You're The Voice | by Efrat Fenigson - Is Bitcoin Compromised? - Luke de Wolf | Ep. 156

Starting point is 00:00:00 This is not an open source software by any stretch of the imagination the way it's currently run. And there's a clear pattern of that someone makes a change who is affiliated with one of these organizations and if there's any pushback to that, that there is sustained opposition to whoever has pushed back, even if they're technically wrong. And this is absolutely the most controversial topic for those in the know. I did read Hodlnot's latest articles about the developers, the core structure, And I must say, I find it very disturbing. I'm with you on that.

Starting point is 00:00:32 From my perspective, Bitcoin was made really, really much less usable as money for a certain period of time until this frenzy died down. The community collectively came in and said, we are not having this. The only thing that we really can't defend against is complacency. If everyone is complacent and decides not to take any action, that's how Bitcoin dies. Bitcoin is the only hope civilization has for getting out of this fiat trap. The great thing about mining is that anyone can participate. You can't say that someone's not allowed to do that.

Starting point is 00:01:03 That's the beauty of a permissionless system. Bitcoin is resilient, but it's only as resilient as the individuals who make the decisions to keep it resilient. end hello and welcome to another episode of you're the voice from ireland i have the honor of being here with luke de wolf hey luke how are you hey f red i'm great thanks so much for having me glad we could make this work i know me too thank you for joining me we're gonna do a very interesting episode today we're going to talk about and this is by the way our second episode together so for those of you who haven't seen the first one i don't remember the number i will put it in the show notes go check out our first episode together with knut as well it was really

Starting point is 00:01:55 fun i want to talk today about your new book that's coming out soon how soon it'll release at btc prague so maybe if this is out after that after so it's already been released by the time we have this out. June 15th. June 15th. Defending Bitcoin. This is the book. We're going to have a link to it as well so that people can purchase. This has been published by your own independent publishing house as well, right? Can you say a few words about that? Like what made you have your own publishing house? Correct. Absolutely. So Lemniscape Media is the publishing house. And basically Knut and I were working with another publisher and that ended up not working out. And we needed to take Knut's books off and publish them independently. We ended up re-editing

Starting point is 00:02:41 all of Knut's books together. Little things, just a little mechanical edits, this and that. And we re-released all of Knut's books under our own imprint. Then Knut and I wrote Bitcoin, the Inverse of Clown World together. And that was a lot of fun. And since then, we've been working with a few other authors. The publishing house is a little bit of just a, I call it a publishing light model. We know all of the things that authors need to do in order to get their book printed and distributed through things like Amazon or big printers, things like this, everything that we figured out. And so we just basically take other authors through that process and make it as easy as possible. And we don't charge an arm and a leg for the service, just basically what we consider

Starting point is 00:03:25 to be worth. So it's Bitcoiners helping Bitcoiners. Max Hillebrand's Praxeology of Privacy is the other one that we've just put out recently, also Roger 9000's book, The Beautiful Balance of Bitcoin. We've re-released a new version of Yoni Appelberg's Abundance Through Scarcity. So we're helping out a lot of authors. And we've also got Larry Lepard's The Big Print on our web shop as well, and a couple of others. So yeah. So authors that want to use your services for that, they can do that. They can approach you. Exactly. You can contact us through various mechanisms, Twitter DMs or telegram signal, whatever. We're approachable. That's it.

Starting point is 00:04:04 You are approachable. Okay, great. So I just wanted to sort that out before we began. Can you give our audience just a bit of your backstory, personally, where you're from, what got you into security, cybersecurity, and then Bitcoin? And, you know, we'll get to the book soon, but I want to start with that. Yeah, absolutely. And great place to start. So my background is that I'm from Canada originally, but more specifically Alberta, that has some nuance there. Alberta is the province in Canada that has the oil and gas sector primarily. There's also, there's oil and gas in other parts of Canada, but that's where the center of the industry is. So that's where I grew up and that's where I went to school. I went to school for computer science

Starting point is 00:04:48 at the University of Calgary. And through that, I was learning to code, software development, this sort of thing. I really had no idea what to do with my life. So I figured, let's try and find a marketable skill and learn that. That's what I expected to be doing. But I lucked out and I got a fantastic internship at an oil and gas pipeline company. And I was working with their monitoring and control systems for the oil and gas pipelines. So these are what are called industrial control systems or operational technology. Operational technology is in contrast to information technology, IT. So OT is kind of the counterpart to IT. And it's everything that runs factories, electrical grids, pipelines, anything that interacts with the physical world. That's OT.

Starting point is 00:05:38 Anything that interacts with primarily the digital world would be information technology, IT. so this is to work for a drone company in mining like real mining yeah so i know of operational technology from there because our drone was used to surveil mines and do mapping of the mines and things like that so exactly exactly so the the the whole thing there is i spent my entire career it's over a decade at this point working with that type of technology and it's a totally different world. It's got different priorities than, say, keeping an IT system running and secure. So I shifted into doing cybersecurity for that field about four or five years into my career. It's been six, seven years now that I've been focusing on security specifically, but I've spent my entire

Starting point is 00:06:27 career working with these industrial control systems in various degrees. And the relevance here is that my background is thinking about systems that keep the world running. You can think of that as critical infrastructure. There are formal definitions for critical infrastructure. Those things, every country basically has their own, but a paraphrase would be those things that keep society running. The lights on, the water flowing out of your tap, the things that you need to eat or to use every day that keep getting manufactured, right? Without this stuff, the world collapses so power plants or any types of uh reserves um anything that the country needs in case of you know just continue functioning and also in case of emergency it's it needs to

Starting point is 00:07:19 continue functioning right that's right and the the funny thing about it is that first of all the united states puts information technology it as one of these these sectors that's that's critical And recently, what did they do with data centers becoming critical infrastructure, right? Well, and that's absolutely true. And there's an interesting tie into Bitcoin as well with data centers, that data centers kind of compete for the same computing resources, or at least electricity under the hood as Bitcoin mining. But I mean, I think the good thing with Bitcoin mining is that those ASICs are still going

