⚡瞬天殺⚡🌋 retweeted
CVE-2010-5139 was fixed with a retroactive soft fork - 52 blocks worth over 2600 BTC to miners were WIPED OUT from history, and any transactions confirmed in that time were reversible.
It could have been fixed by simply voiding the UTXOs with the inflation, no reorg needed. But that would have been an actually bad precedent, and is NOT a viable solution to CSAM.
BIP110 is great because it avoids even the retroactive fix - by patching the bugs proactively, we can avoid ever having to roll back ANY blocks. Miners don't properly appreciate that by failing to activate it sooner, they have been playing with fire.
⚡瞬天殺⚡🌋 retweeted
My opening statement from this debate:
---------------------
BIP110 is a simple statement: "we reject Core 30’s proposed addition of data storage to bitcoin."
Bitcoin is money. That is the starting point. If we lose sight of that, we lose the plot.
The block size war was one of the defining moments in bitcoin history because it forced bitcoiners to answer a basic question: who is bitcoin for? Is it for large companies, exchanges, miners, and professional infrastructure providers? Or is it for ordinary people: pleb merchants, individual savers, and node runners, who need to verify the system for themselves?
In 2017, bitcoiners answered correctly. We rejected the bigblock roadmap because it put bitcoin on a slippery slope: whenever blocks fill up, make them bigger; when they fill up again, make them bigger again. That path leads directly to centralization. It prices out ordinary node runners, turns validation into a professional activity, and recreates the trusted intermediaries bitcoin was designed to eliminate.
But the bigblockers got one thing right: bitcoin must work as a payment system. Their mistake was thinking bigger blocks were the way to get there. The real path is conservative base-layer validation, combined with trustless off-chain protocols like lightning. That is how bitcoin can scale commerce while preserving decentralization.
The current conflict over data spam is part two of the block size war. Once again, the question is whether we prioritize node runners and people using bitcoin as money, or whether we allow other interests to consume scarce block space and raise the technical, economic, legal, and moral cost of running bitcoin.
The worst centralization pressure here is not merely that spam makes nodes more expensive (which it does). It is that arbitrary data storage creates the possibility of deeply harmful illegal material, including CSAM, being embedded in the chain. If that happens, fully validating archival node operators could be placed in the position of storing and distributing material they find morally abhorrent. Even if the legal analysis varies by jurisdiction, the social consequence is obvious: most decent people will not voluntarily run infrastructure that forces them into that position. Node running would become limited to large institutions with legal departments, specialized infrastructure, or people with no moral objection to hosting such material. That is an extreme centralization pressure, and it attacks bitcoin’s security model directly.
So the answer should be the same as it was in 2017: the protocol must protect node runners first. Pleb merchants, especially in poorer parts of the world, must be able to run nodes and conduct business without trusted intermediaries. If they cannot, bitcoin will become dominated by large corporations, custodians, and professional infrastructure providers.
That is why protocol changes should be rare and careful (unlike the removal of the opreturn filter). Unless a change is necessary to make bitcoin more useful as money, or to defend bitcoin against a serious threat, the default should be caution.
But caution is not ossification.
Bitcoin is not a museum piece. It is a living system in a hostile environment. If we pretend the current ruleset is perfect forever, bitcoin loses the ability to adapt to new attacks, incentives, and failure modes. Ossification only makes sense if the protocol is already perfect. It is not.
BIP110 addresses a real vulnerability: the possibility that the developers of the dominant node implementation adopt an ideology that turns against the user community they are supposed to serve. When the people maintaining the main implementation make it harder to run a node, harder to use bitcoin as money, and easier to treat bitcoin as generic data storage, node runners have a responsibility to respond.
This problem is made worse by a small number of influential developers who appear to have an effective pocket veto over consensus changes. They can support changes that create harmful unintended consequences, and then block or stall the fixes. That is an unhealthy level of centralization in the development process.
