Recent episodes
Read_950 - The Internet Is Under Attack
- CrowdStrike reports AI-driven cyberattacks more than doubled in August and again in September, marking a structural shift in internet security threats. - A critical PHP vulnerability affecting roughly 70% of websites was exploited within hours of disclosure, with millions of attack attempts already underway. - AI now enables attackers to detect software weaknesses automatically, break into systems autonomously, and operate without human intervention at minimal cost (~$50 per breach). - Defenders lag significantly behind; patching critical bugs takes approximately two weeks on average, and roughly half of internet-facing servers running vulnerable software cannot receive official fixes. - Social engineering through AI-generated deepfake audio and video—including empathetic virtual personas—poses severe fraud and scam risks, especially targeting isolated individuals. - The economics of attack versus defense have fundamentally shifted; offense currently outpaces defense, necessitating structural changes to how the web handles trust, authentication, and private versus public spaces.
Everything Is a Lie (Inflation Edition)
- Prices should fall over time as technology increases production, but government money printing and debt creation artificially inflate costs instead. - Corporate greed cannot cause inflation; price rises require new money creation first—without additional money supply, sellers simply cannot move inventory at higher prices. - Inflation transfers wealth from savers and workers to the already wealthy and politically connected by eroding purchasing power and enabling debt-based ownership. - GDP growth is a misleading metric that can increase even when living standards decline, as demonstrated by the dog-turd joke illustrating circular money movement. - Deflation (falling prices) should be the natural outcome of a free economy with sound money, but is blocked by continuous fiat money printing. - Money printing is counterfeiting; it benefits the counterfeiters (central banks and governments) at the expense of everyone else in the economy.
Read_949 - The Singularity Stack
- The Singularity Stack framework traces energy conversion through compute, intelligence, agents, identity, coordination, value transfer, and settlement in money. - Fixed-supply money (Bitcoin) is the only asset that captures deflationary gains from AI-driven productivity instead of inflating them away. - Technological deflation is the normal state under sound money; modern monetary expansion masks efficiency gains and creates debt crises. - Current systems cannot allow deflation due to $40 trillion federal debt; expansionary money policy will accelerate as productivity explodes. - Guy's production workflow demonstrates reflexive feedback loops already operational: AI agents iterate on software via debug logs synced across peer-to-peer networks in real time. - Atomic Machines' matter compiler exemplifies the stack: AI-native manufacturing adapts hardware design from code alone, closing the intent-to-result loop in physical production.
Ledger Wallet Spy Implants (The Great Hackening Continues...)
- A sophisticated hardware implant attack targeted Ledger hardware wallets distributed through resellers, particularly in Southeast Asia, with an estimated $70–100 million in stolen funds across 300–350 compromised devices. - The implant was a miniature cell phone (eSIM, microcontroller, and LTE modem) hidden under the screen padding that logged keystrokes and monitored the display, exfiltrating seed phrases without modifying the secure element or firmware. - Ledger's reliance on resellers—specifically CryptoBillis, which was quietly acquired—created a critical supply chain vulnerability that competing hardware wallets like Trezor and Cold Card have addressed differently. - The genuine device check passed because the secure element remained untouched; passphrases and other defensive measures offered no protection since all inputs phoned home identically to the seed phrase. - Multi-signature setups, particularly multi-vendor configurations (Bitbox, Trezor, Ledger, Cold Card), would have prevented theft in this scenario just as they did in the Cold Card entropy failure. - Self-custody remains viable; security improvements historically emerge from attacks and failures, and users must adopt layered defenses including direct manufacturer purchases, PO boxes, offline key generation, and hardened wallet practices.
Everything Should Always Get More Affordable
- In a productive society with advancing technology and manufacturing, **nearly all goods should become cheaper over time**, not more expensive. - The "apple economy" analogy demonstrates how price inflation occurs: if production increases 10x but prices double, it signals either a 20x surge in demand or a massive increase in money supply. - Money printing is silent theft — it redirects the productivity gains workers create into the pockets of those who control monetary expansion. - When real productivity improves but nominal prices rise, the culprit is currency debasement, not market fundamentals or poor performance by producers. - The wage illusion: workers produce more value, but inflation erodes that gain, making real purchasing power stagnate despite increased output. - If goods are not getting cheaper as society becomes more capable, the monetary system is the problem, not the economy itself.
