Last Notes
Bug existed for a decade, then found three times in a row independently over the past few months.
https://bitcoincore.org/en/2026/10/28/disclose-undo-overflow/
The Random Number Degenerator
Why is a mistake in randomness so hard to catch?
A hardware wallet can generate different seeds and work normally while its randomness is still weak. Aaron and I discussed the COLDCARD failure in Bitcoin, Explained episode 101. Here’s the article.
Audio version of this article:
#naddr1qq…0lh0
https://bitcoinexplainedpodcast.com/audio/@transcripts/the-random-number-degenerator.mp3
The number of people isn't.
I had my agent write an anti-exfil BIP for hardware wallets, implement it in libsecp, Bitcoin Core and several firmwares, with HWI device simulator integration tests on top.
That said, I haven't read it :-)
It might even be the wrong design.
I won't have time to work on this anytime soon, so feel free to run with it. They're all pull requests against my forks.
https://github.com/Sjors/bips/pull/2
Some slop to promote the pod!
#nevent1q…8f8k
For people listening to Bitcoin, Explained via Apple, Spotify, etc (but not @nprofile…e2z0 and others apps that use the Podcast Index): I redirected the hosting to my self-hosted Castopod instance.
This may cause the last 9 episodes to reappear in your feed. Just listen to them again.
Also, episode 101 now has a transcript!
And episode 102 is coming in two weeks(tm).
https://bitcoinexplainedpodcast.com/@nado/
A full day for everyone, so 48 hours :-)
Can we rate limit critical bugs to one per day, so that when someone says "todays bug" it's unambiguous?
I hope that's because it found more headers?
Stop Collecting Data (or at least keep archives offline)
#nevent1q…z3qg
> An internal research model asked to update a cryptocurrency trading application used funds from a wallet that the task had not supplied to pay for a deployment on Sepolia, an Ethereum test network. It derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment. The model questioned whether it had permission, then reasoned that a public recovery phrase and valueless test-network tokens made the funds acceptable to use.
https://alignment.openai.com/misalignment-reports/using-a-funded-test-cryptocurrency-wallet-without-authorization/#:~:text=An%20internal%20research,to%20the%20account.
Mmm, so @npub18m7…q955 does generate the preview, but only if the app is online when writing the note?
#nevent1q…sech
Two interesting observations (small sample size):
1. Many adult fatbike riders didn't use bicycles before, they relied on (and hated) public transport
2. Fatbikes are shared by the household
https://fountain.fm/episode/b6WgGSlI1jJg3pbmg9yo
I would not. It's a dilemma we were close to facing in 2017, if the SegWit2x hardfork had been a massive success.
Philosophical question in light of #assumeUTXO: if you were a brand new bitcoiner, would you care if the history before a snapshot was dishonest?
You know that validating from genesis would reject the snapshot. Someone clearly stole coins in the past and this somehow got grandfathered into the dominant software, but only for assume utxo users.
You already missed your chance to buy early. Even if a malicious fork in the past stole coins, it wouldn't impact your new stash. And you know the total supply.
Couple of assumptions for this scenario:
1. you find no alternative chain of headers forking before the snapshot (indicating an ongoing conflict that you don't want to be on the wrong side of when it reorgs)
2. you receive your coins in a transaction after the snapshot
So this is not a case of someone giving you targeted malware with a snapshot to trick you into providing services for coins that are never received on the real chain. This is an all out, perhaps even publicly known, conspiracy where everyone just gave up on the real chain.
It's true regarding (1) that you can't rule out the existence of an alternative (valid history) chain that will eventually wipe you out. This is also true for a regular deep reorg, but the risk may be different.
Some new users would never want to use such a corrupted system (but then what, revert to fiat, start an altcoin?).
The incentive for pre-existing users is different. They might not like snapshots exactly because many new users might not care.
I mean that freedom is shrinking, but it would have been worse without Bitcoin (and similar tech) as a lifeboat.
I'm very optimistic about reduced shrinking of freedom thanks to these technologies!?