Starting point is 00:07:52 to be existing somewhere. So something like a marathon shifting to AI as opposed to Bitcoin mining, I don't think that's a huge problem. Someone is going to want those ASICs to be running and hashing to try and find Bitcoin blocks. I think it's a great opportunity. It's not a problem at all. It's like we're freeing up all that stuff to the market. Let's decentralize even more. Exactly. I'm very pro-decentralization. Absolutely. Okay, so let's go back to critical infrastructure. So the tie-in to Bitcoin here is that payment infrastructure is considered critical infrastructure in virtually every jurisdiction right so your visas your master cards your banks there are so many different kinds of

Starting point is 00:08:32 payment infrastructure and every country basically is going to consider that to be something essential and you knock out the ability to to pay for stuff i mean i mean we're in a society where cash is no longer widely used at least in in the western world some some countries are a little more into it than others but yeah the trend is a little bit worrying right i think it was two three years ago there was a natural disaster in New Zealand if I'm recalling correctly I don't remember where exactly in New Zealand where they had a blackout and I think it went on for about a week or like anywhere between like four to seven days that's a long period of time and during that time and they had no access to cash sorry they had no access to payments the only thing that really

Starting point is 00:09:19 save them was cash and even that was limited because not every business or every place would now accept cash so they it started becoming really ugly really quickly where you know society is kind of fighting each other and trying to survive um but cash was really a needed lifeboat at that specific situation and seriously like you know the power that shouldn't be don't think about those kind of edge cases when it comes to you know critical infrastructure failing if we don't have those alternatives in place we are going to find ourselves in really dark situations very fast and i think bitcoin is also prone to that problem because it relies as we know on digital infrastructure and electricity and so if that's out then we do still need alternatives so that's

Starting point is 00:10:14 That's another thing to keep in mind. Just what you said reminded me of that. No, absolutely. Well, and the thing is, I covered that scenario in chapter 14 of Defending Bitcoin. And so the thing is, we'll maybe jump around a little bit in terms of the format. But the event of that the infrastructure underlying Bitcoin goes down, I mean, okay, you can have the case where all of the electricity in the world goes out all at once. We've got bigger problems.

Starting point is 00:10:40 Not very probable, right? Very low probability of that happening. Tired of feeling like your freedom and future are fading away? Do you live in a country with growing inflation, crazy housing prices, weird culture, and a chaotic economy? You're not alone, and my friend Mikel Thorpe and his team at Expat Money can help. Mikel is the world's leading expat consultant on a mission to free you from broken systems. He's been an expat for 25 years, lived in 9 different countries, and has helped hundreds of people with second residencies and passports,

Starting point is 00:11:12 offshore banking international investing and many other essential tools if you're serious about protecting your wealth and your family it's not enough to hope things will get better you need a plan b in another country the team at expat money can help you build it legally safely and without wasting years of research head over to expatmoney.com to get a free report on plan b residencies and instant citizenships. This is an easy, free way to help support the show while learning how to protect your freedom with a plan B. That's expatmoney.com slash efad. Ever find yourself needing cash but refusing to sell your Bitcoin? That's real life for many Bitcoiners. Because most Bitcoin sales aren't financial decisions, they're liquidity decisions.

Starting point is 00:12:03 And that's exactly what Ledin solves. Ledin is the global leader in Bitcoin-backed lending. They've issued over $10 billion in loans since 2018 with a perfect track record for protecting client assets. Here's what makes Ledin different. With their custodied loans, your Bitcoin collateral is not lent out to generate interest. No credit checks, no monthly payments, and no penalties for early repayments. You apply in minutes and you repay whenever you want. Ledin also publishes proof of reserves reports every six months with full transparency.

Starting point is 00:12:39 So if your capital is in Bitcoin, but your expenses are not, you still have options. Ledin lets you unlock liquidity without selling your Bitcoin. Learn more at ledin.io slash Efrat and get a quarter percent off your first loan. That's ledin.io slash Efrat. Correct. Well, and maybe I can just lightly bring in some of the cybersecurity terminology here. This is what I've wanted to do with Defending Bitcoin, is to bring the cybersecurity background that I have, that I've been working in, with the Bitcoin that is now my focus. And cybersecurity is maybe a misunderstood field, I would say. The preconception that I think many people have of cybersecurity is like a hacker at a computer screen that's, you know, trying to get in somewhere or maybe someone is like working against the hackers and making sure they don't get in wherever.

Starting point is 00:13:36 But the thing is, cybersecurity is actually a set of frameworks to understand risk. Cybersecurity is basically digital risk, the management of digital risk. And the world we live in today is effectively all digital or some kind of digital physical hybrid. so cyber security is is effectively just the management of of risk and there's a there's a formal definition for for what a risk is there there is a the risk is the combination of a vulnerability and a threat so a vulnerability is a weakness in any kind of system that could be exploited by someone who has nefarious intentions and that's your threat so you have to understand both sides here you have to understand who might be wanting to attack

Starting point is 00:14:20 you or the thing that you want to protect and bitcoin is a big target of course yeah so then you have for those who don't know why and what we mean in case you are not a bitcoiner and i do have quite a bit of those audience listening it's because bitcoin is not governable it's very hard to stop it it actually almost is impossible to stop it so it is a threat to institutions who want to control money. Absolutely, absolutely. And then the next part here, what you were getting at in terms of probability

Starting point is 00:14:55 is that the whole idea of risk is that you have to have the likelihood of something bad happening and the impact of something bad happening, right? And the combination of those two is how you rank risks. Is it more important to tackle the risk with a high impact and a high likelihood versus something with a low impact and low likelihood?

Starting point is 00:15:17 that that should that should seem obvious but when you get into the middle ground like is this is this is medium impact but it's going to happen fairly often okay we should probably deal with that yes versus here's something that's high impact low likelihood where do you draw the line where you're going to deal with that that's how you basically do risk analysis analysis so meteor landing on your on your city or your factory that's you can't do much about that right but you can probably do something about losing power for a week something like that so so that's that's the the framework that that i'm i'm talking about here okay you found the chapter 14 i did grid and network failures that's the chapter and then you go through the different types of risks that are

Starting point is 00:15:58 under that the way the book is structured there's a first part that goes into the basics of the vocabulary from both sides of the table so i've got two chapters on bitcoin one bitcoin the technology and another bitcoin the money so i'm i'm coming from the the monetary side of bitcoin That's my background and my way in. I've had to learn about the technical side of Bitcoin as I go. So I'm approaching the book for people who aren't necessarily technical like myself. And so I want a background, a vocabulary that everyone can share. Then cybersecurity is the same thing.

