could do it only for the PoK. Any equivalence proof between curves will be a PoK so there’d be no point in the BLS in the first place.
I like “purecoin”. Although I also think it’s not a great direction. It’d still make way more sense than bip444. It would be interesting to present a possible if not realistic soft fork that actually would significantly reduce the amount of data embedding that could be achieved per vbyte. Then a rational debate could be had.
Point taken about locktimes. I don’t think anyone would be in favour of disabling lightning. You’d probably have to leave the spammers with that one.

2025-11-09 01:57:22 UTC

- reply

Thanks for pointing me to the mailing list post. I don’t know what you mean by there’s no way BLS could be implemented on Bitcoin — you could introduce a BLS12-381 address very easily in a soft fork. This would make data sub-exponential data embedding impossible. Also the BLS PoK (ok technically a PoP) can be constructed non-interactively for aggregated BLS multisig.

2025-11-08 01:46:00 UTC

- reply

You can use 128 bit challenge for the PoK (give up batch verification)
Oh that’s interesting. You reveal the bytes *with* the PoK. Ok then I raise you: We use BLS where the PoK is deterministic.
.

2025-11-07 22:27:39 UTC

Has anyone tried developing a soft fork that would actually verifiably stop all spam?
1. Make a new address type that has a public key + proof of knowledge. 2.5x larger than current addresses. No script nothing else.
2. disable spending to anything other than the new address type.
Spam solved.
You could modify (1) to allow raw multisig also. You can actually do lightning without script using MuSig + adaptor signatures. So everything keeps working… in theory :)

2025-11-05 02:59:18 UTC

I see a few people calling people “unethical” or “dishonest” for their technical opinions. Don’t do this, as good as it feels. Pick up your cross and just make arguments.

2025-11-04 04:33:13 UTC

“I’m waiting for my bags to have one last pump so I can rotate to BTC” is the best genre of post.
https://image.nostr.build/194788ee439aae365773d7b22198ec2fbf2c8092fd02b92f953316e15ca2c1e0.jpg

2025-11-03 10:20:40 UTC

Oh my sides. It's unbelievable that if not for Bitcoin the entire human species would have been forever enslaved to this preposterous system.
https://www.youtube.com/watch?v=G8u0EIY6q-U

2025-08-30 22:12:34 UTC

- reply

Great question. For now you will need multiple devices. This isn’t a fundamental limitation but a design decision taken to simplify things, especially backups.

2025-08-30 05:16:15 UTC

Get into it freaks!
#note10hh…4ve3

2025-08-25 21:19:10 UTC

- reply

A beautiful reading but 40 seconds worth of distance run now? Shrinkflation showing up everywhere.

2025-07-27 22:32:14 UTC

- reply

But how do you know if it’s the person who bought the service or not? Email login?

2025-07-27 10:27:40 UTC

- reply

I think that what remains is to show that you can do blind Schnorr + FROST naively without modifying the blind schnorr signing algorithm and the FROST signing algorithm. There’s also work on making ZKPs so you can prove things about the tx without revealing the whole tx (e.g. you could put a spending limit).
Right privacy good but it also makes it had to be a backup for someone unless they can identify themselves as the true owner of the coins. Maybe there’s something there though where the blind signer would only sign if you prove the utxo it’s spending (without revealing which one) is older than X months to enforce a sort of scriptless degrading recovery mechanism.
What would be cool would be to make the blind signer programmable so we don’t have to think too much about how to build the product — even better make it a reasoning AI prompt that you set up yourself to vet anyone who claims to be the rightful owner of your coins in the future. i.e. upload yourself to the cloud so you can grief your progeny as they try to claim their inheritance.

2025-07-26 23:50:43 UTC

- reply

I think the cryptography for that is partly sorted out but we don’t have concrete designs on a blind signing service tbh. Do you have any thoughts about what you’d like to see?

2025-07-26 22:13:16 UTC

- reply

Awesome! Yep locked in for September shipping.

2025-07-16 14:24:14 UTC

@npub1ynn…u3gk higher 5000

2025-07-16 14:17:42 UTC

- reply

Thank you!

2025-07-01 16:21:22 UTC

- reply

It would be hard to get FROST to work on seed signer because it’s stateless. I know a trick that *might* make it possible. So the main advantage of frostsnap is that it exists!
Yes spending limits require secure hardware that never leaks its secret.
Changing quorum size just means making a new sharing of the secret and everyone deleting their old shares. You can do this without reconstructing the secret.

