waxwing

Bitcoin, cryptography, Joinmarket etc.

Public Key

npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7

Profile Code

nprofile1qqsxwkuyle67y94tj378gw8w2xw2wa6nwmwlqhddlwnz0z7sztsaw2qpzemhxue69uhkzarvv9ejumn0wd68ytnvv9hxgqg4waehxw309ajkgetw9ehx7um5wghxcctwvshql5ch

Publishing to

atlas.nostr.land

eden.nostr.land

nostr-01.bolt.observer

Author Public Key

npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7

Show more details

Last Notes

2025-03-29 16:35:02

- reply

Consolidation of utxos is never a clear cut issue. Co-spending has to occur sometimes. Still I certainly agree that that aspect should be taken into account.
Yes, I know this is not a novel idea *in general*. I'm mostly wondering how easy we can make it for self sovereign users with automation (and also wondering if it's economically viable).

2025-03-27 19:00:24

- reply

No, lol, it's fine, I'd just never heard of the show :)

2025-03-27 17:46:28

- reply

I have no idea what you're talking about, fwiw.

2025-03-26 12:03:12

I don't understand @fiatjaf's argument here, at least, I don't understand the *strength* of it ("NEVER") ? First, on "global feed", it's a bit like (a more extreme version of) "the mempool" - in a decentralized system there is no single synchronized global state, but .. there can be pockets of smaller synchronized state, at the relay level .. I guess even at the client level? If you have instant access to 10k or 100k messages your client can present them how it wants. I admit to not knowing much of anything about relays, so tell me if I'm wrong. If the answer involves "it's more expensive", remember it can be paid for; I already pay for relays, it's completely normal. Also, it has always been very obvious to me that the "social media" application of nostr would obviously benefit from algorithms for feeds. (though such a thing wouldn't magically make nostr suddenly popular).
#nevent1q…m4lp

2025-03-22 23:35:09

- reply

I can't see that results will be very conclusive though. Imagine a very positive outcome for Nostr with say, 10-100M users, 98% of which are not super technically competent. Almost undoubtedly partially-trusted solutions will spring up (even *fully* trusted), somewhat how they did with LN, although that situation got muddied by regulatory pressures. People will be able to choose how much they need to trust those third parties, and it'll depend on how they use Nostr. Still, you for sure have a point. *Any* use of keypairs and signatures that's more widespread is a good thing from my pov. It will be less pressure here (at least less pressure compared with holding bitcoin as *savings*).

2025-03-17 13:50:49

- reply

But how could you do that at age 12+ in a country with a highly functioning education system?

2025-03-09 10:43:04

- reply

Thanks! I only listened to one of these, ages ago, and then forgot about it. He has some incredible interviewees.

2025-02-24 11:24:24

- reply

Where can i find out about this? Just skimmed through bolt12 and couldn't find anything pointing me in the direction of understanding it.

2025-02-22 13:11:10

Seeing a lot of posts about ETH "rollback".
It's slightly annoying seeing how easily people jump on bandwagons without any reflection, though as I'll say in a moment, I don't mean to imply there's nothing to discuss.
First, there is no evidence they are thinking about doing it. Second, this case is not like the DAO because the funds are not locked in a fixed location, allowing a very convenient funds-reassigning 'state transition'. Third, it's not like the DAO because it's a trivially small part of the supply vs like 15%. (I guess 4th is that you wouldn't get "consensus", but tbh they didn't get overwhelming consensus for the DAO, so...).
The real talking point of course is that this scenario *might* be possible. Having an "ETH foundation" has always been part of the problem, but proof of stake - one of the principal arguments in favor of the DAO rollback 9 yrs ago btw - really creates the problem. If the government can point to strong evidence that a) NK is receiving regular staking rewards and b) ETH foundation could choose to implement a blockage, or funds reassignment, then they could be in significant trouble.
The original sin of the DAO funds reassignment is why this is not purely a flight of fancy (albeit, v. unlikely still, imo).

2025-02-17 08:23:50

- reply

Signing messages also has that property though, technically. I guess you mean that, in practice, it needs human intervention, for the reason i mentioned above.

