waxwing

Bitcoin, cryptography, Joinmarket etc.

Public Key

npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7

NIP-57 Address

redsun63681@getalby.com

Profile Code

nprofile1qqsxwkuyle67y94tj378gw8w2xw2wa6nwmwlqhddlwnz0z7sztsaw2qpz4mhxue69uhkg6t5w3hjuur4vghhyetvv9uszyrhwden5te0dehhxarj9emkjmn9uvev4p

Publishing to

ditto.pub/relay

nostr.wine

nos.lol

Author Public Key

npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7

Show more details

Last Notes

2025-05-06 13:47:37

- reply

I get your point about technical specialisms and mastodon. I couldn't get over the friction of localized control and data ownership. Too much responsibility on admins. And of course, while I agree you can get access to a variety of communities on there (at least, some), it still fails w.r.t. my last paragraph.

2025-05-06 11:31:48

I already feel like nostr, at least with amethyst and the relays I have, is close to what I want out of social media: a lot of interesting posts every day, a lot of possibilities for interesting conversation. It still falls short in one general sense: due to a severe lack of scale, and a somewhat homogeneous population, it's a long way from giving me any kind of realtime news feed in the way that Twitter could. Yeah not an earth shattering insight, I know 😄

2025-05-03 15:21:20

- reply

Yeah i vaguely remember you saying as much in your podcast.
Ayre has always been the most important, and least understandable part of the story. A random psycho isn't especially interesting.
I remember quipping on irc, back when all this started, that given Calvin was on an interpol list and Craig was in trouble with the tax office, these were the perfect people to "turn" to set up a psyop. I was only like 80% joking at the time, but of course it's ridiculous at this point. Which just leaves me endlessly bewildered by Ayre's behavior.

2025-05-02 06:35:56

- reply

'Anonymous' is used to mean something more powerful than just not having a real world name attached. What you're describing is more 'pseudonymous', though one could argue that messaging without encryption, over clearnet, on nostr, doesn't even fully achieve that.
I think earlier complaints about DMs were connected with NIP4 not being a well designed scheme.

2025-05-01 20:33:39

- reply

Filters, if the intention is not to create a momentum towards changing consensus, are pointless and also detrimental, a little bit at least, as Greg Maxwell explains here:
https://old.reddit.com/r/Bitcoin/comments/1kab15o/bitcoin_cores_github_mods_have_been_banning_users/mpou6xb/

2025-05-01 20:29:04

- reply

Your idea of actively publishing which block you're censoring is interesting, and a bit headspinning. But before that step, what does "actually work" mean, to you? I start from a baseline that people could always embed data using witness data and xor, say, even inside completely standard transactions that are self transfers. Embedding into the utxo set with standard template scriptpubkeys (without OP_RETURN) is harder, but everything is possible at a high enough price.
If 'actually work' means censoring only easily distinguishable things like certain OP_RETURN s it seems fairly pointless to discuss? Maybe?

2025-05-01 13:17:56

What surprises me about the tech and developer discussion around embedding data onchain (and OP_RETURN is just a corner of that), is how little of the discussion refers to the ethics.
There's an obvious point, and an obvious (in my opinion, incorrect) counterpoint.
The obvious point is that permissionlessness is central to Bitcoin's nature, and that implies *ethically* you cannot tell people what kinds of transactions are OK, and what are not. There are very substantial *technical* arguments as to why it can't really be prevented, but they are secondary to the ethical one: you don't have the *right* to tell people what transactions they can do.
The obvious counterpoint is that posting anything to the blockchain has a cost for *all* users. That's why we spent 4 years arguing about the limit on the size of blocks. I have no ethical right to tell someone not to publish or mine a block of size 10GB, but it doesn't take long to realize that the costs this imposes on other participants, is too large. In case you think, this argument was straightforward, the big blockers were wrong, don't forget that the resolution, for better or worse, was a compromise: average block size today is often 2x the size before. It was a really difficult argument.
So the counterpoint wins and we have to discuss whether embedding data should be allowed? I say, no, this a fundamentally different discussion. It is not a discussion of *how much computational resource is used in total*, but rather a discussion of *what individual users are using the computational resource FOR*, and that crosses the line into being ethically unacceptable, unequivocally.
I say that the technical awkwardness, or even impossibility, of restricting this behavior in the Bitcoin system is just a byproduct of trying to make Bitcoin do the opposite of what Bitcoin was designed for - censorship resistance.

2025-04-27 14:58:41

- reply

I think it's still pretty early. But also not sure those people are the enemy ... it's just, normal people really.

