Zero-Knowledge Goof

The way I read it, frostsnap is the only complaint one. This is about the manufacturer helping users recover funds by bypassing the device pin in some way. We don’t have a pin so we’re fine.

2026-03-10 09:56:33 UTC

And just like that your bitcoin is no longer stored in your house, there's no descriptor backup you can lose and anyone with 2-of-3 devices can restore the funds. Once you obtain this level of peace of mind you can never go back.
#nevent1q…sx8x

2026-02-14 01:25:40 UTC

- reply

Nice I am working on something like this for myself. Where’s the code?

2026-02-14 01:23:48 UTC

- reply

Everyone with conviction has to pay these tuition fees at least once mate. The classic mistake is making big plans at a certain BTC price and having to execute them at a lower one. Sounds like you’ll make it through ok.

2026-01-14 04:07:58 UTC

- reply

haha I was trying to find you not make a note. Oh well follow npub1r89krrt3u2cugr6aje5n8e0f9jtp6awqj7czhx0t5ga5v5x6gq6s90z95r everyone!

2026-01-14 04:06:27 UTC

npub1r89krrt3u2cugr6aje5n8e0f9jtp6awqj7czhx0t5ga5v5x6gq6s90z95r

2025-12-29 00:49:43 UTC

52 years later, only known copy of Unix v4 recovered from randomly found tape, now up and running on a system — first OS version with kernel and core utilities written in C
https://www.tomshardware.com/software/linux/unix-v4-recovered-from-randomly-found-tape-at-university-of-utah-only-known-copy-of-first-os-version-with-kernel-and-core-utilities-written-in-c

2025-12-12 01:43:11 UTC

- reply

Yeah it’s Jan 12. Go for it!

2025-12-11 23:17:32 UTC

To all those people who ask me how to get involved in bitcoin open source, here’s the best way:
https://bosschallenge.xyz

2025-11-30 19:05:12 UTC

- reply

Opus is much better for me. It’s got a better tempo and takes less effort to get it to go in the right direction.

2025-11-19 21:33:14 UTC

- reply

Wtf is wrong with the uk

2025-11-19 20:56:43 UTC

- reply

It works for me!

2025-11-16 07:17:19 UTC

- reply

Haha that sentence was extremely slurred but it sounds like you got the idea!

2025-11-15 07:11:16 UTC

- reply

Yeah that’s a feature. You can forge the PoK on related keys. If a key has a known key then you can’t sub-exponential data with it or any related keys either.

2025-11-11 23:42:49 UTC

- reply

Cool. I think a first step is just to figure out the actual data embedding rate for a few different approaches/assumptions. Has anyone even figured this out for BIP444?

2025-11-10 22:57:35 UTC

- reply

Oh also public derivation could work with the BLS scheme I think. Just don’t commit to the public key in the hash to curve for the PoK and it becomes malleable.

2025-11-10 22:55:22 UTC

- reply

Haha BLS everything of course. I can’t even imagine how you could do it only for the PoK. Any equivalence proof between curves will be a PoK so there’d be no point in the BLS in the first place.
I like “purecoin”. Although I also think it’s not a great direction. It’d still make way more sense than bip444. It would be interesting to present a possible if not realistic soft fork that actually would significantly reduce the amount of data embedding that could be achieved per vbyte. Then a rational debate could be had.
Point taken about locktimes. I don’t think anyone would be in favour of disabling lightning. You’d probably have to leave the spammers with that one.

2025-11-09 01:57:22 UTC

- reply

Thanks for pointing me to the mailing list post. I don’t know what you mean by there’s no way BLS could be implemented on Bitcoin — you could introduce a BLS12-381 address very easily in a soft fork. This would make data sub-exponential data embedding impossible. Also the BLS PoK (ok technically a PoP) can be constructed non-interactively for aggregated BLS multisig.

2025-11-08 01:46:00 UTC

- reply

You can use 128 bit challenge for the PoK (give up batch verification)
Oh that’s interesting. You reveal the bytes *with* the PoK. Ok then I raise you: We use BLS where the PoK is deterministic.
.