Starting point is 00:16:34 Introduce the vocabulary and the framework of thinking that underpins cybersecurity. then i get into and introduce industrial control systems operational technology why they're different and how cyber security is approached differently and i'll tell you the key difference the key difference is that these systems need to stay running so the availability of the system is the critical piece and with bitcoin it's the same thing keeping bitcoin running is what we ultimately need to ensure. And so the main point here is that I've written with Defending Bitcoin is how we as individuals participating in Bitcoin can keep Bitcoin more secure and ensure its availability into the future. That's what Jeff always says. Let's keep Bitcoin decentralized

Starting point is 00:17:22 and secure. That's like his signature sentence. Every time he talks about Bitcoin, as long as it's kept decentralized and secure. So what in a TLDR is your argument for how we keep this decentralized and secure? Great question. Well, the first thing is to understand what Bitcoin is, right? And your own personal Bitcoin is going to mean something different to you than Bitcoin, the network. So part one of the book was kind of this vocabulary tying this all together. And I have a fifth chapter that's tying those four vocabulary chapters all together into the thesis that Bitcoin is critical infrastructure. Then there are 10 chapters on the threat categories to Bitcoin. And I don't want to make that sound like it's exhaustive. I'm writing a book here.

Starting point is 00:18:09 It's got to fit in some reasonable number of pages. So it's 10 chapters and that's broad categories of threats to Bitcoin, whether it's your personal Bitcoin or Bitcoin, the network. So the first three threat chapters are basically all about how you defend your personal Bitcoin and yourself. So exchange risks, the negatives and the risks of holding Bitcoin on exchanges. Then everything to do with self-custody. So this is a meaty chapter, as you can imagine. How do you keep your Bitcoin in your self-custody in a secure way? Then maintaining your privacy, because privacy is a thread that runs through the book, the entire book. Keeping yourself private in the Bitcoin sphere is a matter of security because France at the moment is basically the

Starting point is 00:18:57 hotspot for $5 wrench attacks is the common parlance, although the wrenches cost about $15 at the moment due to inflation, something like this. But physically being attacked because you're a known Bitcoin holder is absolutely a risk and avoiding doing so, being out as a Bitcoin holder is really important. And what do you do if you are a public Bitcoin figure? Because we're both we're both kind of screwed, unfortunately. We're public facing, right? So how do you keep yourself private when people know that you hold Bitcoin, right? So this is everything focused around your individual Bitcoin. Then going beyond is more about understanding the threats to the network, Bitcoin, the network. And this is all about understanding the interplay between

Starting point is 00:19:44 nodes and miners and the governance structures with development. So the middle of the book is all about understanding how these groups interplay with one another and what are the specific threats facing, say, Bitcoin nodes and node runners? What are the specific threats facing mining? And I get into mining decentralization there. That's a massive topic. There was a 24-hour period not long ago where foundry was almost at 50 of the the blocks found that day right and later it wasn't the same day they had a essentially a small reorg that foundry did they held back stating that they had found a block and in the in the meantime another pool found a block but they found a second one and they broadcast their new longer chain right and they ate the old block they made

Starting point is 00:20:34 the old block disappear right so so they were able to take all the mining revenue from those two blocks and effectively steal it steal it sort of from this other pool i think was ant pool who found the the block in the meantime what can prevent that that's the thing is that the only way that this was possible or economical for them was because they had so much hash rate they could keep hashing in the background against the block they had already found yes and then when they found that second block they were able to broadcast both together so they didn't broadcast the first one they continued straight away to find the second one we don't know something technically that you can do if you've got 30 40 percent of the hash rate sure you you could do that a 51

Starting point is 00:21:15 percent attack effectively is just simply having enough hash rate that you're going to find on average more than one more than one out of every two blocks right and the the thing is a a double spend is what a lot of people think is the big problem there. So a double spend is that you pay for something with Bitcoin, and then you pretend that you've moved the Bitcoin to them. And in reality, then you move it to an address that you still control. And the mechanism for doing that would effectively be that you control enough hash power to guarantee that your next block will override the the planned transaction that's right it's not it's not the simplest concept but yeah that's the the basics but having more than 50 of hash rate or even 30 40 of hash rate also

Starting point is 00:22:05 gives you the power to to censor to say that i'm not going to include this list of transactions or let these people from these addresses move their bitcoin right and if you've got half the hash rate okay well that means that on average you're going to have to wait 20 minutes instead of 10 minutes to get into the next block. That might not sound like a lot of time, but there's a lot of variation in how Bitcoin blocks get produced, right? A block could take an hour.

Starting point is 00:22:31 A block can take two hours to find, to get your transaction into something that isn't going to be censored. There are time-sensitive considerations here, right? But the other thing they can try to do is that they could try to keep constantly having the longest chain so that they're the only ones

Starting point is 00:22:48 that are producing Bitcoin blocks. If you have more than 50% of the hash rate, you could just keep on mining with only your chain and basically turn yourself into the only miner producing Bitcoin blocks, because that'll eventually be the longest chain out there. We would be in serious trouble if that were the case. Big, big risk. Yeah. Yeah, absolutely. So the thing is, no one entity currently has 50%, but Foundry is at like 30, 30%. And if their luck in a 24 hour period gets them to 40, 45%, we're at some serious issues here where they have the capability to do nasty things to compete with their other mining competitors right and so

Starting point is 00:23:25 i'm not saying they're doing this but just by having that amount there was a case 2015 2016 ghash.io where they had over 50 percent of the hash power it happened right it's ghash.io they they're they're gone now they were a mining pool uh and they they essentially started up cloud mining effectively that you could you could just send your your hash rate to this pool made it very convenient at least for the era and they accumulated over 50 of the hash rate but the community the community collectively came in and said we are not having this there was a fast reaction that said we have to go to other pools we can't let them have this much hash rate they didn't even want that it actually killed their business by accumulating so much hash rate they bitcoiners

Starting point is 00:24:14 abandoned them quickly and the thing is the difference now compared to back then is there is just so much more hash rate compared to nine ten years ago right miners don't necessarily move quickly between one pool to another and if we were to start to get the the main reason that foundry has so much hash power is that most u.s entities have to be regulated a certain way u.s mining entities and so foundry is one of the the only options that many of these miners have to be able to mine legally with such large mining operations. And so they collect almost all of the regulated, publicly traded hash power in the U.S. What is the probability of a 51% attack?

