<unnamed>

Public Key

npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7

Profile Code

nprofile1qqsxwkuyle67y94tj378gw8w2xw2wa6nwmwlqhddlwnz0z7sztsaw2qpzpmhxue69uhkummnw3ezuamfdejsz9nhwden5te0wdjkzunrdqhxummn9e6x7erp0yqs6amnwvaz7tmwdaejumr0dsm582yz

Publishing to

nostr.wine

search.nos.today

nos.lol

Last Notes

2026-03-12 20:04:33 CET

5 years after they came out I've finally beaten the last of the unholy quartet of Infant Annihilator speed maps. Ov Sacrament, Feast, Necropocalypse and .. Plaguebearer 89%.
It's not the hardest, should be the easiest in fact, just that dense stream at 1min30 is quite quite brutal, plus it's a really long map. Still not as bad the first 2 minutes of Ov sacrament.
https://replay.beatleader.com/?link=https://cdn.replays.beatleader.com/30529240-76561198869198482-ExpertPlus-Standard-9C4820E753370B43DB6C944EED8D6F0966847F0A.bsor
#beatsaber

2026-03-12 16:15:07 CET

- reply

I prefer 'ethical' to moral. Slightly different connotation.

2026-03-12 16:14:36 CET

- reply

Well, maybe. I guess I am only talking about a cognitive error of ordinary non powerful people, who are indeed trying to be moral or ethical.

2026-03-11 13:36:16 CET

Hypothesis: basically *every* error people make in their understanding of the world at large (society, politics, large scale scientific development, war, etc. etc.) comes from a root cognitive failing of conflating the local/personal/small scale with the large scale and believing (usually completely unconsciously) that logic from the former can apply to the latter.

2026-03-11 13:35:13 CET

- reply

Yeah sorry not going to work for a while

2026-03-11 13:14:29 CET

- reply

Yes it needs a soft fork. The important thing is there's a solid theoretical basis for actually doung CISA. Experience with MuSig taught us you have to be super careful building these algos ... the power that Schnorr's linearity gives you is a double edged sword.

2026-03-10 20:20:18 CET

Most honest altcoin name:
https://www.coindesk.com/price/buy-instead-of-getting-a-job

2026-03-10 20:03:05 CET

- reply

Interesting read. It doesn't sound easy to do this across a country... but maybe I'm wrong.

2026-03-09 16:16:59 CET

One aspect of the Iran situation that I don't see much chatter about: ever since the early January events (massacre? - the question mark is my point!), we've been told that "the internet is shut down", basically. That seems ... remarkable? Considering especially that satellite internet is no longer just a theory, starlink is very widespread (though presumably it was never widespread in Iran!) and there were reports that it was "jammed" - can anyone explain exactly how? It reminds me of the early days of the internet, in the late 90s, when everyone laughed at the idea you could fully censor the internet (it "routes around it", remember?) without just cutting all the wires and then .. in about 2000-2005 some of us who were paying attention were stunned to find out that China managed to keep the internet fully functioning, but also more or less entirely politically censored. Now apparently you can *entirely switch off* the internet including presumably all the baseline telecoms infrastructure in a country? How exactly does it work? If people are getting messages out, how exactly are they doing it?

2026-03-06 21:10:56 CET

I think we need a new word for the specific kind of mental anguish I experience when I scroll through twitter and find that every long post (the ones I always gravitated to, because it usually correlated with someone having something to say) is in the "that's not X - it's Y" prose style that is so transparently LLM speak. It really is painful at this point and it's completely endemic. I know we have "slop" but I never really liked that, it's not the content (sometimes, the content is interesting), it's the style and emotional timbre. I put up with it when an LLM is giving me some useful info in my interaction with it, but please for the love of god, write your prose yourself, even if all the info is coming from that source.

2026-03-06 13:44:27 CET

- reply

Interesting. On tor, isn't it already the case that the (large?) majority of reachable nodes are over tor? I don't follow these stats regularly.

2026-03-06 01:57:29 CET

Feels like time to unearth an old opinion ... I don't think the BIP process should be used for anything that doesn't directly affect running a node. So that includes p2p stuff and consensus stuff, but it doesn't include stuff that most people would consider 'obviously' should be in BIPs, like wallet standards. And even addresses.
The alternative is seen clearly in the recent decision on ordinals. An even far more obvious case of something that shouldn't be a BIP imo.
Meanwhile BIP110 *could* be rejected on the basis of it being a terrible and antithetical idea, but it does ofc fit into the category as per the above.
Wallet and address standards could be an entirely different category of document, with a different process. We don't all need to agree (though I accept that addresses stretch this categorization to its limit, but nbd).
#bitcoin

2026-03-04 22:43:59 CET

- reply

At least it's honest. 90% of content is generated like this, but without telling you.