2025-04-27 14:51:49

- reply

I have several responses: (1) i anticipated that :) (2) it doesn't address my point about AI because I myself use it as a tool in that way, what I'm thinking about in the OP goes way deeper in terms of changing human behavior and (3) just curious, but I guess it accesses a transcript on youtube or something? otherwise that'd be a bit much in terms of resources presumably.

2025-04-27 14:16:23

- reply

Can you summarize? I don't want to watch the whole thing and I can't see what his main point is at a glance.

2025-04-27 13:25:04

People started losing the ability to use language when the internet gave them communication with pictures.
I thought that was bad; but I suspect that as AI continues to develop, people are going to lose the ability to think at all.

2025-04-26 15:43:58

- reply

I was about to congratulate you before but then you really hit the mark. It's funny but my intuition was saying 7.
Hope I didn't nerd snipe you from doing something actually useful 😁

2025-04-26 15:40:24

OP_RETURN wars with Luke-Jr crusading on the bitcoin-dev mailing list.
Whatyearisthis.jpg.
Meanwhile I'm all on my own actually reading and commenting on the new CISA algo 😄

2025-04-26 14:04:41

Change "DEAD" to "LIVE", changing only one letter at a time, with each step being a valid English word. I managed it in 10 steps but I'm sure you can do better.

2025-04-24 18:19:41

- reply

No, there is no such thing as "a bitcoin" or "a satoshi", in the software, in memory on your computer, or in the protocol. This is actually crucial, and not just semantics. If each satoshi were an actual thing, then they could be traced from inputs to outputs. All that exists is an accounting mechanism of (output measured value - input measured value).

2025-04-24 18:05:19

- reply

Yes, aut-ct . See my blog post https://reyify.com/blog/privacy-preserving-proof-of-taproot-assets/

2025-04-24 16:59:44

- reply

The standard should be zero knowledge proof of reserve. This approach is unnecessarily dangerous for custodians.

2025-04-24 16:48:10

- reply

No but I tried quite hard to break some.

2025-04-24 13:52:59

- reply

I'd say it's a better scenario than "prove your encryption algorithm is secure", although still hard (to prove). The former is essentially impossible but as you say "test of time" at least moves you probabilistically towards proof. The latter "prove that the system is censorship resistant", I would say, is better, even if not possible to define fully formally, and both of those things are because "the censor" is not a clear concept. There are certain powers that may have the ability to censor with the threat of violence, in different geographies, different times, different corporate entities etc. And they are capricious: they might ignore nostr for 4 years and then suddenly be 100% focused on it. So it's only better than the encryption case in that, when the attack really comes, it will give very clear evidence whether there is an effective censorship resistance or not, but that attack may not come for a long time (or never, also possible if nostr is not hugely successful).

2025-04-21 13:02:43

- reply

But you don't need nostr for that?

2025-04-20 15:03:51

- reply

Interesting podcast.

2025-04-19 21:48:18

- reply

Cheers

2025-04-19 14:25:01

Is MuSig2 in production anywhere?
And/or: Which libraries have implemented it?
Thanks in advance.

2025-04-14 20:27:22

- reply

It's different but ...if you embed bits into a picture, the question is whether you alter the statistical distribution of bits in a way that can be filtered in real time. With my proposed other idea (which does not exist, and maybe cannot, not entirely sure), it's two messages which have nothing *immediately* detectable about them. So it would be more like, two pictures with no anomalies in the least significant bits.
I guess I was only trying to observe one thing: that if there is a significant delay between receipt of a steganographic message, and decryption of it, *it* could cause problems for the most aggressive kind of global censor.

2025-04-14 18:59:03

- reply

The idea was that both M4 and M5 are plausible human text.

2025-04-14 15:01:47

- reply

He doesn't say anything crazy new, but as usual it is a very good blog post summarizing a lot of the history and arguments.
What i found strange about it, though, was giving central value to "freedom", "order" and progress, but not mentioning "security". I get that he's trying to couch it in ways that can appeal to the more privacy skeptic, but this ends up being overly convoluted. No serious person can argue against the necessity of security.

2025-04-14 11:16:27

Seen in a youtube comment: "I sold a motorcycle for £1200 and Monzo froze my account until i provided screenshots of the receipt, facebook advertisement, messages and DVLA new keeper notice. they locked me for a week and only when i threatened them with the police they released it. Just £1200."
(Monzo is a "neo-bank", think Revolut).

2025-04-14 09:00:56

- reply

The recipient wouldn't need an edge; the idea is only that the receipt of m5 is not blocked. Even if you are slower at decryption, you already have it.