Core v30 was a breaking point. Before it, there was a delicate balance between consensus and policy: consensus was permissive enough to allow future upgrades, while policy was restrictive enough to discourage abuse. Now we are told that policy does not matter, that spam transactions should be treated like real payments, and that node runners should simply accept the consequences.
That argument is not serious. Core still maintains many policy limits. Nobody actually believes every possible transaction must be relayed and mined on equal terms. The question is not whether policy matters. The question is whose interests policy serves.
BIP110 is therefore a vote of no confidence in the current leadership of Bitcoin Core. Mistakes happen. But refusing to admit a mistake, refusing to fix the damage, and blocking others from fixing it is far more dangerous than the original mistake itself.
One side effect of that pocket veto is the bikeshedding treadmill. Leadership quietly opposes a fix, but instead of saying what would actually earn support, the discussion becomes endless nitpicking: this opcode, that activation path, this implementation detail. At some point, “review” stops being review and becomes a strategy for delay.
Ultimately, the node network does not need permission from Core leadership to defend bitcoin. Especially not when Core itself introduced or normalized the harmful behavior in question. BIP110 is on track to activate with or without their blessing.
And BIP110 is not merely defensive. I am very bullish on its activation because it breaks the consensus logjam, among other things.
Bitcoin needs other improvements if it is going to destroy the fiat standard. We need better payment systems. We need better custody tools. We need mechanisms like covenants, vaults, and more powerful trust-minimized point-of-sale systems. But the current process makes every consensus change feel impossible, because if any mistake is made, we are told we must live with it forever.
That is not conservatism. That is paralysis.
BIP110 shows that bitcoin can fix mistakes. It shows that unintended consequences from prior upgrades do not have to become permanent vulnerabilities. It shows that node runners can still act when the dominant implementation fails them.
So yes, I strongly support BIP110.
It reestablishes payments as the primary use case of the bitcoin blockchain.
It reasserts that bitcoin is money, not arbitrary data storage.
It protects node runners from being pressured into storing or distributing morally abhorrent material.
It reminds everyone that node runners - not developers, not corporations, and not miners - are ultimately in control of bitcoin.
And it proves that bitcoin can adapt. Not recklessly, not casually, but when necessary: to defend its decentralization, its usefulness, and its purpose.
Bitcoin survives because node runners enforce the rules. BIP110 is node runners enforcing the rules.
Thank you.
BIP 110 debate between @cguida6 on the side of BIP 110 and @SuperTestnet on the side against BIP 110.
youtu.be/qz-VdXUK8hY
⚡瞬天殺⚡🌋 retweeted
The Fed has never been independent.
With US debt-to-GDP over 120% and interest expense exceeding government receipts, "Fed independence" would mean interest rates define US economic policy, foreign policy and defense.
The Fed has never been more dependent. It’s just math.
⚡瞬天殺⚡🌋 retweeted
You own the Perrier company.
You sell pristine spring water in glass bottles.
Employee suggests replacing spring water with sewage.
Board says, “No; people want pure spring water”.
Employee says, “It’s all just molecules, they can’t stop us from bottling sewage and distributing as Perrier. We changed the definition of Perrier on GitHub, so it’s now true. Spring water is fundamentally the same as sewage. That’s the Science. Follow it.”
Employee is fired. Thanks from the board for your “insights”.
⚡瞬天殺⚡🌋 retweeted
That sure was an enthusiastic applause for @GrassFedBitcoin at @LuganoPlanB today. Gives me hope in bitcoiners 🙂
⚡瞬天殺⚡🌋 retweeted
I would not update to Bitcoin Core v30:
1. It was never a debate, a decision was made.
2. Users are not stakeholders
3. Devs do not understand limits of own wisdom.
4. It's not a solution to a problem.
5. Risk of unintended consequences
6. No incentive to relay large op returns!
⚡瞬天殺⚡🌋 retweeted
As a (hopefully) temporary measure, run Knots. I strongly recommend not upgrading to Core v30.
teapaw.org/NickSzabo4/status/1973…
It's a very well-publicized increase in the OP_RETURN allowance that very publicly invites more non-financial data onto Bitcoin. Even though apps can already put data in other parts of Bitcoin, this increase sends a signal inviting more such data. Without adding safeguards to allow archival node operators to non-disruptively delete illegal content for which they will often be held criminally liable.
