Is Bitcoin Compromised? - Luke de Wolf | Ep. 156
00:00This is not an open source software by any stretch of the imagination the way it's currently run.And there's a clear pattern of that someone makes a change who is affiliated with one of these organizationsand if there's any pushback to that, that there is sustained opposition to whoever has pushed back,even if they're technically wrong.And this is absolutely the most controversial topic for those in the know.I did read Hodlnot's latest articles about the developers, the core structure,And I must say, I find it very disturbing.I'm with you on that.
00:32From my perspective, Bitcoin was made really, really much less usable as money for a certainperiod of time until this frenzy died down.The community collectively came in and said, we are not having this.The only thing that we really can't defend against is complacency.If everyone is complacent and decides not to take any action, that's how Bitcoin dies.Bitcoin is the only hope civilization has for getting out of this fiat trap.The great thing about mining is that anyone can participate.You can't say that someone's not allowed to do that.
01:03That's the beauty of a permissionless system.Bitcoin is resilient, but it's only as resilient as the individuals who make the decisions to keep it resilient.end hello and welcome to another episode of you're the voice from ireland i have the honorof being here with luke de wolf hey luke how are you hey f red i'm great thanks so much for havingme glad we could make this work i know me too thank you for joining me we're gonna do a veryinteresting episode today we're going to talk about and this is by the way our second episodetogether so for those of you who haven't seen the first one i don't remember the number i will putit in the show notes go check out our first episode together with knut as well it was really
01:55fun i want to talk today about your new book that's coming out soon how soon it'll releaseat btc prague so maybe if this is out after that after so it's already been released by the timewe have this out. June 15th. June 15th. Defending Bitcoin. This is the book. We're going to have alink to it as well so that people can purchase. This has been published by your own independentpublishing house as well, right? Can you say a few words about that? Like what made youhave your own publishing house? Correct. Absolutely. So Lemniscape Media is the publishinghouse. And basically Knut and I were working with another publisher and that ended up not workingout. And we needed to take Knut's books off and publish them independently. We ended up re-editing
02:41all of Knut's books together. Little things, just a little mechanical edits, this and that.And we re-released all of Knut's books under our own imprint. Then Knut and I wrote Bitcoin,the Inverse of Clown World together. And that was a lot of fun. And since then, we've been workingwith a few other authors. The publishing house is a little bit of just a, I call it a publishinglight model. We know all of the things that authors need to do in order to get their book printedand distributed through things like Amazon or big printers, things like this, everything that wefigured out. And so we just basically take other authors through that process and make it as easyas possible. And we don't charge an arm and a leg for the service, just basically what we consider
03:25to be worth. So it's Bitcoiners helping Bitcoiners. Max Hillebrand's Praxeology of Privacy is theother one that we've just put out recently, also Roger 9000's book, The Beautiful Balance ofBitcoin. We've re-released a new version of Yoni Appelberg's Abundance Through Scarcity.So we're helping out a lot of authors. And we've also got Larry Lepard's The Big Printon our web shop as well, and a couple of others. So yeah.So authors that want to use your services for that, they can do that. They can approach you.Exactly. You can contact us through various mechanisms, Twitter DMs or telegram signal,whatever. We're approachable. That's it.
04:04You are approachable. Okay, great. So I just wanted to sort that out before we began.Can you give our audience just a bit of your backstory, personally, where you're from,what got you into security, cybersecurity, and then Bitcoin? And, you know, we'll getto the book soon, but I want to start with that. Yeah, absolutely. And great place to start. Somy background is that I'm from Canada originally, but more specifically Alberta, that has somenuance there. Alberta is the province in Canada that has the oil and gas sector primarily. There'salso, there's oil and gas in other parts of Canada, but that's where the center of the industry is.So that's where I grew up and that's where I went to school. I went to school for computer science
04:48at the University of Calgary. And through that, I was learning to code, software development,this sort of thing. I really had no idea what to do with my life. So I figured, let's try and finda marketable skill and learn that. That's what I expected to be doing. But I lucked out and I gota fantastic internship at an oil and gas pipeline company. And I was working with their monitoringand control systems for the oil and gas pipelines. So these are what are called industrial controlsystems or operational technology. Operational technology is in contrast to informationtechnology, IT. So OT is kind of the counterpart to IT. And it's everything that runs factories,electrical grids, pipelines, anything that interacts with the physical world. That's OT.