2025-06-30 15:06:45 UTC

- reply

We're going to ship the most robust personal Bitcoin multisig setup ever.
✅FROST key generation and signing
✅Bitcoin wallet + PSBT/Sparrow support
✅Simple seed words backup
and a lot more in the works.
Pre-ordering gets you this ASAP and helps support our efforts. Thanks!
#nevent1q…r9zh

2025-06-11 01:26:11 UTC

I'm talking at Bitcoin Sydney tonight on Frostsnap!
https://www.meetup.com/bitcoin_sydney/events/308244930/?slug=bitcoin_sydney&eventId=308244930

2025-04-09 09:38:12 UTC

Learning about @npub1ejk…expu at Bitcoin Sydney.
https://image.nostr.build/d3b5dfe33c45d1f6893834b8abb0825cd0d92b3bc647be566d98ea23cade90b5.jpg

2025-03-29 06:06:15 UTC

- reply

Here’s the steel man himself: https://rumble.com/v6rajo4-freedom-of-speech-is-not-granted-by-the-government.-non-citizens-in-america.html
1. Fascists don’t nationalize industries. At least before a major war breaks out.
2. Happens later. Why would he make these moves now.
3. They’re deporting people in the US legally for not following state mandated narratives. A woman for writing an opinion in her school newspaper. Don’t worry citizens will get the treatment later.
Of course Biden helped develop American fascism too. So did all the presidents in recent memory. The people who are getting hysterical about it now are just partisan hacks. But they’re not wrong.

2025-03-12 08:48:01 UTC

- reply

Yes I am going to do the same thing but the question is whether to patch out secp256k1 or secp256k1-sys. Which will be less painful…

2025-03-12 08:46:20 UTC

- reply

Yes sounds like you’ve got the main idea!
I had this trick in mind to buy multiple el gamal decryptions with one tx at some point.

2025-03-12 08:34:41 UTC

- reply

Oh but it looks like you’re patching secp25k1 rather than secp256k1-sys?

2025-03-12 08:27:22 UTC

- reply

Awesome thanks.

2025-03-12 03:25:45 UTC

- reply

So you patched out secp256k1_sys?

2025-03-11 01:42:26 UTC

- reply

You still need the ZKP to prove the pre-images of some set of have some valid representation. I am referring the step where you have `n` points whose pre-images you want to sell in a single transaction. I am just saying you don't need n outputs to sell n DLOGs. You can set up an access structure ahead of time such that anyone who knows the discrete log of `X` will learn the discrete log of `X_1`, `X_2`,... , `X_n`. e.g set a polynomial such that p(1) = x_1, p(2) = x_2, ..., p(n) = x_n, then send p(n+1), p(n +2), ... p(2n -1) to the purchaser (they verify they are correct by interpolating X_1, X_2,..., X_n). Then sell them a single DLOG p(2n). From it they can interpolate the polynomial and recover x_1, ... ,x_n. You don't need to do any VSS here.
This is sort of the idea of "packed" secret sharing from the literature. If all the secrets are uniformly sampled and independently random then that *should* be secure protocol under DLOG assumption. Might need some more thought if that's not the case.

2025-03-11 00:59:56 UTC

- reply

Show us the code sir. I also have a good reason.

2025-03-10 10:58:49 UTC

- reply

You don't need n signatures to set up a payment for a n term representation.
Consider that the prover can just treat each secret term in the representation as coefficients in a polynomial, evaluate the polynomial n-1 times and give the evaluations to the verifier (along with the point commitment vector of the terms of cours). The verifier then pays on chain just for n'th evaluation with adaptor signature. With the nth evaluation you can reconstruct all n terms.
I think!

2025-03-10 10:38:34 UTC

- reply

Why though? (I am also doing this)

2025-03-06 08:51:39 UTC

- reply

You can make it work. It requires some UX finesse. You have to sort of “prepare” the silent payment address by getting a threshold of frost signers to do partial Diffie-Hellman and give the result to the coordinator. From there the coordinator can instantiate the silent payment outputs without the signers but it needs to be done once for each SP address.
I think we’re gonna try and hide this behind a kind of “save address” feature which (for security as well) requires you to sign the address with a threshold of devices to associate it with human readable identifier e.g. “Max”. You can slip this crypto in there.

2025-03-03 22:12:20 UTC

- reply

SOD CANDLE

2025-02-07 22:36:40 UTC

Tell me a decent vacuum cleaner brand that doesn’t employ planned obsolescence.

2025-02-04 00:24:14 UTC

- reply

Which country is this?

2025-02-03 10:02:21 UTC

- reply

It’s not bad where you get this?

2025-02-03 09:20:10 UTC

Bitcoin being used as the settlement layer for industrial scale smuggling and tariff evasion is not priced in.

2025-01-28 03:27:44 UTC

The most under appreciated impact of AI is that emacs is actually configurable now. It still takes half your day to change some small thing but you will almost certainly make progress if you are armed with the best models.

