Ryan Lanman (@ryanlanman1) header
Ryan Lanman (@ryanlanman1) profile picture

Former PM for @bitkey at @block, taking a break to connect with family

San Francisco, CA
Joined January 2013
Photo by Ryan Lanman (@ryanlanman1)Photo by Ryan Lanman (@ryanlanman1)Photo by Ryan Lanman (@ryanlanman1)
Ryan Lanman retweeted
please if you are in crypto, and *especially* if you are in Ethereum, read this thread it's a 'nature is healing' moment from Vitalik and is saying so much of what a bunch of us ETH holders have believed for years...even some of the REV maxis from last cycle are having a similar realization now with Zcash P.S.: I think on fundamentals ETH can be a much better SoV than both ZEC and BTC, though I'm in ZEC now as well...the fundamental question is whether smart contracts are a help or hindrance to SoV (and Vitalik himself lays out the dilemma well below) and there is a bunch of theory around this, but I lean that net/net they are a help because it means you potentially never have to exit that hard-money CROPS ecosystem to use your money privately & keep it private...and *use* means more than just 'spending' . . .
Expanding on why I believe "ETH as store of value (SoV)" makes much more sense to focus on than "ETH as fee-burning token". Three primary reasons: 1. ETH as fee-burning token never was as strong as it seemed 2. Optimizing for ETH as fee-burning token would demand Ethereum and ETH function in ways that are very hard to make compatible with decentralization and capture resistance. 3. Meanwhile, optimizing for ETH as SoV is aligned with Ethereum focusing on its unique strengths (decentralization and CROPS) EIP-1559 (including its burn) is fine and good, we should keep them. But we should not feel sad if fee burn is < 10% of breakeven indefinitely; the value of ETH comes from elsewhere. The core idea: the big thing that people appreciate about Ethereum is decentralization and CROPS. The main pragmatic benefit that these things translate into is stability. SoV is the category where that is not an unneeded extra we merely put effort into for ideological reasons, but rather a pragmatic strength from the perspective of people putting in their assets. And in the era of AI disruption, stability will be highly valued.
54
45
5
697
52,021
Ryan Lanman retweeted
Look, man, work from home is better for me too. Obviously it’s more convenient. Obviously it’s nice to be able to do laundry in the middle of the day. There’s no contingent in this argument who thinks otherwise. Like, nobody is confused about the individual utility of working from home. But some 23 year-old living in a new city after college doesn’t actually have that much laundry to do. They need opportunities to network, to meet people. They need to be out in the world. They need to be doing things. They need a world in which to exist that’s outside their bedroom.
88
49
9
1,861
46,463
Ryan Lanman retweeted
Announcing LayerTree: a new tree-based scaling solution for Bitcoin that permits O(1), independent of the number of users in the system: teapaw.org/lightning/status/21108… A single UTXO can hold the balance of millions of users as an off-chain Merkle-sum tree. Transaction introspection techniques permit batched exit from the system in a single transaction w/o any pre-signing: layertree.tech
Introducing LayerTree, a non-custodial scaling solution on bitcoin that connects to Lightning. Using covenants, one UXTO can be shared by a million users. Any user can leave at any time in a single transaction. Users don't need to be online to receive. Funds never time out. LayerTree is the next step in bringing bitcoin to billions. Learn more: layertree.tech
58
125
24
493
47,322
Ryan Lanman retweeted
Dear Secretary Bessent @SecScottBessent, My name is Everett Stern. In 2010 I was a compliance officer at @HSBC. From a back office in New Castle, Delaware, I watched billions of dollars move to drug cartels, sanctioned regimes, and terrorist organizations. The enemies of the United States. I documented it, I escalated it, and when the bank would not act, I took it to the @FBI, the @CIA, and eventually the @SECGov. The result was a $1.92 billion settlement. At the time, it was one of the largest in American history. It was also about five weeks of the bank’s profit. Not one banker was charged. Not one went to prison. I paid a different price. I lost my career, my savings, and my place in the industry I had trained for. I was blacklisted. Every door in American finance closed at once. I slept on a camping cot in a 300 square foot apartment because I could not afford a bed, and I waited tables at @PFChangs to eat. I tell you this not for sympathy, but so you understand that I know exactly what it costs to do the right thing in American finance, and exactly how little the system does in return. I made that sacrifice because I believed it would change something. Yesterday, your department fined @BankofAmerica $1.2 billion for