2025-02-14 01:04:13

You may be impressed by the forceful *tone* of harding's post here. But I think the most important point is the slightly-less appreciated, nowadays, fact that Bitcoin is not just 'finite supply', but 'bypass a corrupt power system, fuck the banks'. Bitcoin 'grew out of' the era of Wikileaks, operation chokepoint, and of course '08 crisis up to '14 Cyprus confiscation event.
And if you struggle to resonate with this 'anti bank' position, despite how blatant it was with e.g. the Canadian trucker event, then I suggest you need to shake yourself up a bit and do *something* unusual for once, because the level of "normie" you have to be to not experience problems with banks is slowly reaching inhuman levels.
#nevent1q…pkfn

2025-02-10 16:53:24

This is one analogy, but the other would be that the stalls are not transparent, but there is a camera in each one hooked up to a system maintained by a govt engineer on 30K/yr, currently on break, the system password is hunter2, and the networking gear is all sourced directly from the PLA.
#nevent1q…q7wk

2025-02-10 16:23:07

The benefit of a common language 😆
https://www.youtube.com/watch?v=1jHfY0dDZxA

2025-01-27 15:42:22

- reply

Would be nice! But even then wouldn't be enough, right, it's fiddly to handle the no-change case as a user unless the software does the nasty arithmetic for you (subtracting the fee). I mean you can do that calculation manually but the software has to be coded to expect it (getting change=0 after calc.ing fee-rate * tx weight, and ditching the second output), in which case, it should just automate it for you, i.e. a flag or button for "put all of my inputs minus fee into the channel"

2025-01-27 14:55:53

- reply

Right, that's often part of it, but the thing I'm pointing at is you don't need to have a specific target here. Suppose you have one utxo of 0.1 btc and another of 0.001 btc. If your plan is to open a channel of 0.1 btc, you usually don't care that it's *exactly* that, unlike when you're paying for a product, when your payment size has to be fixed. So you can sweep up the second utxo and have two inputs to the tx and have the channel be size 0.1005 or whatever.

2025-01-27 14:44:00

Do LN implementations make it a priority in their coin selection code, to open channels without change outputs? I guess not, but I was just thinking that channel opens are a unique opportunity for consolidation, because you usually don't care about exact amounts. While you can say, reasonably, "nah, we'd prefer to have the channel open pattern the same as the payment pattern for privacy/anon set", the economics of utxos is going to be vitally important long term, plus removing change from a payment breaks some heuristics. Even more interesting ofc is if you could negotation a 2x no-change coinjoined channel open.
#lightning

2025-01-27 14:38:17

- reply

One nice thing about LN channels is that the exact amount doesn't matter. So you can sweep up dusty utxos when you create them. As for non economic tiny outputs more generally, yes they are quite a headache.

2025-01-27 14:36:07

- reply

Good point to consider. Affects both 5/ and 7/
I think here in El Salvador I have never encountered this as a problem. E.g. in a department store i pay to a terminal using LN the same way i pay in cash. I don't see how it could be blocked.

2025-01-26 15:25:15

Reasons to spend bitcoin (incl. Lightning):
1/ It's more secure and private than filling out a form with personal information (e.g. credit card payment on some websites) or 1a/ handing over *credentials* to a waiter, or a POS machine that you don't trust. 1b/ The UI is therefore better (it's smoother)
2/ It's cheaper *maybe* for you, but specifically for the merchant, than credit cards
3/ It (quasi)-settles immediately in LN case and in 10 min on chain; card payments often take 60 days
4/ It has cash like properties but you can pay remotely and immediately
5/ It cannot be blocked by a payments provider
6/ There is no (realistic) limit how small or large the payment can be
7/ Every transaction, especially the more p2p ones, e.g. between friends, but also to companies, adds and improves bitcoin's privacy overall - consider that if we did nothing but move bitcoin to and from KYC exchanges, there would be zero privacy, independent of advanced cryptography. More business or personal transactions without KYC, the less information is in the onchain tracing.
8/ There is no global systemic downtime when some backend fails (this one is more debatable)
9/ Actually using bitcoin is how you learn its mechanics and will give you necessary expertise to not lose it, even if your primary goal is only saving.
10/ Using bitcoin makes it a better money, as you are participating in the process which makes it a viable form of money for others.
#spedn

2025-01-19 02:52:57

- reply

Iirc the idea was that you had to 2FA but if you couldn't for sosome reason, you could recover the funds after a timeout yourself. I forget the details.