2025-11-07 22:27:39 UTC

Has anyone tried developing a soft fork that would actually verifiably stop all spam?
1. Make a new address type that has a public key + proof of knowledge. 2.5x larger than current addresses. No script nothing else.
2. disable spending to anything other than the new address type.
Spam solved.
You could modify (1) to allow raw multisig also. You can actually do lightning without script using MuSig + adaptor signatures. So everything keeps working… in theory :)

2025-11-05 02:59:18 UTC

I see a few people calling people “unethical” or “dishonest” for their technical opinions. Don’t do this, as good as it feels. Pick up your cross and just make arguments.

2025-11-04 04:33:13 UTC

“I’m waiting for my bags to have one last pump so I can rotate to BTC” is the best genre of post.
https://image.nostr.build/194788ee439aae365773d7b22198ec2fbf2c8092fd02b92f953316e15ca2c1e0.jpg

2025-11-03 10:20:40 UTC

Oh my sides. It's unbelievable that if not for Bitcoin the entire human species would have been forever enslaved to this preposterous system.
https://www.youtube.com/watch?v=G8u0EIY6q-U

2025-08-30 22:12:34 UTC

- reply

Great question. For now you will need multiple devices. This isn’t a fundamental limitation but a design decision taken to simplify things, especially backups.

2025-08-30 05:16:15 UTC

Get into it freaks!
#note10hh…4ve3

2025-08-25 21:19:10 UTC

- reply

A beautiful reading but 40 seconds worth of distance run now? Shrinkflation showing up everywhere.

2025-07-27 22:32:14 UTC

- reply

But how do you know if it’s the person who bought the service or not? Email login?

2025-07-27 10:27:40 UTC

- reply

I think that what remains is to show that you can do blind Schnorr + FROST naively without modifying the blind schnorr signing algorithm and the FROST signing algorithm. There’s also work on making ZKPs so you can prove things about the tx without revealing the whole tx (e.g. you could put a spending limit).
Right privacy good but it also makes it had to be a backup for someone unless they can identify themselves as the true owner of the coins. Maybe there’s something there though where the blind signer would only sign if you prove the utxo it’s spending (without revealing which one) is older than X months to enforce a sort of scriptless degrading recovery mechanism.
What would be cool would be to make the blind signer programmable so we don’t have to think too much about how to build the product — even better make it a reasoning AI prompt that you set up yourself to vet anyone who claims to be the rightful owner of your coins in the future. i.e. upload yourself to the cloud so you can grief your progeny as they try to claim their inheritance.

2025-07-26 23:50:43 UTC

- reply

I think the cryptography for that is partly sorted out but we don’t have concrete designs on a blind signing service tbh. Do you have any thoughts about what you’d like to see?

2025-07-26 22:13:16 UTC

- reply

Awesome! Yep locked in for September shipping.

2025-07-16 14:24:14 UTC

@npub1ynn…u3gk higher 5000

2025-07-16 14:17:42 UTC

- reply

Thank you!

2025-07-01 16:21:22 UTC

- reply

It would be hard to get FROST to work on seed signer because it’s stateless. I know a trick that *might* make it possible. So the main advantage of frostsnap is that it exists!
Yes spending limits require secure hardware that never leaks its secret.
Changing quorum size just means making a new sharing of the secret and everyone deleting their old shares. You can do this without reconstructing the secret.

2025-06-30 15:06:45 UTC

- reply

We're going to ship the most robust personal Bitcoin multisig setup ever.
✅FROST key generation and signing
✅Bitcoin wallet + PSBT/Sparrow support
✅Simple seed words backup
and a lot more in the works.
Pre-ordering gets you this ASAP and helps support our efforts. Thanks!
#nevent1q…r9zh

2025-06-11 01:26:11 UTC

I'm talking at Bitcoin Sydney tonight on Frostsnap!
https://www.meetup.com/bitcoin_sydney/events/308244930/?slug=bitcoin_sydney&eventId=308244930

