waxwing

Bitcoin, cryptography, Joinmarket etc.

Public Key

npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7

Profile Code

nprofile1qqsxwkuyle67y94tj378gw8w2xw2wa6nwmwlqhddlwnz0z7sztsaw2qpr3mhxue69uhkummnw3ezucnfw33k76twv4ezuum0vd5kzmqpz4mhxue69uhk2er9dchxummnw3ezumrpdejqpcz6qj

Publishing to

nostr.bitcoiner.social

eden.nostr.land

Author Public Key

npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7

Show more details

Last Notes

2025-09-26 14:10:31 UTC

I spent a good long while thinking about this issue in more detail, even to the point of writing out formal security arguments, and I came to the conclusion that there's no real-world way to prevent at least a 20% leakage of data (i.e. data can be published at 20% of the size of the utxo) in the hypothetical scheme where you require a signature on the pubkey, so (P, (R, s)), in scriptPubkeys.
Why 20%? Think of it like this: the nonce being deducible is absolutely unavoidable. You could ban repeated nonces, you could ban ultra-low value nonces, you could ban other specific patterns but there will always be a way to leak it to interested observers - it could be something as neat as "the secret nonce is exactly the previous block's block hash" or something more messy like a function of the time of day, or ... whatever. That will mean that in *any* one signature we can broadcast the private key at least. In a (P, R, s) scheme that means 32 bytes in 160. In reality, grinding could add a few more bytes to that so it's a little higher.
In the repeated scheme, you leak 64 bytes out of 320 bytes, which is still 20%.
But 20%-ish with the massive caveat that you let others control the key and thus eject the data from the utxo set. It's *academically* super-interesting but I'm not sure any "bad actor" would ever choose this channel, unless perhaps they were forced out of other ones.
"Academically interesting" because while outputs don't work like this now, and probably never will, it would not totally solve the problem of "spam data in unpruneable utxos". It would make it less efficient, but at the cost of making Bitcoin as a whole also much less efficient.
#nevent1q…rfwj

2025-09-26 10:30:31 UTC

- reply

Ah yes. Yours was the 1st message I read today, otherwise... 😅

2025-09-26 10:04:29 UTC

- reply

2025-09-25 01:40:56 UTC

- reply

Wow, looking on twitter, that article got a lot of attention on twitter! Understandably. But it was kinda obvious, plus I'm not sure people appreciate the "non utxo utxo" aspect.

2025-09-25 01:29:44 UTC

- reply

Yes, can make sense. I think usage tokens for digital services more generally. Like API access where privacy is especially important (hence: privacypass). With the caveat that things Lightning may be preferable in more "open" contexts.

2025-09-25 01:24:02 UTC

Apparently Bitmex research last month wrote an excellent article using the same idea about data in private keys that I mentioned on the mailing list last May:
https://delvingbitcoin.org/t/response-to-pieter-wuilles-stackexchange-answer-re-nuking-the-opreturn-filter/1991/8
(I don't think they had seen my post).
Jokes aside, it is kinda fascinating to try to formally prove that you can't embed data in Schnorr in P, (R,s) without doing this. I have a vague outline but it's quite unclear.

2025-09-23 22:52:15 UTC

- reply

Ambiguous wording on my part, but i am talking about provincial *elections*, not opinion polls.

2025-09-23 19:19:48 UTC

- reply

But M0 includes cash and not only money printing. More specifically, if demand for cash rises a lot, then what's in M1 (money in bank accounts) can shift into M0. That's not "printing money out of thin air". It's the same money (here, pesos) moving from one form to another.
Another thing that really drove this, from what I'm reading today, is something called "LELIQs". Basically to try to suppress the hyperinflationary effect of their excessive spending, earlier governments got banks to put excess peso reserves in high interest paying instruments. Milei's govt made it a big priority to remove this, as it was a huge interest expense that the government had to pay. To do that, these instruments were liquidated - converting them into cash, which put them in M0.
The bottom line is "printing money out of thin air" is the chronic problem of Argentina for decades, and Milei was explicitly trying to reverse it. M0 is a pretty arcane measure and difficult to interpret, but bear in mind, if Milei was printing and spending like a drunken sailor, all of his huge opposition in Argentina would not be shy to point it out, since his entire campaign was based on reversing it.