05:38Anything that interacts with primarily the digital world would be information technology, IT.so this is to work for a drone company in mining like real mining yeah so i know of operationaltechnology from there because our drone was used to surveil mines and do mapping of the mines andthings like that so exactly exactly so the the the whole thing there is i spent my entire careerit's over a decade at this point working with that type of technology and it's a totally differentworld. It's got different priorities than, say, keeping an IT system running and secure. So Ishifted into doing cybersecurity for that field about four or five years into my career. It's beensix, seven years now that I've been focusing on security specifically, but I've spent my entire
06:27career working with these industrial control systems in various degrees. And the relevancehere is that my background is thinking about systems that keep the world running. You canthink of that as critical infrastructure. There are formal definitions for critical infrastructure.Those things, every country basically has their own, but a paraphrase would be those things thatkeep society running. The lights on, the water flowing out of your tap, the things that you needto eat or to use every day that keep getting manufactured, right? Without this stuff,the world collapses so power plants or any types of uh reserves um anything that the country needsin case of you know just continue functioning and also in case of emergency it's it needs to
07:19continue functioning right that's right and the the funny thing about it is that first of all theunited states puts information technology it as one of these these sectors that's that's criticalAnd recently, what did they do with data centers becoming critical infrastructure, right?Well, and that's absolutely true.And there's an interesting tie into Bitcoin as well with data centers, that data centerskind of compete for the same computing resources, or at least electricity under the hood asBitcoin mining.But I mean, I think the good thing with Bitcoin mining is that those ASICs are still going
07:52to be existing somewhere.So something like a marathon shifting to AI as opposed to Bitcoin mining, I don't thinkthat's a huge problem. Someone is going to want those ASICs to be running and hashing to try andfind Bitcoin blocks. I think it's a great opportunity. It's not a problem at all. It's like we're freeingup all that stuff to the market. Let's decentralize even more. Exactly. I'm very pro-decentralization.Absolutely. Okay, so let's go back to critical infrastructure. So the tie-in to Bitcoin hereis that payment infrastructure is considered critical infrastructure in virtually everyjurisdiction right so your visas your master cards your banks there are so many different kinds of
08:32payment infrastructure and every country basically is going to consider that to be somethingessential and you knock out the ability to to pay for stuff i mean i mean we're in a society wherecash is no longer widely used at least in in the western world some some countries are a littlemore into it than others but yeah the trend is a little bit worrying right i think it was two threeyears ago there was a natural disaster in New Zealand if I'm recalling correctly I don't rememberwhere exactly in New Zealand where they had a blackout and I think it went on for about a weekor like anywhere between like four to seven days that's a long period of time and during that timeand they had no access to cash sorry they had no access to payments the only thing that really
09:19save them was cash and even that was limited because not every business or every place wouldnow accept cash so they it started becoming really ugly really quickly where you know society is kindof fighting each other and trying to survive um but cash was really a needed lifeboat at thatspecific situation and seriously like you know the power that shouldn't be don't think aboutthose kind of edge cases when it comes to you know critical infrastructure failing if we don't havethose alternatives in place we are going to find ourselves in really dark situations very fastand i think bitcoin is also prone to that problem because it relies as we know on digitalinfrastructure and electricity and so if that's out then we do still need alternatives so that's
10:14That's another thing to keep in mind.Just what you said reminded me of that.No, absolutely.Well, and the thing is, I covered that scenario in chapter 14 of Defending Bitcoin.And so the thing is, we'll maybe jump around a little bit in terms of the format.But the event of that the infrastructure underlying Bitcoin goes down, I mean, okay, you can havethe case where all of the electricity in the world goes out all at once.We've got bigger problems.
10:40Not very probable, right?Very low probability of that happening.Tired of feeling like your freedom and future are fading away?Do you live in a country with growing inflation, crazy housing prices, weird culture, and a chaotic economy?You're not alone, and my friend Mikel Thorpe and his team at Expat Money can help.Mikel is the world's leading expat consultant on a mission to free you from broken systems.He's been an expat for 25 years, lived in 9 different countries,and has helped hundreds of people with second residencies and passports,
11:12offshore banking international investing and many other essential tools if you're serious aboutprotecting your wealth and your family it's not enough to hope things will get better you needa plan b in another country the team at expat money can help you build it legally safely andwithout wasting years of research head over to expatmoney.com to get a free report on plan bresidencies and instant citizenships. This is an easy, free way to help support the show whilelearning how to protect your freedom with a plan B. That's expatmoney.com slash efad.Ever find yourself needing cash but refusing to sell your Bitcoin? That's real life for manyBitcoiners. Because most Bitcoin sales aren't financial decisions, they're liquidity decisions.
12:03And that's exactly what Ledin solves.Ledin is the global leader in Bitcoin-backed lending.They've issued over $10 billion in loans since 2018 with a perfect track record for protecting client assets.Here's what makes Ledin different.With their custodied loans, your Bitcoin collateral is not lent out to generate interest.No credit checks, no monthly payments, and no penalties for early repayments.You apply in minutes and you repay whenever you want.Ledin also publishes proof of reserves reports every six months with full transparency.
12:39So if your capital is in Bitcoin, but your expenses are not, you still have options.Ledin lets you unlock liquidity without selling your Bitcoin.Learn more at ledin.io slash Efrat and get a quarter percent off your first loan.That's ledin.io slash Efrat.Correct. Well, and maybe I can just lightly bring in some of the cybersecurity terminology here.This is what I've wanted to do with Defending Bitcoin, is to bring the cybersecurity background that I have, that I've been working in, with the Bitcoin that is now my focus.And cybersecurity is maybe a misunderstood field, I would say.The preconception that I think many people have of cybersecurity is like a hacker at a computer screen that's, you know, trying to get in somewhere or maybe someone is like working against the hackers and making sure they don't get in wherever.
13:36But the thing is, cybersecurity is actually a set of frameworks to understand risk.Cybersecurity is basically digital risk, the management of digital risk.And the world we live in today is effectively all digital or some kind of digital physical hybrid.so cyber security is is effectively just the management of of risk and there's a there's aformal definition for for what a risk is there there is a the risk is the combination of avulnerability and a threat so a vulnerability is a weakness in any kind of system that couldbe exploited by someone who has nefarious intentions and that's your threat so you haveto understand both sides here you have to understand who might be wanting to attack
14:20you or the thing that you want to protect and bitcoin is a big target of course yeah so thenyou have for those who don't know why and what we mean in case you are not a bitcoiner and i do havequite a bit of those audience listening it's because bitcoin is not governable it's veryhard to stop it it actually almost is impossible to stop it so it is a threat to institutionswho want to control money.Absolutely, absolutely.And then the next part here,what you were getting at in terms of probability
14:55is that the whole idea of riskis that you have to have the likelihoodof something bad happeningand the impact of something bad happening, right?And the combination of those two is how you rank risks.Is it more important to tackle the riskwith a high impact and a high likelihoodversus something with a low impact and low likelihood?
15:17that that should that should seem obvious but when you get into the middle ground like is this isthis is medium impact but it's going to happen fairly often okay we should probably deal withthat yes versus here's something that's high impact low likelihood where do you draw the linewhere you're going to deal with that that's how you basically do risk analysis analysis so meteorlanding on your on your city or your factory that's you can't do much about that right butyou can probably do something about losing power for a week something like that so so that's that'sthe the framework that that i'm i'm talking about here okay you found the chapter 14 i did grid andnetwork failures that's the chapter and then you go through the different types of risks that are
15:58under that the way the book is structured there's a first part that goes into the basics of thevocabulary from both sides of the table so i've got two chapters on bitcoin one bitcoin thetechnology and another bitcoin the money so i'm i'm coming from the the monetary side of bitcoinThat's my background and my way in.I've had to learn about the technical side of Bitcoin as I go.So I'm approaching the book for people who aren't necessarily technical like myself.And so I want a background, a vocabulary that everyone can share.Then cybersecurity is the same thing.
