provoost
Sjors Provoost

Physicist turned bitcoin developer aka "shadowy super-coder", author of Bitcoin: A Work In Progress

Public Key

npub1v25jqj332n630klwtqeqxgyrjl4alw4phmluhu2x6lcxzwy9m03suqexw3

NIP-05 Address

Profile Code

nprofile1qqsx92fqfgc4faghm0h9svsryzpe067lh2smal7t79rd0urp8zzahccpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsrmnne8

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1v25jqj332n630klwtqeqxgyrjl4alw4phmluhu2x6lcxzwy9m03suqexw3

Show more details

Last Notes

2026-04-02 16:17:14 UTC

- reply

Mandatory normy post for new accounts m?

2026-04-02 12:39:01 UTC

- reply

It's not just employees, also any regular private investor in a seed round might not know in advance what the tax treatment will be.
Institutional and corporate investors are not affected by this, they fall under completely different taxation rules - they don't pay until the asset is sold.

2026-04-02 12:35:59 UTC

Dutch bureaucrats trying to come with a "solution" for startup equity holders in the upcoming unrealized gains tax system.
A bureaucrat is going to decide if it's sufficiently innovative and if the innovation is scalable.
Totally unclear if foreign startups can apply for this for Dutch employees. And what if they don't, or it after years of legal procedings the application is denied?
Then the employee is just fucked and has to pay 36% of the paper gains the moment a funding round bumps the completely illiquid stock price. And will not get it back if it subsequently drops to zero.
https://www.bnr.nl/nieuws/ondernemen-werk/10597781/nieuwe-definitie-startup-moet-box-3-probleem-oplossen-pas-betalen-bij-verkoop-aandeel

2026-04-02 10:30:48 UTC

- reply

I prefer to clone the repo and then ask, it can more easily grab context and even try things.

2026-04-02 09:00:38 UTC

- reply

It reminds me of the 2018 supply chain attack on Copay, but that targeted end users in the browser, not developer machines.
I briefly covered it in my book in the chapter about Guix.
https://image.nostr.build/de7ec16e1bd8bc0b2da05273bac9b1a17c5d81789946172879214a6d0a2ef343.jpg

2026-04-02 08:32:38 UTC

Yet another npm supply chain attack, though of course this can happen elsewhere. It was detected quite quickly. Seems to be aimed at developers, of which there are a lot more now thanks to LLMs.
https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

2026-04-01 17:54:18 UTC

- reply

(not saying it should replace e-cash, but that's definately not the case for all wallets - but I would like to see it)

2026-04-01 17:53:24 UTC

- reply

I guess I should have said: until you've spec'd and implemented bolt12 zaps :-)

2026-04-01 17:51:31 UTC

- reply

My lightning node is never offline, unless it's under DDoS or a bug.

2026-04-01 17:49:22 UTC

- reply

Temporarily holding received zaps, until you get around to implementing bolt12 zaps.

2026-04-01 17:45:14 UTC

So far I only read section "VIII. Dormant Assets" of the Google quantum whitepaper. Although I wish they used a two column layout, it's an interesting analysis.
The National Security Response might actually be the easiest path, and there's nothing we can do about it. But it does require a president with diamond hands. They could issue an executive order, stating the United States shall be the first country to build a quantum computer, as publicly demonstrated by burning any coin that hasn't moved yet.
By the time lawyers get to object, the transactions are already confirmed.
The OP_RETURN statement would read: "EO 21400: fork your bitcoin if you want fork"
https://image.nostr.build/b710600057975f1827314eba300c20716f31ad5e261ea9a56d97a9d8528eb628.jpg
https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/

2026-04-01 10:41:59 UTC

This would have made an excellent April Fools newspaper headline.
#nevent1q…j7fn

2026-03-31 07:51:23 UTC

Thursday, Rotterdam, be there: https://bitdevsamsterdam.org/2026-04-02-april-bitdevs-rotterdam

2026-03-30 17:00:58 UTC

- reply

Version bit grinding? :-)

2026-03-30 09:10:41 UTC

- reply

Though in that case it'd be easier to just pay her to record this.

2026-03-30 09:09:45 UTC

- reply

Could be an information campaign to throw off Iranian intelligence of course, just send a bunch guys to a strip club with government money.

2026-03-30 09:07:52 UTC

- reply

Also not too great OpSec if this operation was supposed to be a secret. I assume intelligence agencies monitor strip club revenue carefully, and then TikTok does the rest.
Loose lips sink ships.