2025-09-23 18:59:01 UTC

Not sure if it's of interest to anyone here, but I tried to make a formal reduction from silentpayments unlinkability to DDH here. Haven't had any review yet.
It wasn't 100% trivial (also I couldn't find earlier papers that had analyzed this), but it also feels, to me, unlikely that there's any problem here, at the base level. It says nothing about ways you could screw up privacy with usage patterns.
https://github.com/AdamISZ/silentpayments-unlinkability-note
#cryptography
#nevent1q…f4e6

2025-09-23 15:34:10 UTC

- reply

Well, the article itself says immediately after quoting a 165% increase in M0, that "the BCRA no longer finances the Treasury by printing new pesos since 2023". So what is the cause of that increase? It wasn't clear to me that the article had an answer? It starts, form that point, to talk about credit in general. I suspect the right answer is rather complex.

2025-09-23 13:35:20 UTC

- reply

Yes, very true, but your standard here is "don't use fiat money". It's a good standard! But it's one that literally no country meets.
I do agree it's reasonable to criticize Milei for not taking non-fiat money more seriously, but he actually put the government in surplus and did *not* print money to finance govt activities, despite what people apparently believe (choosing to believe western media is just incredibly stupid here, but apparently if it suits your bias, it's fine!)

2025-09-23 13:29:03 UTC

- reply

I think that's just false. Any evidence? Milei put the government in surplus - something basically unique, certainly amongst Western governments. He also specifically said he would stop financing the treasury with money issuance. Apparently the IMF reported the same thing this year.
While at the same the economy grew at more than 6%, and the poverty rate was actually reduced, not increased.

2025-09-23 13:22:26 UTC

- reply

What stuff do you mean?
The recent news is that his party lost a crucial local election, and the market (correctly) perceived that as a warning sign that the extreme leftists who have driven the Argentinian economy into the ground for 3+ decades are quite likely to take back power, and so went into a complete tailspin. How does that reflect poorly on Milei?
Don't get me wrong there are a lot of negatives here. 1, neither dollarizing nor allowing a free market in Pesos is somehow finding the worst solution (a soft peg); eventually the market will attack it, and it's happened sooner than expected. 2. corruption cases involving his sister Karina, I'm not sure of the details but I get a very bad sense of that person (who was the key in the "Libra" fiasco). That stuff doesn't actually matter much imo but optics-wise it's a disaster. 3. well honestly there's no specific 3, I think everything else that hasn't worked well about Milei's tenure has all related to the fact that he does not have full political power, his party is smallish and new, he does not have control over the lower houses so has to use executive power to do anything substantial, and the other side of the debate is genuinely deeply (imo) evil; the classic south American disease of take all the country's wealth and give it to cronies (including helping the poor to be clear, but still stealing/cronyism - for which Kirchner has just been convicted btw, another story largely ignored byvWestern media), even though it has lead already to complete ruin, they want to keep doing it until they outcompete Venezuela.

2025-09-23 13:07:22 UTC

- reply

512 bit wouldn't help against quantum; the problem is Shor's algo is not exponential in that parameter, it's polynomial so it basically doesn't help.
Meanwhile we're at about 128 bit security (think birthday) w/ 256 bit curves, at least as far as anyone knows, shifting to 512->256 bit security is obviously "better" but otoh nobody seriously considers anything above 90 bits is attackable (and remember that scale is exponential!)

2025-09-23 11:37:36 UTC

- reply

I forgot to put "Buenos Aires" after "provincial" sorry.

2025-09-23 11:07:23 UTC

Unsurprisingly people are really clueless about Argentina and so if they decided Milei is bad they don't really have to check more than the headline, they already "know" the reasons behind the story ...
#nevent1q…jqjt

2025-09-23 11:02:31 UTC

- reply

It is faltering because leftists are winning in the polls ...