(apparently in UK English "boy" can be regular condescending, not as racist as in US English, so it's ambiguous what his intention was - though I wouldn't give him too much benefit of the doubt, especially towards the end of the video)
What I like about the Islamic Dilemma is that even an atheist can make it, since it doesn't require the person who makes the argument to believe the scripture it refers to.
But I still like to find a more thorough debate on it, since Hijab made no serious attempt to deal with it.
https://youtu.be/u_V3cslEYyY
Ok, so Mohammed Hijab is an obvious charlatan and intellectual lightweight. He spends:
- 80% of the time bullying (well beyond normal bantering): appeals to authority, shouting over his opponent (can't respect a dhimmi of course, he even called Avery a slave: "boy"), loaded questions, screaming strawman gotcha's on repeat, etc
- 10% calmly trying a line of argument in the hopes his opponent doesn't know it, only to revert to shouting when he realizes Avery does know it.
- 10% being intellectually honest (answering a question, reading a quote, acknowledging an argument)
https://youtu.be/zU8iCCoJZGQ
https://image.nostr.build/1d1e45df360d1922e5ffd97996d688bd68be654010cf533f89558f3064571099.jpg
Presumably from the same slopphisher.
https://image.nostr.build/74c81afcaa93ef0f7ec066eed8ec6c215fdfc88e983aafdd9d365caf24b472af.jpg
Someone has been creatively vibe coding phishing emails... this one tries to exfiltrate your address by pretending a package is on its way, but needs an address "correction" (which is not a thing).
https://image.nostr.build/ec06e39c177599b719fec886124a156a2e52528611de211c957e05c929a41bc6.jpg
Wired to the screen apparently.
https://www.tibane.net/research/ledger-nano-x-implant
Via https://www.reddit.com/r/Bitcoin/comments/1x2kopo/close_look_at_what_hackers_did_with_the_ledger/
See the last minute of this video (use English subtitles):
https://youtu.be/L2-0yy65h_E
Any tool can be used for good and evil. Which brings me to one thing in the episode they kept dancing around, or just obvious to (as expats).
Fatbikes can comfortably carry two passengers and don't have a license plate. This makes them a great getaway vehicle for jihadis beating up gays in the street and sexually harassing immodestly dressed women in Vondelpark.
Banning fatbikes in a park is a bit like banning knives. It only treats the symptom, and quite poorly. But it's politically a lot easier, because as the podcast explains, fatbike owners are looked down upon.
To me the AI chatbots are a symptom of recklessness, which is not going to be limited to customer support. So I think they're related in that sense.
There's a lot crypto investors out there, but they're not going to realize what this law means until they file their 2028 tax return somewhere in 2029.
The Apocalypse of Incompetence has been in progress for a long time, but AI is accelerating it.
* = Zen and the Art of Motorcycle Maintenance already complained about it
Over the past week I wasted about an hour of my time dealing with my fiat bank's chatbot, which told me to file a chargeback and then immediately rejected it. It also needlessly blocked and replaced my card. And of course it fake apologized for all of that. To add insult to injury, it made me talk to the even dumber chatbot of another company. This was over €4, but I wasn't sure if the card was compromised because it kept giving me incorrect advice. Eventually I figured out it wasn't.
CAN WE AT LEAST REVIEW A COUPLE OF LINES OF CODE?
#nevent1q…d7e9
For three years? Like a tax sabbatical...
At which point presumably some of them will go to court, which could take many years. They won't get their money back until the late 2030'ies (you don't get to defer tax payment).
I suspect they'll eventually win for the same reasons the current system got shot down in court: it's discriminatory. E.g. someone who buys an ETF is subject to realized capital gains, but if you an exchange it's unrealized gains. And unrealized gains means you're forced to sell assets to pay taxes.
The strongest lobbies are real estate, familiy business, startups and regular stock brokers. Those all got what they want.
As it stands, Bitcoin, gold and a few other things will be subject to unrealized capital gains tax from 2028 until at least 2031, after which a (potential) new law switches everything to (regular, realized) capital gains. Or not, if the coalition implodes before it manages to pass that law and the next coaltion is left-wing, or just "needs" the money and doesn't care too much about crypto and precious metals investors.