Starting point is 00:24:59 I mean, I consider it quite low. I certainly consider it quite low. But the thing is, cybersecurity is not about the low probability things. You shouldn't take those into consideration. It's about what is the worst case scenario and what can you do about it. and i mean the the great thing about about mining is that anyone can participate right and it's it's just like running a node it's just like holding bitcoin anyone can do it you can get a bidax you can get a a nerd miner you can get you can get a bitcoin heater where i'm living in finland it's

Starting point is 00:25:30 it's cold most of the year not most of the year but uh i've so i've got a couple of bitcoin heaters that heat my home during the cold months and i you can do remote mining with my sponsor abundant mines. Exactly. For example. And this is actually an interesting case here. There used to be these so-called cloud mining solutions that were very scammy. You couldn't trust them. And they gave a bad name to that type of mining. Exactly. But nowadays you can get mining hosting and it's provable that you're directing the hash rate to where you want it. I mean, Ocean is the example that that i use here absolutely you can just point your hash towards ocean then you get a nice little dashboard that shows all of the mining shares that you're that you're getting so so it's it's

Starting point is 00:26:17 provable that you are actually taking control of the hash rate and and and if you're like me you can actually drive or go to the mining facility and see your miners even though it's it's remote go check go verify it's there and then you have the dashboard and that's right it's working it's fantastic and anyone can participate and the the capital needed to do that is is usually not so high anymore you can make a good profit off of off of bitcoin mining you absolutely can you can also be near break even or even losing a little bit of money spending a little bit of money to decentralize the network to put your your will onto the network with your amount of hash rate with your proof of work that's the idea and it's the same thing as running a node running a node

Starting point is 00:27:02 you run your rules. You get to decide which of the relay policies or mempool policies you want to run. If you are the one hashing your Bitcoin, and when I say this, I mean, if you are running a system that lets you build your own blocks, you get to decide what goes into a Bitcoin block that you find. So everything comes down to, to try to get back to your original question, is the thing you can do to ensure Bitcoin security is to keep it as decentralized as possible and do the things as an individual. There is always something you can do in every sector of Bitcoin security, whether it's to the individual stuff or to the network level stuff, or even dealing with politics and quantum and AI. There's always something you can do right now. Always. That's what I maintain

Starting point is 00:27:49 here. All right. And let's talk about another adjacent or similar type of threat, which is the mining supply chain or the hardware side, because I know today that most miners, I'm not a mining expert, but I do know that most of the mining companies have to rely on the same company when they buy their hardware or their chips. Can you talk a bit about that? Absolutely. And I certainly consider this to be a big threat, isn't it? Absolutely. Absolutely. I mean, the main reason why this isn't something to get uh say yeah to think too worried about it right now yes it is simply that that the the hardware is throughout the world and there are these open source firmwares that you can put on top of of different uh mining hardware the centralization in terms of

Starting point is 00:28:41 the actual foundries that produce the the chips that's a worldwide problem okay like like access to the foundry time is one of the things that's driving up costs for computing in general. Not just in Bitcoin, but in general. Exactly, exactly. Consumer prices for memory, for CPUs, hard drives, these have all gone through the sky, partially because of the advent of AI, but also because of the scarcity of this foundry space, right? So the thing is, there's centralization in every step somewhere. Yep. and getting a new player into the market is so, so difficult, right?

Starting point is 00:29:22 So it definitely is a problem that ASICs are manufactured by only a couple of manufacturers at the moment, and I would love to see there be more competitors in that space. There was the ant bleed attack, or say, yeah, I mean, attack is a good enough word here. It was that in ant miners, there was effectively a backdoor that allowed the manufacturer to effectively run the ASICs a little bit hotter if they controlled them, if they were pointing to their pool. And when the community found out about this, this was all in the middle of the block size wars, basically, and had an effect on the adoption of Segwit and rejecting the proposals to raise the block size. This was all tied up in the same era.

Starting point is 00:30:10 So the community did find this backdoor in the in the firmware running the miners. And I would say these days it's it's not so easy to put something so unknown. The Bitcoiners are tinkerers and there's a lot of companies that take the actual hardware and do things with them. So putting on, for example, Brains firmware onto your miner is a good way to at least have more control and more of an idea that your miner that you have is going to work, right? And using other, say, manufacturers, these open source mining solutions, that's another way yourself that you can take action to combat this centralization. you might think that any kind of action you take is going to be too small to make a difference, but it makes a difference for you. The only thing that we really can't defend against is complacency, right? If everyone is complacent and decides not to take any action, that's how Bitcoin dies, right? So the only threat there's no defense to is not taking any defense. I should say that more eloquently. Yeah. That's a very good way of putting it. Let's talk about another

Starting point is 00:31:26 kind of risk or or threat that i'm sure you covered in the book and you will probably tell me the chapter number and page number it's all in my head right now yeah so the governance you talked you mentioned it before so the governance model the devs i'm particularly curious about the governance model when it comes to vetting new developers and choosing them and why do we have so few and who gets to say he's good he or she's good they're the right people we're gonna have them as developers how does it work is it changeable can we change it can we have more like what's going on there i don't even know how that whole mechanism works this is a deep topic and this is absolutely the most controversial topic for those in the know i did read huddle