2026-03-30 08:59:44 UTC

- reply

Doesn't look fake to me* and it seems plausible that a stripper doesn't know military jargon.
It's her interpretation that the soldiers are "kinda depressed" and I don't think she meant "all their money" literally.
Seems reasonable that they're a bit anxious and need some extra entertainment because there's no strip clubs on Kharg (yet).
* = not an expert in spotting AI slop videos though

2026-03-30 06:40:06 UTC

Every six months there's this recurring discussion about daylight savings time. It's a nice opportunity to learn new historical tidbits. E.g. I already know that the Nazis put us on Berlin time, but always wondered why we didn't switch back to London time.
Well, that's because we didn't use London time, we stubbornly kept using Amsterdam time (yellow on the map). Still doesn't explain why France and Spain didn't revert.
I also still want to go back to per city timezones (using UTC under the hood). Should be no problem with smartphones.
Then there's this constant recurring argument that we have adjust the clock for health reasons. I find that pure nonsense. Obviously it's non-issue for people who work from home on their own schedule. But you can also just change the times schools and office jobs start. You don't have to change the clock for that.
https://youtu.be/1ph_PqrUlRc
https://image.nostr.build/1246b3f864172eab78c07fb35d16bd5cd874eb45496dec13ff4f25c588958417.jpg
https://image.nostr.build/94b2c448f8469b9a7356ab3103a80e4b31c8be1023c71edfde06f4a08cf2bdd7.jpg
https://image.nostr.build/f56dfd931b8d557f6dbf57b4ff8c40e023b2a647e574dfe4d86f7ea106e133bc.jpg

2026-03-29 13:36:56 UTC

Reviewer (on a different project): this looks weird, must be LLM generated?
Me (not out loud): I'm sure it does, to someone who doesn't lint their whitespace

2026-03-29 12:10:51 UTC

Why manually order a few books in two minutes, if you can spend a day automating it?
https://github.com/Sjors/cloud-print-rs

2026-03-28 17:55:22 UTC

- reply

Well then you also don't need the de minimis.

2026-03-28 13:43:49 UTC

Why do household chores on a Saturday if you can instead ask your agent to get rid of WooCommerce and just use simple BTC Pay Button links on a static website (the book is open source anyway, so no need for securing the download links, though that would be a nice feature): https://www.btcwip.com

2026-03-28 09:38:37 UTC

- reply

We know that since at least the Blocksize Wars.
But I do want to give them credit for any contribution to legal defense of developers.

2026-03-28 09:29:25 UTC

- reply

So this law is just to pump their stock price?

2026-03-28 09:25:08 UTC

- reply

Wait for nostr developers and relay runners to get arrested, give them legal support? Or maybe something more preemptive :-)

2026-03-28 09:19:01 UTC

De minimus de schmiminus, this is more important.
#nevent1q…ev94

2026-03-28 09:12:40 UTC

- reply

> Without de minimis for Bitcoin, every small Lightning payment or sat transaction still forces cost-basis tracking and IRS headaches. Paying your plumber in sats or grabbing lunch with Bitcoin remains a taxable event.
Just to play devils advocate: just vibe code a tool that calculates this stuff and fills out your tax form. Let IRS deal with the headache.

2026-03-28 09:09:35 UTC

- reply

Why would USDC even need a de minimis exception? They're no cost basis or gains.
Like Draghi said: "a euro is a euro, today, tomorrow, in a month, it's always a euro"
Or are they worried about slight deviations from the peg?
https://youtu.be/wztu8yyCPZQ

2026-03-28 08:35:47 UTC

- reply

Ironically the porn company probably also knows who you are based on that stuff, but they're just discrete about it and they protest age verification because it ruins this we-pretend-we-don't-you game.

2026-03-28 08:33:11 UTC

Some Dutch news article about EU age verification on porn sites... of course someone in the replies brags about how a VPN protects him. Then I feel obliged to point out that the VPN company knows which sites he's visiting and that if you paid them with fiat they also know your identity. And since creditcards are to get for minors, pretty much also your age.
(and otherwise there's plenty of marketing databases with your name, ago, browser fingerprint, advertising id, etc)
So you've opted in to age verification before the EU made you.

2026-03-27 20:29:53 UTC

Sounds like the Tornado Cash prosecution argument. Why protect encrypted speech when we don't protect encrypted money? Or some such dystopian logic.
#nevent1q…25a4

2026-03-27 20:17:13 UTC

- reply

Or the presence of really extreme ones that the internet gives access to?
Or the lack of mass conscription for war? (a good thing, I'll take the manosphere trade-off)

2026-03-27 13:44:52 UTC

- reply

I just let it struggle on a task and then ask it to write a skill based on that.

2026-03-27 07:56:50 UTC

- reply

There's a potential privacy issue there for the volunteers. But you could have one key per polling station, and they could upload only the counting tables to Blossom and the rest to municipal servers - where they get deleted after a few months.