2025-04-09 09:38:12 UTC

Learning about @npub1ejk…expu at Bitcoin Sydney.
https://image.nostr.build/d3b5dfe33c45d1f6893834b8abb0825cd0d92b3bc647be566d98ea23cade90b5.jpg

2025-03-29 06:06:15 UTC

- reply

Here’s the steel man himself: https://rumble.com/v6rajo4-freedom-of-speech-is-not-granted-by-the-government.-non-citizens-in-america.html
1. Fascists don’t nationalize industries. At least before a major war breaks out.
2. Happens later. Why would he make these moves now.
3. They’re deporting people in the US legally for not following state mandated narratives. A woman for writing an opinion in her school newspaper. Don’t worry citizens will get the treatment later.
Of course Biden helped develop American fascism too. So did all the presidents in recent memory. The people who are getting hysterical about it now are just partisan hacks. But they’re not wrong.

2025-03-12 08:48:01 UTC

- reply

Yes I am going to do the same thing but the question is whether to patch out secp256k1 or secp256k1-sys. Which will be less painful…

2025-03-12 08:46:20 UTC

- reply

Yes sounds like you’ve got the main idea!
I had this trick in mind to buy multiple el gamal decryptions with one tx at some point.

2025-03-12 08:34:41 UTC

- reply

Oh but it looks like you’re patching secp25k1 rather than secp256k1-sys?

2025-03-12 08:27:22 UTC

- reply

Awesome thanks.

2025-03-12 03:25:45 UTC

- reply

So you patched out secp256k1_sys?

2025-03-11 01:42:26 UTC

- reply

You still need the ZKP to prove the pre-images of some set of have some valid representation. I am referring the step where you have `n` points whose pre-images you want to sell in a single transaction. I am just saying you don't need n outputs to sell n DLOGs. You can set up an access structure ahead of time such that anyone who knows the discrete log of `X` will learn the discrete log of `X_1`, `X_2`,... , `X_n`. e.g set a polynomial such that p(1) = x_1, p(2) = x_2, ..., p(n) = x_n, then send p(n+1), p(n +2), ... p(2n -1) to the purchaser (they verify they are correct by interpolating X_1, X_2,..., X_n). Then sell them a single DLOG p(2n). From it they can interpolate the polynomial and recover x_1, ... ,x_n. You don't need to do any VSS here.
This is sort of the idea of "packed" secret sharing from the literature. If all the secrets are uniformly sampled and independently random then that *should* be secure protocol under DLOG assumption. Might need some more thought if that's not the case.

2025-03-11 00:59:56 UTC

- reply

Show us the code sir. I also have a good reason.

2025-03-10 10:58:49 UTC

- reply

You don't need n signatures to set up a payment for a n term representation.
Consider that the prover can just treat each secret term in the representation as coefficients in a polynomial, evaluate the polynomial n-1 times and give the evaluations to the verifier (along with the point commitment vector of the terms of cours). The verifier then pays on chain just for n'th evaluation with adaptor signature. With the nth evaluation you can reconstruct all n terms.
I think!

2025-03-10 10:38:34 UTC

- reply

Why though? (I am also doing this)

2025-03-06 08:51:39 UTC

- reply

You can make it work. It requires some UX finesse. You have to sort of “prepare” the silent payment address by getting a threshold of frost signers to do partial Diffie-Hellman and give the result to the coordinator. From there the coordinator can instantiate the silent payment outputs without the signers but it needs to be done once for each SP address.
I think we’re gonna try and hide this behind a kind of “save address” feature which (for security as well) requires you to sign the address with a threshold of devices to associate it with human readable identifier e.g. “Max”. You can slip this crypto in there.

2025-03-03 22:12:20 UTC

- reply

SOD CANDLE

2025-02-07 22:36:40 UTC

Tell me a decent vacuum cleaner brand that doesn’t employ planned obsolescence.

2025-02-04 00:24:14 UTC

- reply

Which country is this?

2025-02-03 10:02:21 UTC

- reply

It’s not bad where you get this?

