קשה להסביר נדירות יחידה במינה וביזור שאין כמותו בלי אמון בצד שלישי יופיו בפשטותו טכנולוגיה מהפכנית קסם של האינטרנט וקסם של קהילה יש מעטים שמבינים נאה כמותו עוד לא ראיתי מימי.

🚨Warning: This is not only hitting us. Same hacking campaign is also standing up fake sites for: @fold_app @PhoenixWallet They then trick people into installing malware that hands the attacker remote control of the pc.

🟥 URGENT: Critical vulnerability in Core Lightning Blockstream developers urge users to shut down CLN Lightning nodes right NOW! Please let everyone know!

אנשי הביטקוין #211: אביב בר אל על הפורק שלא היה אביב בר אל חוזר עם פרק בחדשות הביטקוין והפעם על BIP-110- הסיפור המטורף על לוק דז'שר, ופלנגת לוחמי הספאם שלו, שאסרו מלחמת חורמה על בעיה לא קיימת- הספאם ש(לא) מציף את רשת הביטקוין, ואיך המלחמה שלהם הובילה לפורק העצוב ביותר שראו המאבקים על הרשת- פרק מיוחד למי שמעניין אותו באמת איך מתקבלות החלטות בפרוטוקול המבוזר של ביטקוין ומה קורה שמנסים ללכת נגד הקונצנזוס ברשת. לצפייה והאזנה עכשיו 👇 🎥 יוטיוב ◀️ youtu.be/w_vr0GctzzI 🌐 באתר האיגוד ◀️ tinyurl.com/3zkvc2mj 🎧 ספוטיפיי ◀️ tinyurl.com/4wwxetjd 🍎 אפל פודקאסטס ◀️tinyurl.com/2uzwzttj @Aviv__BarEl

tl;dr: @lukedashjr decided to use a testnet4 block hash as the random beacon to pick BIP-110-chain's new PoW function. An absolutely batshit decision. It's clearly possible to manipulate that by just mining blocks with the right hash. Mining a testnet4 block has a trivial cost. So mining one with a specific last byte in the block hash – thus forcing a particular PoW choice – also has a trivial cost. When Zcash did something similar for a trusted setup, they picked a Bitcoin block in the future, and they specified that the block hash would in turn be re-hashed 2⁴² times¹ to ensure that absolutely no-one could possibly pick the value in advance (that's a 2-3 weeks of sequential computation). There's two possibilities here: 1) Luke is incompetent. 2) Luke is malicious, and is trying to pick a specific PoW. The possibilities are not exclusive. 1) zips.z.cash/protocol/protoco…