16:34Introduce the vocabulary and the framework of thinking that underpins cybersecurity.then i get into and introduce industrial control systems operational technology why they'redifferent and how cyber security is approached differently and i'll tell you the key differencethe key difference is that these systems need to stay running so the availability of the systemis the critical piece and with bitcoin it's the same thing keeping bitcoin running is what weultimately need to ensure. And so the main point here is that I've written with Defending Bitcoinis how we as individuals participating in Bitcoin can keep Bitcoin more secure and ensure itsavailability into the future. That's what Jeff always says. Let's keep Bitcoin decentralized
17:22and secure. That's like his signature sentence. Every time he talks about Bitcoin, as long asit's kept decentralized and secure. So what in a TLDR is your argument for how we keep thisdecentralized and secure? Great question. Well, the first thing is to understand what Bitcoinis, right? And your own personal Bitcoin is going to mean something different to you than Bitcoin,the network. So part one of the book was kind of this vocabulary tying this all together. And Ihave a fifth chapter that's tying those four vocabulary chapters all together into the thesisthat Bitcoin is critical infrastructure. Then there are 10 chapters on the threat categoriesto Bitcoin. And I don't want to make that sound like it's exhaustive. I'm writing a book here.
18:09It's got to fit in some reasonable number of pages. So it's 10 chapters and that's broadcategories of threats to Bitcoin, whether it's your personal Bitcoin or Bitcoin, the network.So the first three threat chapters are basically all about how you defend your personal Bitcoinand yourself. So exchange risks, the negatives and the risks of holding Bitcoin on exchanges.Then everything to do with self-custody. So this is a meaty chapter, as you can imagine.How do you keep your Bitcoin in your self-custody in a secure way? Then maintaining your privacy,because privacy is a thread that runs through the book, the entire book. Keeping yourself privatein the Bitcoin sphere is a matter of security because France at the moment is basically the
18:57hotspot for $5 wrench attacks is the common parlance, although the wrenches cost about $15at the moment due to inflation, something like this. But physically being attacked because you'rea known Bitcoin holder is absolutely a risk and avoiding doing so, being out as a Bitcoin holderis really important. And what do you do if you are a public Bitcoin figure? Because we're bothwe're both kind of screwed, unfortunately. We're public facing, right? So how do you keep yourselfprivate when people know that you hold Bitcoin, right? So this is everything focused aroundyour individual Bitcoin. Then going beyond is more about understanding the threats to the network,Bitcoin, the network. And this is all about understanding the interplay between
19:44nodes and miners and the governance structures with development. So the middle of the book isall about understanding how these groups interplay with one another and what are the specific threatsfacing, say, Bitcoin nodes and node runners? What are the specific threats facing mining? And I getinto mining decentralization there. That's a massive topic. There was a 24-hour period notlong ago where foundry was almost at 50 of the the blocks found that day right and later it wasn'tthe same day they had a essentially a small reorg that foundry did they held back stating that theyhad found a block and in the in the meantime another pool found a block but they found asecond one and they broadcast their new longer chain right and they ate the old block they made
20:34the old block disappear right so so they were able to take all the mining revenue from thosetwo blocks and effectively steal it steal it sort of from this other pool i think was ant pool whofound the the block in the meantime what can prevent that that's the thing is that the onlyway that this was possible or economical for them was because they had so much hash rate they couldkeep hashing in the background against the block they had already found yes and then when theyfound that second block they were able to broadcast both together so they didn't broadcast the firstone they continued straight away to find the second one we don't know something technicallythat you can do if you've got 30 40 percent of the hash rate sure you you could do that a 51
21:15percent attack effectively is just simply having enough hash rate that you're going to find onaverage more than one more than one out of every two blocks right and the the thing is a a doublespend is what a lot of people think is the big problem there. So a double spend is that you payfor something with Bitcoin, and then you pretend that you've moved the Bitcoin to them. And inreality, then you move it to an address that you still control. And the mechanism for doing thatwould effectively be that you control enough hash power to guarantee that your next blockwill override the the planned transaction that's right it's not it's not the simplest concept butyeah that's the the basics but having more than 50 of hash rate or even 30 40 of hash rate also
22:05gives you the power to to censor to say that i'm not going to include this list of transactions orlet these people from these addresses move their bitcoin right and if you've got half the hash rateokay well that means that on average you're going to have to wait 20 minutes instead of 10 minutesto get into the next block.That might not sound like a lot of time,but there's a lot of variationin how Bitcoin blocks get produced, right?A block could take an hour.
22:31A block can take two hours to find,to get your transaction into somethingthat isn't going to be censored.There are time-sensitive considerations here, right?But the other thing they can try to dois that they could try to keep constantlyhaving the longest chainso that they're the only ones
22:48that are producing Bitcoin blocks.If you have more than 50% of the hash rate,you could just keep on mining with only your chain and basically turn yourself into the onlyminer producing Bitcoin blocks, because that'll eventually be the longest chain out there. Wewould be in serious trouble if that were the case. Big, big risk. Yeah. Yeah, absolutely. So thething is, no one entity currently has 50%, but Foundry is at like 30, 30%. And if their luck ina 24 hour period gets them to 40, 45%, we're at some serious issues here where they have thecapability to do nasty things to compete with their other mining competitors right and so
23:25i'm not saying they're doing this but just by having that amount there was a case 2015 2016ghash.io where they had over 50 percent of the hash power it happened right it's ghash.io theythey're they're gone now they were a mining pool uh and they they essentially started up cloudmining effectively that you could you could just send your your hash rate to this pool made it veryconvenient at least for the era and they accumulated over 50 of the hash rate but the community thecommunity collectively came in and said we are not having this there was a fast reaction that saidwe have to go to other pools we can't let them have this much hash rate they didn't even wantthat it actually killed their business by accumulating so much hash rate they bitcoiners
24:14abandoned them quickly and the thing is the difference now compared to back then is thereis just so much more hash rate compared to nine ten years ago right miners don't necessarily movequickly between one pool to another and if we were to start to get the the main reason thatfoundry has so much hash power is that most u.s entities have to be regulated a certain way u.smining entities and so foundry is one of the the only options that many of these miners haveto be able to mine legally with such large mining operations.And so they collect almost all of the regulated, publicly traded hash power in the U.S.What is the probability of a 51% attack?