2025-09-23 11:00:58 UTC

- reply

The reason is that the Peronistas won the provincial elections, convincingly. Markets are not taking it well (currency, stocks etc.). Meanwhile Milei's team took the (imo) ill considered decision to create a slowly expanding "band" (think soft peg) around the ARSUSD exchange rate. And the ceiling of the band was hit in the above market panic. They started selling reserve USD to defend that ceiling.

2025-09-22 18:11:19 UTC

- reply

"Stopped thinking" 😆

2025-09-22 18:10:37 UTC

- reply

Yes, i got to the point of reading those descriptions but it feels a bit strange. Perhaps I should go to nostr.wine and see if they have advice on it, since I had the impression that their service was my principal "access point", I already used them for inbox as well as search, but didn't realize there were several other functions to consider. I'll try to investigate more. Thanks.

2025-09-22 18:06:07 UTC

- reply

It probably actually came up 3 times.
(My best attempt at a crypto joke today. I'll see myself out.)

2025-09-22 18:00:50 UTC

- reply

Sorry, 2 inbox DM relays. And the long list at the bottom is "connected" relays. Is that OK?

2025-09-22 17:59:12 UTC

- reply

Is that good or bad? 😅 ... i see a bewilderingly long list of options; I see 4 search relays active, I think, and 1 inbox DM relay ... and there's a long list of relays right at the bottom, but I'm not sure what that signifies.

2025-09-22 16:30:19 UTC

- reply

Dubai springs to mind but I'm willing to bet there are others. Though iirc dubai introduced corporate taxes while still keeping it free of income tax.

2025-09-22 16:28:57 UTC

- reply

No argument here. I'm still suspicious of the pure PoW solutions, and also of the ecash solutions, too.

2025-09-22 16:26:53 UTC

- reply

Not sure!

2025-09-22 16:26:41 UTC

- reply

Yeah i came to the same conclusion when i thought about it. It's obviously the practical choice to use a limited set, while the op_return carve out for data is ... not obvious, but has a clear purpose but can be argued against, for sure.

2025-09-22 15:56:30 UTC

- reply

Yes, new in US but many similar schemes in other jurisdictions.

2025-09-22 15:55:50 UTC

- reply

"We" have, yes (maybe you're specifically referring to bitcoin but it works either way), but a large plurality of people are convinced that WoT and similar community based scoring systems are the right answer.
The evidence doesn't support that thesis imo, specifically for anon systems as we're discussing here.

2025-09-22 15:52:07 UTC

- reply

I never saw anything completely satisfactory, but, payment rates massively convex wrt rate of requests seems like the only completely correct answer. Think surge pricing. That's one a few reasons I narrowed in on utxo ownership tokens, as there is some hard to define rate at which they become absurdly expensive to produce, whereas at low rates they are very close to free.

2025-09-22 15:29:23 UTC

Is anyone else having a lot of trouble getting things to load on Amethyst after the recent update?

2025-09-22 14:23:05 UTC

- reply

It's hardly new. States all over the globe have been doing this at scale for a long time ... though the book was prescient there, as it was a pretty niche thing in the 90s.

2025-09-21 17:45:24 UTC

- reply

I guess you can read his comments like that, true. I also think he just genuinely finds the question of how to address the potential threat intellectually interesting. Maybe a bit of all three.

2025-09-21 15:45:15 UTC

- reply

Hmm as I write that I realized the obvious point that unrestricted scriptpubkey types might themselves represent a dos threat: but there's a still a distinction to be made, right, between limits on size (and parsing computation), and limits on "type".

2025-09-21 15:41:25 UTC

- reply

Yes, good question. There are relay standardness policies like minrelayfee that are about DOS protection for nodes in terms of bandwidth etc.
I should probably research it, but as i remember there are others that are not like that, perhaps non-standard scriptpubkey types, and those would fit into the rubric of what I'm saying here, agreed.