2026-03-04 18:38:26 CET

- reply

Interesting. If we think of LN, we have that: not only ability to withdraw, but also ability to maintain currently held funds, passively, can be violated even without 51% attack but merely through censorship by miners, or even pure unavailability or pricing out through fees > available balance. Hence someone put it in some pithy statement that I can't remember along the lines of "in Lightning censorship resistance is a security requirement" (meh I can't remember exactly but you get it). But then is that overlapping with a 51% attack, or not? I always thought of the latter as specifically referring to attempts to "undo" payments, so changing inclusion and/or ordering of txs. I think I'm trying to say that, with this definition, even LN doesn't count as an L2, does it?

2026-03-04 18:07:23 CET

Of course the main point, which has still not come close to general public consciousness yet is: "we *already* have the tech to support a centralized big brother controlling every aspect of digital life through credentialling that can *very credibly* argue that they are not violating your privacy, because they can use ZK to ensure the barriers they use to block your dissent are based on a ruleset that does not intrude into your personal life directly; it only *infers* your nonpersonhood without actually accessing your meatspace identity". There's my cheery thought for the day :)
#nevent1q…3wa5

2026-03-04 14:05:12 CET

Matthew Green's annual/biannual whatever blog post finally out. He's one of the best out there at patiently explaining #cryptography without overwhelming amounts of math.
It's on anonymous credentials, and even before reading it, I know exactly where he's going. I agree this is going to be a crucial part of our future with AI, bots, whether we like it or not (and we probably won't). Also the "tech" is already pretty much all there, it's not "moon math" at this point, particularly. Let's see what he says .. :)
https://blog.cryptographyengineering.com/2026/03/02/anonymous-credentials-an-illustrated-primer/

2026-03-03 23:04:57 CET

Very much like the old Frozen Heart vulnerability report:
https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/
Basically the Fiat Shamir heuristic requires you to hash in the whole of the conversation before the challenge step; if you miss something, bad things are possible. (Specifically you can prove statements that aren't true). Very detailed writeup for those interested.
#cryptography

2026-03-02 14:05:01 CET

- reply

How is that helpful? An AI can run a mining rig. One person can claim to be a thousand, running a thousand miners. Etc.
In the digital realm, there is no solution to Sybil attacks other than cost, and there is no *real* solution to decentralized currency other than proof of work.

2026-03-02 13:55:46 CET

- reply

Yeah I'm only doubting in the technical domain. Something like claude doesn't in any sense brown nose when it comes to some technical idea or description; if I'm directly wrong, it'll say so. It's a more subtle but strong tendency to end up at the conclusion that I tangentially implied, but actually I don't know if it's true. That kind of thing.

2026-03-02 13:52:48 CET

- reply

Imo, people are rarely *this* sycophantic, or, they are not very useful if they are (i.e. people with this extreme high functionality aren't anything like this agreeable).

2026-03-02 13:49:59 CET

- reply

Yeah. As per other answer, it's persistent beyond that, and maybe with *multiple* perspectives it gets close to objectivity but that's a lot of work. They're not ultimately *that* good at 'audit'. But certainly better than nothing, just, don't treat it as even remotely definitive.

2026-03-01 13:40:07 CET

- reply

Good luck with that :)

2026-03-01 12:58:29 CET

- reply

Is it better than claude, chatgpt, kimi for this kind of thing? I'm talking about cryptography, let's say.

2026-03-01 12:57:21 CET

- reply

I'd claim it doesn't solve it, though I'm not sure of this: if I say "critique this idea" it does indeed critique it and look for weakpoints, but the same problem is still there in disguise: even if the idea is absolutely brilliant, its tendency to say what I've asked it to say persists. Still, it's already a step up, and maybe if as you say I ask for *6* different perspectives that conflict with each other, I'm getting closer to objectivity. It's hard though, I feel like every part of the responses is colored by the agreeability bias.

2026-03-01 11:50:53 CET

An LLM tool that was programmed to be *disagreeable* - I'd buy that product. If I had to bend over backwards to convince the AI that I was right in some vague intuition, it would be, no joke, a lot more useful than what I have today (the opposite). Of course it depends on your use case. If you need to polish your writing or achieve IT/software tasks that you don't currently have the skills for, this issue is not so relevant. But I'm trying to use it to vet ideas and its enormous, aggressive desire to agree with me is massively getting in the way.

2026-02-28 19:57:41 CET

I've finally figured it out. *2027* is the year of Linux on the desktop!
https://lunduke.substack.com/p/california-law-to-require-linux-windows

2026-02-28 15:00:01 CET

- reply

Yes, as is likely obvious, I completely disagree with Lopp about this.