24:59I mean, I consider it quite low.I certainly consider it quite low.But the thing is, cybersecurity is not about the low probability things.You shouldn't take those into consideration.It's about what is the worst case scenario and what can you do about it.and i mean the the great thing about about mining is that anyone can participate right and it's it'sjust like running a node it's just like holding bitcoin anyone can do it you can get a bidax youcan get a a nerd miner you can get you can get a bitcoin heater where i'm living in finland it's
25:30it's cold most of the year not most of the year but uh i've so i've got a couple of bitcoin heatersthat heat my home during the cold months and i you can do remote mining with my sponsor abundantmines. Exactly. For example. And this is actually an interesting case here. There used to be theseso-called cloud mining solutions that were very scammy. You couldn't trust them. And they gave abad name to that type of mining. Exactly. But nowadays you can get mining hosting and it'sprovable that you're directing the hash rate to where you want it. I mean, Ocean is the examplethat that i use here absolutely you can just point your hash towards ocean then you get a nice littledashboard that shows all of the mining shares that you're that you're getting so so it's it's
26:17provable that you are actually taking control of the hash rate and and and if you're like me youcan actually drive or go to the mining facility and see your miners even though it's it's remotego check go verify it's there and then you have the dashboard and that's right it's working it'sfantastic and anyone can participate and the the capital needed to do that is is usually notso high anymore you can make a good profit off of off of bitcoin mining you absolutely can you canalso be near break even or even losing a little bit of money spending a little bit of money todecentralize the network to put your your will onto the network with your amount of hash ratewith your proof of work that's the idea and it's the same thing as running a node running a node
27:02you run your rules. You get to decide which of the relay policies or mempool policies you wantto run. If you are the one hashing your Bitcoin, and when I say this, I mean, if you are runninga system that lets you build your own blocks, you get to decide what goes into a Bitcoin block thatyou find. So everything comes down to, to try to get back to your original question, is the thingyou can do to ensure Bitcoin security is to keep it as decentralized as possible and do the thingsas an individual. There is always something you can do in every sector of Bitcoin security,whether it's to the individual stuff or to the network level stuff, or even dealing with politicsand quantum and AI. There's always something you can do right now. Always. That's what I maintain
27:49here. All right. And let's talk about another adjacent or similar type of threat, which is themining supply chain or the hardware side, because I know today that most miners, I'm not a miningexpert, but I do know that most of the mining companies have to rely on the same company whenthey buy their hardware or their chips. Can you talk a bit about that? Absolutely. And I certainlyconsider this to be a big threat, isn't it? Absolutely. Absolutely. I mean, the main reasonwhy this isn't something to get uh say yeah to think too worried about it right now yes it issimply that that the the hardware is throughout the world and there are these open source firmwaresthat you can put on top of of different uh mining hardware the centralization in terms of
28:41the actual foundries that produce the the chips that's a worldwide problem okay like like accessto the foundry time is one of the things that's driving up costs for computing in general.Not just in Bitcoin, but in general.Exactly, exactly. Consumer prices for memory, for CPUs, hard drives, these have all gonethrough the sky, partially because of the advent of AI, but also because of the scarcityof this foundry space, right? So the thing is, there's centralization in every step somewhere.Yep.and getting a new player into the market is so, so difficult, right?
29:22So it definitely is a problem that ASICs are manufacturedby only a couple of manufacturers at the moment,and I would love to see there be more competitors in that space.There was the ant bleed attack, or say, yeah, I mean,attack is a good enough word here.It was that in ant miners, there was effectively a backdoor that allowed the manufacturer to effectively run the ASICs a little bit hotter if they controlled them, if they were pointing to their pool.And when the community found out about this, this was all in the middle of the block size wars, basically, and had an effect on the adoption of Segwit and rejecting the proposals to raise the block size.This was all tied up in the same era.
30:10So the community did find this backdoor in the in the firmware running the miners. And I would say these days it's it's not so easy to put something so unknown. The Bitcoiners are tinkerers and there's a lot of companies that take the actual hardware and do things with them.So putting on, for example, Brains firmware onto your miner is a good way to at least have more control and more of an idea that your miner that you have is going to work, right?And using other, say, manufacturers, these open source mining solutions, that's another way yourself that you can take action to combat this centralization.you might think that any kind of action you take is going to be too small to make a difference,but it makes a difference for you. The only thing that we really can't defend against iscomplacency, right? If everyone is complacent and decides not to take any action, that's howBitcoin dies, right? So the only threat there's no defense to is not taking any defense. I shouldsay that more eloquently. Yeah. That's a very good way of putting it. Let's talk about another
31:26kind of risk or or threat that i'm sure you covered in the book and you will probably tellme the chapter number and page number it's all in my head right now yeah so the governance youtalked you mentioned it before so the governance model the devs i'm particularly curious about thegovernance model when it comes to vetting new developers and choosing them and why do we haveso few and who gets to say he's good he or she's good they're the right people we're gonna havethem as developers how does it work is it changeable can we change it can we have morelike what's going on there i don't even know how that whole mechanism works this is a deep topicand this is absolutely the most controversial topic for those in the know i did read huddle
32:17notes uh latest articles about the the developers the the core structure and i and i must say i findit very disturbing i i'm i'm with you on that and the and the the thing is so you're the voice isbrought to you by trezor the original bitcoin hardware wallet company pioneering the developmentof self-custody for crypto assets since 2013 empowering individuals with an open source deviceenabling beginners and experts to easily and securely hold their coins i find my treasuresuper easy to use and recommend it to my friends and family enjoy my five percent discount ontreasure product by clicking the link in the show notes and using the code flat i want to introduceyou to abundant minds because they take a very different approach to bitcoin mining most people
33:07buy bitcoin but the smart ones mine it straight into self-custody with abundant minds you can doit without giving up your privacy. Abundant Minds was founded by Bo and Christine Marie Turner,a couple who lost more than half a million dollars to providers making empty promises.Instead of walking away, they built a company that raises the industry standard and puts clientfirst. And that's why I like them. With Abundant Minds, you own your machines. They never touchyour Bitcoin, never skim a revenue share, and you choose your own mining pool. Their customer careis unusual, clients speak to a real person for self-custody education, privacy consulting,and even visiting their site. They serve clients from around the world, but U.S. investors
33:55specifically enjoy a big tax benefit and 100% bonus depreciation. This is more than just miningBitcoin. It's about freedom, privacy, and purpose. You can book a free strategy call, see how itworks and mine some of your first Bitcoin for free with a special offer for my audience.Learn more on AbundantMines.com slash effort. Defending Bitcoin is not only for Bitcoinersthat are in this inner circle. I want to make all of this clear and accessible, but this wassomething that I couldn't justify not covering. This is absolutely something that's going onthese days and is a concern. So I have two chapters that basically tie into this.Where? Where do I find?