2026-03-27 07:54:20 UTC

- reply

The next thing I'd like to do someday is OCR the forms, with local models this time, and try to reproduce the election result. But with 13k+ different handwritings, that seems rather daunting.
In fact, I already wasted a long, doom-coding session on it.
That said, the table itself and party names are printed, and the numbers have to add up. There's also a separate count per candidate that needs to match the count per party. And the CSV files with totals are also available. So that would give a model some constraints to work with when deciphering individual glyphs.
https://github.com/Sjors/verkiezingen-processen-verbaal/pull/115
https://image.nostr.build/3af35a4c4caed2c41fc964a92a7f615188af7471a7170f3c8d801bd3364c7afc.jpg

2026-03-26 23:18:06 UTC

You can now ask Claude to check the #OTS timestamp for the Dutch municipal elections! :-)
More interestingly though, the data collection does really benefit from LLMs. This is the second election where I've been using them. Still not a smooth ride, but I'm getting better at the process. And the tools are getting better too.
There are 13k+ polling stations in the Netherlands. Volunteers count the votes (70x100cm paper ballots) and fill out a form by hand. After that, the computers take over to accumulate the results. But these paper forms are scanned and uploaded on 300+ municipal websites, creating an audit trail.
My project then tries to download these PDFs. I don't re-publish the documents themselves, just the list of URLs, their SHA256 checksums, and a timestamp. The repo has scripts that make it easy to redownload and compare checksums.
Collecting the URLs, however, is incredibly tedious. Every municipal website is different, the documents are named after the polling station, etc. The first time back in 2023, I spent days collecting the URLs, with scripts and with a few other people helping out. You'd think that for the next election, you just find and replace the year? Nope, all different again.
There are a couple of common CMS systems used. Some are easy, at most requiring some rate limiting and a fake user agent to prevent getting blocked. Still, other municipalities use some JavaScript frameworks or even Google Drive— until recently, those required a manual download.
This task can't be fully automated by scripts, yet it's too much work to do by hand. That makes agents a great fit. For 80% of the work, I was able to just say "Pick 25 municipalities and divide them over 5 sub-agents," and I'd end up with 25 commits half an hour later. Or a rate limiting error from GitHub Copilot :-)
I struggled more with the remaining ones, though I think I'm in good shape for the next election. As a rough guideline: GPT5.4 and Claude Sonnet (both at medium effort) can do most of the heavy lifting, of course with constant "encouragement", whereas subagents with GPT5.4 mini can call a script to fetch documents, do some sanity checks, and commit the result.
I briefly tried a local model (nemotron-cascade-2 with Ollama), but it started hallucinating PDF names. I might also try PayPerQ.
https://github.com/Sjors/verkiezingen-processen-verbaal/
https://img.sprovoost.nl/981a49c04aae2659d0cbd3c5a24078c2f81b180749742db35e6474595b97f137.webp

2026-03-26 20:13:55 UTC

- reply

Here you go: #nevent1q…rmkt

2026-03-26 20:13:12 UTC

Maybe not #ProductionReady but I vibe coded an iPhone node based on the kernel the other day.
Just signet for now, because the kernel can't prune yet. Oh and it syncs from mempool.space :-)
https://github.com/Sjors/kernel-i-node

2026-03-26 18:22:49 UTC

- reply

But it's video? https://github.com/divinevideo/divine-mobile
I'm a boomer, I only do photos.

2026-03-26 17:41:20 UTC

- reply

Don't look at the wallet screen, just zap.
https://image.nostr.build/c1f80e164e6a648a01a3c36e305e4bb4ac8530e921795d0eca948d50e8aa0e63.jpg

2026-03-26 17:39:55 UTC

- reply

Oh wow, NWC between @npub18m7…q955 and @npub1xnf…lpr5 actually worked, nice!

2026-03-26 17:36:58 UTC

Claude: avoid the word "very", make very few mistakes.
#nevent1q…2mwh

2026-03-26 13:45:45 UTC

The half-yearly #chatcontrol zombie returned and was rekilled.
#nevent1q…t9ud

2026-03-26 10:14:23 UTC

- reply

They always had the power to do this, we need to deal with that problem sooner or later.
Sounds like they're opting for later though?

2026-03-25 21:46:24 UTC

- reply

Thanks to browser fingerprinting and general profile collection practices by payment processors you might however already be cursed.
Sadly paywalled so you can't read it without an approved creditcard: https://www.nytimes.com/2019/11/04/business/secret-consumer-score-access.html 🤡🌎

2026-03-25 21:41:23 UTC

- reply

A VPN connection to whatever country the bank thinks you belong in can help. Except they also tend to block known VPN IP addresses, so you'd need to tunnel to your own home or a friends place ideally.
Or use Bitcoin.
Or both :-)

2026-03-25 21:31:23 UTC

- reply

I assumed they already did this.