2025-04-14 02:35:56

- reply

Well ... the main idea of steganography is that it shouldn't be detectable. *But* I'm proposing here, or rather trying to, something very weird: *publishing* with that property. It's almost a contradiction in terms. Except I'm imagining that the censor might not be able to realize what has happened before it's too late. (So in your example imagine M6 cannot be found quickly or easily). Unless the censor delays everything by the corresponding time period, I guess; maybe at that pointit is a logical impossibility indeed.
But anyway it's not like I actually know how to do it...

2025-04-13 15:39:16

Steganographic broadcast?
Adversarial model: the adversary controls the communication channel and only allows communications it approves.
Ideas: broadcast "normal" message M1 that passes through the censor wall.
Then broadcast secret key material M2 that decrypts M1 to M3 which is your intended broadcast. Call f(a,b)=c the function that decrypts two messages into the third.
For a typical f, like xor, this idea is dumb because M2 cannot be broadcast; it's random.
But posit a certain amount of computational power. Might it be possible to find pairs (M4, M5), which have two properties: *both M4 and M5* are inoffensive to the censor, *and* M6=f(M4, M5) gives your intended message?
The problem is more or less that of finding hash collisions or cycles. If f is xor, or mod add, it's reversible, so it seems like you could pad M6 (the output) with random bytes, instead of the input, and then grind, which in this application is a critical difference. But no: xor doesn't "diffuse" like a hash and so you can't grind like that. Does any such f exist?
Might Wagner's attack help? I think you could do it with hundreds of messages but that's a stretch.
(Another angle is using data in messages that *has* to be random in encrypted traffic; see tlstweet).
This is just some thoughts about avoiding severe censorship; I doubt it's actually viable, but, maybe there's a direction there.
#cryptography #censorship

2025-04-13 13:40:11

- reply

"reputable archivist" - does archive.* not count there? I think to whatever extent we actually needed evidence for something, the cpof of the archiving entity is a big problem.
(Maybe 1000 nostr archivers, all signing. That's something, but not if they all repost one guy, hehe)
Mostly it's not much of a problem with news, events, because of global broadcast online. But the advent of convincing AI is going to bring this issue to the forefront soon, I guess.

2025-04-13 13:28:54

- reply

You think? Not so sure. This is why we created tlsnotary btw (albeit it was a hack and what you really want is for the actual author to digitally sign in the first place).

2025-04-10 19:06:24

- reply

I hate the fact that this does actually make some sense.

2025-04-10 16:49:57

- reply

Sure, there's a time lag, but digital signatures predate bitcoin by 30 years.

2025-04-10 13:12:52

- reply

Yeah sure but ... there are tech and mgmt people at banks who are younger than this tech's first deployments.

2025-04-10 12:44:35

Many years ago I had reason to mull over in great detail the question of "why don't banks and government institutions use digital signatures?" (there are many scenarios where this would make processes vastly more easy for users, for the banks themselves, while at the same time making processes more secure. And the common reason for explaining why digital signatures are not used "it's too complex to keep up with key management" only makes sense applied to *users* - banks and similar institutions can easily handle that).
It was interesting to hear people's responses to this question. For example, Mike Hearn basically brushed it off with "they're just dumb" or some flavor thereof, and also pointed out that a bank he had somewhere (California, Switzerland, I forget) actually did offer digital signing. I researched and found one bank in India that claimed to do it but didn't. By chance, a bank in Europe I was using, a year or two later, claimed to offer it *for the users*, and asked me to input my gpg key, which I did, but they never followed up with any functionality at all.
In retrospect I still think my original line of thinking was correct: it didn't pass the lawyers. The most crucial thing about modern digital signatures is their *transferrability*. This means that once a bank signs something, like a statement of account, it can be spread anywhere and is guaranteed to be authentic. This is astoundingly useful *to the bank's clients* but to the bank itself it only represents a liability if they get caught equivocating somehow. Notice how signatures would be useful to the bank at the level of actual transactions (e.g. swift transfers with their peers), but clients are not in the position of actually *transacting* at an equal level; they're just creditors. It's a little like a recent experience of cancelling a UK phone contract: I went through a phone process to cancel it then got charged a bill again; feeling irate, I wanted an email so I could have a record of the conversation I had with their customer service; but they don't offer any email address at all. Only phone or ephemeral chat windows. Same basic thing.