2026-02-28 14:59:13 CET

- reply

First, fair criticism. I can't generalize to all BIP110 supporters.
But that wasn't really my point, my point was that this *general* mental framework of 'non-cryptographic spending is anathema' is becoming less and less obvious and we're seeing the effects in various places.

2026-02-28 13:26:27 CET

- reply

https://x.com/secsovereign/status/2027518985281867849
Does that work?

2026-02-28 12:48:39 CET

I saw a message on twitter from a BIP110 proponent arguing that the fact that Karpeles' pull request to redirect the MtGox coins to creditors was immediately closed is evidence of the problems with Bitcoin Core. It wasn't a joke.
I think this a good, and stark, example of how far some substantial portion of the modern Bitcoin community has drifted away from the original cypherpunk--> bitcoin vision. The whole cypherpunk thesis was something like: the new online/digital version of the world (speaking from c. 1990 when the internet was very nascent) will have a natural tendency to vast government overreach (think: instead of letters that can't be intercepted by law, you have emails that are default open to all government agents to read), and the way to protect against it is to build systems using public key cryptography which render government's asymmetric force impotent. Their whole motivation for digital cash came from that same vision, but also, in analogy to the mail vs messaging problem, they focused on the secrecy side, which in retrospect may have been an error (see my recent post about the 1999 mailing list message); the great achievement of bitcoin was not to make it impossible for a government to see a transaction occurring, but that it couldn't stop it through decentralization; and it worked incredibly well, but only because transactions are controlled by cryptography, not people. Satoshi heavily nodded towards this with references to bittorrent in particular (doubtless bitcoin's name is related to this, though "bit-*" was being used a fair bit back then). So at the very center of this vision is the idea that no one can stop you from doing transactions, only public key cryptography controls ownership, nothing else. Ethereum violated this principle about 1 year after it launched - it added a consensus change to simply redirect funds, i.e. the funds transfers explicitly was not a function of cryptographic authorization. It's easy to miss this detail in all the noise; but crossing that line is anathema, it completely removes the entire point of the system. Any proposal along these lines, from CZ, from Karpeles, from anyone, is idiotic. And if you support it you are at the very least, a million miles from being a bitcoiner. When we say "no rulers" we specifically mean that: nobody gets to move funds except by having the spending key; the end, no exceptions.
Bitcoin's value has this principle as its backbone. That's why proposals to freeze coins are fundamentally wrong, imo. You can't protect a house from flooding by setting it on fire.

2026-02-28 11:35:16 CET

- reply

Taproot is not quantum resistant.

2026-02-28 11:34:30 CET

- reply

Research the 'double spend problem'.

2026-02-25 19:55:08 CET

- reply

Yeah. But 'practice and gain confidence first' - kinda true second-order. First-order direct experience is an unending struggle *against* vast overconfidence and excess agreeableness.

2026-02-25 15:10:08 CET

- reply

Not sure. Like, the FE'd up cov idea, then yes. Which admittedly one of the biggest unlocks would be a generic covenant. But 'gate private key behind ZKP verif' ... here, maybe not? I don't know.

2026-02-25 13:42:56 CET

I'm not really sure about this, but I think I'm in a slowly growing group of people who are gravitating to this thesis: between witness encryption (WE), functional encryption (FE) and indistinguishability obfuscation (iO), listed in increasing order of power and decreasing closeness to actual existence, there is a slowly clarifying path to bitcoin becoming practical. It's "practical" already, to be clear, especially with Lightning (confident in saying so, as I actually use it, unlike all the influencers on twitter). But that's quite limited. The potential future is one that's a lot more fun and a lot less about arguing with each other ... a bit like the very early days where for a lot of people Bitcoin felt very "the sky's the limit" in terms of introducing whacky new schemes and systems. A lot of that was kind of deluded, but at least it *was* fun, something that's a bit lacking "here" nowadays (yes you have it on nostr, sure, but nostr is not money!). If we even get the simplest of the 3, witness encryption, with enough generality, it could obviate the need for lots of arguments about op_codes and people will be able to build genuinely interesting offchain constructions where people can do things like super-low cost txs without any setup or collateral, or engage in bets or smart contracts etc. etc. .. with WE it's clunky because of the background onchain plumbing being a bit messier. With FE you can have the same things, or better, and it's a lot more streamlined, I think. But FE only exists in sort of toy form for now (so called "inner product functional encryption" is very elegant but extremely limited, afaict). As for iO, it allows you to do .. basically exactly anything (every existing crypto primitive can be done with iO, and others too), which is probably why it remains just a theory for now.
#bitcoin #cryptography

2026-02-24 20:45:19 CET

- reply

Still begs the question, which is 'what makes it good money?'.