2025-01-18 22:43:52

Are there any desktop or mobile wallets with miniscript support?

2025-01-18 15:26:23

- reply

I'm thinking it wouldn't be amazing if it was something as random as time of day. On Nostr that can matter a lot.

2025-01-18 14:42:30

Just had a realization that I don't know the best way to write my nostr identity as a contact, on a pdf slide for a presentation I'm giving. I want to just write the npub, that's a possibility, so that at least people who have the pdf file can copy it (if I make it copyable), but that's useless most of the time. Can we make human readable versions of npubs (like maybe 4 or 5 words or something)? A very vague thought. Note that bip39 has 12 words for 128 bit entropy with 2000ish dictionary words. An npub is 256 bits so clearly you can't do that in 5 words, but what if we used a bigger dictionary?
#asknostr

2025-01-17 18:23:50

Signet has 215K unconfirmed txs right now. Wtf 🤯

2025-01-15 23:28:59

- reply

Yes

2025-01-15 22:19:05

- reply

One's immediate assumption on hearing "Tether is moving its base to El Salvador" is that, I agree. And it still maybe 99% true, but I did see Paolo talking about "building Tether tower" or something. There is at least in my mind some faint hope that he might bring a bit more than nothing, here. After all there *is* some actual Bitcoin business activity here. In dollar amounts it's miniscule of course, but it's significant because the environment is so different here. Still Tether's business and customers are not mostly here (though Tether is *huge* across latin america generally).

2025-01-15 22:09:47

So Tether is really moving its operations to El Salvador? Like as in employees and so on? That is a huge deal if so.
On the other hand, I guess Tether has a small base of say engineers (they probably make more profit per engineer than any other company on Earth, even like OpenAI or whatever), and if anything probably pay enormous sums to law firms around the planet to do most of the "work" that matters. And I'm sure it's a *lot* of remote work. So it's maybe not some spectacular achievement for the working prospects of ordinary people here ...

2025-01-15 19:54:20

Are there any phone wallets that support signet?
#asknostr #bitcoin

2025-01-12 21:49:48

- reply

The context is the thread!

2025-01-12 20:30:40

This guy must be trolling 😆
https://github.com/spesmilo/electrum/issues/7544#issuecomment-2564712563

2025-01-11 00:23:30

- reply

Sorry you're right. I use 90% LN so I'm only using onchain btc a few times a month.

2025-01-10 23:17:10

Still out here using bitcoin every single day ... and according to the mempools I see, there are literally ... dozens... of us.

2025-01-07 00:22:53

- reply

If you think it sold weapons or assassinations or similar, you are woefully misinformed.

2025-01-06 23:29:46

- reply

Oh you don't know this story? A bunch of wallets lost a bunch of user funds by using a broken implementation of SecureRandom on Android. Then later blockchain.info fucked up again by using a web call to random.org that failed.
Since address reuse was rampant, there resulted many cases of reused R, even at large scale.

2025-01-06 23:05:54

"Re: Reused R-values again"
from bitcointalk, 2014 https://image.nostr.build/c34fe79968c4a709ea9011f8fed6509a3cfcbe8b8c9f89dfd833222885b40545.jpg