2025-04-10 12:01:37

- reply

Lol i actually removed it but then just hit "paste" again 🤦‍♂️

2025-04-10 12:00:18

An interview with the famous, but entirely anonymous gwern, using an avatar.
His very first answer, about being anonymous, was interesting.
https://youtu.be/a42key59cZQ?si=IDKVrUDsCMj2fPdY

2025-04-08 12:32:40

Recently analyzing https://github.com/AbdelStark/nostringer-rs with @nprofile…lw5g (ring signatures) led me to write this in Python:
https://gist.github.com/AdamISZ/1012d90d47c53a9d4f99995877548b4f
, just a bare bones Back-LSAG impl. that doesn't include the ring in the challenge hash. As we discussed at length in https://github.com/AbdelStark/nostringer-rs/issues/24 there does not appear to be a security vulnerability; the ring is implicitly committed.
#cryptography

2025-04-08 12:24:29

- reply

Sorry I don't get it.
Edit: I searched, apparently a Dutch thing? I'll try not to be offended that you think I'm Dutch 😁

2025-04-04 01:52:28

- reply

Nice, didn't know he'd added that section. This is my top recommendation for cryptography books for learning.

2025-04-03 15:46:09

- reply

You could use aut-ct indeed, but ring signatures are fine for smallish anon sets. I think it would be worth switching to something like that if we have a use case where we want 10k-1M+ anon set over npubs. Tbh I don't really know what the planned use cases are. It would require some setup where everyone agrees on the "currently applicable set" of that 10k-1M npubs. With v. small anon sets however, you can just send them as part of the ring sig; less hassle.
Btw you can get log sized proof ring signatures even sticking to basic discrete log. The fundamental problem that ring sigs have, that curve trees solve, is linear verification time.

2025-04-03 00:28:40

- reply

Does it use some kind of timelock?

2025-04-02 18:16:00

- reply

Yeah it's really complex isn't it. And for fidelity bonds read Chris' old gist on the mathematics of fidelity bonds.

2025-04-02 16:07:49

- reply

Why don't you select randomly already? If it's because you don't feel it's appropriate to give implicit trust to the coordinators, I understand that, but then surely that wouldn't change if it was decentralized?

2025-04-02 15:59:12

- reply

My reading suggestion is, read this :)
The reason a fidelity bond is a reasonable suggestion is that we need to impose some cost or scarcity to prevent an attacker creating 100k Sybil agents as potential coordinators. I'm assuming you don't use any kind of trust or public identity behind the process of advertising yourself as a potential coordinator.
Why a fidelity bond vs some kind of more "high tech" thing like a podle commitment, a ring signature or an aut-ct token (think of it like a ring sig but you can get 1M anon set instead of 500-1k)? Because while privacy is important here, cost imposition should also be high. Something like aut-ct is good for rate limiting (I don't want a burst of 100k requests in 1 minute) with super-high privacy, but it doesn't impose any really significant cost on an individual user. A fidelity bond can lock money for a significant time e.g. 1 yr resulting in a very non-trivial time value of money sacrifice. While it isn't perfect privacy wise if on-chain, it can be an output from a coinjoin, so if well controlled, that utxo needn't leak a huge amount.
Finally though, on the general idea of a "moving" coordinator: it ends up rather similar in spirit to what I implemented in Joinmarket with "directory nodes" to find lists of counterparties, then the taker pings the onion services of the makers, avoiding having the actual coinjoin coordination occurring at a central party. Here it could be seen as better, but I have two practical concerns with it: 1/ isn't a big part of the coordinator role to ban utxos that don't cooperate, if you had 1000 coordinators, or, let's say, the coordinator is always moving, is that mechanism impacted? and 2/ wouldn't you need some way (like "directory nodes") to discover the "current coordinator list"? hence "directory node" idea in Joinmarket (which tangentially ended up never really working properly due to inability to have the onion services accessible, I honestly still don't know how that could be fixed).
Back to "which mechanism to prevent Sybil": none of them are perfect. With fidelity bonds you have to at least consider the problem that if you set the minimum cost to some reasonably-easy-to-attain for a normal person, you have the issue that a rich attacker can split their stash into 1000 smaller utxos and Sybil anyway. Chris' original solution to this was to use (sacrificed value)^2 but given the natural distribution of people's wealth, this *also* led to complaints about the fact that some people are 100 times richer and can therefore offer 10k more sacrificed value^2. It gets really tricky to handle this.

2025-04-01 22:09:13

- reply

Yeah, that's really bad. But the private key part is somehow infinitely worse!

2025-04-01 17:13:26

- reply

The dark side of good UX can be that you mislead people who are most attracted to it. A good example is the bullshit on that page about "hacker proof", "robotic process" and "isolated network facility".
Just listening rn to a podcast with a guy who lost 1.4btc, using these (although I have no idea if these cards were at fault, the fact that he was even using them is already tragic).

2025-04-01 16:58:47

- reply

It's just because the public key is public. If we used p2pk not p2pkh that would work too.