Starting point is 00:32:17 notes uh latest articles about the the developers the the core structure and i and i must say i find it very disturbing i i'm i'm with you on that and the and the the thing is so you're the voice is brought to you by trezor the original bitcoin hardware wallet company pioneering the development of self-custody for crypto assets since 2013 empowering individuals with an open source device enabling beginners and experts to easily and securely hold their coins i find my treasure super easy to use and recommend it to my friends and family enjoy my five percent discount on treasure product by clicking the link in the show notes and using the code flat i want to introduce you to abundant minds because they take a very different approach to bitcoin mining most people

Starting point is 00:33:07 buy bitcoin but the smart ones mine it straight into self-custody with abundant minds you can do it without giving up your privacy. Abundant Minds was founded by Bo and Christine Marie Turner, a couple who lost more than half a million dollars to providers making empty promises. Instead of walking away, they built a company that raises the industry standard and puts client first. And that's why I like them. With Abundant Minds, you own your machines. They never touch your Bitcoin, never skim a revenue share, and you choose your own mining pool. Their customer care is unusual, clients speak to a real person for self-custody education, privacy consulting, and even visiting their site. They serve clients from around the world, but U.S. investors

Starting point is 00:33:55 specifically enjoy a big tax benefit and 100% bonus depreciation. This is more than just mining Bitcoin. It's about freedom, privacy, and purpose. You can book a free strategy call, see how it works and mine some of your first Bitcoin for free with a special offer for my audience. Learn more on AbundantMines.com slash effort. Defending Bitcoin is not only for Bitcoiners that are in this inner circle. I want to make all of this clear and accessible, but this was something that I couldn't justify not covering. This is absolutely something that's going on these days and is a concern. So I have two chapters that basically tie into this. Where? Where do I find?

Starting point is 00:34:40 Chapter 11 is on arbitrary data. And witness abuse. And we need to start with that chapter a little bit to understand how the governance problems have started to emerge. And so they flow into each other. The next chapter, chapter 12, is about the governance structure and the governance risks. Right. Yes. But the arbitrary data, if I want to try to condense this a little bit, is basically that certain changes and decisions were made that made Bitcoin more vulnerable to arbitrary data coming on chain. Yes.

Starting point is 00:35:14 And my take on arbitrary data is a little different from some others that you might hear. Okay. Some in the community are more concerned about arbitrary data for that it's increasing the requirements on node runners to have larger hard drives, to have more RAM, to be able to run their nodes. And that is absolutely a concern. That's a real thing, especially since we just talked about there's a scarcity of memory, of hard drives, all this. The prices are going up. So the price to run a node has gone up for sure. That's true.

Starting point is 00:35:44 and the the less decentralization we have in terms of running nodes that's a negative thing if a node runner if an individual chooses to turn off their node because they've run out of hard disk space and they don't have the funds to get a new hard drive something like that well that's one less node one less piece of decentralization that we have and it's cumulative this is all kind of death by a thousand cuts territory right it's where we're going directionally is bitcoin in a state of more nodes coming online or less. And it's hard to say. I mean, I'm not going to call this overblown. I think more node runners are being minted all the time. New Bitcoiners get the conviction to run a node. And that's a good thing. That's what I advocate for, for sure.

Starting point is 00:36:29 But increasing the demand on node runners makes it more expensive to do. And some of the choices, specific choices around Taproot in particular, made it so that Bitcoin was more vulnerable to to this kind of arbitrary data now i said i take a different approach to why this is a problem so in 2023 2024 the the fees just went ballistic exponential uh overnight almost and this was at the advent of ordinals when the ordinals protocol came out yep and there was just a flood of people from the crypto space who came on to bitcoin and wanted to make a buck off of these nfts and tokens and things like this but yeah so i'm against this stuff from a perspective of that this makes bitcoin worse as money that this stuff is all it would be great if this all just stayed on ethereum or one

Starting point is 00:37:20 of the other cryptos that would be fantastic but the problem is that those transactions those non-monetary transactions were directly competing with all the monetary transactions it was making the system less available yeah pushing down in priority monetary transactions well and and even the thing was it was making them more expensive, right? So the thing there is that from a critical infrastructure cybersecurity perspective, what we talked about at the beginning is that availability is the critical point for these sorts of systems. And my argument is that this arbitrary data was making Bitcoin less available as money. Raising the cost, it's the same thing as a DDoS attack or a spam attack. I mean, I consider this stuff spam, but email spam. You go back to one of the

Starting point is 00:38:04 precursors to bitcoin adam backs hash cash right this was a solution to getting too much email from wherever because the cost of sending email was super low and then you have all the spam in your inbox and adam came up with a system to deal with that it proof of work he wasn't the originator of proof of work but it had been originated a few years prior right and this is one of the systems one of the only things that is specifically referenced in the bitcoin white paper is proof of work. Proof of work was originally a spam prevention system. And it still is. So the mechanism for Bitcoin transactions as being a fee market, this is one of the arguments why this arbitrary data stuff isn't a problem, is that the fees eventually equal everything out, right? That

Starting point is 00:38:50 they are spending their sats, their money, in order to get into a Bitcoin block. And it shouldn't matter what their purpose is, right? Now, I agree with that. As long as you're not putting data onto the chain right and that creates a different pressure that that means that there are fewer transactions that are be able to be in any any one block right there's a scarcity of block space over time a block every 10 minutes means there's a certain number of blocks that are going to be found over a course of a person's lifetime even you can think of it that way right so if you can't get into a block at a certain fee you either have to pay more or you have to to wait and for that year two years it went well into it was february 2023 to well into 2024 that fees were really

Starting point is 00:39:35 really high 30 sats per v-byte was about the floor for a long time and it was in the hundreds and this translates to dollars per transaction fifty dollars a hundred dollars per transaction at the absolute peak the worst of it right yeah yeah like for some people that's going to be fine if you're moving a million a million dollars worth of bitcoin a billion dollars worth of bitcoin but If you wanted to move $1,000, $500, $100, less than that, so many parts of the world would have been unable to transact. And so the people who were already on Lightning or other second layers, you were kind of insulated from that at the period of time. But if you weren't, the cost to open a new Lightning transaction was really high. There were delays in getting your money into services like custodial services like Wallet of Satoshi, for example.