⚡瞬天殺⚡🌋 retweeted
Fees protect the miners, but they don't provide enough disincentive to protect the full nodes. This has always been a problem, of course. But increasing the OP_RETURN allowance will likely make this problem worse. It also will increase legal risks.
⚡瞬天殺⚡🌋 retweeted
Dear @HRF,
I write this to you sitting in my San Francisco penthouse, barely surviving on my $750k salary as a Core developer. My fingers are worn to the bone after coding straight for 16 hours to remove various defaults.
We are experiencing an unprecedented crisis today, suffering unimaginable oppression under the heavy boot of distributed authoritarianism. Many of my fellow developers can no longer have consensual sex except for the purpose of reproduction, all because the Knots users are interfering with the consensual conduct of third parties.
We implore you to send aid immediately or it may be impossible to release version 30.
Thank you.
⚡瞬天殺⚡🌋 retweeted
That, but also:
> Luke sent the FBI after his fellow Bitcoin Core contributors
False statement. You provided no source to verify it, and I know the opposite to be true.
>Knots is a dangerous "solo dev" project that does not have the necessary level of peer review
Misleading statement, unless the same is also said about LibreRelay and Bitcoin Knobs, and much more emphasis is put on Btcd.
> He became much more vitriolic toward Bitcoin Core and now makes outrageous claims that it's compromised and trying to destroy Bitcoin
Qualified as your personal opinion, but logically contradicted by your own examples of him being *way* more vitriolic in the past with many (cf the Voorhes and Silk Road cases you listed, contrast them with his tolerance of libertarian claims more recently): by any metric I can think of, Luke has gotten way less vitriolic over time. In general, I'm not sure using dev political opinions to dismiss software (which is 99% of your pamphlet) is the game you want to play, in order to defend Core. Be my guest in case.
> abused his position of maintainer of the Gentoo Bitcoin Core package to enable his custom blacklist rules by default
This statement is contradicted by the following claim by Luke's own statement "it did not occur to me at the time that the spam filter was even included". You provided no source to verify otherwise.
> There is also controversy around Ocean's Datum protocol which is a competitor to Stratum V2
Misleading statement. DATUM *will be* a competing protocol to Stratum V2, once the latter will actually realize the miner-side-template-production. I think as of now OCEAN/DATUM is literally the only case of minin-side-template-production active on any pool. Even then, it will be a competing protocol, but not competition to his pool: Luke confirmed OCEAN will support SV2 as well once it gets traction.
> When you get into Luke's personal opinions on bitcoin mixing (further down) this particular decision will make more sense. [...] This is relevant to my earlier point about Knots breaking the Whirlpool mixing protocol. He doesn't care because he thinks mixing is wrong and people shouldn't do it.
False statement. Luke publicly stated support for coinjoin transactions in many occasions, and you provided no source of him saying otherwise, even if you claim you do in the first part of the mention. Indeed, Knots has always been relaying *all* coinjoin tx by Whirpool. It just happened that, for no good reason that I know of to this very day, some weird type of NON-coinjoin txs by Whirpool (tx0s) contained Op_returns uselessly larger than Core's historical limit (which was still Knot's limit).
> Luke appears to be a geocentrist. "By the way, the Sun really orbits the Earth, not vice-versa."