2025-01-05 13:44:13

After a chance to really dig in - this post was *way* too optimistic! Unfortunately. The idea that you could split out the secret(s) for signing and then do IPFE efficiently like that doesn't work as simply as I thought. As per the referenced paper (and the two others in 2015/16) you can do IPFE on standard DL groups (like secp), sure, but the output of the decryption step only gives the curve point, not the scalar (so not the s you need for signing, but sG), and some of the language around that in the papers confused me initially. It works for secrets in restricted ranges because you can just do a DLOG calculation, but not for a 256 bit space. There may be a way round that with Paillier instead of El Gamal (see eprint 2015/608), but it's complicated. Also, my idea of splitting the signature into two parts: vector 1 being [k_1^-1, k_1^-1 * p] ("half of the nonce" is k_1, private key is p), and vector 2 being [k_2^-1 * e * (R_x+1), R_x * k_2^-1] and the dot product of these is equal to the signature, and calculating R_x as k_2 * K_1 - all this so an initial setup could construct ciphertexts of the first vector then ditch the private key ... this line of thinking may still be promising but it's really tricky to create it in a way that is secure.
#cryptography
#nevent1q…qe2h

2025-01-04 15:25:26

- reply

Milei's been in power for a full year now. It seems like he's doing very well considering how profoundly controversial his measures were always going to be.

2025-01-03 15:59:17

A bit tricky to explain this but let's try:
In the summer Jeremy Rubin proposed "F-ed up covenants" which was the idea of making covenants on bitcoin without an op code, using functional encryption. Basically the idea of FE is "you don't have a key that lets you decrypt encrypted data, you have a key that lets you decrypt the result of a function, F, on encrypted data". And he used that to get a signature on a transaction to be outputt-able by decryption, but the "functional" part restricted it so it would only work if the transaction hash was some value, e. This means that only the covenant-preparer's intended transaction could be signed over, assuming the "root" private key had been permanently deleted on setup. (and this could be repeated indefinitely for different covenants after an initial setup).
Very clever idea and I commented on it here at the time. The problem was, as Jeremy himself well understood, that the function he proposed being complicated (something like "ECDSA-sign(private key + hash, over message which is hash)") is complicated and there is no functional encryption scheme that we know that can do this efficiently. More or less.
So I've spent a couple days writing it out, and I *think* you *can* actually do this using the simplest kind of functional encryption which is inner product functional encryption. There are several twists, though. First, it only works for ECDSA not taproot (I'll explain that to anyone that asks). Second, what we want out of this is different from the toy "calculate student's grade average from encrypted grades" use-case example that's quoted in papers; we want to calculate the ciphertext of the private key, throw it away, then calculate decryption keys separately for each new transaction that we want to covenant. I found a way to do that but with a huge limitation: we need a server to be able to calculate the one-time use decryption keys; we can *still* throw the original private key away, immediately, but we need these "decryption secrets" per use case. However, I think this can be done with a simple blinding, such that a decryption-key-generating server doesn't need to see anything when creating them. Given this, one simply needs to use the El-Gamal encryption scheme "over" the functional encryption (see https://eprint.iacr.org/2015/017.pdf ) to allow anyone to output a valid ECDSA signature from an inner product of the one-time created ciphertext for the private key, combined with the user's individual nonce and transaction data.
fwiw the nastiness of trusted setup one-time privkey creation doesn't bother me so much; it can probably be MPC-ed which is good enough. But the need to do (albeit blinded) calls to some server to create the one time decryption keys is quite nasty. If there were a trick to get round that, AND there was solid enough security analysis to say that this actually works, then I'd call this a huge advance. For now it's a bit pie in the sky. I'll try to make a toy implementation along with a writeup, when I get back to my desk.
Original f-ed up covenants post: https://delvingbitcoin.org/t/fed-up-covenants/929
#cryptography

2025-01-03 13:32:19

- reply

No soy nativo, pero me interesa la pregunta: no es mejor decir "no hay intentar" (en ingles "there is no 'try'")? O es que en la pelicula español usan 'no lo intentes'?

2025-01-02 08:46:39

TIL the Brazilian real has fallen below 6 to the dollar (6.184). Lost 25% of its USD value in just a year. Still a long way from hyperinflation but on a very dodgy path.

2025-01-02 07:25:03

- reply

> ... trick you into relinquishing your ability to decide the future of bitcoin
Wait, I can do that?