Starting point is 00:40:24 So from my perspective, Bitcoin was made really, really much less usable as money for a certain period of time until this frenzy died down. Right. And what I come back to is that cybersecurity isn't about what's the situation now. It's about what if this happens again. And there's always a risk that someone is going to create a new frenzy on Bitcoin for tokens or images. So how do you link that into the devs and the governance? Okay. So this is where things get a little bit sticky.

Starting point is 00:40:51 The Taproot was launched with two vulnerabilities that made Bitcoin susceptible to this stuff happening. So one vulnerability was that TapScript, Taproot is two things. Taproot is Schnorr signatures, which is the Taproot address type. And it's the type of signature used in order to make most transactions look really similar. This is the privacy improvement of Taproot. At the same time, they introduced TAP script, which is a new type of Bitcoin scripting that is theoretically more able to do more things and a little bit more, say, powerful in a certain sense. There's no real reason from what I understand for the two of those things to have been introduced together. They didn't need to be introduced at the same time.

Starting point is 00:41:37 And TAP script didn't include a cap on the amount of data that you could include with that scripting system. And at the same time, the mechanism for inscriptions uses a particular Bitcoin script called op false op if. So if you know a little bit about programming, if something is false under a branch, that means it's not going to execute. So in Bitcoin script, if you have an op false, that means everything after that isn't going to be executed. It's not going to do anything on chain, right? But then they realized that you could just then put a new block of data right underneath that false. So that Bitcoin is not going to care about that, about that data, but you can still put as much as you want on chain up to the transaction limit. So these two things

Starting point is 00:42:22 together made it so that the inscriptions, so-called inscriptions that Ordinals uses, were able to get onto Bitcoin in a much more easy way. So I'm again, pulling it back to the governance piece. Luke Dash Jr. argued, okay, actually, I'm going to pull this back one step further. First of all, just taproot being released without some checks on these two particular systems, that's a problem in itself. There's an argument for sure to be made that taproot just needed some more time in order to be released without, say, these vulnerabilities. 99% of taproot outputs are dust, right? And the reason for that is that these... Can you explain what dust means yes yes yes the reason that these spam transactions uh they they use as little satoshis

Starting point is 00:43:11 as little bitcoin as possible in order to to spend the least uh to get on on chain so dust is the the definition of the dust limit is the the minimum amount of bitcoin that could reasonably be spent that's effectively what this is and dust is a is a relay policy you can technically uh have a UTXO of almost nothing. Almost no Bitcoin could be on there. But all of the node implementations have agreed that there should be a minimum limit of Satoshis. And it's needed. Core developers all agree that this is absolutely needed because there are a lot of attacks that are possible if the dust limit was didn't exist so you'll find that so many of these transactions are 100 sats 100 200 300 sats something like this there's specific levels where they ratchet up and so

Starting point is 00:44:07 they're hardly anything they're worth almost nothing and then they've got some kind of picture or token or something like that attached to it over 99 of outputs measurably from taproot are this kind of arbitrary data yes so if we're talking about outcomes yes taproot has had the outcome of just putting a ton of arbitrary data onto Bitcoin, increasing the demands on node runners and making Bitcoin less usable as money. So that's the result. So my argument, first of all, is that Taproot just needed some more time so that it could have been released without these vulnerabilities. Then the thing is, Bitcoin core developers argued that these weren't really vulnerabilities. So Luke Dash Jr. submitted these two issues as the system is called CVE,

Starting point is 00:44:51 common vulnerabilities and exposures. This is a cybersecurity database where any kind of bug is submitted. Exactly. So Luke Dash Jr. submitted there and said that here are these problems and here I have a fix to this solution. So one bottom line here is that Bitcoin Knots has fixed these problems. If you run Bitcoin Knots, these two issues are patched. Okay. Bitcoin Knots does not relay transactions that include these issues and it does not allow for for a tap root tap script to have more data core declined to implement these fixes so the justification they gave is legitimate in in a certain sense and i'll i'll explain here it's completely legitimate to have a vulnerability and say that the means for fixing that vulnerability we don't agree is feasible

Starting point is 00:45:46 We don't agree that this is going to work. And the argument that they give for the most part is that these transactions are being mined. They are consensus valid transactions and someone is going to relay them. Peter Todd created LibreRelay, which is basically a node implementation that will relay any transaction and take them to miners, right? So the argument is that since these transactions are making it into miners, if we make it less easy for these transactions to propagate around the network, people who want to put this arbitrary data on Bitcoin are just going to go directly to the miners and they're going to increase mining centralization. We just talked about all of that, right? Marathon has their own system called Slipstream, where they will accept nonstandard transactions that won't be relayed and you can pay them directly to get included into the next block. Marathon's had a few blocks that have been one transaction, four megabytes approximately, just one transaction, one image or piece of data, one block. So that's an entire block that didn't have any monetary transactions in it. And someone paid Marathon to put that on the chain.

Starting point is 00:46:52 And you can think that this is the free market, this is capitalism, all this, and that people are just simply paying to get into blocks. And I'm sympathetic to that argument. I'm sympathetic because the the the thing here is that I think core just simply has the the wrong priorities like it's always possible to do this and for the most part it always will be possible to simply say hey you've got a bunch of hash rate you're a miner can I pay you some extra money so that you put my transactions into your next block absolutely that's going to be possible that's always going to be possible bitcoin you you can't you can't say that someone's not allowed to do

Starting point is 00:47:26 that. That's the beauty of a permissionless system. The role that network defaults have is shaping behaviors. So for the longest time, arbitrary data stayed under 80 bytes. OpReturn was the solution to arbitrary data. And there was an agreement that 80 byte OpReturn is going to be relayed by the network. And people stuck to that. Every once in a while, you would get a miner a user in a miner that would agree to have a non-standard opera turn and get that into a block but it was rare and it wasn't the default it wasn't supported by the protocol and then we've taken that away and so the the governance piece the governance piece i hope this isn't too jumbled but the the governance piece really came to a head with core v30 when they decided to remove