34:40Chapter 11 is on arbitrary data.And witness abuse.And we need to start with that chapter a little bit to understandhow the governance problems have started to emerge. And so they flow into each other. Thenext chapter, chapter 12, is about the governance structure and the governance risks.Right. Yes.But the arbitrary data, if I want to try to condense this a little bit, is basically that certain changes and decisions were made that made Bitcoin more vulnerable to arbitrary data coming on chain.Yes.
35:14And my take on arbitrary data is a little different from some others that you might hear.Okay.Some in the community are more concerned about arbitrary data for that it's increasing the requirements on node runners to have larger hard drives, to have more RAM, to be able to run their nodes.And that is absolutely a concern.That's a real thing, especially since we just talked about there's a scarcity of memory, of hard drives, all this.The prices are going up.So the price to run a node has gone up for sure.That's true.
35:44and the the less decentralization we have in terms of running nodes that's a negative thingif a node runner if an individual chooses to turn off their node because they've run out of harddisk space and they don't have the funds to get a new hard drive something like that well that'sone less node one less piece of decentralization that we have and it's cumulative this is all kindof death by a thousand cuts territory right it's where we're going directionally is bitcoin in astate of more nodes coming online or less. And it's hard to say. I mean, I'm not going to callthis overblown. I think more node runners are being minted all the time. New Bitcoiners getthe conviction to run a node. And that's a good thing. That's what I advocate for, for sure.
36:29But increasing the demand on node runners makes it more expensive to do. And some of the choices,specific choices around Taproot in particular, made it so that Bitcoin was more vulnerable toto this kind of arbitrary data now i said i take a different approach to why this is a problemso in 2023 2024 the the fees just went ballistic exponential uh overnight almost and this was atthe advent of ordinals when the ordinals protocol came out yep and there was just a flood of peoplefrom the crypto space who came on to bitcoin and wanted to make a buck off of these nfts and tokensand things like this but yeah so i'm against this stuff from a perspective of that this makes bitcoinworse as money that this stuff is all it would be great if this all just stayed on ethereum or one
37:20of the other cryptos that would be fantastic but the problem is that those transactions thosenon-monetary transactions were directly competing with all the monetary transactions it was makingthe system less available yeah pushing down in priority monetary transactions well and and eventhe thing was it was making them more expensive, right? So the thing there is that from a criticalinfrastructure cybersecurity perspective, what we talked about at the beginning is that availabilityis the critical point for these sorts of systems. And my argument is that this arbitrary data wasmaking Bitcoin less available as money. Raising the cost, it's the same thing as a DDoS attackor a spam attack. I mean, I consider this stuff spam, but email spam. You go back to one of the
38:04precursors to bitcoin adam backs hash cash right this was a solution to getting too much email fromwherever because the cost of sending email was super low and then you have all the spam in yourinbox and adam came up with a system to deal with that it proof of work he wasn't the originator ofproof of work but it had been originated a few years prior right and this is one of the systemsone of the only things that is specifically referenced in the bitcoin white paper is proofof work. Proof of work was originally a spam prevention system. And it still is. So themechanism for Bitcoin transactions as being a fee market, this is one of the arguments why thisarbitrary data stuff isn't a problem, is that the fees eventually equal everything out, right? That
38:50they are spending their sats, their money, in order to get into a Bitcoin block. And it shouldn'tmatter what their purpose is, right? Now, I agree with that. As long as you're not putting dataonto the chain right and that creates a different pressure that that means that there are fewertransactions that are be able to be in any any one block right there's a scarcity of block spaceover time a block every 10 minutes means there's a certain number of blocks that are going to befound over a course of a person's lifetime even you can think of it that way right so if you can'tget into a block at a certain fee you either have to pay more or you have to to wait and for thatyear two years it went well into it was february 2023 to well into 2024 that fees were really
39:35really high 30 sats per v-byte was about the floor for a long time and it was in the hundreds andthis translates to dollars per transaction fifty dollars a hundred dollars per transaction at theabsolute peak the worst of it right yeah yeah like for some people that's going to be fineif you're moving a million a million dollars worth of bitcoin a billion dollars worth of bitcoin butIf you wanted to move $1,000, $500, $100, less than that, so many parts of the world would have been unable to transact.And so the people who were already on Lightning or other second layers, you were kind of insulated from that at the period of time.But if you weren't, the cost to open a new Lightning transaction was really high.There were delays in getting your money into services like custodial services like Wallet of Satoshi, for example.