2025-09-21 15:38:30 UTC

- reply

Thanks. Not sure if it's Amethyst or I'm just being dumb!

2025-09-21 13:51:07 UTC

- reply

I can't for the life of me figure out how to find Chris Guida's @ . If anyone could find that it would be appreciated, not that it matters much.

2025-09-21 13:48:18 UTC

A response to some of Chris Guida's points I posted on Delving:
https://delvingbitcoin.org/t/response-to-pieter-wuilles-stackexchange-answer-re-nuking-the-opreturn-filter/1991/4

2025-09-20 17:41:06 UTC

- reply

It's one of those tricky arguments to which people will apply this concept of "the precautionary principle". For my money that principle is wrong; every choice has both benefits *and* costs, so you can't argue that we should always do something to prevent a small probability threat, "just in case". It depends.

2025-09-18 12:50:03 UTC

Re: https://delvingbitcoin.org/t/provable-cryptography-for-bitcoin-an-introduction-workbook/1974 that was recently advertised
As I spent some time this summer working through this material (with a bunch of other people), I can heartily recommend it, but, it's not for the faint of heart! I think it would be much more useful to explain why the title is what it is - "*provable* cryptography". Without getting technical, let me give you some background that might inspire you to get involved:
The concept of "provable security" sounds a bit bland; of course you want to prove things are secure, rather than just hope it! But in the history of cryptography, it .. wasn't always like that. Pre- asymmetric encryption (think from Caesar cipher to Enigma machines, so until 1960ish), cryptography and cryptanalysis were in a constant battle - one side came up with clever ciphers, the other side found clever ways of breaking them. Like an arms race (except ciphers are not weapons! they're armor .. so, an armor race). As far as I know, nobody tried to *prove* the Enigma machine's complex cipher was secure at the time. But in the 70s and 80s, after Diffie and Hellman's groundbreaking work introduced practical cryptography without having to share a secret key (the DH protocols, and RSA around the same time), things started to change for a definite reason: these protocols were based on a deep "fact" (usually not a proven fact, but a belief) about number theory. The classic one is factoring: the "fact" that factoring a very large number takes an exponentially long time. Rapidly, many other similar "very hard problems" were found, the one most familiar to readers will be the "elliptic curve discrete log problem" (find the private key, given only the public key). Cryptosystems were being built with these "hard problems" as foundation.
And people started using the concept of "reduction", which is slippery logically but very powerful: I build cryptosystem A. If you can break A (notice: I'm not saying how, I'm just saying if you can break it *in any way*) with some magical machine, you can take that same magical machine and ... find a private key given only a public key. If you think about it, it makes sense to describe that as "reducing the security of A to the elliptic curve discrete log problem". The reason this gained traction through the 80s and 90s is because it circumvents the cryptographer-cryptanalyst war we mentioned at the start (at least, in theory it does!). The cryptographer doesn't have to consider all the different ways the cryptanalyst might break his system. He only has to believe that the math problem (e.g. factoring) is indeed hard, because if it is, and because he has a reduction, he knows that any such clever cryptanalyst is breaking the factoring problem, too.
I'll admit I balked a bit at this "backwards" logic when I first encountered it. I thought "hmm well maybe the clever cryptanalyst is going to use his technique against my cryptosystem A, and *actually* break ECDLP by doing it!". (I remember Greg Maxwell's response when I expressed this was "good luck" 🙂 ). But I hope you can see that this is generally missing the point, since the reduction isn't saying anything at all about ECDLP or factoring or whatever. It's just making a bridge from your specific thing, to the general "hardness" of the "big" problem like factoring. A bit like how money is useful because we don't need an unreasonable number of barter prices; everything is compared, numerically, with one central thing. Similarly there is a zoo of crypto protocols that use ECDLP as their "foundation", their security can be (even numerically) related to the security of that underlying thing.
As usual I'm now waffling a bit, but the main point I'm trying to get across is: "provable security" is based on these reductions, and in the "modern era" of cryptography, it's the main way you have any chance of navigating the huge complexity of answering the question "is this cryptosystem secure"? If you can reduce it to a known problem, you are done. Of course such reductions are sometimes wrong, and sometimes fail to model certain details that occur in real implementations, so they're not a panacea, but they are the best we have.
#cryptography

2025-09-17 23:16:36 UTC

- reply

lichess is a good site and app.