Starting point is 00:48:14 the opera turn limit altogether that the default would be that there is no limit okay so let's just let all of these transactions relay as much as we want and there's no limit to that whatsoever and there was a massive massive pushback to that right a lot of users thought that okay us having the reference implementation for bitcoin bitcoin core can be considered the reference implementation the the descendant of the original software that satoshi created that turned into Bitcoin Core, and that has had over 80%, 90%, 95% of market share for the entire time until this whole furor, if you want to call it that. Bitcoin knots went from around 5% users to around 20% of the network. That's where it stands right now, is that users are saying,

Starting point is 00:49:05 hey, we don't want to have the default be that we relay all this arbitrary data. And who gets to make those decisions and all this. So you have users choosing to use a different form of software as a direct response to what Core has done. Okay, I'm going back to one of my initial questions. Who chooses the devs? Exactly. So the thing about this is that Bitcoin Core is a meritocracy per their own statements. They operate on a system of rough consensus, which is, this is another technical term that comes from the original panels that formed the internet back in the early 90s. That's where it came from. The working groups that decided how the internet was going to work. And rough consensus means that they're going to take into consideration the

Starting point is 00:49:54 voices of those who are inside, who are considered experts into the community, and these have to come to consensus for anything to happen. Now, in these changes, there was a lot of pushback and opposition, especially this opera turn change with Core v30. But they chose to still put in the opera turn change because they considered the group of Bitcoin Core contributors to have a rough consensus that the opera turn change was a good idea. Can you tell me how many developers there are in Core? Okay, well, that that is a little bit different. So 200, 500, 1000 plus, depending on how you're counting, anyone can contribute to Bitcoin Core. If you know Fractal and Crypt, he made the big circular art pieces that Michael Saylor has, for example, he went and

Starting point is 00:50:48 made a documentation change, he noticed something wrong in the documentation. And they and then they agreed that yeah this was a good change this improved something and they accepted that um that change who is they good point so there we go there are five to six i believe it's currently five maintainers of bitcoin core and this this comes down to a specific role in github which is the website that bitcoin is hosted in or you can go one level deeper and call it get the the protocol you have certain number of people who can sign a new release of the software five or six people yes five or six people and the majority of them now have come directly from this is probably what you're getting at two companies specifically uh you could call them two and a

Starting point is 00:51:36 half at the moment so it's brink chain code and spiral is the kind of the baby they're the one financing those people correct and that's why they are the ones that are able to continue holding those roles right maintainers and so the the the issue here if we're talking about a risk right so yes there's a there's a couple of things yes um i don't want to say that gloria jow is the only one who who is kind of the but she's a very good example of this sort of pipeline of going from a an internship with one of these companies a fellowship she had a fellowship with brink and then after not a very long time being a contributor to bitcoin core she was nominated to be the next maintainer and then when she decided to retire from bitcoin core only a few

Starting point is 00:52:26 months ago she nominated her own successor so which is another big problem yes exactly so we're talking about risks and defending bitcoin yeah so so so the thing here is that all of this is how do i call bullshit on all that stuff where do i do that on github i'm serious i'm like serious The fact that there are five people sitting there on an ivory tower, because some companies pay them, and they can also nominate their own successors. And this is supposed to be a decentralized global monetary system and our future and my son's future. I want to call bullshit. Where do I do that? Good. I asked that same question, actually. I'm sorry that I'm so, you know, hijacking your... it's perfect i i i asked that same question on x i did i i said what would it take for someone like me i've got a technical background right i i know how to read code whatever it is right

Starting point is 00:53:22 and what would it take for me to start to to have my voice be heard and so the thing is that there were there were people technical people who had github accounts that are years years years old that that were ignored in in all of these debates right because they're not regular contributors to So basically their answer is you have to spend significant amounts of time, over time, your own time, in order to contribute to Bitcoin Core before they'll listen to you. I call bullshit on that too, because if you have technical expertise in an adjacent field and again, like you said, know how to write code, sorry, know how to read code, know how to evaluate risks or understand technological implications and also economical and social implications. You don't need to write code for Bitcoin Core in order to be okay to make your opinion heard. Yeah, well, and I think I come down to that the division of labor is something really quite important here, right? Because we all contribute to Bitcoin or to the world in our own way.

Starting point is 00:54:29 You specialize, right? So it's not going to make a lot of sense to completely shift gears to working directly on Bitcoin Core. If you're already doing something, like, for example, with your show, you're reaching people. I believe that Bitcoin adoption, increasing Bitcoin adoption is way more important than increasing the use cases on Bitcoin, increasing the technical capabilities for doing these things like covenants or whatever newfangled use cases being suggested. These things are important. It's fantastic that developers are building new things on Bitcoin. But I think adoption is vastly more important to get more people using Bitcoin as money and bring them into the monetary system. So it's not going to make sense for you, Efrat, to go in and become a Bitcoin core contributor.

Starting point is 00:55:15 But that doesn't mean you don't understand Bitcoin to a certain sense. So I go into... You just opened a whole Pandora box for me, just so you know, just so you know. And I'm not sure that that's a good thing because I think I'm going to put more attention and more of my energy on that now. And I want to speak to the manager. You should talk to Hodlundot for sure. And well, you know, I want to balance a little bit here. I do want to say that from my perspective, there's nothing nefarious going on here.

Starting point is 00:55:47 Just the... How do you know? Exactly. I always want to be suspicious. I don't trust, I verify. I'm basically pissing off everyone here by kind of taking the position that's trying to be nice here. but the the the thing is the the problem to me is that this is not an open source software by any

Starting point is 00:56:05 stretch of the imagination the way it's currently run they have physical offices it's in new york it's in london it's in san francisco and these are people who they come into the like they don't do remote work they actually don't they come into they come into physical offices and they do the development together you have lunch break conversations john attack who you should talk to i don't know if you have john yeah okay good um yeah john john attack um is a is an x core developer who has his own story of kind of what went down he was on knut's podcast and he was on bob burnett's podcast i don't think he's done others but he has a great story about kind of what happened in in that development culture and states plainly that that some of the conversations

Starting point is 00:56:48 that were supposed to be out in the open were taking place on private signal chats instead or unverifiable in the lunchrooms or whatever the decisions were being made there. And there's a clear pattern of that someone makes a change who is affiliated with one of these organizations and if there's any pushback to that, that there is sustained opposition to whoever has pushed back, even if they're technically wrong. So there's definitely something going on there and this is my attempt to be as honest as possible here. I do believe that there are patterns of, say, nepotism or too much concentration in one organization here. You can just be looking at the numbers when you have five people doing a certain type of work funded by three companies, two and a half companies in a system that's supposed to be global serving millions, if not billions of people in the future.