40:24So from my perspective, Bitcoin was made really, really much less usable as money for a certain period of time until this frenzy died down.Right.And what I come back to is that cybersecurity isn't about what's the situation now.It's about what if this happens again.And there's always a risk that someone is going to create a new frenzy on Bitcoin for tokens or images.So how do you link that into the devs and the governance?Okay.So this is where things get a little bit sticky.
40:51The Taproot was launched with two vulnerabilities that made Bitcoin susceptible to this stuff happening.So one vulnerability was that TapScript, Taproot is two things.Taproot is Schnorr signatures, which is the Taproot address type.And it's the type of signature used in order to make most transactions look really similar.This is the privacy improvement of Taproot.At the same time, they introduced TAP script, which is a new type of Bitcoin scripting that is theoretically more able to do more things and a little bit more, say, powerful in a certain sense.There's no real reason from what I understand for the two of those things to have been introduced together.They didn't need to be introduced at the same time.
41:37And TAP script didn't include a cap on the amount of data that you could include with that scripting system.And at the same time, the mechanism for inscriptions uses a particular Bitcoin scriptcalled op false op if. So if you know a little bit about programming, if something is falseunder a branch, that means it's not going to execute. So in Bitcoin script, if you have anop false, that means everything after that isn't going to be executed. It's not going to do anythingon chain, right? But then they realized that you could just then put a new block of dataright underneath that false. So that Bitcoin is not going to care about that, about that data,but you can still put as much as you want on chain up to the transaction limit. So these two things
42:22together made it so that the inscriptions, so-called inscriptions that Ordinals uses,were able to get onto Bitcoin in a much more easy way. So I'm again, pulling it back to thegovernance piece. Luke Dash Jr. argued, okay, actually, I'm going to pull this back one stepfurther. First of all, just taproot being released without some checks on these two particularsystems, that's a problem in itself. There's an argument for sure to be made that taproot justneeded some more time in order to be released without, say, these vulnerabilities. 99% oftaproot outputs are dust, right? And the reason for that is that these... Can you explain whatdust means yes yes yes the reason that these spam transactions uh they they use as little satoshis
43:11as little bitcoin as possible in order to to spend the least uh to get on on chain so dust is thethe definition of the dust limit is the the minimum amount of bitcoin that could reasonablybe spent that's effectively what this is and dust is a is a relay policy you can technically uh havea UTXO of almost nothing. Almost no Bitcoin could be on there. But all of the node implementationshave agreed that there should be a minimum limit of Satoshis. And it's needed. Core developersall agree that this is absolutely needed because there are a lot of attacks that are possible ifthe dust limit was didn't exist so you'll find that so many of these transactions are 100 sats100 200 300 sats something like this there's specific levels where they ratchet up and so
44:07they're hardly anything they're worth almost nothing and then they've got some kind of pictureor token or something like that attached to it over 99 of outputs measurably from taproot arethis kind of arbitrary data yes so if we're talking about outcomes yes taproot has had theoutcome of just putting a ton of arbitrary data onto Bitcoin, increasing the demands on noderunners and making Bitcoin less usable as money. So that's the result. So my argument, first ofall, is that Taproot just needed some more time so that it could have been released without thesevulnerabilities. Then the thing is, Bitcoin core developers argued that these weren't reallyvulnerabilities. So Luke Dash Jr. submitted these two issues as the system is called CVE,
44:51common vulnerabilities and exposures. This is a cybersecurity database where any kind of bug issubmitted. Exactly. So Luke Dash Jr. submitted there and said that here are these problems andhere I have a fix to this solution. So one bottom line here is that Bitcoin Knots hasfixed these problems. If you run Bitcoin Knots, these two issues are patched. Okay. Bitcoin Knotsdoes not relay transactions that include these issues and it does not allow for for a tap roottap script to have more data core declined to implement these fixes so the justification theygave is legitimate in in a certain sense and i'll i'll explain here it's completely legitimate tohave a vulnerability and say that the means for fixing that vulnerability we don't agree is feasible
45:46We don't agree that this is going to work. And the argument that they give for the most part is that these transactions are being mined. They are consensus valid transactions and someone is going to relay them. Peter Todd created LibreRelay, which is basically a node implementation that will relay any transaction and take them to miners, right?So the argument is that since these transactions are making it into miners, if we make it less easy for these transactions to propagate around the network, people who want to put this arbitrary data on Bitcoin are just going to go directly to the miners and they're going to increase mining centralization.We just talked about all of that, right?Marathon has their own system called Slipstream, where they will accept nonstandard transactions that won't be relayed and you can pay them directly to get included into the next block.Marathon's had a few blocks that have been one transaction, four megabytes approximately,just one transaction, one image or piece of data, one block.So that's an entire block that didn't have any monetary transactions in it.And someone paid Marathon to put that on the chain.