2025-09-17 19:27:14 UTC

- reply

In general the answer is you need fast read access to the utxo set all the time to run a validating node, right.

2025-09-17 15:23:49 UTC

- reply

I was talking about *consensus rules*: the set of rules about what is and is not allowed into transactions that are mined. We call that "consensus" because we cannot disagree about it (because Bitcoin can have only one history, to prevent double spending).
Not talking about consensus amongst people generally.

2025-09-17 13:38:33 UTC

- reply

There is no change to consensus; before and after this, the amount of data (however you're defining that) allowed onchain is the same.

2025-09-17 13:07:35 UTC

- reply

Over 100 replies.
That's not common here!
#nevent1q…p0ng

2025-09-17 13:05:38 UTC

- reply

Wow. That 2nd message.
He seems to be saying that it's not a problem if it ends up in a block, but is a problem if it's gossiped. But ... blocks get gossiped ..?

2025-09-17 11:38:29 UTC

- reply

I'll grant you that the end is overindulgent. But overall it's a masterpiece, and absolutely mesmerizing.

2025-09-16 19:57:52 UTC

- reply

CSW's new venture?

2025-09-16 16:15:27 UTC

- reply

What's the audio like?

2025-09-16 13:51:33 UTC

- reply

No, they are antithetical. The fact that they don't work directly links to that point. Because Bitcoin's entire design was to prevent that working (censorship).
So the nuance is only: I'm against using filters because they deteriorate Bitcoin's decentralization somewhat, and make the user's life a little harder too. I'm not *spectacularly* anti- them, because they don't completely kill the network.
I'm more forcefully against the arguments I've heard for them, than I am against filters themselves. Same principle as being anti censorship: if that's how you want to run your node, so be it (even if I'm sure it's ill considered!).

2025-09-16 12:37:44 UTC

- reply

> “if X percentage of filtering nodes are unable to 100% reliably stop spam, then they don’t work” is just a fallacious claim. The obvious contradiction is that if 99.9% nodes aggressively filter spam, and filtered txs still end up in blocks (they can), then filters also can’t be used for censorship (the whole argument falls apart)
So we agree: censoring doesn't work if it's not at the level of consensus: if it did, bitcoin would fail. but further, what kind of restrictions can and should exist at the consensus level is very controversial. even limiting the *rate* of transactions per block was controversial enough to create a full blown war in Bitcoin, for years. The only argument that falls apart is the one saying there's any point in doing mempool filtering; while there are very clear and concrete negative outcomes (though I wouldn't overplay them) from filtering, too.
> And no, filters work not because they reliably prevent spam from getting into blocks, but because they force behaviour that makes spam economically and rationally self-defeating (to a large extent)
I don't agree. Your argument seems to be that they make spam much more expensive, but I see absolutely no reason to think that, specifically because, as we already agreed, they don't work - the same transactions you are filtering end up in blocks, relayed directly to miners, often.

2025-09-16 11:28:02 UTC

- reply

What exactly do you think has been debunked? Do you think that if 90% of nodes on the p2p network apply filters, that the filters will prevent those transactions from getting into blocks? 99%?

2025-09-15 22:05:20 UTC

- reply

They can't work. If the rules need to change, they have to do so at consensus level, i.e. a soft fork.

2025-09-15 20:12:37 UTC

- reply

The point is, whose decision is it what the transaction's meaning is? The only correct answer is nobody at all.

2025-09-15 16:22:30 UTC

- reply

Interesting thought for sure. Obviously *any* out of band could work (with clearly some tradeoff), nostr fits particularly nicely. I'll read it more.