Roundtable_025 - This Time, It's Actually Different
- Max Hillebrand discusses White Noise, a decentralized encrypted group messaging protocol using MLS (Messaging Layer Security) that solves the hard problem of rotating keys in a decentralized consensus system without a central server. - The conversation explores how **AI agents are accelerating development** of complex Freedom Tech projects; agents completed in months what experienced developers struggled with for years, including building MLS implementations and native clients. - Discussion of the future where **average software user base becomes one person**—individuals building customized tools for their own workflows using AI assistance rather than using generic commercial software. - Sovereign Engineering cohorts (six-week immersive programs with 21 participants) have produced significant freedom tech projects including Zap Store, Blossom, Marmot, FIPS mesh networking, and Maplis. - Open-source hardware and modular design are critical for user freedom; examples include Start9's RISC-V router, Edison Motors' right-to-repair hybrid trucks, and the need for repairable consumer appliances and power tools. - Bitcoin's fungibility problem with exchange flagging of "tainted coins" exists but appears manageable; HODL HODL's recent policy to warn users about flagged coins backfired when they discovered coins marked "dirty" had passed through their own service.
The AI Crisis
- OpenAI and Anthropic are **deeply unprofitable** despite massive customer bases, with OpenAI losing $12 billion in Q1 2026 on $5.7 billion revenue and facing $800 billion+ in obligations by 2030. - Both companies are heavily subsidized on compute costs and still burning capital; their accounting shows they lose more money with each additional customer. - China's open-source AI models (e.g., Kimi K3) are closing the capability gap to US frontier models in 2–4 weeks while costing a tenth as much, eroding any competitive moat. - AI industry leaders are engineering regulatory panic around "dangerous AI" and lobbying for government partnerships, liability protection, and regulatory boards to preserve their business model and block competition. - The goal is a centralized surveillance infrastructure with government backing, guaranteed customers, impossible-to-enter compliance barriers, and immunity from liability—funded by taxpayers and users. - Mark Zuckerberg's counter-argument: alignment and liability are already handled by free-market customer choice and corporate responsibility without heavy-handed regulation.
Chat_179 - Back to What Matters with Cory Klippsten
- Bitcoin will achieve widespread adoption as a store of value first, with medium-of-exchange use only emerging much later when enough people hold Bitcoin as their primary wealth asset. - Stablecoins have captured most payment demand in crypto, making merchant adoption a lower-priority problem than commonly assumed in Bitcoin discourse. - M2 money demand remains strong globally; the dollar is unlikely to collapse hyperinflationary, but will lose purchasing power gradually as Bitcoin gains purchasing power over decades. - The Coldcard exploit affected ~1,500 coins—far fewer than losses to centralized exchanges and CeFi platforms; proper data segregation and multi-sig custody mitigate risk. - Swan offers a spectrum of custody solutions from pure self-custody (Swan Sovereign) to collaborative (Swan Vault) to institutional delegated custody (Swan Safe) to multi-institutional (Swan Trinity in development). - Bitcoin does not require hyperinflation or dollar collapse to succeed; gradual adoption by 8 billion people recognizing superior monetary technology is the realistic path.
The Great Hackening of 2026
- Coldcard suffered a critical random number generator (RNG) bug where the firmware's safety check was "defined" but not executed, severely degrading entropy from cosmic-scale randomness to near-pseudorandom levels, potentially allowing key collisions and fund theft. - Liquid Network was exploited for 4,200 BTC via a cache verification bug in confidential transactions; an attacker created fake proofs, inflated the LBTC supply, and extracted 4,200 BTC before returning 3,600 voluntarily (gray-hat). - Multiple Lightning implementations (Core Lightning, LND, Eclair) disclosed buffer overflow and denial-of-service vulnerabilities that could crash nodes via malicious messages or flooded gossip protocols. - BitBox, Sparrow Wallet, Trezor, and Ledger all disclosed security vulnerabilities and data breaches; none exploited in the wild but all require immediate firmware/software updates. - AI-powered exploitation has inverted attack economics: frontier models can now discover and exploit bugs with minimal human skill or time cost, making Bitcoin and Layer 2 systems attractive targets due to irreversible payouts.