2026-03-24 21:32:23 UTC

Is Olas still a thing is there a new thing?

2026-03-24 12:33:47 UTC

Zullen de Basis Registratie Persoonsgegevens maar gewoon openbaar maken? Half Nederland kan er legaal in grasduiden en de andere helft zit al in diverse datalekken. #zucht
https://hrif.eu/2026/03/banken-in-brp-hrif-eu-zegt-geen-goed-idee/

2026-03-24 11:34:18 UTC

- reply

And it didn't turn off constant timeness to speed things up? :-)

2026-03-23 12:05:10 UTC

- reply

I think of it more as a verb than a noun: an experienced developer can also vibe code, as long as they resist looking at the result :-)

2026-03-23 12:03:03 UTC

- reply

Does anyone still use mixed case on X?

2026-03-22 21:55:18 UTC

- reply

It didn't let me move my life savings.
https://image.nostr.build/e9d2d59ac0c041718f4509276868e1e628c85ecf9453c242886ec3fe4e36b7f4.jpg

2026-03-22 19:34:07 UTC

- reply

I would add that "care" should be more directed to the reviewer and potential future co-developer, rather than a reflection of how important the project itself feels.
For example, I might write something for my own use that really needs to behave correctly. Because nobody else needs to look at the code, I can just compensate for the fluff with good manual testing and test coverage.
Whereas a far less important pull request to a project I'm not passionate about will need way more polishing because I don't want to bother the reviewer.
There's also a third category: "this is entirely vibe coded, feel free to close". And then it gets merged anyway. Probably best reserved for projects you're familiar enough with to at least know the change is:
1. Useful and not already being worked on
2. Harmless even if ugly

2026-03-22 19:13:27 UTC

- reply

With code, I tend to think of it as polishing.
The time spent on polishing might be near zero if something isn't very important, and not bothering anyone. E.g. a Python script that generates a plot from a log file that helps me debug something. I might not even look at it.
But especially when something needs review by another human, the polishing phase easily takes 90% of the time— and probably even more of the tokens.
The LLM is called "generative" for a reason; you need to keep chipping away at the stuff it generated. There's also a constant hunt for weirdness hiding in corners, the you’re-absolutely-right waiting to happen.
The key here is to relive your why-phase on steroids on every single line in the diff.
> If I had more time, I would have written a shorter pull request.
It does raise the question whether it would have been more efficient to just write the initial version by hand. For me, the jury is still out on this when it comes to high-care situations.
But generating code myself also involves quickly producing something that roughly works and gradually polishing it. With the LLM, I just spend more time wearing my grumpy reviewer hat and less time wearing my "I don't feel like writing a test for this" hat.

2026-03-22 18:35:16 UTC

- reply

Two hours is not #doomcoding, try two days!

2026-03-21 17:20:05 UTC

- reply

Just rig it with self driving capability so can drive it a few feet back and forth remotely?

2026-03-20 12:59:14 UTC

- reply

Especially if the npub was generated by Damus :-)

2026-03-20 10:19:26 UTC

- reply

I like the idea of just allowing any new npub to claim the history of any other npub. It's web-of-trust anyway.
Could even be an enumeration of specific events you care about, leaving any stupid remarks plausibly deniable :-)

2026-03-20 09:37:26 UTC

@npub18m7…q955 smooth! :-)
https://image.nostr.build/1717472f39db6ec50b872a9a061b27981393c27970fce362e57a677d8ddb0af2.jpg

2026-03-20 09:26:49 UTC

So is there a NIP yet for marking an account as do-not-trust after a certain block hash? Of course that only works if every previous event is timestamped...

2026-03-20 09:17:37 UTC

- reply

It's quite easy to click "sign up" instead of "login" and end up becoming Mr Nsec. Then you click sign out and try again, before or without realizing that now you don't have access to that new self-doxxing account either (and maybe could have reduced the risk by changing the username and hoping nobody stores the original).

2026-03-20 09:10:15 UTC

- reply

Soon(tm)

2026-03-20 05:02:21 UTC

Also cinnamon adds a nice touch to an Espresso Martini.
https://image.nostr.build/1b74c6b2b90347b5283c7c95c4508f927005659271670ea3a6e8c0e806630138.jpg

2026-03-20 02:56:22 UTC

Well I'm not going to enter my previous nsec into a Python script to see if it's actually compromised, but it's quite possible it got Mr Nostr'd in the past(e).

2026-03-20 02:46:34 UTC

GM, time for a new nsec.