2026-02-24 20:44:24 CET

- reply

Oh yes, great point! I'd forgotten that.
Maybe 7 years+, Satoshi forgot 😄

2026-02-24 03:37:03 CET

- reply

Network effect is a proximate cause, not an ultimate cause. It begs the question. Why does the network form around this particular thing?

2026-02-21 13:56:00 CET

Been reading BitVM2 and I think I have it right that their "one time setup then delete the key" for the signing committee is actually once *per peg in*, not once only. That's non trivially different (worse) in practice. But if I'm right, the paper is quite misleading about that.
#bitcoin #cryptography

2026-02-21 11:36:59 CET

- reply

Well by *this* definition yes, but it's not the definition of "ecash" that's generally understood. Good point! 😁

2026-02-21 00:56:02 CET

- reply

Not sure about this analogy because in the game Yhorm is a complete joke 😄

2026-02-21 00:55:09 CET

- reply

2026 is really the year of linux on the desktop.

2026-02-20 14:18:04 CET

- reply

Also https://dr.orlovsky.ch/blog/cyphernox-manifesto

2026-02-20 14:16:46 CET

You can say a lot about Orlovsky but you can't say he thinks too small.
https://dr.orlovsky.ch/blog/inevitability-of-cypherpunk-for-a-proper-civilization

2026-02-19 15:55:44 CET

- reply

Ok, calm down, lol. Fwiw I was typing on typewriters in the 1980s and never used this convention. It may be regional; I don't remember it being common in the UK in the past, but I could be wrong.

2026-02-19 14:43:57 CET

- reply

"checks out", sorry

2026-02-19 14:27:39 CET

- reply

Afaik b-money was 1998 so the timeline checks it. I guess the cypherpunks mailing list readers would all be aware of it.
Personally I thought b-money was pretty uninteresting, but I guess you had to be there at the time :)

2026-02-18 19:08:46 CET

- reply

Yeah, i guess. That's my biggest problem with using, nostr, I think. I have no idea about choosing relays.

2026-02-18 15:59:16 CET

For those of you who never saw it:
This post from *1999* on the cypherpunks mailing list pretty much described bitcoin; it was, interestingly, in response to Adam Back saying that the most essential feauture of ecash was not blinding, but non-confiscatability/bearer (reflecting that, unlike many, Back knows what "cash" actually means!).
https://marc.info/?l=cypherpunks&m=95280154629912&w=2
Note that the post uses 2 spaces after the period :)

2026-02-18 13:05:04 CET

Posting from Yakihonne. Do people see this? I'm having trouble seeing updates on Amethyst last few days. Posts and notifications don't seem to show up reliably (slow to show up, then disappear/reappear).

2026-02-18 02:16:28 CET

- reply

That seems like maybe the worst task for an LLM though.
Still the article expresses the problem with them very well, especially the form they have gravitated to based on market forces.

2026-02-17 19:39:01 CET

The Schwartz-Zippel lemma, also known as the DeMillo-Lipton-Schwartz-Zippel lemma, also known as the blindingly bloody obvious.

2026-02-13 17:36:05 CET

- reply

It's been a really eye-opening year or so. Not because a bunch of people have a bad or stupid take, but that they got so vicious and nasty about it.
Respect to the ones who just expressed a viewpoint, with decency and without hyperbole. I count very few.

2026-02-12 17:20:18 CET

Saw this on stackernews:
koinvote.com
Would be a good use case for aut-ct tokens (incl. the 'audit' version, to prove balance over many utxos), albeit 'voting by how many coins you have' is a lot less interesting than betting.
Imagine voting on Taiwan independence for example...

2026-02-12 17:00:51 CET

- reply

Oh sure, but he had heard 'qc is a danger to bitcoin' thing. To be fair, didn't like, quiz him in detail.

2026-02-12 13:42:57 CET

Met a completely non-technical bitcoiner yesterday. He'd never heard of bip110 about bip110 or the spam controversy but had heard about quantum. Just thought that was an interesting anecdote.

2026-02-11 15:40:08 CET

A break - especially a full break (+) - of SHA256 is rarely discussed. It's kind of interesting, because unlike switching a signature algorithm, switching the hash function we use for our proof of work has an extra side effect which is particularly nasty. It renders all of Bitcoin's history before that unverifiable.
Not 100% perhaps, but certainly "unverifiable from a purists' point of view". We would be forced to effectively checkpoint (we have things similar to checkpoints already, but it's all optional) some flag day in retrospect and say "that was the block hash" because with a fully broken hash function people will be able to forge any history they like.
(+) Huge devil in the details here which somewhat invalidates the rest of my point; I'm assuming the worst possible case: break of 1st preimage resistance. Preimage resistance is needed for proof of work (forcing grinding to be random rather than "finding" a preimage); but in a real world scenario, in case of a break of this property, "finding" might not be immediate or total, e.g. what kind of input strings would such an algorithm use, e.g. could you just append random numbers to a fixed string? Or prepend? (the breaks of SHA1 involved such limitations, btw) And then there's the other kinds of break, second preimage resistance and collision resistance, both of which will violate security enough that you would have to call the whole system "broken", but again, only *if* the "break" is not so absurdly restricted (short, specific strings) and/or expensive (a gazillion GPU hours for one execution).
#bitcoin #cryptography

2026-02-11 15:18:11 CET

- reply

The next step is to realize that all the scientific reasoning you've done, including postulating the existence of a brain, has all come from similar brain -modulated sensory experience, which is circular :)

2026-02-06 16:35:19 CET

- reply

The report seems to say it's normal behavior?