failing to report more than $5 billion in suspicious transactions, some of it tied by your own findings to Chinese laundering networks, narcotics, and the southwest border, alongside 475 apparent sanctions violations touching Russia, Iran, and global terrorism. The bank admitted it willfully violated the Bank Secrecy Act. Fourteen years after HSBC. A bank with “America” in its name. And once again, not one individual charged. Secretary Bessent, I want to say plainly what I believe you already know. The fines are not working. A fine is paid by shareholders, absorbed by the balance sheet, and forgotten by the next earnings call. Bank of America reported earnings this morning. Nobody who set the alert thresholds, nobody who decided the 2024 cease and desist could wait, nobody who chose the backlog over the law will lose a single thing they value. Their lives are untouched. That is the entire reason the behavior repeats. This is money laundering. This is blood money. Money that reaches a cartel buys fentanyl that kills Americans. Money that reaches a terrorist organization buys the next attack. This country has fought a war on drugs and a war on terror for decades, at enormous cost in lives and treasure, and all the while we have allowed the financing to flow through institutions we charter and regulate. Cut off the money and we win. We have never seriously tried. There is also a question of equal justice that I cannot let go. Before I walked into the FBI building to report HSBC, I stopped in front of the Great Seal on the wall and read the words engraved beneath it: “Justice is the defense of our liberty.” I believed that. I still want to. But every day in this country, people go to prison for crimes that are nothing next to moving money for the people who want Americans dead. A suit, a title, and a corporate badge should not be a shield from the consequences that apply to everyone else. If a street dealer goes to prison for what he sells, the banker who moved the cartel’s money should be standing next to him. I also want to raise something that is rarely said in these conversations. Why has no one inside Bank of America come forward the way I did? The answer is that everyone in American banking knows what happened to me, and to the whistleblowers who came after. The last person who spoke up is the only policy anyone believes. That is a culture problem, and it starts with leadership, in the banks and in the agencies that regulate them. This is not a political issue. It has spanned administrations of both parties. It is a national security issue, and I am asking you to treat it as one. Three things would change the math overnight. Refer individuals for criminal prosecution. Not the analyst in the queue. The executives who set the thresholds and chose the risk. One banker in handcuffs would do more than every fine in Treasury’s history combined. End “too big to jail.” An institution cannot be too big to fail and too big to jail at the same time. If it is the first, it must be held to a higher standard, not a lower one. And if Bank of America will not act as America’s bank, review its charter. A national charter is a privilege granted on behalf of the American people. It should be conditioned on not moving money for the people trying to kill them. Secretary Bessent, you said yesterday that these actions send a clear message that even the biggest institutions are not above the law. With respect, the institution was never the problem. The people inside it are above the law, and they know it. Until that changes, I will keep writing letters like this one, and the next bank will keep paying the next fine. I gave up everything I had to stop this. I am asking you to use the power you have to finish it. Respectfully, Everett A. Stern HSBC Whistleblower Founder and Intelligence Director, Tactical Rabbit
3,181
30,688
2,545
94,582
3,759,294
Ryan Lanman retweeted
5/ Progress on insane galaxy brain math that nobody cares about, much less understands, does not indicate that one of the most studied, most widely deployed, and most important mathematical objects in the history of humanity is at risk.
2
11
1
112
27,635
Ryan Lanman retweeted
covenants on bitcoin
51%yes
12%no
37%no idea / show
1,049 votes • Final results
27
11
8
54
25,491
Ryan Lanman retweeted
This might seem nerded out, but the ability to run a node at home from anywhere in the world is one of the things that gives your crypto physical properties. It means that you can *physically* verify for yourself that some random bits on a network in the cloud belong to you. More important than actually running a node, is the *option to* run a node. To quickly sink up with the chain tip from anywhere in the world with just a laptop. It doesn’t mean everyone will do it, but at least they can if they want to. Kind of like a fundamental right. A constitutional amendment. That’s what separates blockchains from databases at the end of the day.