2025-09-15 14:36:23 UTC

- reply

For example: for receiver B, and multiple payers A_i, we want this: payments P_i are not linkable to B, except payment P_i is linkable to B by payer A_i (of course!). Thinking in this way allows you to realize for example that the effectiveness of SilentPayments may crucially depend on B's spending policies. (in the ideal case: B only receives coins via this protocol and only co-spends utxos that were created with it; you can satisfy yourself that in this case the non-cospent utxos should not be linkable. Or maybe you can't. But that's the kind of thing I think is worth investigating. A bit beyond a BIP of course, maybe, likely, someone has already done it.)

2025-09-15 14:26:42 UTC

- reply

You're missing a lot in that characterization, but the main reason such an analogy might be made, even if it's ultimately an unfair one, is the pro-filter arguments don't make sense "mechanically" (they don't achieve the intended goal *and* they harm the network) and are actually anathema to the entire purpose of bitcoin, which is censorship resistance.

2025-09-15 14:21:57 UTC

Been spending some time looking at the design of Silent Payments, just from a crypto point of view. Overall I like it; the only wiggle room for attack I can find so far is if the spending key is somehow a key that itself previously existed and was used for something, which it never would be. I see basically no attacks that make sense, so far. If I have a complaint about the BIP, it's that it isn't as clear as it should be about what privacy guarantees it's claiming (though the common sense reading seems to be right; it should be explicit though). Obviously the way out there stuff, like inputs that are from MuSig2/FROST, or coinjoins, which are pointed at in the BIP, are very much uncharted territory and would be hard to get right, but for now I think that is just not going to happen. Anyway I'll keep looking.
#cryptography #bitcoin

2025-09-15 14:20:55 UTC

- reply

My response to them is the same as that of Austan Goolsbee, Obama's chair of council of economic advisors, when asked about Bitcoin:
ROFLMAO

2025-09-15 11:59:21 UTC

- reply

There is no central server but there is a trusted root "community owner" for the PKI.

2025-09-14 18:04:17 UTC

- reply

Been a while but that first part of the game was definitely the best for me.

2025-09-13 15:26:58 UTC

The .mediawiki format is an interesting one for the bitcoin/bips repo. With markdown, you can preview your documents pretty much anywhere. But when I was recently editing a BIP to make a PR, I found it was an ... interesting ... process trying to preview my version of the doc. Short of literally setting up a local wiki with database and everything, it wasn't easy to figure out how to preview what the edits look like (and the syntax of mediawiki is significantly different to the by now very well known markdown (.md files)). Best I could find was the result from "mediawiki sandbox" search, like: https://meta.wikimedia.org/w/index.php?title=Meta:Sandbox&action=edit .

2025-09-12 19:08:10 UTC

- reply

😆 ... Or, you create a timelocked transaction to pass money to your heirs. Developer who included the nlocktime field in the GUI ... straight to jail.

2025-09-12 18:52:49 UTC

- reply

I would say that's the least important of the arguments he's making here. People should read this, but, they've already had all this explained to them and they don't care, shrug.

2025-09-12 18:49:06 UTC

- reply

My favorite one is the last one. Waiting to have a cup of tea before sending your payment? Straight to jail.

2025-09-12 12:27:07 UTC

- reply

Not sure about the nostr analogy, because about Visa/Mastercard: it's a bit like Tether, in a way. What Tether does, technically, is very trivial. The absurd profit comes from negotiating through the legal and regulatory minefield, and becoming "the incumbent".
With bitcoin/nostr and similar I don't see how something similar can happen. The whole Saylor thing is along those lines, but it's epiphenomenon, not phenomenon.

2025-09-10 16:11:26 UTC

- reply

Right, there's no total solution in jumping jurisdictions. It can't work for more than a small minority. I'm more just saying that in some scenarios, you can't expect much in terms of adoption at the level of everyday life. Progress tends to occur at the edges.

2025-09-10 13:31:41 UTC

- reply

I've lived in El Salvador for 3 years, mostly on bitcoin. It's not just a dream. To me the actual unrealistic thing is to try to push bitcoin adoption in jurisdictions where there is very little motivation. You have to "read the room", so to speak.