2025-02-03 09:20:10 UTC

Bitcoin being used as the settlement layer for industrial scale smuggling and tariff evasion is not priced in.

2025-01-28 03:27:44 UTC

The most under appreciated impact of AI is that emacs is actually configurable now. It still takes half your day to change some small thing but you will almost certainly make progress if you are armed with the best models.

2025-01-23 12:17:03 UTC

- reply

fed season is already here.

2025-01-23 11:09:38 UTC

Good news: There is not more alt season
Bad news: It has been replaced by wrench attack and kidnap season.

2025-01-13 00:41:37 UTC

- reply

This is pretty futile. Once you press the copy button there is no guarantee the thing that goes to your clipboard is the thing you verified.

2024-12-30 23:32:45 UTC

Does nostr have a way to ask a relay to provide a signed receipt of a message. Do relays have public keys at all?

2024-12-22 21:27:38 UTC

- reply

Third time lucky.

2024-12-22 21:26:44 UTC

High quality literature in the p2p street library this morning. There’s hope for us yet. https://image.nostr.build/61d591a8a50313ca86688c5f89b1a2e711f5cb1b071fb01bfaa56ebc12cb2ade.jpg

2024-12-22 21:26:17 UTC

High quality literature in the p2p street library this morning. There’s hope for us yet.

2024-12-22 21:25:44 UTC

High quality literature in the p2p street library this morning. There’s hope for us yet.

2024-12-10 19:59:57 UTC

- reply

No that would exhaust my QC

2024-12-10 10:16:01 UTC

Introducing wanko, a state of the art quantum computing system made up of intricate lattice of bosons (actually just my body). With it I was able to solve the adult male ejaculatory latency sampling problem (ELS) in LESS THAN FIVE MINUTES.
To properly model such a complex nervous stimulation with a leading supercomputer would take over 10^25 years, far beyond the age of the universe(!).

2024-12-09 22:18:01 UTC

- reply

“A standard benchmark computation” :^)

2024-12-09 21:50:58 UTC

- reply

He’s not wrong though. The longer you wait to go all-in the greater the fool you are.

2024-12-04 05:37:07 UTC

New frostsnap logo lands
https://m.primal.net/MnMF.jpg

2024-11-25 23:07:02 UTC

Well deserved. Dunno where our product or Bitcoin research would be in general without these people. #note1njv…sn8s

2024-11-25 21:49:17 UTC

I think about the fate of this “caution: falling rocks” sign a lot. https://image.nostr.build/b3ecd2c28438bad04c6dfc261879424b5afb8f3449e627400bcc90b574518e83.jpg

2024-11-11 08:03:41 UTC

- reply

Caliber**

2024-11-11 08:02:46 UTC

- reply

That’s literally what it is lmao. I was testing what happens when you sign something with images with amber and chose something from my photo library that wasn’t a family photo and found WhatsApp auto-saved aunt calibre bible quote.

2024-11-10 23:10:06 UTC

GM https://image.nostr.build/6ba1d692947d5c9d27bf72d17c2e21c7566d5555b59e2df970d7781a2abdb2d9.jpg

2024-10-28 22:33:09 UTC

The pandemic is over #note1w5s…fd3q

2024-10-26 21:24:36 UTC

GM my digital age human souls https://image.nostr.build/bbf4ef63cca4b15802f7ad0da48de8f0b8a5f4c797526e75a45f6b83317e5c74.jpg

2024-10-25 00:22:57 UTC

- reply

Bruh it’s the morning.
Good to see you on the panel anyways.

2024-10-25 00:16:58 UTC

- reply

You’re going already!?

2024-10-23 20:15:27 UTC

It's not looking good ethbros. I've been doing some technical analysis on ETH/BTC. It turns out that maybe ETH and all "utility tokens" have no fundamental value and it just took an unusually long time for the market to begin adjusting them towards zero. https://image.nostr.build/2e96c0592b32172d98e3427809a2406be4a778fa443e38f224380c5ecc4e63df.jpg

2024-10-23 12:13:40 UTC

It's not looking ethbros. I've been doing some technical analysis on ETH/BTC. It turns out that maybe ETH and all "utility tokens" have no fundamental value and it just took an unusually long time for the market to begin adjusting them towards zero.
https://m.primal.net/LfZi.png

2024-10-18 09:14:29 UTC

- reply

Need to make frostsnap work with it so someone had to get one. Also very interested to see how the “””Apple Intelligence””” works.