2024-12-30 11:55:32

- reply

Sure; as noted in the thread, boosting is already a thing, so it can be paid for with any kind of payment.
Even if mining power were massively distributed, it's always possible for it to coordinate, even purely anonymously, to cooperate in such a scheme. If everyone's interests align, it can happen (maybe unlikely, today, but ... possible. Not sure econ. value of watching is high enough). Centralization makes it fragile, also.
Afaict the OP 'ethereum is dead because this adverts for tx fees scheme exists' is just stupid.

2024-12-29 20:32:21

Wen zapjoin?
#nevent1q…lns0

2024-12-29 11:32:26

- reply

Asking the right questions!
I have 2 answers:
1. Some combination of p2p to make unstoppable networks, with strong cryptography and a bit of steganography thrown in.
2. We're fucked.

2024-12-29 08:43:36

- reply

Apart from the point about ethics near the end, there's also the general point about identities in systems. But admittedly that stuff is only *related* to the fallacy. I guess the essay is more trying to point out something (the mental pattern) and its causes than trying to draw conclusions.
Heck a lot of my tech writing has no conclusion, either 😄

2024-12-29 01:25:15

New blog post:
https://reyify.com/blog/the-fallacy-of-agency
A pictorial essay about a (wrong) mental pattern, which I think is very pervasive, and my own speculation about why it exists.
It is a *bit* related to bitcoin, I promise :)

2024-12-28 22:17:46

- reply

Technically ... there's Ne7 that needs Qg7 also. But it's quite annoying to list every possibility I guess

2024-12-28 18:46:48

A remarkable anecdote about Uber's early growth strategy:
"Regulators eventually figured out they needed to impersonate honest customers, summon a driver through Uber’s App and then finally arrest them. However, Uber frequently anticipated this scheme and thwarted it. Uber used sophisticated software to identify the cartel’s enforcers and evade them. Uber altered the apps on the phones of the cartel’s would-be enforcers’ so that drivers appeared to be unavailable, with their true locations hidden. Actual cars were replaced with non-existent ghost cars in these apps! Thus, the Uber “underground” rebels could conduct operations right under the regulators’ noses yet still slip away. Sometimes the undercover taxi police would create false identities on a new cell phone number. Even then, Uber quickly adapted. They would deduce (or perhaps be informed, since satisfied Uber customers were turning up everywhere in the growing Uber underground) where the batch of phones had been purchased and eventually identify them. When cartel enforcers did manage to catch a driver. Uber would pay all fines and legal costs."
Obviously i have no way of verifying how true it is, but, wow.
https://www.adamsmith.org/blog/uber-literally-saves-lives

2024-12-28 10:07:38

- reply

I mean they're not literally the same, right. CR is necessary but not sufficient for 100%U.
Being born in the USA is necessary but not sufficient for being president, there, and clearly 'another way of saying "being born in the USA" is being president" isn't right (extreme, but it illustrates the point).

2024-12-27 17:29:44

- reply

Aha first.
Investing in something you don't understand is a recipe for disaster IMHO.

2024-12-26 16:37:05

- reply

Yes, see the recently published RFC9591 : "..However, unlike EdDSA, the signatures produced by FROST are not deterministic, since deriving nonces deterministically allows for a complete key-recovery attack in multi-party, discrete logarithm-based signatures."
The reason this very counter-intuitive footgun exists in MuSig2, FROST etc. : whereas typically you tie the *exact* nonce point R into the hash in standard Schnorr, i.e. you calculate s = k + H(R,..,message) where R is the point for k (R = kG), in the collaborative version (both FROST and Musig2) you do s = k + H(R_aggregated,..,message) where R_aggregated *includes* your individual R, but also adds in the other guys' R-values, too. So the attacker can make R_aggregated change for your s calculation, while your k value does *not* change if your private key and message don't change (you basically do k = H(privkey,message)). So you end up reusing the nonce on different equations and then the attacker can just subtract one of your s-values from the other. You signed a different "message" even though your actual message (e.g. the bitcoin transaction) was the same, because mathematically your "message" is "R, ..., message" and not just "message".
So you could see it as an impurity of the concept of 'nonce' leading to undesirable outcomes.
This is why MuSigDN and stuff like https://eprint.iacr.org/2021/1055 exist.

2024-12-24 19:46:54

- reply

Specifically mathematics tasks right?
But eventually open source wins imo, at least for things that matter.