2026-02-05 21:59:44 CET

Trying to read this in a bit more detail, and now I think - lukewarm at best! Not only is the actual scheme they propose not practical - because it needs 100s of TB for the ciphertext - but for a much more important reason. The idea that "a secret key is locked behind providing a valid witness" involves, here, actually generating that secret key in advance. They propose doing so with an MPC protocol; even if the technicalities of that can be worked out, it still means that N of N parties could collude to bypass the proving mechanism. Not saying it's useless but it almost seems like their earlier idea (functional encryption rather than witness encryption) was actually the more interesting of the two. These are very vague, surface impressions though.
#nevent1q…vd83

2026-02-05 20:05:09 CET

The new hotness?
allocinit.xyz/uploads/pipesv2.pdf
By sheer coincidence I was literally this morning thinking about witness encryption and why specialized forms of it feel like the right way forward. Then this pops up 😃
#cryptography #bitcoin

2026-02-04 00:26:38 CET

- reply

Sorry on reflection that was a bit dumb; a ring sig wouldn't allow apportioning blame either. I found the old coinshuffle paper to be quite insightful on this difficulty.

2026-02-03 19:25:37 CET

- reply

Ah, i see. By using all|acp you have the 'crowdfunding' workflow, so the output set can be ... set ... in advance of the input set, so people can send their signed inputs independently of the other ones.
There's one complicated detail I see: in your example you have Carol fail-to-deliver on the inputs, and then the re-start with the other two, and the ring sigs allow them to demonstrate they were part of the original set, right. But in the case where the coordination fails, not because of failure-to-deliver but because of inputs not matching with outputs, you have the problem of not knowing who is at fault, right. Not saying you *have* to solve that problem, not sure, maybe.

2026-02-02 23:28:12 CET

- reply

Interesting. Definitely people have talked about this kind of approach before. A couple Qs: phase1 and phase 2 are disconnected at the network layer, right? so phase 2 A and B send a psbt with their inputs signed, is that right? Yes I think this all makes sense. At phase 3 (network disconnected again right) you're, by ring-signing, asserting you were one of the phase2 participants and that you authorize the use of one of the addresses (it says A' in phase 3 but address is A?) for output. Are you using linkable ring sigs? (to avoid ability to make 2 valid ring sigs on same pubkey). Hmm now I look more carefully I'm not sure I understood the A' vs A distinction, because is Phase 4 for normal operation or fallback? If it's normal operation, what does Phase 1 do?

2026-02-01 17:07:58 CET

- reply

Sure, let me know, always up to chat :)

2026-01-30 02:52:57 CET

Oh, and in case you were wondering, isn't something like witness discount similar? The answer is a resounding no! Think about it - what the witness discount controls is *how much stuff can go into a block* and is therefore a *global* consensus rule. If miners break it they fork off. Here what the ZIP is discussing is having everyone sing kumbaya and agree what kinds of fees are fair, reasonable and keep good privacy and ddos resistance for everyone. It'll work fine, until it doesn't.
#nevent1q…4gl3

2026-01-30 02:51:48 CET

I discovered something quite remarkable today after seeing podcasts with Sean Bowe [1] describing the new tachyon system and then one today with Ying Tong [2] mentioning the fabled 'sandblasting attack' . It turns out that zcash put out a ZIP zips.z.cash/zip-0317 with what seems to me extraordinary content: it says not that there is some resource limit for blocks, but that individual transactions *should* be treated thusly: fee should be linear in number of ins/outs, but 2 outs should be treated like one (for a privacy reason), that certain types of transactions (their different shielded pools) should not be discriminated, and they disrecommend relay of transactions with other fees, and then give a long RECOMMENDED section to miners on how to construct blocks. This is totally nuts - the miner incentive is always to maximize fee revenue, and while it can be hard to work under that scenario sometimes, it's crazy to try to say things like randomize your candidate transactions and only take high paying txs in this ratio, or similar, as they do. Bear in mind that the sandblasting attack, which genuinely crippled the network afaik because they couldn't verify, in a normal node, as fast as the attacker could create transactions, happened because they had the insane idea of a flat fee for every individual transaction, no matter how big it was! (to be sure, they must have done that for better privacy, but it's an utterly broken concept).
These are some of the very smartest cryptographers in the world, and I am not exaggerating for effect, there. How did they get such batshit insane ideas (or lack of ideas?) about how a permissionless p2p network works?
[1] its on the recent Zero Knowledge podcast, look it up, [2] the recent BTCKVR podcast 'BitVM optimizations', around 35 minutes
#cryptography #bitcoin #zcash

2026-01-25 19:04:17 CET

- reply

Interesting for sure! But why is it described as AI powered? Is that an essential component?