2025-04-01 16:57:32

https://materialbitcoin.com/en/
It's funny because when, 8 or 9 years ago I saw them using cards with private keys in paralelni polis, I laughed at it.
Seriously though, wtf is wrong with people?

2025-04-01 16:53:07

- reply

Another thing to keep in mind is that it *requires* using taproot, and (imo) that will continue to be under-adopted until it's in wide adoption on Lightning.
You can still get very large anon sets within taproot today, but for a typical user, having to switch infrastructure to taproot may (or may not) be a pain.
It's quite striking that while Binance uses sophisticated ZK techniques for the liabilities, for the assets they literally just publish all their addresses in a spreadsheet!

2025-04-01 15:42:18

- reply

aut-ct already works as a tool, and can do this. I just need some people to pay attention to it, as well as audit it. But I'm not particularly optimistic about that.
With most such tools it's often better to just "launch" something as people's usage will attract the necessary attention. For a "this proves I own bitcoin in this range across N utxos" tool, as exists in aut-ct, the natural user is some medium size bitcoin business that wants to prove utxos with privacy, a much smaller group, more conservative in its actions (and indeed, I can't even recommend using it without some audit, anyway).

2025-04-01 14:27:28

- reply

Just keep up your 50 a day cigarette habit while in the room, good for your ocular health.

2025-03-30 13:07:49

Here are some challenges I came up with, suitable for learning Bitcoin engineers (only some involve code, so this is still kinda suitable for non-developers who are trying to get a sophisticated level of technical understanding). They were planned to be used for a workshop last year but weren't used, so no point me keeping them, if anyone finds them useful, have at it! Note: "answers" are in the comments at the bottom, though in some cases the answers aren't fleshed out, they're more like "teacher notes". Italics are also teacher notes ofc.
https://gist.github.com/AdamISZ/7b13df9baf9dc5dc9ec428ccc518f6bc
#bitcoin #puzzles #education

2025-03-29 16:35:02

- reply

Consolidation of utxos is never a clear cut issue. Co-spending has to occur sometimes. Still I certainly agree that that aspect should be taken into account.
Yes, I know this is not a novel idea *in general*. I'm mostly wondering how easy we can make it for self sovereign users with automation (and also wondering if it's economically viable).

2025-03-29 16:13:10

- reply

Would be great.

2025-03-29 16:12:48

- reply

Account is a BIP32 thing. Basically a different (2) branch(es) of the HD tree. The stated intent of accounts in BIP32 is basically isolation of the coins, addresses from ones in other accounts.
It's imo the most natural way to prevent co-spending though of course it can be done otherwise.

2025-03-29 13:32:06

- reply

Hmm. I wondered if someone would bring up ecash as a possible approach. It is *interesting*, for sure, but I'm talking about larger amounts here. I feel like if we stick to small amounts, privacy problems aren't nearly so bad. And at large amounts, is ecash both practical and low enough risk?

2025-03-29 13:30:32

- reply

Your point is important, and I consider it always, nowadays, when thinking about privacy setups, but: coinjoin is very obviously by far worse here. That's why offchain/onchain mix makes sense; pure offchain makes most sense of all, because all of its cost benefit is inextricably accompanied by a privacy benefit, thereby removing the problem you mention. I'm discussing here what can be done for the stuff that cannot be offchain all the time. Again, this is much more "justifiable" to external people, although that line of thinking only goes so far.

2025-03-29 12:48:18

- reply

Interesting project.

2025-03-29 12:26:58

Bitcoin privacy showerthought: most users don't have 100kUSD+ in bitcoin. Usually it's 1k-50kUSD range. More specifically, even if they do have a large stash, the part that's ever active (i.e. they spend it, move it) is in that smaller range. (source: I made it the fuck up). Assuming that is correct, why not have a wallet that actively manages your privacy like this: on a regular but somewhat randomized schedule, it performs submarine swaps moving random chunks of your money (anything from $50 to $1000) into a channel. On an equally random schedule it can move money back, in reverse, to keep your money onchain most of the time, if that's what you prefer (you can keep a on-chain off-chain split percentage as a setting perhaps). The swaps are done with third parties. What "comes out" the other side will be very difficult to link to the original onchain coins. This will cost a bit in fees but I think for a certain midrange of amounts the fees will be very tolerable (it may not be a good solution when individual chunks go down to 2 figures, not sure). Probably not worse than coinjoin fees and I think the outcome is better, or at least it could be, if the third party swappers were actively trying to create outputs without fingerprints like hash preimages (insert technical argument).
(It would be of course important that the "after" account is different from the "before" to prevent co-spending. That's one thing that too few people do it seems to me, to partition wallets into multiple accounts for different usages (well apart from privacy wallets ofc).)