How Does Bitcoin Self Custody Recover From This? (Coldcard Q&A P3)
- The Coldcard firmware vulnerability dating back 5–6 years compromised seed generation across all affected devices, and Guy believes Coinkite is unlikely to survive the reputational and technical damage. - No realistic path exists for Coinkite to offer refunds; the company appears to be going silent rather than confronting the issue publicly. - DIY signing devices like SeedSigner and understanding entropy manually are now seen as essential safeguards against manufacturer failures in hardware wallet firmware. - Multisig is the only practice that meaningfully protected users; Guy has moved personal funds to Bitbox and emphasizes multisig as a risk-mitigation layer. - White-hat wallet recovery efforts face insurmountable ethical and legal obstacles, chiefly the inability to prove original ownership without KYC records. - Understanding encryption and key management will become a survival skill as AI and digital threats intensify; this knowledge should be normalized early rather than treated as niche expertise.
Roundtable_024 - The Aftermath
- Mechanic has stepped down from Ocean following the BIP-110 soft fork failure, and the roundtable discusses whether this signals defeat or a necessary separation to let Ocean's core mission (decentralized block templates) succeed independently. - BIP-110 failed to activate primarily due to lack of miner adoption across major pools, not because the technical proposals (OP_IF removal, data carrier limits, public key size limits) were flawed. - The real existential threat to Bitcoin is **block template centralization** (handful of mining pools controlling transaction selection), not spam—a problem decentralized mining via Stratum V2 and Ocean addresses, not consensus rules. - Knots adoption and Ocean's hash share grew meaningfully before BIP-110 announcement; the soft fork announcement may have polarized rather than unified support, potentially overplaying a hand that had genuine momentum. - Coldcard firmware vulnerability (USB supply chain attack vector) and the possibility of state-sponsored infiltration of hardware wallet companies raises custody and privacy concerns; multisig setups proved crucial for affected users. - A proposal to force Coinbase transparency on BTC reserves by requiring customers to withdraw Bitcoin as wrapped CBBTC tokens on Ethereum, making on-chain proof of reserves visible and testable against claimed holdings.
Was it all a "Retirement Attack"? (Coldcard Q&A P2)
- The Coldcard RNG bug involved a fundamental design flaw where a security library checked only if a switch existed, not whether it was turned on, causing the device to fall back to weak software-based random number generation instead of the secure hardware chip. - The debate between malice versus incompetence centers on whether NVK's defensive, dismissive attitude toward bug reports created an environment where critical issues went unaddressed for years. - The licensing shift from open-source to source-available code may have introduced bugs during refactoring done specifically to enable the license change, rather than for security improvements. - Extremely poor entropy from the bug likely caused key collisions, explaining years-old Reddit posts about users discovering Bitcoin already on newly generated addresses—possibly funds sent by others who generated the same keys by accident. - Fake mobile apps for Sparrow and Wasabi wallets are actively stealing Bitcoin from users trying to quickly migrate funds away from compromised hardware wallets. - The arrogant, dismissive posture toward all criticism—dismissed as "FUD"—prevented legitimate security concerns from receiving proper scrutiny or testing.
Is Rolling Your Own Entropy The New Standard? (Coldcard Q&A P1)
- The Coldcard random number generation (RNG) failure exposed a fundamental security flaw where the device relied on pseudo-random generation instead of true random generation, causing weak key derivation for years undetected. - Simplicity and single-path execution are critical in security-critical code; the RNG implementation was overcomplicated with fallback logic and unnecessary handoffs between firmware components. - Source-available code (publicly viewable) differs materially from open-source code (reusable and auditable by developers with incentive); Coldcard's source-available model lacks incentive for third-party security review. - Users who rolled their own entropy using 100+ dice rolls generated cryptographically secure keys independent of Coldcard's firmware and face no immediate risk. - Strong passphrases provide secondary protection (analogous to "poor man's multisig") but should not be treated as primary seed security; funds with weak passphrases warrant relocation. - Coldcard can still be used safely as a signing-only device for imported seeds or for rolling dice entropy, rather than discarding the hardware entirely.