46:52And you can think that this is the free market, this is capitalism, all this,and that people are just simply paying to get into blocks.And I'm sympathetic to that argument.I'm sympathetic because the the the thing here is that I think core just simply has the the wrongpriorities like it's always possible to do this and for the most part it always will be possibleto simply say hey you've got a bunch of hash rate you're a miner can I pay you some extra money sothat you put my transactions into your next block absolutely that's going to be possible that'salways going to be possible bitcoin you you can't you can't say that someone's not allowed to do
47:26that. That's the beauty of a permissionless system. The role that network defaults haveis shaping behaviors. So for the longest time, arbitrary data stayed under 80 bytes.OpReturn was the solution to arbitrary data. And there was an agreement that 80 byte OpReturn isgoing to be relayed by the network. And people stuck to that. Every once in a while, you wouldget a miner a user in a miner that would agree to have a non-standard opera turn and get that intoa block but it was rare and it wasn't the default it wasn't supported by the protocol and then we'vetaken that away and so the the governance piece the governance piece i hope this isn't too jumbledbut the the governance piece really came to a head with core v30 when they decided to remove
48:14the opera turn limit altogether that the default would be that there is no limit okay so let's justlet all of these transactions relay as much as we want and there's no limit to that whatsoeverand there was a massive massive pushback to that right a lot of users thought that okayus having the reference implementation for bitcoin bitcoin core can be considered thereference implementation the the descendant of the original software that satoshi created thatturned into Bitcoin Core, and that has had over 80%, 90%, 95% of market share for the entire timeuntil this whole furor, if you want to call it that. Bitcoin knots went from around 5%users to around 20% of the network. That's where it stands right now, is that users are saying,
49:05hey, we don't want to have the default be that we relay all this arbitrary data. And who getsto make those decisions and all this. So you have users choosing to use a different form ofsoftware as a direct response to what Core has done. Okay, I'm going back to one of my initialquestions. Who chooses the devs? Exactly. So the thing about this is that Bitcoin Core is ameritocracy per their own statements. They operate on a system of rough consensus, which is, this isanother technical term that comes from the original panels that formed the internet back inthe early 90s. That's where it came from. The working groups that decided how the internet wasgoing to work. And rough consensus means that they're going to take into consideration the
49:54voices of those who are inside, who are considered experts into the community, and these have to cometo consensus for anything to happen. Now, in these changes, there was a lot of pushback andopposition, especially this opera turn change with Core v30. But they chose to still put inthe opera turn change because they considered the group of Bitcoin Core contributors to havea rough consensus that the opera turn change was a good idea. Can you tell me how many developersthere are in Core? Okay, well, that that is a little bit different. So 200, 500, 1000 plus,depending on how you're counting, anyone can contribute to Bitcoin Core. If you know Fractaland Crypt, he made the big circular art pieces that Michael Saylor has, for example, he went and
50:48made a documentation change, he noticed something wrong in the documentation. And they and then theyagreed that yeah this was a good change this improved something and they accepted that umthat change who is they good point so there we go there are five to six i believe it's currentlyfive maintainers of bitcoin core and this this comes down to a specific role in github which isthe website that bitcoin is hosted in or you can go one level deeper and call it get the theprotocol you have certain number of people who can sign a new release of the software five orsix people yes five or six people and the majority of them now have come directly from this isprobably what you're getting at two companies specifically uh you could call them two and a
51:36half at the moment so it's brink chain code and spiral is the kind of the baby they're the onefinancing those people correct and that's why they are the ones that are able to continue holdingthose roles right maintainers and so the the the issue here if we're talking about a risk rightso yes there's a there's a couple of things yes um i don't want to say that gloria jow is the onlyone who who is kind of the but she's a very good example of this sort of pipeline of going from aan internship with one of these companies a fellowship she had a fellowship with brinkand then after not a very long time being a contributor to bitcoin core she was nominatedto be the next maintainer and then when she decided to retire from bitcoin core only a few
52:26months ago she nominated her own successor so which is another big problem yes exactly so we'retalking about risks and defending bitcoin yeah so so so the thing here is that all of this ishow do i call bullshit on all that stuff where do i do that on github i'm serious i'm like seriousThe fact that there are five people sitting there on an ivory tower, because some companies pay them, and they can also nominate their own successors. And this is supposed to be a decentralized global monetary system and our future and my son's future. I want to call bullshit. Where do I do that?Good. I asked that same question, actually.I'm sorry that I'm so, you know, hijacking your...it's perfect i i i asked that same question on x i did i i said what would it take for someonelike me i've got a technical background right i i know how to read code whatever it is right
53:22and what would it take for me to start to to have my voice be heard and so the thing is that therewere there were people technical people who had github accounts that are years years years oldthat that were ignored in in all of these debates right because they're not regular contributors toSo basically their answer is you have to spend significant amounts of time, over time, your own time, in order to contribute to Bitcoin Core before they'll listen to you.I call bullshit on that too, because if you have technical expertise in an adjacent field and again, like you said, know how to write code, sorry, know how to read code, know how to evaluate risks or understand technological implications and also economical and social implications.You don't need to write code for Bitcoin Core in order to be okay to make your opinion heard.Yeah, well, and I think I come down to that the division of labor is something really quite important here, right?Because we all contribute to Bitcoin or to the world in our own way.
54:29You specialize, right?So it's not going to make a lot of sense to completely shift gears to working directly on Bitcoin Core.If you're already doing something, like, for example, with your show, you're reaching people.I believe that Bitcoin adoption, increasing Bitcoin adoption is way more important than increasing the use cases on Bitcoin, increasing the technical capabilities for doing these things like covenants or whatever newfangled use cases being suggested.These things are important.It's fantastic that developers are building new things on Bitcoin.But I think adoption is vastly more important to get more people using Bitcoin as money and bring them into the monetary system.So it's not going to make sense for you, Efrat, to go in and become a Bitcoin core contributor.
55:15But that doesn't mean you don't understand Bitcoin to a certain sense.So I go into...You just opened a whole Pandora box for me, just so you know, just so you know.And I'm not sure that that's a good thing because I think I'm going to put more attention and more of my energy on that now.And I want to speak to the manager.You should talk to Hodlundot for sure.And well, you know, I want to balance a little bit here.I do want to say that from my perspective, there's nothing nefarious going on here.
55:47Just the...How do you know?Exactly.I always want to be suspicious.I don't trust, I verify.I'm basically pissing off everyone here by kind of taking the position that's tryingto be nice here.but the the the thing is the the problem to me is that this is not an open source software by any
56:05stretch of the imagination the way it's currently run they have physical offices it's in new yorkit's in london it's in san francisco and these are people who they come into the like they don't doremote work they actually don't they come into they come into physical offices and they do thedevelopment together you have lunch break conversations john attack who you should talk toi don't know if you have john yeah okay good um yeah john john attack um is a is an x coredeveloper who has his own story of kind of what went down he was on knut's podcast and he was onbob burnett's podcast i don't think he's done others but he has a great story about kind ofwhat happened in in that development culture and states plainly that that some of the conversations
56:48that were supposed to be out in the open were taking place on private signal chats insteador unverifiable in the lunchrooms or whatever the decisions were being made there.And there's a clear pattern of that someone makes a change who is affiliated with one of these organizationsand if there's any pushback to that, that there is sustained opposition to whoever has pushed back,even if they're technically wrong.So there's definitely something going on there and this is my attempt to be as honest as possible here.I do believe that there are patterns of, say, nepotism or too much concentration in one organization here.You can just be looking at the numbers when you have five people doing a certain type of work funded by three companies, two and a half companies in a system that's supposed to be global serving millions, if not billions of people in the future.