Misleading statement, since it insinuates this view is as unpopular as the others listed below (monarchy, masturbation, sedevacantism, etc.), at least among scientifically literate people. It's not. This seems to me to be a honest mistake based on your own parroting of the common "midwit-science" pop-view, naively misinterpreting pre-Einstein (but actually pre-Mach) Galilean relativity. In modern General Relativity, geocentrism is *literally* just as valid as any other reference frame choice (you just adjust the curvature and/or metric). Even if Newtonian physics, geocentrism is a valid choice as long as the Earth rotates to account for centrifugal forces.
> Where has a large portion of the social and technical community's time and attention been spent? I tend to agree that Luke & Co have been rather poisonous as of late.
False statement, offered without evidence, but also clear logical contradiction in the context of the panphlet. As explained (and paradoxically very well illustrated by your STASI-like dossier), Luke has been significantly *less* vitriolic and controversial than ever in the recent years and months. If large portion of the social and technical community's time and attention been spent supporting or attacking the claims of somebody with very low people-skills, who was traditionally ignored by most due to his unpopular opinions and eccentric personality, that's clearly caused by something else. I have theories.
⚡瞬天殺⚡🌋 retweeted
It's not the "faster block propagation" part that's the issue. I'm all for faster block propagation!
The issue is that the current method for getting there, compact blocks, is being used as a centralization tool. The FUD of "We must all run the same policies otherwise blocks won't propagate! 😱"
You clearly get the best compact block reconstruction results when your relay/mempool policies match that of miners.
The problem with that is the dynamic of who runs the network gets flipped. It's supposed to be node runners calling the shots, not the miners. The miners work for the network, not the other way around.
The better compact block reconstruction is, the more node runners have conformed to miner policies. That's centralizing. If compact block reconstruction were 100%, we might as well be PayPal. Who needs miners when everyone agrees on transactions?
You don't chase what miners are putting in blocks and adjust node policies accordingly, like Core devs have been FUDing for a while now to justify spam and worse.
Instead, the P2P network of node runners should set sane policies, and miners who act against the collective will of the decentralized P2P network SHOULD be penalized for mining blocks that don't fit with the majority of nodes in the form of slower block propagation and higher stale rates.
If you're a sane miner, you go with the overall will of the network itself (node runners) and get some benefit from the associated speedup. If you go against what the majority of the network is willing to relay and still want to spam the network, then you get penalized in the form of losing blocks to slow propagation.
Pretty simple economics that have worked fine for the last 15 years, yet all of a sudden Core devs are trying to flip that on its head and tell you that you must relay garbage for the good of faster blocks!
Insane.
⚡瞬天殺⚡🌋 retweeted
The default on the op return filter has not changed yet (to be released) and I'm saying if the tolerant minority sets the policy limit, why is it necessary to change the default? Why not let nodes organically switch.
⚡瞬天殺⚡🌋 retweeted
Ok, I had little bit more time today. Before I post an update on the main tweet (happy to do it), I want to be sure to do it once, so I can keep it pinned for a while and correct any misrepresentation. Let's do some more back&forth now so we reach as much objectivity as possible.
1) We agree that, in 2014, v0.10.0 simultaneously relaxed the P2SH limits and added the -datacarrier and -datacarriersize options. It's true the only imagined "data carrier" for the author seems to be the op_return. It's also very clear that the author considers larger sizes "unacceptable" for an output ("maximum size, in bytes, we consider acceptable for data carrier outputs"). It's not entirely clear that the fact that the simultaneous relaxation of IsStandard() rules for P2SH redemption scripts is predicted, let alone intended, to facilitate standard data carriers in the input. That seems a bit inconsistent with the language used for op_return, and makes that limit completely irrelevant (unless the implicit rationale was to incentivize input-data over output-data, which is weird considering op_return was made to be easy to prune from UTxOset anyway) and sounds more like an unintended attack surface opening. I wasn't able to find any explicit mention about such an intention, and many current proponent of the reduced role of mempool policies for spam prevention today expressed opinions in the opposite direction back then.