מה צריך לדעת על BIP-110? כדי להבין את BIP-110, צריך לחזור לפברואר 2023, אז הציג קייסי רודמור (Casey Rodarmor) את פרוטוקול Ordinals. הפרוטוקול מאפשר לשייך מידע (כמו תמונות או קבצים קטנים) לסאטושי בודד באמצעות טרנזקציות ביטקוין, ובכך למעשה יצר את ה־NFTs על רשת הביטקוין. מאז, השימוש ב-Ordinals ובפרוטוקולים שנבנו מעליהם, כמו BRC-20, הוביל לעלייה משמעותית בכמות הטרנזקציות שאינן מיועדות להעברת ערך בלבד. יש הרואים בכך שימוש לגיטימי ב-blockspace, בעוד אחרים טוענים שמדובר ב"ספאם" שמעמיס על הרשת, מגדיל את הבלוקצ'יין ומייקר את השימוש בביטקוין כמערכת תשלומים. כאן נכנס BIP-110. ההצעה ביקשה לבצע Soft Fork זמני שיחסום סוגים מסוימים של טרנזקציות שמזוהות על ידי תומכי ההצעה כטרנזקציות ספאם או ככאלה שמטרתן העיקרית היא אחסון מידע על גבי הבלוקצ'יין, ולא העברת ביטקוין. תומכי ההצעה טענו שביטקוין נועד להיות כסף ושיש להגן על הרשת מפני שימושים שאינם פיננסיים. המתנגדים, לעומת זאת, ראו בכך ניסיון צנזורה של טרנזקציות "רעות" והאמינו שרשת הביטקוין לא צריכה לחסום שימושים גם אם הם מהווים ספאם. אחד הנושאים השנויים ביותר במחלוקת היה אופן ההפעלה של BIP-110. חלק מהתומכים ביקשו להפעיל אותו באמצעות UASF - User Activated Soft Fork - כלומר, באמצעות משתמשים ומפעילי צמתים, גם ללא תמיכה רחבה של הכורים. לעיתים השוו את המהלך ל-SegWit, אך ההשוואה אינה מדויקת. אמנם בשנת 2017 הוצע UASF, אך בפועל הוא מעולם לא נכנס לתוקף. לפני מועד ההפעלה, הכורים החלו לאותת בעד SegWit, והרשת הגיעה לקונצנזוס ללא צורך להעמיד את מנגנון ה-UASF למבחן. במקרה של BIP-110 המצב היה שונה. ללא תמיכה רחבה מצד הכורים (שרק כ-2.6% מכוח החישוב תמכו בהצעה), רוב מפתחי Bitcoin Core או הקהילה, הניסיון להפעלת UASF הוביל ב-8–9 באוגוסט 2026 לפיצול רשת (Chain Split). אולם הפיצול הזה קרס כמעט מיד: השרשרת החדשה גייסה כוח כרייה אפסי, הצליחה לכרות שני בלוקים בלבד (961,632 ו-961,633), וקפאה לחלוטין בשל קושי הכרייה הגבוה שנשאר מהרשת המקורית – עד שננטשה כליל תוך זמן קצר. אחת הטענות המרכזיות נגד BIP-110 הייתה שמדובר למעשה במירוץ חתול ועכבר. גם אם נחסמים מנגנונים מסוימים שמאפשרים להכניס מידע לבלוקצ'יין, סביר שמפתחים ימצאו בעתיד דרכים חדשות לעשות זאת במסגרת חוקי הקונצנזוס. בנוסף, יש הטוענים שביטקוין כבר כולל מנגנון טבעי להתמודדות עם ספאם: שוק חופשי של עמלות. כל מי שרוצה להשתמש ב־blockspace, בין אם להעברת ביטקוין ובין אם למטרה אחרת, חייב לשלם עבורו עמלות. ככל שהביקוש ל־blockspace עולה, כך גם העמלות עולות, והעלות הכלכלית של יצירת טרנזקציות בכמויות גדולות גדלה בהתאם. לפי גישה זו, אין צורך לקבוע אילו טרנזקציות הן "טובות" ואילו "רעות" - כל עוד הן עומדות בחוקי הקונצנזוס ומשלמות את מחיר השוק עבור המשאב המוגבל. בסופו של דבר, הוויכוח סביב BIP-110 הוא הרבה יותר מוויכוח טכני. הוא מעלה שאלה עקרונית: האם ביטקוין צריך לאכוף את ייעודו כמערכת להעברת ערך בלבד, או להישאר פרוטוקול חסין צנזורה שבו כל שימוש שמתבצע בהתאם לחוקי הקונצנזוס ומשלם את מחיר השוק עבור ה־blockspace לא צריך להחסם? כפי שהוכיח כישלון הפיצול והחזרה המהירה לשגרה ברשת הראשית, ל-BIP-110 לא הייתה תמיכה מספקת כדי להפוך לחלק מביטקוין, אך הדיון סביבו מדגיש מחלוקת עמוקה על עתידו של הפרוטוקול ועל האופן שבו נכון לנהל בו שינויים. תודה @Aviv__BarEl

If you spent $1 million per day since Jesus was born, you would have spent $740 billion. US national debt just hit $40 Trillion.

There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds. Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer. If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.

To give some perspective of how AI tooling has also accelerated defender capabilities: Before this year if I wanted a comprehensive external pentest & code audit I was looking at $50K - $100K and a month to receive the report. Now I can do it for $1K in 1 day.