Chat_178 - Our Burden To Carry with American HODL, Erik Cason, and Brandon Quittem
- Recent Coldcard exploit exposed severe entropy vulnerability affecting thousands of users, causing tragic losses of savings and triggering widespread community guilt and survivor's guilt among influencers and security-minded Bitcoiners. - The Bitcoin community engaged in toxic maximalism and groupthink around self-custody dogma, promoting hardware wallets like Coldcard to users unprepared for the complexity, placing blame on influencers and community leaders for misleading newcomers. - Multi-sig architecture with multiple vendors and geographic distribution emerged as the most practical defense against single-point failures in hardware wallets and supply-chain compromises. - Self-custody should be tiered by user sophistication and position size; ETFs and custodial solutions are legitimate entry points and should not be shamed; custody is a process, not an endpoint. - Open-source models, local AI servers, and peer-to-peer tools are critical to resisting government surveillance and regulatory capture; proprietary AI guardrails and KYC internet gatekeeping represent existential threats to freedom. - The coming false-flag event or major AI-enabled attack will accelerate censorship, surveillance, and universal compute governance, though long-term human nature and market pressure may eventually restore decentralization.
Learning the Wrong Lessons
- A recent Coldcard entropy bug caused thousands of Bitcoiners to lose their entire holdings, sparking debate about whether self-custody is now pointless or failed. - Self-custody remains orders of magnitude safer than centralized custody despite this disaster; the bug is significant precisely because such failures are rare. - Historical perspective: centralized exchanges and custodians have lost approximately 1.36 million Bitcoin plus $23 billion in customer funds over 17 years, dwarfing the estimated 1,778–2,400 Bitcoin lost to the Coldcard bug. - Three actionable lessons from the Coldcard failure: distinguish between open-source and source-available code; enforce independent audits and adversarial code review across hardware wallet manufacturers; educate users on entropy and randomness in key generation. - "Don't trust, verify" and "not your keys, not your coins" are not failed heuristics but hard-won wisdom earned through repeated institutional failures. - Holding your own keys remains the safest Bitcoin ownership strategy when applied correctly; the problem was not the principle but execution gaps in firmware quality and oversight.
Chat_177 - Security Is Just a Hard Problem with Lloyd Fournier
- Frostsnap rethinks multisig using Shamir secret sharing, keeping key shares separate on devices that never reconstruct the private key in a single location; instead, devices produce signature shares that combine on-chain into a single signature. - The Coldcard entropy vulnerability exposed fundamental weaknesses in RNG implementation: weak fallback randomness (Yasmurang), compiler flags that disabled the hardware TRNG, and layers of obfuscation that made the bug extremely difficult to detect even with AI code analysis. - BLS signatures eliminate the need for randomness during signing by using pairing operations and group elements instead of field scalars, making them deterministic yet cryptographically secure—a major advantage over current ECDSA for hardware wallet security. - Dark Skippy attack demonstrates that even air-gapped hardware wallets with user-chosen seeds are vulnerable at signing time: a malicious device can leak seed words by embedding them in transaction signatures. - Hardware wallet manufacturers are inherently trusted third parties for entropy generation and signing; true security requires either offline randomness contribution (like a phone or laptop) or alternative cryptography that eliminates signing randomness entirely. - Quantum computing risk remains speculative and early-stage; proposed safeguards include taproot quantum-leaf backups triggered by a "quantum canary" challenge (breaking a smaller elliptic curve) rather than preemptive migration to quantum-resistant addresses.
BIP110 vs UASF: Do the Suitcoiners Control Bitcoin?