2) We agree that, in 2015, you included a tool to demonstrate generic data publishing bypassing datacarriersize limits in the examples for your python-bitcoinlib library. Well before SegWit and Taproot indeed. The rate could not be "just as much" as the spam attack I'm discussing in my post, like you claim, because consensus limited it at 1Mb before the Witness discount. Still, it was bypassing the datacarriersize option entirely, most likely against the intentions of who created such option, logically. It's true that Luke didn't propose a fix back than, but that's not an argument for it being intentional or by design. For sure it was not bad for devs, like you, considering incentive-incompatible mempool policies doomed and harmful anyway. But it still sounds fine to call it an unintentional bug.
3) In 2023, Luke *did* propose a fix to it. It's clear the relaxation it talks about is the original one, but it's also clear that *after* SegWit the potential spam-rate from exploits passed from 1Mb to 4Mb due to the discount, and that *after* Taproot there were now *more* "newer datacarrying styles" to update datacarriersize for. In no part of the PR Luke claims that Taproot itself, or Segwit itself, are the exclusive origins. Taproot is just the last step in a series of cumulative (and most likely unintentional, at least for most developers, possibly including him) ways to completely bypass and render moot the datacarriersize option. I don't see how the wording "" could be interpreted specifically as "harrassment". I tried to also clarify that I don't think Taproot itself has anything relevant to do with this. My claim is that the bug was "not connected with Taproot itself", but that it "defused one such filter (datacarriersize) for some txs". I accept I should have clarified further, and I will. But I still don't see how the Taproot reference alone could be used for harassment.
4) After Luke created the PR (github.com/bitcoin/bitcoin/p…), for a while nobody contested the unintentional nature of the bug. Glozow just asks to add some tests. 8 contributors (including the very same portlandhodl that claims we should not consider a contributor at all) agreed with her via emojis. On the following days, other 6 contributors interacted with the PR without any controversy about the unintended nature of the exploits. Only several days later, you gave your concept NACK, with the following wording: "the transactions targeted by this pull-req are a very significant source of fee revenue for miners. It is very unlikely that minres will give up that source of revenue. Censoring those transactions would simply encourage the development of private mempools - harmful to small miners - while making fee estimation less reliable." You are making a case (imo using the totally absurd term "censorship", but that's a separate discussion) for not filtering stuff that miners want, due to the risk of private mempools (ironically, today the job of the very same portlandhodl). 13 other devs NACK with you, 10 ACK. None mentions the bug definition as problematic.
5) Months later, glozow summarizes all the reasons for ACKs and NACKs. Nobody says that ways to bypass the datacarriersize option were intended by the v0.10.0 contributors who created the option in the first place. Even murchandamus, who brings for the very first time the argument of the datacarriersize option only referring to op_return (as in the release docs you mentioned, indeed), just makes economic arguments about *why* the previous rationale for filtering doesn't apply *anymore*, so it's ok not to update the option. Then achow101 closes the PR since it's "controversial". Not because the bug doesn't exist (curiously, controversy will not be reason enough to close more recent PRs, since now it gets redefined as "brigading").
6) Months later (github.com/bitcoin/bitcoin/p…), the documentation gets changed to agree with the behavior.
⚡瞬天殺⚡🌋 retweeted
From 2010 until 2022, Bitcoin used spam filters to keep garbage out of the chain. Despite that, the blockchain has grown far faster than technology can keep up with.
In 2022, the "Inscription" exploit was discovered, and we now have 2 full years of its damage to observe. Anyone who has synced a node recently can attest to how terrible it's gotten.
Bitcoin's greatest threat to survival is that far too few people are using a full node. For Bitcoin to work, at least 85% of economic activity needs to do so. As a result, Bitcoin is _likely_ going to fail already - it's an uphill struggle.
What do you think will happen now that Core is opening the floodgates to spam, and essentially endorsing it? (No matter what they say, that's how spammers will take it.) Any chance we have of making Bitcoin a success will go out the window - unless the community takes a clear stand and rejects the change.