I have spent over $10,000 scanning 100+ bitcoin ecosystem related libraries looking for vulnerabilities with Kimi K3 running as quarterback. Myself and a small "Red Team" have found multiple serious vulnerabilities impacting the ecosystem. They vary in scope severity, but this is a call to action. For any critical tier vulnerability that was identified if I was able to immediately demonstrate a POC (proof of concept), I have already responsibly disclosed to the maintainers. HERE IS HOW YOU CAN HELP ME IF YOU ARE NOT TECHNICAL: - please share with me any repository that is on github that I can scan, we want to cast a wide net. It takes a few moments for you to link github accounts, we'll take it from there - if that project does not have a SECURITY.md make an issue asking the dev to list one IF YOU ARE TECHNICAL: - If you are a maintainer or contributor to a project, I may have already scanned your repo, hit me up I'll share the results, if not I'll add your project to the list. - If I can trust you to do larger review to start looking through this stuff to give me more eyes let me know. AI Has forever changed software development. Tomorrow marks 1 week of Kimi k3 being live in open weights. We are going to accelerate.

JUST IN: Dustin Dettmer (@dusty_daemon) digs into the COLDCARD firmware commit history to uncover what actually happened in the code to introduce one of the worst bugs for self-custody in recent bitcoin history open.substack.com/pub/btcpp/…

Only a matter of time before phishing emails claiming to be security notices from Coinkite start going out; they will be trying to trick you into entering your seed phrase into a malicious web site. Don't fall for it!

speed is of absolute importance. act swiftly, this can’t wait. you don’t have another hour to check your wallet. if you’re affected and your bitcoin isn’t stolen yet, it’s guaranteed to be stolen soon. the attackers are racing against you.

COLDCARD Mk3 Security Advisory If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk. Mk4, Q and Mk5 are not affected based on our early analysis. Read the advisory and migrate carefully: blog.coinkite.com/coldcard-m…

“...and no one commits to stopping them.” In Bitcoin, committing to stopping a change generally just means continuing to run the software you are running. The supermajority of nodes and 99% of miners are continuing to run Core. That's committing to stop BIP-110.