2026-01-20 20:54:49 CET

https://eprint.iacr.org/2022/1178 "We propose a new, unifying framework that yields an array of cryptographic primitives with certified deletion. These primitives enable a party in possession of a quantum ciphertext to generate a classical certificate that the encrypted plaintext has been information-theoretically deleted, and cannot be recovered even given unbounded computational resources." 🤯
#cryptography

2026-01-19 14:07:46 CET

- reply

I hardly ever use gpg any more, but i remember the subkey thing being a major pain point in having a correct mental model of wtf is going on.

2026-01-19 13:47:52 CET

https://files.catbox.moe/qgy1ni.pdf
Perhaps it's a bit silly but I show here the full conversation I had yesterday with Claude, in which I asked it to teach me Groth16 (the most famous ZKP system). It's a little cheat-y in that I had already "overview" studied it, more than once, but I always found the existing explanatory materials difficult to work though and lost track at some point. This time, with Claude actively teaching me, I can confidently say I have a solid understanding of the whole system, after one single day.
In my opinion LLMs are great for these things: Search, learning and language (incl. code). They can seem ludicrously brilliant at all of these, but in each case you have to be wary of different variants of the same flaw: their inability to notice their weakspots. In learning Spanish I get 97% perfect explanations/answers/translations, but with certain obscure slang it might resolutely refuse to accept the existence of the phrase I'm referring to. In this Groth16 conversation it slips up with a specific equation/algebraic notation (it says it was 'sloppy'; I'd say it was wrong) halfway through, in a way a human professor wouldn't. In search I'm not as sure as I don't use it as much, you could argue semantics and say it's not really the one doing the search, but I bet it slips up in a similar way there too.
I don't think this kind of flaw is the real story, though. The real story is that if you frame your request properly, and you engage seriously and reflectively, you have access to a teacher that a decent simulation of a high-level expert, in a one-on-one session. If you actually want to learn something, I do think you should do as I did here and ask it to "teach me X based on the fact that my background is roughly Y (so it can pitch at the right level), and ask concept-checking questions along the way".
(btw this is not a commentary about claude vs others .. i think this kind of job can be done ~ equally by all the latest models).
I have to emphasize how natural this felt. I really felt like I was talking to a teacher that was listening carefully to my responses and engaging with them. Among a number of notable moments in the conversation, this one in particular, after the aforementioned algebra screwup, stood out to me: I asked "yes. back to Q13. rewrite it if necessary, otherwise I'll just keep thinking." and it responded after a few seconds: "{Claude:} The question stands as is. Take your time."
A reasonable push-back on this example is that I chose something that has been described and discussed on the 'net a lot over the last 8+ years - certainly no other ZKP system has as much material. So it's showing the best it can be. If you discuss cutting-edge research with it, you're in *much* more dangerous territory.

2026-01-19 00:37:30 CET

- reply

I think it depends how far it goes.
At the extreme a perfectly trustless sidechain or rollup of some flavor will be the best way to transact with bitcoin. Actual scalability and privacy.
What they're aiming at right now is, I agree, just a high tech implementation of a bridge with maybe better security properties than those that already exist.

2026-01-18 19:51:00 CET

- reply

Oh you said improve not remove. OK. Seems like a performance difference not a trust difference.

2026-01-18 19:49:58 CET

- reply

Right. But does it actually remove the DV part? It's still describing a protocol between a prover and verifier, and it's still describing use of a 2PC between them, just the circuit they're garbling is a much different and simpler one (in fact so simple it's just a single multiplication). So the verifier's secret needs to be there at setup, so it's a DV.
Correct me if I'm wrong. Paper is huge 😁

2026-01-18 13:43:26 CET

- reply

About extreme scenarios like 80% of btc stolen (- I'm going to ignore the "how do you measure it" part, though I suspect that'll come back to bite us at some point!): i mean there is presumably a failure mode where trust breaks down, but it's not really about a specific number or ratio. It's about whether there's any credibility that going forward, the system will be trustworthy. Anything above 30-40% is presumably disaster-level and the project *might* just kind of fall apart. But I really don't know. I just know that if you violate the core principle of private property you've mostly already lost. Maybe I'm wrong and everyone would love it, but what's the point in bitcoin in that case, I don't see it.