57:41There's a problem.Absolutely.Simple.And so in Defending Bitcoin, I lay out the timeline and Hodlinauts articles are an excellent place to go beyond this.I also welcome anyone from these organizations to come in and tell their side of things.But I do want to say that they're, especially on X, especially on some of these podcasts, there's an attitude of, well, we just know better.And if you don't like it, you can use another software.And you know what?
58:09That's what people are doing.People are migrating to knots.not people there's there's funding of third implementations so production ready is issomething that's samson moe and jimmy song are kind of i know there's other people involved butthose are the two that that are kind of prominently going on shows and talking about this to to funda third implementation for bitcoin right there are more implementations that exist but i thinklike anything else decentralization i don't want any one implementation to have majority marketshare of bitcoin node software yeah bitcoin knots is maintained by one guy right you think five is
58:45bad that's also a risk yeah now the the the thing i think about knots is that basically he's just anextra level of validation on bitcoin core and he makes his own decisions i run knots i think knotsis good for my purposes it's a slightly more not slightly it's a more conservative clientthat takes a more conservative mempool policy and i believe that's the right thing for meokay everyone has to make their own decisions that's the thing about bitcoin is thatdefending bitcoin whatever it is worth to you is up to you yeah all the responsibilities on youyeah and that's scary like it or not that's scary but it's freeing and the thing is you you thisbook i hope is is a way of educating bitcoiners on things that they might not know about and also
59:30to be empowering. There's always something you can do no matter what. I agree with you. So this isa great way of kind of peeking into your very smart brain. So I'm glad that, you know, I pushedon that point more and more because that gives people an example of the kind of threats andrisks that you are covering in this book. There are plenty more. I know that because I've readthe table of contents at least that i can't wait to read the whole book will there be an audioversion of it there will absolutely be an audio version i'll i'll record it so that you'll bespeaking yes i will that's awesome yeah okay when i grow up i want to record audio booksthat's perfect that's just one of the things i thought about okay and um i have a last question
01:00:22for you. Why do you care so much? Why did you write this book? I wrote this book and I gotinto Bitcoin because to me, Bitcoin is the only hope civilization has for getting out of thisfiat trap, for the world to fix itself from having a system where printing money is just creating allof these issues, inflation and making life harder for those who don't have resources. I came from asituation where I didn't know if I would have a job in the next month, something like this. AndI've always been thinking from a perspective of what's the worst that can happen. And I don'tlike to be a doomer or anything like this. I want to make it concrete. I wrote this book to showthat Bitcoin is actually pretty darn resilient. And it is. Bitcoin is resilient, but it's only
01:01:13as resilient as the individuals who make the decisions to keep it resilient. And I'm goingto do something that I think I should have done in the beginning, but I'm going to do it now. I'mgoing to just read the back of the book for our audience. So Bitcoin secures over a trilliondollars in value. Isn't it closer to two trillion today? Yeah, probably something like that. It hasno security team. It actually has no marketing team either. This is what I try to do. DefendingBitcoin applies the same frameworks that protect power grids and pipelines to the world's firstdecentralized critical infrastructure the full threat landscape is here exchange failures keymismanagement 51 attacks developer capture regulatory overreach quantum computing so are
01:02:01the controls mapped to industrial standards with practical steps you can take today if you're abitcoiner who wants to think like a defender or a cyber security professional who hasn't takenBitcoin Seriously Yet. This book is the bridge. Fantastic. Okay, great. Defending Bitcoin willcome out by the time this episode is out. Luke, where should people follow you?Yes, I am at Luke DeWolf, L-U-K-E-D-E-W-O-L-F on X. You can find me by my name on LinkedIn,etc. I am appealing to the LinkedIn crowd with this, my existing network of cybersecurity andtech professionals. DefendingBitcoin.com is where I want you to go. Okay. You can find all of theresources, extended resources from the website. I've got an interactive threat model tool on the
01:02:48website right now. Nice. If this were coming out before the book is released, you can go and signup for an advanced review copy. But if it already has come out, you'll find all the ways you canpurchase it on Amazon or BitcoinInfinityStore.com would be my two recommendations. So on the website,there'll also be some type of forum or something like that where people can engage with you or withother people absolutely there's good there's going to be a tons of interactive stuff right now youcan you can fill out your own threat model profile to understand how this book can apply to youthe threats and controls and all this we don't collect any data though whatsoever if you wantto sign up for the mailing list for updates and cyber security news you can do that but otherwise
01:03:30we don't take any data i don't want to see what your situation is i just want to provide toolsand the the entire book is going to be even essentially turned into an interactive tool onthe on the website with all the threats all the controls and up-to-date new resources recommendedreading all this so defending bitcoin.com is where i want you to go for more informationfantastic we'll put a link to that in the show notes and to your profile as wellyou're a nostril too right of course primal.net slash luke there we go i got the i got the thefour letter. Fantastic. Anything else you want to add before we wrap up? Go defend your money.Yeah, right. Go defend your money. Go defend your life. Absolutely. Thank you so much, Luke.
01:04:12Thank you for having me on, Efrat. Thanks. Yeah. Thanks for being with us. Please take a minuteto give this episode a like, comment, and subscribe, and hit the notification bell to benotified when I release my next episode. All this really helps me beat the suppression ofthe algorithms. Take a moment to check my sponsors and affiliation offers in the show notes. That'show you support me and the show, ensuring I can carry on with my mission. Lastly, please sharethis with your friends so they can also get value and choose to take some positive action. Till next time.Thanks for watching!
There aren't comments yet for this episode. Click any sentence in the transcript to leave one.