2025-03-29 01:56:59

A favorite of mine from Aquaflee, one of the best UK players (love his maps):
https://replay.beatleader.com/?scoreId=10077286
Track is Kamah (Scythe) by Camellia. There's also an old DE125 map of it. Exhilarating stuff.
#beatsaber
#nevent1q…x39g

2025-03-28 21:04:49

- reply

Sorry that message was for @nprofile…lw5g

2025-03-28 21:03:55

- reply

Thanks, this is a cool project! I left an Issue on the repo, but it's a technical point so leaving that aside for now - btw you write "suitable for anonymous voting" under SAG but that application requires linkability (otherwise repeated votes etc.). On the other hand, a distinction that I think *is* very interesting but won't occur to people immediately is, the difference between plain vanilla LSAG and Back-LSAG: with the latter, the key image is fixed for ever, for a given pubkey, which means if there is a "only use once" rule applied for say 10 different signing contexts (maybe, 10 different votes), the vote between each of the 10 use cases can be linked. Obviously that's not what you usually want. But for a cryptocurrency usage, it's exactly what you want: only one key image across every ring you'd ever use this key in (to prevent *global* double spend). The non-Back LSAG is the other way: the key image depends on my key, but also on the entire keyset, so it's different every time I ring-sign over a different keyset.

2025-03-28 16:29:30

- reply

Agreed 👍

2025-03-28 15:05:40

- reply

There is no such thing as intellectual property imo.

2025-03-28 13:36:33

Does anyone else find it really weird that gpg lets you create subkeys with different purposes - cool, very good idea - but doesn't seem to let you annotate those purposes on the individual subkeys? Only the primary key can be annotated/commented. Unless I missed something.

2025-03-27 22:56:34

The note discovery feature on Amethyst is a nice idea for feed customization. I'm curious, are the zaps for each feed consequential in any way?
#asknostr

2025-03-27 19:00:24

- reply

No, lol, it's fine, I'd just never heard of the show :)

2025-03-27 17:48:25

- reply

It's short for "number used once".
Several cryptographic protocols require numbers that are not repeated between runs of the protocol.
Often they are kept secret, but not always.

2025-03-27 17:46:28

- reply

I have no idea what you're talking about, fwiw.

2025-03-26 15:31:16

- reply

I didn't actually mean ephemeral keys, but I suppose such a thing is possible. I also didn't consider zaps but that seems to add nontrivial complexity either way.

2025-03-26 14:46:06

- reply

Yes, except the first prime 2.
Because they are all odd, because they are not divisible by 2, because they are prime.

2025-03-26 12:11:55

By the way, the default on Chivo is address reuse (I know because I've been paying some Salvadoreans onchain recently).
(And yes I know you should use Lightning, I've been paying Chivo users for 2+ years, it's just that these people in particular are very non tech savvy and getting this far was already hard. Also, if you need to pay several thousand you might not be able to do it with LN).
#elsalvador #bitcoin

2025-03-26 12:03:12

I don't understand @fiatjaf's argument here, at least, I don't understand the *strength* of it ("NEVER") ? First, on "global feed", it's a bit like (a more extreme version of) "the mempool" - in a decentralized system there is no single synchronized global state, but .. there can be pockets of smaller synchronized state, at the relay level .. I guess even at the client level? If you have instant access to 10k or 100k messages your client can present them how it wants. I admit to not knowing much of anything about relays, so tell me if I'm wrong. If the answer involves "it's more expensive", remember it can be paid for; I already pay for relays, it's completely normal. Also, it has always been very obvious to me that the "social media" application of nostr would obviously benefit from algorithms for feeds. (though such a thing wouldn't magically make nostr suddenly popular).
#nevent1q…m4lp

2025-03-26 11:47:20

- reply

It might be better to just allow anonymous submission *without* a keyset, like they do for whistleblowers. The nature of such reports is that they can be verified anyway, right, so that you don't need to trust the one reporting.

2025-03-26 11:33:13

- reply

Yes, right. I get where you're coming from. I agree that linkability is a nice-to-have feature here, maybe not essential. For spontaneity, yes, you get that with the AOS style (all of its derivatives, LWW, LSAG etc), I guess in practice it only ever mattered in cryptocurrency; because the nice idea of spontaneous ring formation rarely ended up being useful in practice; people have to have a key that you can spontaneously choose; if the number of such people is small enough, why not choose them all? IIRC Liu Wei Wong actually covered this point in one interesting way, suggesting that you could spontaneously form ring sigs over keys of different types (e.g. RSA and ECDSA etc.).
From a 20 minute look through the results for "ring signature" on github, I agree with you that it's hard to impossible to find an existing library that is reputable enough/well enough developed to be usable for a generic ring signature application of the type you're looking for. It's, I guess, a function of the fact that ring signatures never reached the threshold of common usage that led to them being included into the big crypto toolkits like you find in popular languages like Python and Javascript etc. After all they were never standardized by NIST and I don't think an RFC exists.