On the filter fork topic. I don't usually have time, but this morning listened to one of the twitter spaces from earlier in the week, with some well meaning relative bitcoin newcomers, that humanized them, and their concerns and thoughts for why they thought that made it logical to support 110. My feeling after listening, is if these are the people with #110 in their handles, I'm sad to see them about to fork off and get disillusioned without understanding why bitcoin rejected 110 robustly. So here's a more empathetic, constructive higher level version of explaining why not. I hope it's high-level and first-principles enough that everyone can follow. They seem to want to understand what makes people tick, and are suspicious of intent. So, if someone asked me why is Bitcoin important and what is it, I'd say my (personal) mission and hope for bitcoin is to build the cypherpunk future, that "Snow Crash" was a blueprint, and work backwards from there. Bitcoin I hope leads to fully free markets via bearer unseizable, hard mathematically dependable money. Not everyone is comfortable with that level of freedom, but that's my view. And at this point, I believe that surprisingly, even now many governments have come to understand and value bitcoin's gold-like mathematical assurance, a positive development. Others may have milder views than myself, but still like hard censorship resistant money. Because of motive suspicion, if it's not obvious: I hate spam with a passion, that's how I came to design hashcash while researching decentralized bearer money with others, and running nodes in privacy related cypherpunk p2p networks nearly three decades ago. People seem upset about the default op return policy change in bitcoin. I will just assert, there are extremely robust and simple reasons for bitcoin changing default relay policy, and most just didn't do their research, so don't know what those are, or maybe not technical enough to fully understand though there have been 1000s of posts trying to explain in various simplified ways. So that lack of understanding lends itself to shared build-up of false narratives. So here's my back-to-basics higher level explanation. The decentralization needed to create cypherpunk money has implications a: side effect of decentralization is that you can't impose your views on others. The very decentralization mechanism that helps that, is working against what BIP 110 wants, which at it's most basic is a quest to police other people. I understand supporters don't see their intent like that, but introspect deeper. You can modify your software, but not anyone else's. Another critical and incredibly robust technical bitcoin immune system is bitcoin can't have people who don't understand technology basics insist on eroding security, decentralization robustness and core properties. That would end badly, fast, and so people will fight you on that. So the message is Bitcoin respectfully says "no" to what you want. Sorry, and bitcoiners do genuinely understand and empathize that you mean well, have high level thoughts that make emotional sense, and articulate sensible bitcoin-defensive high level ideas, but they are not grounded and without you seeing it, the way you propose to achieve your ideas, hard-conflict with free cypherpunk permissionless money. My advice is to listen to more experienced people who understand the system and why it works the way it does, to whatever detail you want to understand the grounded reasons for why this is the implication of decentralization and cypherpunk money. I guarantee you the developer and protocol ecosystem shares and exceeds your views on bearer hard money (and dislike of spam). You may not agree with individual developers choices, views, way of expressing themselves etc, BUT you also need to understand the IETF-like decentralized technical consensus process creates a protective change resistance, that is highly effective at protecting bitcoin mission. The implication of which is no developer can change anything without technical consensus from hundreds of other developers and protocol observers who are pedantic and extremely knowledgeable clever people who won't let any unaddressed technical question past. The protective change resistance is robust and decentralized in an amplifying way because of this technical consensus. And the many highly technical mainline developers' cypherpunk mission mindsets are probably far more determined than you can even handle on clarity of understanding and views about freedoms on permissionless networks, as many of you are probably still subconsciously inured by the matrix, where they have transcended that, and grew up immersed in it decades ago. They think natively in this space, while you are just grappling with the surface. Many wont have internalized or have the experience to know how this internet physics works, where there is no policeman, no policy authority, just mathematics, free market and hard money. That has implications for your views also, unfortunately. Now the tough pill, which is unfortunately true: If you won't listen to reason, educate yourself, learn, the same radical freedom applies to you: your permissionless recourse is to club together and create a fork. But bitcoin won't be joining it. (With respect and no sleight intended.) Please rejoin bitcoin now, or later if you're not convinced and need to experience 110 forking off and fizzling for yourself to start that journey of introspecting and learning. It would be sad if bitcoin lost people disillusioned due to simple lack of understanding of what's going on there, we're all trying to defend bitcoin and keep it on mission. Including btw the 110 technical promoters, just they wandered off plot somehow. Join the cypherpunks on bitcoin, come cypherpunk summer🌞 in a few weeks.

#Bitcoin is money controlled by no one, and available to everyone.

F

bip110 is well-intentioned but naive. if there was a reliable way to stop spam, I would support it. there is none. the only decentralized spam prevention method known to us is proof of work. it's sad, but math doesn't care about your feelings. get used to it or get rekt.

BitMEX Research just published a counterproposal to BIP-361. Don't freeze any bitcoin unless someone proves the quantum threat is real. The mechanism is a "canary fund." A special address is created where no one knows the private key, but the public key is published. Any spend from that address is cryptographic proof a quantum computer broke Bitcoin's signatures, and it automatically triggers a network-wide freeze via a pre-loaded soft fork. Users can donate bitcoin to the canary through a 1-of-2 multisig, where one key is theirs and the other is the canary. This creates a growing bounty that incentivizes whoever builds a quantum computer to prove it publicly rather than quietly drain wallets. There's also a safety window, quantum-vulnerable spends would be allowed but locked for roughly one year. If the canary triggers during that window, those coins freeze retroactively. The catch: this assumes the first entity capable of breaking Bitcoin will claim a bounty rather than steal millions of BTC. If that bet fails, Bitcoin gets the catastrophe it was trying to prevent. BIP-361 trades freedom for safety on a fixed timeline. The canary trades safety for freedom until the threat materializes. Neither is perfect. Both force the same question, how much of "your keys, your coins" are you willing to sacrifice for quantum insurance you might never need?

A while ago, we've held a "quantum night", where we discussed how quantum computing could affect Bitcoin, and what can be done about that. We have now published the videos from that event. Subtitles are available for all videos, and it is recommended to use them.