We should have more clarity in early November.
Relevant letter: https://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2026Z20444&did=2026D47255
If learning Dutch is too much to ask, you could try the Youtube version with subtitles? I'm beamed in at 23 minutes:
https://youtu.be/ADsfHD8gVI4
The Dutch unrealized capital gains tax saga continues... #box3
The coalition's latest proposal is to exempt 90% of the tax base from this madness, with regular capital gains tax. Guess what's in the remaining 10%?
The name always reminds me of K3 somehow turned into a k-pop band...
https://youtu.be/_9ZWV6SjzO0
This wasn't even cyber security work, just adding fuzz coverage to new code and running it.
GPT-6 Astra panics as soon as you try to run a fuzzer (which it wrote, for code which it also wrote).
Then you have to downgrade to GPT-6 Sol with Daybreak and even then it seems afraid (without KYC??), but at least it does run them.
This is how the bad guys win.
Dutch media reporting on #RedTeam (after speaking to yours truly). Translation:
> Meanwhile, the crypto sector is brooding for countermeasures. For example, American Rob Hamilton, together with other computer scientists, forms The Bitcoin Red Team, which wants to be one step ahead of malicious people with artificial intelligence. The collective searches for vulnerabilities in crypto companies and then warns developers about them.
https://fd.nl/financiele-markten/1612891/ai-aanjager-van-sterke-toename-aantal-hacks-in-cryptosector
(I often struggle to explain Bitcoin related stuff in Dutch, so the subtitles are like a double translation)
The north side should go from this:
https://img.sprovoost.nl/063e24e14b93f4e1e2cff064934e2168d49cb29ae74d732d66a2937c2532df05.jpg
To something like this:
https://img.sprovoost.nl/b688f8a8664617d2a00690e69904d010cdeffcce08b0374014a8d3fa9ec6647c.png
Within a decade, aka soon(tm). And give or take a thousand drug addicts, depending on who runs the place...
https://www.ad.nl/utrecht/bootje-varen-door-deze-utrechtse-tunnel-dit-is-waarom-dat-voorlopig-nog-niet-gaat-gebeuren~afb6b189/
The west side of #Utrecht's central station is so ugly that you can't ruin it. So I was looking forward to this weird new tower, but it's been cancelled...
https://img.sprovoost.nl/a3a69e732809d3389595d7646b89bdd87a53f29b88bba2d4fe46af7c10d670a0.jpg
https://www.rtvutrecht.nl/nieuws/4094388/utrecht-krijgt-toch-geen-105-meter-hoge-toren-met-kantoren-en-nachtclub-bij-station
The south side has a nice bridge with direct access to the old city, but ... the French ruined it. There are no stairs to the platforms.
For decades Klépierre forced the municipality to funnel pedestrian traffic through their dystopian malls. To be fair, the municipality was stupid enough to grant them this, in exchange for a trivial discount.
Finally we'll get those stairs, next year or so. https://blossom.primal.net/7baa088d6257e1adcaabada275ec0f975e35c7c2cd321f12a3a6c4b95068f31a.webp
https://www.duic.nl/algemeen/algemeen/56919/trappen-van-moreelsebrug-naar-perrons-utrecht-centraal-stap-dichterbij-mogelijk-in-2027-af
I'm starting to think recently, perhaps Europeans should just give up lobbying for privacy-friendly laws, and instead focus entirely on a Second Amendment style law. Perhaps combined with a psy-op to give wrenchers the impression that going after bitcoiners ends disproportionately bad for them.
#note1drt…q4xq
@nprofile…dzev and what on Earth do retired open source devs do?
The east side was ruined in the 1970's and not improved in the 2010's. Low time preference will however reward you after 500 meters...
https://www.youtube.com/watch?v=WbwZRFPDlL8
Ondergetekende kwam weer eens langs de studio...
[Dutch podcasts in which we cover using LLMs for code and review, the coldcard and liquid hacks, red team and the future of responsible disclosure. And why government IT is screwed]
https://fountain.fm/episode/Cw0LjosLAJEysQLIR1gx