Reminder: you can now sync an ethereum node within half a day and with aggressive settings the space it takes up on disk can be under half a terabyte. EIP-4444 and hard work by client teams on optimizing snap sync has improved things *a lot*. Glamsterdam will improve the sync situation further still (eg. Nimbus's new sync protocol uses it)
10
13
146
5,537
Ryan Lanman retweeted
While I deeply respect the cryptographic research that @nemothenoone and the @allocinitxyz team are pursuing to enable covenants on Bitcoin without a soft fork, it’s worth emphasizing that the cryptography underlying this approach is still highly experimental, and its security assumptions are far from established. It will likely take years of research and scrutiny before there is enough confidence in these constructions for use in Bitcoin applications — and realistically, that confidence may never materialize. I love the boldness of their vision and I’m impressed by the progress so far. At the same time, I think it’s important that the community has a clear understanding of where the research currently stands and how uncertain its practical viability remains from a cryptographic perspective.
Shielded Bitcoin: Private Transfers on Bitcoin L1
29
47
14
361
27,292
Ryan Lanman retweeted
If you are the hacker in question and you are reading this, and you are genuinely a white hat, please reach out to me. I’ve worked with white hat hackers in analogous situations, and there are options for returning the funds in a way that protects everyone involved and minimizes unnecessary legal risk. Send me a DM.
It looks like ~4,000 BTC just moved from the Liquid Network bridge all at once with an OP Return saying, "we are whitehats. contact us on chain". TXID: c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19
39
53
5
418
76,001
Ryan Lanman retweeted
We’ll be sharing more about this soon. But internally nobody that can push app code can push server code to production. And nobody that can push app or server code can push firmware code. And you need at least 2 people on the Bitkey team (not anyone at block) to push to any of them. Nobody is in more than one group. So for rogue employees to write code that attempts to compromise two keys would take collusion of at least 4 people just to attempt it. But in reality even more because our security team at Block (outside of Bitkey) controls gates that review all code with LLMs before they go into the release and if it finds a security issue it blocks the release PR from merging. So now you’ve got probably 6-7 people on the mix. Plus if it were done through our normal release pipeline any Android code that’s malicious would be pushed to the public to create visibility. We have people scanning our public repository constantly. Both internally and externally. And our mobile app is 98% shared mobile code via Kotlin Multiplatform. Which means there’s no iOS only repo to go make changes in. You’ve gotta then find a way to get malicious iOS code into the release pipeline and you’ve still then only got a shot at one key in this hypothetical situation. Our release pipeline is also hardened in that we do reproducible builds internally. So we build the version of the app in 3 distinct build environments and if any of them don’t match the others it halts. Ok so now you’ve gotta find a way to compromise 3 distinct/different build systems each with their own security pipelines including one run in the local machine of the release manger which changes hands periodically, and do in a way that’s not detectable to all the layers of safeguards we have. And that’s still just trying to get to one key. And if you think that’s me trying to shut down a conversation about possibility space, I’m not. I’m saying rogue Bitkey employees doing this would be extraordinarily difficult. We all see each others’ PRs. We all helped build these safeguards because don’t trust verify is in our veins. And yes I know this does not fully address what if Block decides to risk its Fortune 500 business on rigging its own customers. If that’s what you’re worried about, keep reading. Long conversations about possibility space is what this team thrives on. And we’re never done. Which means we’re looking at ways that you wouldn’t even need to trust me on the above to get the protections against app-key compromise some people in this thread are asking for. Hence our discussions on a two hardware option for those that care a lot about this specific area. And some other interesting related ideas we’ll share if they pan out. Whatever you do, whether you choose Bitkey or not, go with a solution built by people that care this much about protecting you from themselves. Hope this helps!
15
12
7
140
27,979
Ryan Lanman retweeted
Lots of people have been asking for a demo of Bitkey's Emergency Exit Kit. So here it is! This is the way you can move your funds if access to the official Bitkey app ever becomes unavailable to you for any reason.