Starting point is 00:57:41 There's a problem. Absolutely. Simple. And so in Defending Bitcoin, I lay out the timeline and Hodlinauts articles are an excellent place to go beyond this. I also welcome anyone from these organizations to come in and tell their side of things. But I do want to say that they're, especially on X, especially on some of these podcasts, there's an attitude of, well, we just know better. And if you don't like it, you can use another software. And you know what?

Starting point is 00:58:09 That's what people are doing. People are migrating to knots. not people there's there's funding of third implementations so production ready is is something that's samson moe and jimmy song are kind of i know there's other people involved but those are the two that that are kind of prominently going on shows and talking about this to to fund a third implementation for bitcoin right there are more implementations that exist but i think like anything else decentralization i don't want any one implementation to have majority market share of bitcoin node software yeah bitcoin knots is maintained by one guy right you think five is

Starting point is 00:58:45 bad that's also a risk yeah now the the the thing i think about knots is that basically he's just an extra level of validation on bitcoin core and he makes his own decisions i run knots i think knots is good for my purposes it's a slightly more not slightly it's a more conservative client that takes a more conservative mempool policy and i believe that's the right thing for me okay everyone has to make their own decisions that's the thing about bitcoin is that defending bitcoin whatever it is worth to you is up to you yeah all the responsibilities on you yeah and that's scary like it or not that's scary but it's freeing and the thing is you you this book i hope is is a way of educating bitcoiners on things that they might not know about and also

Starting point is 00:59:30 to be empowering. There's always something you can do no matter what. I agree with you. So this is a great way of kind of peeking into your very smart brain. So I'm glad that, you know, I pushed on that point more and more because that gives people an example of the kind of threats and risks that you are covering in this book. There are plenty more. I know that because I've read the table of contents at least that i can't wait to read the whole book will there be an audio version of it there will absolutely be an audio version i'll i'll record it so that you'll be speaking yes i will that's awesome yeah okay when i grow up i want to record audio books that's perfect that's just one of the things i thought about okay and um i have a last question

Starting point is 01:00:22 for you. Why do you care so much? Why did you write this book? I wrote this book and I got into Bitcoin because to me, Bitcoin is the only hope civilization has for getting out of this fiat trap, for the world to fix itself from having a system where printing money is just creating all of these issues, inflation and making life harder for those who don't have resources. I came from a situation where I didn't know if I would have a job in the next month, something like this. And I've always been thinking from a perspective of what's the worst that can happen. And I don't like to be a doomer or anything like this. I want to make it concrete. I wrote this book to show that Bitcoin is actually pretty darn resilient. And it is. Bitcoin is resilient, but it's only

Starting point is 01:01:13 as resilient as the individuals who make the decisions to keep it resilient. And I'm going to do something that I think I should have done in the beginning, but I'm going to do it now. I'm going to just read the back of the book for our audience. So Bitcoin secures over a trillion dollars in value. Isn't it closer to two trillion today? Yeah, probably something like that. It has no security team. It actually has no marketing team either. This is what I try to do. Defending Bitcoin applies the same frameworks that protect power grids and pipelines to the world's first decentralized critical infrastructure the full threat landscape is here exchange failures key mismanagement 51 attacks developer capture regulatory overreach quantum computing so are

Starting point is 01:02:01 the controls mapped to industrial standards with practical steps you can take today if you're a bitcoiner who wants to think like a defender or a cyber security professional who hasn't taken Bitcoin Seriously Yet. This book is the bridge. Fantastic. Okay, great. Defending Bitcoin will come out by the time this episode is out. Luke, where should people follow you? Yes, I am at Luke DeWolf, L-U-K-E-D-E-W-O-L-F on X. You can find me by my name on LinkedIn, etc. I am appealing to the LinkedIn crowd with this, my existing network of cybersecurity and tech professionals. DefendingBitcoin.com is where I want you to go. Okay. You can find all of the resources, extended resources from the website. I've got an interactive threat model tool on the

Starting point is 01:02:48 website right now. Nice. If this were coming out before the book is released, you can go and sign up for an advanced review copy. But if it already has come out, you'll find all the ways you can purchase it on Amazon or BitcoinInfinityStore.com would be my two recommendations. So on the website, there'll also be some type of forum or something like that where people can engage with you or with other people absolutely there's good there's going to be a tons of interactive stuff right now you can you can fill out your own threat model profile to understand how this book can apply to you the threats and controls and all this we don't collect any data though whatsoever if you want to sign up for the mailing list for updates and cyber security news you can do that but otherwise

Starting point is 01:03:30 we don't take any data i don't want to see what your situation is i just want to provide tools and the the entire book is going to be even essentially turned into an interactive tool on the on the website with all the threats all the controls and up-to-date new resources recommended reading all this so defending bitcoin.com is where i want you to go for more information fantastic we'll put a link to that in the show notes and to your profile as well you're a nostril too right of course primal.net slash luke there we go i got the i got the the four letter. Fantastic. Anything else you want to add before we wrap up? Go defend your money. Yeah, right. Go defend your money. Go defend your life. Absolutely. Thank you so much, Luke.

Starting point is 01:04:12 Thank you for having me on, Efrat. Thanks. Yeah. Thanks for being with us. Please take a minute to give this episode a like, comment, and subscribe, and hit the notification bell to be notified when I release my next episode. All this really helps me beat the suppression of the algorithms. Take a moment to check my sponsors and affiliation offers in the show notes. That's how you support me and the show, ensuring I can carry on with my mission. Lastly, please share this with your friends so they can also get value and choose to take some positive action. Till next time. Thanks for watching!

You're The Voice | by Efrat Fenigson - Is Bitcoin Compromised? - Luke de Wolf | Ep. 156

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.