- BIP110's failure does not prove corporate miners or "suitcoiners" control Bitcoin; it reflects normal consensus dynamics. - The relationship between miners and nodes functions as push-pull or offense-defense: miners extend, nodes and users defend network integrity. - BIP110 lacked broad support from both users and miners (only ~1% miner alignment), unlike SegWit which had consensus on the change itself. - The UASF during the Block Size Wars was defensive in nature—users resisted an unwanted packaging of SegWit with contentious block-size increase, not forcing an unwanted change. - Broad consensus remains **strictly required** to change Bitcoin's consensus rules; no single faction (miners, corporations, developers) can unilaterally alter the protocol. - BIP110 attempted an offensive maneuver with minority support; Bitcoin's defensive power structure is strongest when resisting unwanted changes, not initiating contentious ones.
Chat_176 - Is Every Conspiracy True? with Talip
- Talip transitioned from Ethereum development to Bitcoin in late 2022, initially viewing Bitcoin as "crippled" compared to Ethereum before recognizing its fundamental design principles and slower, more deliberate governance. - The BIP 110 spam war and Citrea conspiracy theories were vastly overblown; Citrea never cared about OP_RETURN policy changes and designed its bridge to work with existing Bitcoin versions (v28/v29), requiring only ~144 bytes published once if bridge malfunction occurs. - Statechains enable privacy-preserving transactions and peer-to-peer trading without on-chain visibility; LX Research is exploring dark pools and OTC markets where Bitcoin sales remain hidden while maintaining self-custody exit guarantees superior to centralized exchanges. - AI-powered red teaming using models like GPT-4.6, Claude, and especially Kimi (the open-source Chinese model) can now identify critical vulnerabilities in hours; the Cold Card entropy bug demonstrates how easily LLMs expose low-hanging security fruit across open-source repositories. - Bitcoin needs more cypherpunk ethos and privacy experimentation rather than purely establishment-friendly infrastructure; balancing institutional adoption with underground rebellious tools protects decentralization long-term. - Stablecoins serve as a pragmatic bridge to Bitcoin adoption by teaching users key management and programmable money without requiring immediate monetary conversion.
Chat_175 - Building in the AI Era with Luís Novo & Matt Ahlborg
- Open Notebook is an open-source research and learning environment that collects sources (PDFs, videos, links) and uses LLMs to extract insights, build AI-assisted notes, and create organized "thinking layers" for knowledge management. - The Coldcard hardware wallet security incident highlighted why open-source auditing and verification tools are now critical; the speaker rethinks sponsorships and security dependencies after realizing he had not re-verified hardware wallet code despite changing threat landscape. - AI models (Claude, GPT-4, others) now write and review code autonomously; developers are deferring 90%+ of code review to AI while maintaining test coverage and validation layers, fundamentally changing software engineering workflow. - Local versus cloud tradeoffs are shifting as Apple silicon, unified memory, and falling compute costs make local inference viable; cloud scaling economics are breaking for providers, creating space for private, on-device AI tools. - Building defensive and offensive teams (validation vs. shipping speed) is essential for scaling engineering; aggressive development paired with strict testing prevents catastrophic failure while maintaining velocity. - PairCore/PairDrive represent a peer-to-peer framework for organizing personal data across multiple devices without relying on centralized cloud providers.
Roundtable_023 - Staying Humble
- Coldcard firmware entropy failure generated weak keys (equivalent to 8-character passwords) on Mark 3+ devices, enabling mass GPU brute-forcing of wallets in minutes instead of requiring computational energy exceeding the sun's output. - Transition from open-source (GPL) to source-available firmware in 2019–2021 reduced scrutiny and may have introduced the bug; the fallback pseudo-random number generator should never have existed as a design choice. - AI and LLMs have fundamentally changed vulnerability discovery: attackers now require only hours with language models to find and exploit weaknesses that previously required deep expertise. - Hardware manufacturers must adopt continuous entropy validation testing (running devices 24/7 generating seeds) and include physical dice with every device to give users agency over randomness. - Multi-signature setups with at least one compromised key remain vulnerable; users must spend all funds at once via high-fee transactions or out-of-band mining to avoid revealing script hashes that expose remaining keys. - Open-source code is non-negotiable for security-critical software; source-available licenses enable regulatory capture and reduce community auditing that would catch such failures.