46
62
12
411
103,205
Ryan Lanman retweeted
Unpopular opinion: word choice isn't the hardest problem we should be solving in self-custody right now
Unpopular Opinion: We should rename “Bitcoin hardware wallets” to “Bitcoin signing devices.” It’d fix so many problems in understanding for Bitcoin beginners and make it evident why a passphrase is needed. Everything is a @SeedSigner with extra steps and tradeoffs.
5
4
68
7,918
Ryan Lanman retweeted
On a couple of occasions, wallet scrutiny has spotted a hiccup in our reproducible builds and every time it’s helped us harden our pipeline. For example we now have a nightly job that ensure the job is reproducible and we get pinged in Slack if it fails. This is a security win for everyone and having public accountability makes the software safer IMO.
Just wrong and misinformed. When we pinged @nunchuk_io they were able to ship a reproducible build in less than a week. Reproducible builds *is* the first step towards security. Moreover, we don't ask people to trust our findings - we encourage them to verify themselves.
1
3
37
3,852
Ryan Lanman retweeted
We understand the bitcoin community is seeing more Bitkey content in your algorithm. While our team is flattered, this is not a "psyop." We have not changed our marketing in recent weeks. However, current events have led to many new people discovering, using, and discussing Bitkey as a solution to several common self-custody problems. We will continue to help securely store your bitcoin as we have for years. We also reserve the right to tell people what we have built, what we are going to build, and why. To our longtime customers, those who have just joined us, and those still exploring self-custody solutions, our team appreciates all your questions and comments. Please keep the feedback coming.
53
26
7
492
52,061
Ryan Lanman retweeted
Let’s take em one at a time! First, the fingerprints never leave the hardware. We don’t want your biometrics. Your data is yours. We are very data averse. Theres no KYC, we cryptographically can’t see transactions we’re not a part of co-signing. This is something Bitkey engineers cared about so much that we invented and implemented Chaincode Delegation to blind ourselves. And then gave it back to the community as a BIP. We explicitly track no analytics in money movement flows so we don’t even have the capability of tracking your spends with the app and hardware. The code is open source so you can point an agent at it and have them verify. If this doesn’t ease your mind, would you mind sharing more about what would? Do you also feel like services like Nunchuk and Casa are sus because one of their keys is on your mobile phone? Do you feel like the entire collaborative signing industry is doing it wrong? Totally understand if so! Just trying to learn more.
11
6
3
55
13,821
Ryan Lanman retweeted
Far too many people previously dismissed @Bitkey because of group-think We've changed nothing about our approach: engaging diligently, answering all concerns transparently, winning trust in a time of panic And now many people's eyes have been opened that it's a great product
What's up with this sudden Bitkey shilling by some many account i never seen before. Anyone else have their timelines filled with Bitkey shilling? Something feel's very off about this.
31
16
6
278
89,279
Ryan Lanman retweeted
I had Kimi K3 audit @Bitkey published code, firmware & legal docs. Verdict: Block (or a govt leaning on them) can't steal keys or freeze funds (per published source code) Weak points: fingerprint unlock, data trail, unverifiable iOS app. Full analysis 👇
14
17
7
88
22,576
Ryan Lanman retweeted
Those who wasted our time and energy with BIP-110 are not going to tell us what to focus on. Bitcoin needs a great consensus cleanup and covenants. Possibly a few more optimizations. Just because the most retarded update in Bitcoin's history has failed, doesn't mean we need to slow down. The great crashout of the incompetent is over. The engineering mindset must take over now.
48
50
9
771
35,448
Ryan Lanman retweeted
Replying to @JasonPLowery
@JasonPLowery a story worth amplifying: Last week, adversarial AI found and exploited vulnerabilities across Bitcoin systems. Counter-cyber efforts raced to fix them first, but had to abandon US models due to “safety” restrictions and switch to overseas models to keep up.
We need letters of marque for cyber activities today or the US will lose the war before it even starts. Current best practice for white hats today is to abandon all US provided models!?!
1
5
23
2,492
Ryan Lanman retweeted
Ok can we finally go back to activating covenants now?
11
10
2
103
6,114