2024-10-18 09:06:06 UTC

Just moved from android to iPhone. The only apps that were easy to move were the nostr apps.

2024-10-12 10:44:03 UTC

- reply

Started reading this post. Decided to finish it in my first sauna for 10 years. Loved it. Inspired to try working this into my routine.

2024-09-13 02:07:33 UTC

- reply

Oh interesting OK. So this is broadcast and then you send out deletion for it when the draft is no longer needed?
It seems to happen even if I don't close a note though..

2024-09-12 10:52:14 UTC

- reply

....what's a draft note?

2024-09-12 09:43:33 UTC

Technical nostr question: How come when I make a note Amethyst asks me to sign an event deletion.

2024-09-10 07:47:47 UTC

- reply

Oh no just before the goldenbull run.
#nevent1q…79yl

2024-09-09 03:52:02 UTC

- reply

Still waiting for the pro-kamala nostr corner to develop. Even Pro-trump is pretty weak here.

2024-08-31 04:59:04 UTC

- reply

Ah thanks. I didn't catch that idea in my skim listen.

2024-08-30 12:38:43 UTC

Making Bitcoin more private with CISA
https://youtu.be/HvI7NPI_Pk0
This is a very peculiar topic since CISA doesn't make anything more private.

2024-08-30 04:08:22 UTC

- reply

You make an LN payment every single time?

2024-08-30 01:39:14 UTC

ChatGPT downgraded me to the free version because of some billing issue and all of a sudden I feel...lonely?

2024-08-29 01:01:15 UTC

- reply

Can she actually win with this policy???

2024-08-28 07:51:05 UTC

Can anyone recommend some good nostr talks/podcasts that discuss technical goings on and explain architecture of nostr etc.

2024-08-27 21:12:37 UTC

- reply

Oh someone's working on FROST nostr already!
#nevent1q…rfr5

2024-08-27 13:22:14 UTC

- reply

I read you. No post less. I haven't finished reading your last one.

2024-08-27 13:19:21 UTC

- reply

I tried to order one of these but I goofed the address, cancelled it and they wouldn't let me reorder because of item limits :(

2024-08-27 11:17:01 UTC

- reply

Any talks you recommend in particular?

2024-08-27 10:16:15 UTC

Thinking about opportunities for FROST and nostr integration.
1. It should be easy to generate a FROST key with a bunch of people on nostr. But this creates a new thing for everyone to back up (the key share).
2. Maybe we can avoid this with the recovery feature of the FROST keygen WIP BIP. Basically you have your share encrypted to a (smallish) encrypted blob in a nostr note so just with your nostr nsec it should be possible to recover it. Maybe there is some way to pay relays to keep a note into the future.
3. Apart from keygen nostr relays might be used to broadcast signature requests to notify people with other keys that there's something to do. Even an encrypted chatroom among share holders.
4. I'm not sure how this fits in with frostsnap. Frostsnaps could have their own npubs for keygen but I don't really want to back them up. So I think you'll be forced to write down your share backup as usual.
5. It would be good if signing was still one round so I guess presharing nonces would be done via nostr too.

2024-08-06 00:17:19 UTC

- reply

See FAQ: https://darkskippy.com/faq.html
24 words needs twice as many signatures as 12. 24 words with strong passphrase needs twice as many as 24 words without one.

2024-08-06 00:14:06 UTC

- reply

If the attacker has the xpub then it's definitely much easier and it should be possible in one sig. Your aglo looks right. You can also do it in a single address reuse.
https://x.com/LLFOURN/status/1733992948294181299
The reason we thought this attack was notable and worth disclosing is that it doesn't depend whatsoever on the user's behavior or precautions (i.e. not giving out xpubs).