2024-12-24 12:30:47

- reply

So you're saying we need algorithms 😉

2024-12-24 11:25:25

- reply

Re: the second, maybe, that seems to be the story he's telling, but ... I don't think so. There's something very different going on in the psychology of people who are long time, knowledgeable bitcoiners, but can be persuaded (without violence) to hand over a seedphrase. I remember being shocked by this in the Junseth interview.

2024-12-24 05:56:59

For all the sophistication of these attacks, both victims made absolutely elementary mistakes.
One saved a photo of his plaintext seedphrase to the cloud, the other was convinced to type in his seedphrase on a website.
Still absolutely required reading, I think:
https://krebsonsecurity.com/2024/12/how-to-lose-a-fortune-with-just-one-bad-click/

2024-12-23 13:22:01

- reply

Best part is you probably received less product, too!

2024-12-19 17:52:14

- reply

You can live largely on bitcoin in the city, e.g. paying bills. For food orders and travel also, for occasional items it's mixed, but cash from a bitcoin ATM fills the gaps and barely costs anything.

2024-12-19 15:57:46

- reply

The smaller stores and businesses all use it, because it links easily with their bank account.
The larger and multinational stores usually have custom solutions from other providers, Chivo was not a good solution early on, it was very unreliable. Better now but still not amazing.

2024-12-19 15:51:21

Little comment on the details of the IMF-Bukele deal. My take on the general bending-of-the-knee here I already gave a week ago.
I think people are not paying enough attention to one aspect of the language here (distracted as they understandably are by the first 4 sentences): "Transparency, regulation, and supervision of digital assets will be enhanced to safeguard ..." . Here the IMF is reasserting the right of the global banking system to prevent autonomous control of money using Bitcoin in El Salvador. Note that the banks wilfully ignored the bitcoin law for 3 years despite on more than one occasion Bukele claiming he would address this and punish them, but he never did. And now, not only have they been vindicated and will continue to persecute bitcoin usage aggressively, but even very concrete every day things - using Bitcoin ATMs here will imo, after a while, be reduced and phased out - no longer will you be able to buy and sell hundreds of dollars just with a random phone number. If the ATMs persist at all, they will require ID cards and/or (more likely) the use of accounts regulated and approved by the banking system/regulators. And since Chivo will be phased out (most likely), then using bitcoin in stores will *mostly* disappear. Pessimistic take, but I think so. I give it 18 months before living on Bitcoin here will not be very practically possible any more. Hopefully I'm wrong!
#elsalvador

2024-12-18 23:05:58

- reply

This; if you have a bip39 seedphrase (usually 24 or 12 words) you can import and recover the same wallet, without using a transfer onchain. In some situations it might not work (talking generally, not Jade specifically) due to incompatible address types, but hardware wallets are mostly interoperable like that.

2024-12-18 21:28:57

- reply

He'd,say not, I'm sure, because it's not bitcoin.

2024-12-18 14:12:14

This is a really important point to make.
The question is whether the slightly shaky foundation of lightning, as current- LN penalty- will support enough further refinement that it can be used into the future. This shakiness has made the engineering workload needed to reach safe usability, huge. And there are still big holes in it from the point of view of robustness.
But Calle is dead right that LN sets the bar way higher in decentralization, and we should only really be looking for alternatives that have that same property.
#nevent1q…uaez

2024-12-16 16:27:10

- reply

But on which blockchain can I verify that Aura is the right blockchain to verify Prada?

2024-12-16 16:24:54

- reply

Unable to send zap, here.

2024-12-15 16:56:14

Amazon UK won't sell me a garden trowel without documented proof I'm over 18.
And some people wonder why I don't live in the UK.

2024-12-15 12:53:03

- reply

Cool. I read all those books, loved them but don't remember much.

2024-12-14 18:40:08

You might know Maxwell's demon, but do you know Szilard's?
https://en.m.wikipedia.org/wiki/Entropy_in_thermodynamics_and_information_theory#Szilard's_engine
This idea, that acquiring information is somehow equivalent to a reduction of entropy, feels very resonant with proof of work.