2025-09-10 11:49:05 UTC

- reply

You'd be surprised how practically possible it is to live without bank accounts in certain parts of Latin America (and not only), if you're pragmatic about it. Bitrefill, debit cards you can charge, tons of exchange places that accept both bitcoin and (much much more) usdt, and most important of all: countries where cash transactions remain the norm. A huge reason it seems so bad in much of Europe is because cash is slowly being softbanned.

2025-09-08 21:01:22 UTC

- reply

Kinda funny that he's advising against anything but hardware wallets, when it's exactly things like Ledger that have been using an egregiously insecure architecture of electron apps in javascript. (Ok, metamask style web apps are worse, but Ledger allows you to plug into that...)

2025-09-08 18:18:11 UTC

The story of integrating Schnorr into Bitcoin and its related applications has been very much this: wow this new (old) signing algorithm is super clean and powerful. We can now do X and Y and Z. But then after some delving into details it becomes "yeah we can do X and Y and Z, but attackers can also do X' and Y' and Z' so, shit, we'd better add a bunch more details to the algorithms for X, Y, Z". and those details have been hard. Crudely, Schnorr being "linear" means you can munge them around in clever ways that are efficient and private, but you need to sort of "restrict" how the linearity is used to make it work the way you want, and not some arbitrary other way that leads to security breaks. Here's a good example of what I mean:
I was recently revisiting the idea of an adaptor-based atomic swap. That is, a coin swap which is secure because if one side spends, the other side can also spend, by extracting a secret from the corresponding Schnorr signature. See https://github.com/BlockstreamResearch/scriptless-scripts/blob/a8b6ff21fc7f4529eabbe639fbff49f047a3579d/md/atomic-swap.md . I realized that there's a certain way to do it, that seems very natural, but is actually broken (if not trivially in practice .. but still, broken, in that money *could* be stolen, depending on the setup). I wrote about that attack yesterday here: https://gist.github.com/AdamISZ/489a08a0367137ed131efb90439bc9f5 . But, it's quite obvious (if you're familiar with Wagner's attack!), so not surprisingly this has already been considered and a more secure variant of "adaptor signature for a MuSig2 protocol execution" is in a years-old PR by Jonas Nick here: https://github.com/BlockstreamResearch/scriptless-scripts/pull/24 . It's not merged because it's not thoroughly reviewed and worked out, though I'm not sure if anyone's working on it. Bottom line, using the power of Schnorr and actually convincing yourself that it's being done safely, is not a simple matter. (Consider for example that PTLC Lightning intends to use something like this, so it's not exactly a completely uninteresting side topic).
#cryptography

2025-09-08 14:59:31 UTC

- reply

Ok found it nvm.

2025-09-08 14:56:30 UTC

- reply

Where (if anywhere) can I get a link to zkpoor?

2025-09-07 10:57:18 UTC

Latest ZK podcast episode has Huijia Lin giving a really good introduction to what the heck is "indistinguishability obfuscation":
https://zeroknowledge.fm/podcast/375/
#cryptography

2025-09-06 09:33:09 UTC

- reply

How does tx relay over nostr help with censorship resistance? Genuine Q, I'm curious.

2025-09-06 09:23:04 UTC

- reply

How reliable is Orbot nowadays?

2025-09-05 15:18:51 UTC

- reply

Ok that makes sense, but to be clear, you are saying it doesn't include stablecoins, right?

2025-09-05 14:55:46 UTC

- reply

Is stablecoins treated as a separate category?
Was never really sure of the definition of "defi".

2025-09-04 18:32:47 UTC

- reply

I guess we need a culture that makes anon accounts desirable. On the other hand, we don't even have any emphasis on network level anonymization here, so your point stands...

2025-09-03 19:54:25 UTC

- reply

There has to be a really strong motivation not to be in a client-server relationship. Bitcoin and bittorrent both have/had that.