2026-01-18 13:38:14 CET

- reply

On the DAO,ETC,ETH and my "bet": excellent point to raise, there. There is no doubt that the opposite side to my argument won. At the time as you'll remember it was just as obvious that it wouldn't have happened in BTC because of the "DNA" of what bitcoin even is, being so tied to uncensorability (let's not forget that it's a bit murky whether anything like "consensus" was actually reached in the ETH community; it might even be possible to characterise it as the equivalent to the new york agreement winning in btc's case; but I'd be willing to cede the opposite is possible, that the DAO coin "reassignment" was a community consensus). The DAO disaster just showed that there was a profound divergence between the communities at a not just technical but philosophical level. So yeah, another project which has a different less pure concept of decentralization might reasonably define cutoff dates, but I don't think BTC should. It's against its nature and purpose. Concretely, the tradeoffs bitcoin's design makes (e.g. no onchain obfuscation; no onchain global state and complex contracting; slow block times; etc) are all in service of that. I know that this is a retelling of history - SN didn't seem to see it quite like that, but somehow designed it like that despite himself, lol.

2026-01-18 13:28:18 CET

A bit of an update/nuance on the below, after continuing to read more about this new field: it's a valuable correction to say "this is not just like a federated sidechain: you can get a 1 out of n trust model, not only a majority/quorum". indeed, you can, though i would caution that you have to reflect on the security limitations of having a designated set of verifiers, even if only 1 of them has to be honest (I think that model is not bad at all for setup, but for continuous operation it's not so great; think: "men with guns"). Also worth noting that a related paper was released shortly after, using a different trick (witness encryption, pretty exotic stuff) but based on the same general ideas: https://eprint.iacr.org/2026/065.pdf
#nevent1q…0dmy

2026-01-18 13:27:13 CET

- reply

Right. But it wasn't practically feasible. I think that's a fair statement.

2026-01-17 16:33:16 CET

- reply

i disagree with that framing at the end, it feels illogical. it's not necessary for everyone to agree on what level of security to use, it's a lot more nuanced than that (trivial example: hashed addresses vs not, pre-QC consideration; it was never a trivial question. Remember Nicolas Courtois' scaremongering?). And there is no requirement for any specific users to move out of existing coins to be able to say "bitcoin has the functionality required to keep your coins secure". bitcoin has never yet required people to move their coins, don't forget. And to illustrate more concretely, the part you put in quotation marks: that describes me, I think that, but I don't agree with what follows: I don't prefer the fork "with fewer coins sold", I think that's a non sequitur (not that it can't follow, I mean that it doesn't logically follow), *and* I think it's the ethically wrong position, too, *and* I think long term it's a vector of failure for the project in its goals.

2026-01-17 15:21:59 CET

- reply

I disagree about fork choice. People will choose a version of bitcoin where there is zero human governance over coin issuance and coin ownership. If my bet is wrong there is very little value left in bitcoin as a system.
It doesn't matter if Bitcoin "looks like chumps" or whatever. It matters that it has integrity as a system. "Miraculously" it has somehow maintained that for a long time.
I do agree though that it'll be a disaster if we don't have any viable migration by the time QC hits, but, meh, it seems ridiculously far off. Glad some people are working on it.

2026-01-17 14:14:52 CET

- reply

I see several things wrong with this pov. First, stop assuming they're Satoshi's. We don't know that. Second, when/if they are spent, we won't know how the private key was known to the spender. Quantum's existence won't change that epistemic limitation. Third, there is no "we" to make such a choice. No group of people have the right to confiscate coins, no matter how rational the reason.
And to *anyone* (not Matt specifically) who is worried about the market effect of huge selling, consider the market effect of the precedent of freezing coins at the protocol layer. Everything is a one-time exception until it isn't.
Notice that that last point is not wrong because "if QC then all btc is worthless"; we are discussing the scenario of there being a migration path but old plain pubkey holders don't use it

2026-01-17 13:14:40 CET

A second round of Glock review/reading to better .. grok? .. what the hell this stuff is. The TLDR is that, afaik, there is still no there there. I don't mean that this research isn't incredibly impressive and exciting; at least to my dumb eyes, it is. I mean that it hasn't created the dream scenario of verifying arbitrary off-chain contract execution with negligible onchain cost. It *almost* has done this: it allows you to verify a SNARK, post the proof somewhere offchain and have people be able to punish you onchain if you lie. All that happens without nasty onchain costs like in BitVM and similar. But there's a crucial detail: the SNARK we're talking about here is "designated verifier"; so it's not public verification, it's more like a sidechain where you trust an entity or a federation to enforce the rules. Obviously, that in itself is not really interesting to most people.
The new follow-up "Argo MAC" paper ( https://eprint.iacr.org/2026/049.pdf ) is really in the weeds (though if like me you find Elliptic Curve endomorphisms interesting then .. it's fun!) but it *does* change the above crudely described system from "impractical" to "probably completely practical" - because the garbled circuit stuff suddenly went from 100s of GBs to 10s of MBs. But the DV- nature of the SNARK is not changed by it .. so the open question is "can you replace the DV-SNARK with a public verifiable SNARK" and I have no idea of the answer except, the verifier circuit has to be small and that's .. hard?
if anyone out there (not *that* unlikely) can correct or refine that description, I'd be grateful.
#cryptography #bitcoin