2024-12-12 16:30:57

- reply

Oh sorry you said "up" 😄

2024-12-12 16:30:30

- reply

Been falling in spending power pretty consistently for 100 years. But that's not collapse, imo erosion would be a much better word.

2024-12-12 14:57:02

- reply

The dollar has been just about to collapse within 6 months for as long as I can remember.

2024-12-11 20:22:48

- reply

Yeah. Another one that's very useful is the Cauchy-Schwartz inequality, gets used a ton in e.g. mathematical physics

2024-12-11 20:15:54

- reply

If you want a hint, try finding a way to apply AM-GM twice.

2024-12-11 17:12:15

- reply

Yeah but: they have a lot of knowledge; they make superb search engines. So language and knowledge, perhaps, but not understanding, thinking, reasoning, whatever we call that.
In many fields they simulate reasoning to an uncanny extent.

2024-12-11 17:08:57

- reply

It's simple but not easy :) I didn't find it, but to be fair I didn't really try, just looked up the answer after 5 minutes 😄

2024-12-11 17:07:02

- reply

You're good with the obscure book references.
Nowadays I'm stuck with basic Spanish language novels. But I have graduated from Harry Potter type stuff to Agatha Christie so it's not so bad.

2024-12-11 16:49:52

- reply

Yep,
prove that x^4 + y^4 + z^2 >= sqrt(8)*x*y*z

2024-12-11 16:48:41

- reply

I can believe it, seeing what it's done with coding problems, a few times. What's really shocking about what I just saw is how massively it hallucinated simplifications in a short problem (by the way, this one, to give you a sense: prove that x^4 + y^4 + z^2 >= sqrt(8)*x*y*z ). I think Olympiad problems (even easier ones) are designed to require some kind of "craft", creativity, rather than only handle turning. So unsurprisingly it immediately appealed to the AM-GM inequality (bread and butter for this kind of thing), but then made 2 or 3 dreadful mistakes to pretend that the structure was simpler than it was, before confidently asserting in great detail why so and so was true, when it was patently false.
I think it can be very good and giving you hints and strategies appealing to its vast knowledge base. Doing something new or actually *thinking*, it's just absolutely dreadful.

2024-12-11 16:18:11

If you want to see just how few clothes the emperor really has, ask an LLM a nontrivial problem in algebra. I just gave a math olympiad question (on the very easy end of the spectrum) to chatGPT and I cringed at its response. If it was a human being I wouldn't even criticize what they wrote, I'd be too embarrassed. And this is not because the answer's bad (and wrong), but because of the very obvious effort that this hypothetical human is making to *look* like it understands what is so obviously does not understand at all.
It's as if LLMs perfectly encapsulate the superficial and vapid nature of the Silicon Valley-rooted modern culture. There's no there there.

2024-12-10 22:34:51

- reply

Ah yes that works, thanks!

2024-12-09 22:00:56

- reply

Hey, thanks. Unfortunately I can't read it, is there a higher res version?

2024-12-09 16:17:14

- reply

Btw i do understand that people focus on the ethics; choice of how to trade should be voluntary. But if a country has a legal tender law (and all currently do) then the argument is more subtle. Making bitcoin legal tender imo actually helped, and it was never realistically about blanket enforcement (impossible).

2024-12-09 16:07:22

- reply

Is it because UPS or because different physical locations?

2024-12-09 02:32:18

- reply

Wow that anecdote at the start is such a perfect (in a dark way) representation of the reality of NGOs.