2025-03-26 09:07:09

- reply

Why "back at"? They never got away from it.

2025-03-26 01:05:04

- reply

What's your use case? The one they implemented here?
But no, I don't know of a library that implements ring signatures. The Borromean one is really just a small optimisation of the general AOS design, which itself is a natural generalization of Schnorr to 1 of N secrets. See reyify.com/blog/ring-signatures/ (for anyone unfamiliar with the ideas).

2025-03-25 23:14:03

- reply

Oh, very interesting! For some background for readers: the idea of using a ring signature to sign code is to help the anonymity (in a limited set) of the author; not a crazy idea, by any means. However the vulnerability mentioned is what interests me here: because around 2016, shortly after the Confidential Transactions idea was published by Maxwell and Poelstra, the Monero devs got understandably excited, because the idea of an anonymizing cryptocurrency with plaintext amounts obviously isn't great. So their initial proposals to use Confidential Transactions contained flaws, and I think the first one was exactly the one mentioned here: usingn H(data)*G for the alternate basepoint. This is an incredibly bad failure because it 100% breaks the anonymity immediately (I won't explain to avoid boring people), and also because it's a very basic error. I believe it was Jonas Nick who read their paper and pointed it out, and also pointed at a second much more subtle but very serious flaw in a proposal they had. My memory may be failing me there, but anyway something along those lines happened, but it never got into the code of Monero the cryptocc. So yeah it's really interesting if it *did* get into this project and then went unnoticed/undeleted.

2025-03-25 19:23:08

- reply

Oh yes. Very good point. I had vaguely heard about these bonds (the inflation-linked ones sold to the public) but I appreciate the info.
About hedge funds, yes, the govt defaulted on international debts and then certain funds (sometimes called vulture funds) bought the debts at discount and then they try aggressively to collect. It's a common model, see e.g. MtGox.

2025-03-25 16:17:33

Here's a "fun" fact for visitors to Argentina: it's (from a video I recently watched, and I confirmed by going into the nearest McDonalds in Buenos Aires) now *second in the world* on the famous "Big Mac Index", second only to Switzerland in cost. I think it's around $7. A combination of continued inflation (though less than the extremes of pre-2024 of course), with a rapid appreciation of the peso vs the USD, means that prices are shockingly high of many everyday things like food, for visitors. A good steak in a restaurant was, a year ago, $10-12 and is now $25 for example. So it went from being surprisingly cheap to being .. well, surprisingly expensive, in about a year. But a fascinating extra detail on the price of a Big Mac, and here I quote from wikipedia:
"Critics of the presidency of Cristina Fernández de Kirchner in Argentina and many economists believe that the government has for years falsified consumer price data to understate the country's true inflation rate.[28] The Economist stated in January 2011 that Big Mac index "does support claims that Argentina's government is cooking the books. The gap between its average annual rate of burger inflation (19%) and its official rate (10%) is far bigger than in any other country."[22] That year the press began reporting on unusual behavior by the more than 200 Argentinean McDonald's restaurants. They no longer prominently advertised Big Macs for sale and the sandwich, both individually and as part of value meals, was being sold for an unusually low price compared to other items. Guillermo Moreno, Secretary of Commerce in the Kirchner government, reportedly forced McDonald's to sell the Big Mac at an artificially low price to manipulate the country's performance on the Big Mac index.[29][28] In June 2012, the price of the Big Mac value meal suddenly rose by 26%, closer to that of other meals, after The Economist, The New York Times, and other media reported on the unusual pricing. A Buenos Aires newspaper stated "Moreno loses the battle"."
#argentina #inflation

2025-03-25 14:56:18

- reply

Yeah this (cult)ure developed principally on twitter in the 2017-2020 period, I feel like. Nostr just feels different because there's little else.
I don't honestly think it matters much, and anyway, that's just how humans human, most of the time. People tribalize.

2025-03-24 16:34:20

- reply

OK computer was their magnum opus imo.

2025-03-23 16:40:04

- reply

When i read it, I just read True Names itself (downloaded it online somewhere). Great, yes, and visionary too.
Vinge's imagination was something very special. I think "A Fire Upon the Deep" is the best science fiction book I've ever read.