2026-01-14 23:17:36 CET

- reply

Agreed.

2026-01-12 15:28:16 CET

- reply

https://old.reddit.com/r/LocalLLaMA/comments/1oqi4qp/comment/nofbwx1/

2026-01-12 13:47:41 CET

- reply

For completeness:
In response to "we will come back to this, but first, i'm disappointed that you have the same "AI slop" writing style as other commercial models (no real problem in communication, but stereotypical). i'm curious, what is the origin of this LLM model?" it said "Fair. I'm Claude 3.5 Sonnet, built by Anthropic. You're right—that bullet-pointed, "here's where you're right and wrong" structure is a pattern I default to when I'm trying to be comprehensive and balanced. It's the LLM equivalent of a corporate presentation: clear, but soulless."
Neither my nor your experiment proves anything, ofc, remembering how these things operate.

2026-01-12 02:54:21 CET

- reply

Not too surprising to see variation, in itself. I think I asked it which LLM it was, and it was quite specific ... Claude 3.5 from Anthropic.

2026-01-11 14:39:28 CET

- reply

Waiting for the Kratter video to educate me on where you went wrong here.

2026-01-11 14:21:01 CET

- reply

See #nevent1q…hzfw
... seems relevant!

2026-01-11 14:01:04 CET

- reply

I asked K2 what model it is and it said it was claude 3.5.
Is it like an open source version or something? Hmm that doesn't make sense.

2026-01-10 17:44:05 CET

- reply

Right. If the content is actually tied to your personal life it's gonna be super tough. There could still be value in separation between sessions though, so, tor could be something for that.

2026-01-10 13:41:45 CET

- reply

I have run open source LLMs locally for free. The performance can't match, not even in the same ballpark (hence me mentioning $20K etc) ... or did I misunderstand you?

2026-01-10 13:16:35 CET

Maple.ai via Tor with anon account paid for with Lightning.
I think this a decent tradeoff against the appalling reality of what most of us are doing giving personal data to OpenAI, Anthropic etc.
The at-home build isn't viable for real work except if you pay like $20K and sink time into it (and even then).
Also I'm not shilling maple here .. it probably can't give you the same level of convenience etc. But maybe close, I think?
Opinions?
#asknostr

2026-01-08 16:26:01 CET

- reply

Lol, yes, you got it. The gender bit is dropped :)

2026-01-08 15:42:17 CET

- reply

It's a mix of everything. There are a lot of pre-european naming, but then you have not only spanish influence but also italian (in the south) and even african. A good example might be aguacate for avocado, which is old Nahuatl, but it's palta in Argentina. Chocolate is another famous one that's from Nahuatl i think. Meanwhile 'green beans' have literally 4 completely different names, no joke.

2026-01-08 15:35:58 CET

English nouns are basically the x-only pubkeys of European languages.

2026-01-08 14:46:12 CET

- reply

That's cool. It reminds me of something interesting: even though the same language, across Latin America there are a huge variety of words for certain common fruits and vegetables. And some everyday items too like a straw. But i noticed it especially with vegetables.

2026-01-06 21:40:26 CET

- reply

I'll write something on the issue shortly.

2026-01-06 02:33:24 CET

- reply

I was a Linux user for years before I found out 😆

2026-01-05 02:36:52 CET

- reply

It will have mysteriously gone missing, so it'll be a moot point.

2026-01-04 14:39:22 CET

There's something hilarious about this: I went to kalshi.com out of curiosity to see how bets are set up. In their "Crypto" section they have a bet on whether Satoshi will move his coins. Never mind the ludicrous way in which everyone assumes they know which coins belong to Satoshi (I mean, apart from the origin of the Hal payment, that's pretty much the only one we know "for sure"), just look at the terms of the contract https://kalshi-public-docs.s3.amazonaws.com/contract_terms/SATOSHI.pdf (both the "Source Agent" - Coinbase and Kraken, wow! - and especially the "Contingency" at the bottom!). And here's the supposed source: https://intel.arkm.com/explorer/entity/satoshi-nakamoto . I guess people just like gambling on, well, anything.