2024-12-08 17:08:33

VPS for bitcoin, especially w/lightning, which service is the best for uptime, general reliability, quality?
#asknostr

2024-12-07 17:12:47

Years ago I remember Maxwell being very sniffy about the threshold ECDSA ideas that involved Paillier. There was a swathe of implementations in the last I guess, 6 years or so but, somehow I started reading some papers that were released since 2021 (links below) and realized .. it's kind of a shit show out there. The main protocols are the old Lindell one and GG18/GG20 ; they're using zk proofs and paillier to basically share keys for an ECDSA calculation. It is complex, and it doesn't "flow" as nicely as using one prime order group. An example: in one of the ZK proofs in GG18, you need to calculate a value t_1 = e * beta + gamma, where e is a typical fiat shamir hash, beta is the secret and gamma is a blinding factor. this looks very familiar right? (s = k + ex), but there's a vital detail: t_1 is *just an integer*, not an element of a finite field. Hence, even though e and beta might be values in a field of order N, let's say, then if you choose gamma to also be in that same 0..N-1 set, you've suddenly leaked the secret!
Why? Because e*beta is in the range 0..N^2, not 0..N. The way to exploit that is to just divide by e: t1/e = beta + gamma/e. And since gamma/e is less than 1 with probability 0.5, the right hand side is basically just beta!
This is one example, but others included improperly formed paillier public keys and absence of range proof checks, seen in implementations in the wild. Both Binance and Bitgo had the dubious privilege of being mentioned as having implementations that could leak the entire set of private keys in *one* signature - even covertly (i.e. the signing goes through). Not saying everything hasn't been fixed from these reports, but, sheesh.
https://eprint.iacr.org/2021/1621
https://eprint.iacr.org/2023/1234
https://eprint.iacr.org/2019/114
#cryptography

2024-12-06 17:11:20

- reply

#beatsaber

2024-12-06 17:11:00

Applause speedcore remix mapped by Dailyy 93.1% 2 miss (expert)
https://replay.beatleader.xyz/?scoreId=19647303
Not much in this map, just basic fast jumps and bursts. Been trying to stabilize my speed with the new Q3 controllers ... hasn't been going well sadly. This is about as good as it gets.

2024-12-06 16:15:11

- reply

I'm joking but whenever you end up with an answer to an optimization problem, using some kind of empirical or quantitative method, that's "a bit less than three", then it kind of *should* be e (all the more so if it's about bases/logs!)

2024-12-06 15:36:02

https://blog.cashu.space/buckets-of-blind-signatures/
@nprofile…xnfk : good clear writing, thanks for that writeup! I think it's rather hard to explain the *first* part, let's say, the (M,C), (M',C') relationship, to the unfamiliar reader. I particularly thought the second half fleshed out the issues very well. And by the way, I refuse to believe that the optimal base is not in fact e :)

2024-12-05 22:45:54

- reply

Doh, I didn't read properly, now i get it, you mean mining on e.g. regtest right. Yeah that sounds very off. I remember it being ~ instant.

2024-12-05 21:49:45

- reply

I set up albyhub using ldk not lnd I'm pretty sure (and yes, Core).

2024-12-05 16:03:21

- reply

Nice way of laying it out, agreed!

2024-12-05 15:29:50

- reply

I think ~100% not 80% really? They did giveaways on bitcointalk to attract people in, but it was a tiny fraction of their made up supply.
Everyone can do whatever they like between consenting adults but this scam disgusts me about as much as OneCoin.

2024-12-05 14:38:28

- reply

Oh wow, it's way deeper than I thought 🤯

2024-12-05 14:31:59

- reply

100 'blocks to an address'?

2024-12-05 14:28:33

- reply

Fiat is virtual, bitcoin is not imo.
Consider that a trillion units of fiat can be created instantly at the stroke of pen, this cannot happen with bitcoin (*very* indirectly, because of the energy consumption required).
I understand that being a physical object or not might feel like the right definition, but I don't think so, it's more useful to consider what is virtual as what can be instantly, cheaply copied. (virtual as opposite of *real*, not opposite of physical).

2024-12-05 14:16:27

- reply

I think the main thing is to follow extremely aggressively when you start out. Click every profile you see and unless it's awful, follow, for now.

2024-12-05 13:27:12

- reply

Seems more like he's going to NACK

2024-12-04 17:22:01

- reply

Are there alternatives that offer yield to counteract inflation but don't require CGT?

2024-12-03 15:47:46

- reply

Do you have particular FHE schemes in mind? Rubin was keen on applying functional encryption to make soft forkless covenants but has recently branched away from that because the crypto is just not there yet.
Fwiw I agree that it's the right direction; I just don't know how far away it is.