2025-03-23 16:37:21

- reply

Heat isn't a problem, but entropy is :)

2025-03-23 12:36:02

- reply

I always had that same feeling about combining microtransactions with microblogging, but, one has to keep an open mind. There are a lot of possible use cases.

2025-03-23 03:14:15

- reply

I guess I was more thinking about it at the infrastructure level, i.e. how relays can manage resource usage at larger scales. The problem of distinguishing "real" users from fake, or bots, is different. Using WoT type solutions for that, as you suggest, is reasonable I guess but there may never be any perfect solution there. Well it's a long discussion.

2025-03-22 23:35:09

- reply

I can't see that results will be very conclusive though. Imagine a very positive outcome for Nostr with say, 10-100M users, 98% of which are not super technically competent. Almost undoubtedly partially-trusted solutions will spring up (even *fully* trusted), somewhat how they did with LN, although that situation got muddied by regulatory pressures. People will be able to choose how much they need to trust those third parties, and it'll depend on how they use Nostr. Still, you for sure have a point. *Any* use of keypairs and signatures that's more widespread is a good thing from my pov. It will be less pressure here (at least less pressure compared with holding bitcoin as *savings*).

2025-03-22 16:51:15

- reply

Oh, that's interesting. First, apologies for not backing up my casual assertion that aut-ct etc. is me trying to "do" anti-Sybil without any details, but I'm afraid of having made so many posts about it in the past, I don't want to bore people. So overall: I think this question (how to defend against Sybil in (1) open (2) decentralized (3) private networks is just an extremely hard and deep question generally. For example, you say you see nip5 as weak and, I don't know, it latches onto an existing system which is quite "strong" but very expensive and it's also not private. While a WoT or other trust network solution might have similar tradeoffs (costly but *could* be strong) but could also just fail horribly dependent on algorithm. Meanwhile cost based solutions might be strong but .. uhh.. costly, lol. And "anonymous tokens from scarcity of utxos" as I'm suggesting is just generally weak, but could prevent bursty attacks on a system. So I don't know really. Also to be considered is pure proof of work, which has other problems/tradeoffs.

2025-03-22 12:52:34

Interesting thoughts from Melvin here.
Personally I think that, to misquote Szabo, "social verification does not scale" and that's why I came up with "RIDDLE" and then aut-ct though, to be clear, that's a set of ideas very focused on keeping privacy along with Sybil resistance, but as a side effect it does not "pollute" the main chain nor have related, nasty user costs.
The biggest negative of those ideas is that the Sybil resistance effect is negligible at small scale, it will only defend against large scale spam/DOS, but I think that's a good tradeoff against it costing the user absolutely nothing.
#nevent1q…fpkl

2025-03-21 21:21:22

To be honest, I bet this is deserved, but I'm not sure it's very wise... #argentina
https://www.state.gov/designation-of-former-president-of-argentina-and-former-minister-of-planning-of-argentina-for-involvement-in-significant-corruption/
I wonder if they will take an active siside in Brazil also.

2025-03-17 23:36:31

- reply

Oh yes. They are intended to, and I'm not claiming they're useless. I used the word 'dodgy' intentionally. I'm just claiming they'll naturally be biased by formal education, though they try not to be.

2025-03-17 13:50:49

- reply

But how could you do that at age 12+ in a country with a highly functioning education system?

2025-03-17 13:24:03

- reply

Mixnets are the inevitable 'correct' design for proper anonymity, because the involve every participant's public behavior being functionally identical.
But in the real world they have never gotten any usage, and I don't think that's accidental.
AFAIR Chaum discovered the central concept behind mixnets (guy was literally a genius), so it's no surprise he focused on this design.

2025-03-17 13:04:01

- reply

True, but not everyone even gets the chance to be educated/trained.

2025-03-17 12:40:20

- reply

They're not worthless but I guess it depends on what you're rmtrying to measure. Treating the result as a measure of innate ability that can't change is wrong I think.
A lot of it is a function of how much time a person has been trained in certain kind of abstract reasoning, which for the majority is a proxy for how much (not completely dysfunctional) education have you received.
(Not talking about super high IQ scores, just 'this person is normally intelligent' scores)

2025-03-17 12:20:36

- reply

IQ is a pretty dodgy measure. I agree with your point all the same.

2025-03-16 16:54:35

- reply

Generally I don't think one should leave cold storage secret key material on a signing device.
Good question.
Redundant storage is orthogonal; the signing device is a bad place to store the secrets.

2025-03-16 11:47:04

- reply

It seems like the other answers didn't explicitly tell you: they aren't claiming that syncing over satellite doesn't take days, they're saying syncing an ETH full node with fast internet takes even longer (cue argument about what constitutes a full node..).