2025-09-03 18:59:51 UTC

- reply

Yeah, at least, use something that isn't my normal email 😆

2025-09-03 15:25:19 UTC

Can anyone top this? For pure spamming audacity, the award has to go to Argentina's budget airline "Flybondi". After taking one trip with them 2 months ago, they have never failed to send me less than 2, and sometimes up to *4* emails every single day, with always different but always bullshit titles trying to sell me some rubbish or other. Congratulations. (I know that one just drops these in the spam folder, but I can't help waiting for a bit longer to see just how far they go).

2025-09-03 11:06:54 UTC

- reply

Yes. The tough question is, indeed, if you want to do larger purchases but also stay kyc free, it's nearly impossible in today's world. Note that that doesn't imply it's worthless to stay kyc free. But then also note that staying kyc free totally, could make certain purchases impossible. No easy answers; even the lazy answer "always use kyc" will carry its own, separate, risks.

2025-09-03 10:10:09 UTC

- reply

You may not find every topic discussed interesting, but if you're at all "involved" in Bitcoin at a technical level, or learning about it (as literally everyone is), this is hands down the best podcast out there.
#nevent1q…jwgx

2025-09-03 10:02:52 UTC

- reply

Tax and house purchase are 2 different things right. For the latter, I can only say that I know that in several countries, providing evidence for the source of funds is, nowadays, a requirement. But it doesn't need to be perfect evidence, just, evidence that is plausible enough for e.g. notaries, lawyers. I *think* this is true (nowadays) across basically all "developed" countries, but I'm not sure.

2025-09-02 14:04:24 UTC

- reply

Oh, repeat payment without communication. I was just thinking of p2p payments.

2025-09-02 13:34:26 UTC

- reply

Sousveillance

2025-09-02 12:44:33 UTC

- reply

Well you shouldn't have to hand over xpubs, right. Software should be able to let you get a fresh receiving address.

2025-09-02 10:25:52 UTC

- reply

Re: exchanges, they were forced to use this policy, generally. It's not laziness, like it was 10+ years ago. Re: hardware wallets, that shouldn't be a problem, we have watch-only with xpubs, right.

2025-09-01 21:17:31 UTC

- reply

Fantastic.
Also that thumbnail reminds me of modelling xenon transients with an analog computer 😄

2025-09-01 19:27:01 UTC

- reply

Wow, this is a very interesting direction to take!
#nevent1q…26jx

2025-09-01 14:20:44 UTC

- reply

It was a logical conservatism, as well as the patent, I suspect. ECDSA had already been deployed on the internet for a while by then. Worth noting that bitcoind originally had an openssl dependency because of this, which it took years to get rid of.
Not downplaying the patent though, it was indeed the root cause of all the mess.
And if he was 100% conservative, why choose secp256k1 and not secp256r1? That's not easy to explain.

2025-09-01 10:39:38 UTC

- reply

Nice to see Adam talking sense there.

2025-09-01 08:29:49 UTC

- reply

I didn't know you were a 4000 year old pharaoh!

2025-08-31 19:38:52 UTC

- reply

Cost basis zero is always an option, and afaik is not uncommonly used if you don't have good evidence of a nonzero cost basis. (Although to get better discussion it's a good idea to mention what country you're in!).

2025-08-31 15:02:21 UTC

- reply

It's Sunday though!

2025-08-26 20:46:23 UTC

https://youtu.be/Xd2qBs-hscU
This guy has a great dry wit!

2025-08-24 08:54:51 UTC

I have no idea if Liam Egan's Glock will be realizable, but it might be the closest I've seen anyone claim that they can do "it": fully general offchain contracting, converted into onchain verification with just a signature. I say closest, because it's still fraud proof based, which you can say is less pure than batched onchain verification (though it's debatable).
https://groups.google.com/g/bitcoindev/c/g_-Tfmjz0pw
#cryptography #bitcoin

2025-08-22 00:40:22 UTC

- reply

Should I know what you're talking about? (Serious question!)

2025-08-19 23:53:25 UTC

- reply

That's completely false.