2025-01-23 12:17:03 UTC

- reply

fed season is already here.

2025-01-23 11:09:38 UTC

Good news: There is not more alt season
Bad news: It has been replaced by wrench attack and kidnap season.

2025-01-13 00:41:37 UTC

- reply

This is pretty futile. Once you press the copy button there is no guarantee the thing that goes to your clipboard is the thing you verified.

2024-12-30 23:32:45 UTC

Does nostr have a way to ask a relay to provide a signed receipt of a message. Do relays have public keys at all?

2024-12-22 21:27:38 UTC

- reply

Third time lucky.

2024-12-22 21:26:44 UTC

High quality literature in the p2p street library this morning. There’s hope for us yet. https://image.nostr.build/61d591a8a50313ca86688c5f89b1a2e711f5cb1b071fb01bfaa56ebc12cb2ade.jpg

2024-12-22 21:26:17 UTC

High quality literature in the p2p street library this morning. There’s hope for us yet.

2024-12-22 21:25:44 UTC

High quality literature in the p2p street library this morning. There’s hope for us yet.

2024-12-10 19:59:57 UTC

- reply

No that would exhaust my QC

2024-12-10 10:16:01 UTC

Introducing wanko, a state of the art quantum computing system made up of intricate lattice of bosons (actually just my body). With it I was able to solve the adult male ejaculatory latency sampling problem (ELS) in LESS THAN FIVE MINUTES.
To properly model such a complex nervous stimulation with a leading supercomputer would take over 10^25 years, far beyond the age of the universe(!).

2024-12-09 22:18:01 UTC

- reply

“A standard benchmark computation” :^)

2024-12-09 21:50:58 UTC

- reply

He’s not wrong though. The longer you wait to go all-in the greater the fool you are.

2024-12-04 05:37:07 UTC

New frostsnap logo lands
https://m.primal.net/MnMF.jpg

2024-11-25 23:07:02 UTC

Well deserved. Dunno where our product or Bitcoin research would be in general without these people. #note1njv…sn8s

2024-11-25 21:49:17 UTC

I think about the fate of this “caution: falling rocks” sign a lot. https://image.nostr.build/b3ecd2c28438bad04c6dfc261879424b5afb8f3449e627400bcc90b574518e83.jpg

2024-11-11 08:03:41 UTC

- reply

Caliber**

2024-11-11 08:02:46 UTC

- reply

That’s literally what it is lmao. I was testing what happens when you sign something with images with amber and chose something from my photo library that wasn’t a family photo and found WhatsApp auto-saved aunt calibre bible quote.

2024-11-10 23:10:06 UTC

GM https://image.nostr.build/6ba1d692947d5c9d27bf72d17c2e21c7566d5555b59e2df970d7781a2abdb2d9.jpg

2024-10-28 22:33:09 UTC

The pandemic is over #note1w5s…fd3q

2024-10-26 21:24:36 UTC

GM my digital age human souls https://image.nostr.build/bbf4ef63cca4b15802f7ad0da48de8f0b8a5f4c797526e75a45f6b83317e5c74.jpg

2024-10-25 00:22:57 UTC

- reply

Bruh it’s the morning.
Good to see you on the panel anyways.

2024-10-25 00:16:58 UTC

- reply

You’re going already!?

2024-10-23 20:15:27 UTC

It's not looking good ethbros. I've been doing some technical analysis on ETH/BTC. It turns out that maybe ETH and all "utility tokens" have no fundamental value and it just took an unusually long time for the market to begin adjusting them towards zero. https://image.nostr.build/2e96c0592b32172d98e3427809a2406be4a778fa443e38f224380c5ecc4e63df.jpg

2024-10-23 12:13:40 UTC

It's not looking ethbros. I've been doing some technical analysis on ETH/BTC. It turns out that maybe ETH and all "utility tokens" have no fundamental value and it just took an unusually long time for the market to begin adjusting them towards zero.
https://m.primal.net/LfZi.png

2024-10-18 09:14:29 UTC

- reply

Need to make frostsnap work with it so someone had to get one. Also very interested to see how the “””Apple Intelligence””” works.

2024-10-18 09:06:06 UTC

Just moved from android to iPhone. The only apps that were easy to move were the nostr apps.

2024-10-12 10:44:03 UTC

- reply

Started reading this post. Decided to finish it in my first sauna for 10 years. Loved it. Inspired to try working this into my routine.

2024-09-13 02:07:33 UTC

- reply

Oh interesting OK. So this is broadcast and then you send out deletion for it when the draft is no longer needed?
It seems to happen even if I don't close a note though..

2024-09-12 10:52:14 UTC

- reply

....what's a draft note?