Antoine Poinsot

@ChaincodeLabs.

Prev @wizardsardine / @btcazores co-founder.

590B7292695AFFA5B672CBB2E13FC145CD3F4304.

[Antoine Poinsot @darosior]

Superthread of the main points regarding the OP_RETURN standardness limit controversy.

I'm seeing diminishing marginal returns to my engagement with people on X on this topic. I'm progressively phasing-out my 2 weeks campaign here on the topic and getting back to work.

[Anthony Towns @ajtowns]

Hmm, blockstream's liquid post-mortem isn't terribly confidence inspiring: "Both approaches were reasonable engineering choices for the reported issue. The byte-boundary vulnerability that later surfaced as Bug B was a separate defect that was not identified by any reviewer at the time."

Introducing a byte-boundary vulnerability wasn't a reasonable engineering choice, and if that problem wasn't identified by any reviewer, there was vastly insufficient review.

[Murch @murchandamus]

Christine and I just recorded for the upcoming episode 35 of @ready4merge. We chatted about BIP54: Consensus Cleanup, the mechanics of the Timewarp Attack, and a recent Lean proof showing that the proposed mitigations are sufficient to bound chain growth.

Coming out next week!

[Jonas Nick @n1ckler]

We discovered this while building a machine-checked security proof for SHRINCS and repeatedly prompting models to look for gaps in our own proofs. Earlier formalizations of the SPHINCS+ proof missed it because they don't model running time, and neither does ours. This shows that formal verification is no cure-all.

The gap is fixable, but fixing it requires tedious accounting of every step of the proof, which we're currently doing for SHRINCS.

[ReproducibilityMatters @sedited_]

32.0rc2 testing binaries are now available https://t.co/RcFNQ6VXl8

Includes the new getopenrpcinfo RPC (shoutout @willcl_ark). It returns a machine-readable OpenRPC spec of the entire RPC API, useful for generating client code and docs or diffing between releases.

[Antoine Poinsot @darosior]

Will be discussing Bitcoin's PQ challenges in 30 minutes at @bitcoinpolicy's Freedom Tech DC

[Salvatore Ingala @salvatoshi]

@KLoaec @francispouliot_ @jurbed @lianabitcoin @Trezor Segwit miniscript was a mistake

[Carl Dong → obscura.com @carl_dong]

Obscura on Linux at last!

[Antoine Poinsot @darosior]

@coinjoined @PubKey One too many

[Antoine Poinsot @darosior]

Beefsteak @PubKey DC

[Antoine Poinsot @darosior]

@jyn_urso @PubKey Hey. Just seeing this now. Meet you tomorrow?

[Antoine Poinsot @darosior]

@stevenroose3 @salvatoshi @Rob1Ham @lukechilds That sounds like a terrible idea for anything designed to hold a non-trivial amount of funds.

[Jonas Nick @n1ckler]

Adaptive attacks against FROST when number of signers and corruptions is large. BIP 445 (FROST) not affected because it requires fewer than 128 signers. This requirement in BIP 445 was added by @real_or_random exactly because there was uncertainty about the hardness of LDVR.
https://t.co/E52aI7psNQ

[OpenSats @OpenSats]

“On one side was Google, the big name, the fancy offices, all of that. On the other side I could work on Bitcoin, which I found both technically fascinating and genuinely important.”

- @danielabrozzoni

https://t.co/1rQ2hfm1rd

[localhost research @lclhostresearch]

In town for @bitcoinpolicy's Freedom Tech DC? Join us for @DCbitdevs at @PubKey! Justin of Localhost and @darosior will be co-moderating. Topics include PQ output type design, Bitcoin Core PRs, PoCs of BIP 448, recent security disclosures, and more. 🌭 & 🍻 on us!

[Antoine Poinsot @darosior]

https://t.co/kb0onu9WFz

[Antoine Poinsot @darosior]

BIP54 would make it so Bitcoin's PoW actually provides tight bounds on worst case resource usage.

Read Pieter's latest post on Delving.

[Bisq @bisq_network]

Bisq v1.10.8 is released.

This important security update fixes vulnerabilities identified during our recent security audit.

Updating to this version is required to continue trading.

https://t.co/Z3WkycrRAO

[Michael Ford @fanquake]

> Bitcoin Core has spent more than a century of CPU time fuzzing individual functions and critical components (though oss-fuzz, Fuzzor, bitcoinfuzz and individual contributors), and decades of CPU time simulating small networks of full nodes under test (Antithesis, Fuzzamoto). I can’t establish causality from this alone, but my strong suspicion is that the sustained testing effort is an important reason these projects have become so robust.

[Antoine Poinsot @darosior]

Good read if you've been following the AI security news in the Bitcoin space, and wonder how Core is dealing with that.

[Niklas Gögge @dergoegge]

I wrote a blog post on the recent exploits in the Bitcoin ecosystem, how Bitcoin Core is holding up, and how I think the community can get ahead of the models:

https://t.co/JEH8xTQa3E

[Antoine Poinsot @darosior]

Ugh.

[Alex Thorn @intangiblecoins]

this is a setback for BRCA supporters. the clear criminal exemption is gone. prior drafts said non-controlling devs are “not engaged in money transmitting as defined in 1960”. the replacements are all regulatory: 5330, the FinCEN MSB reg, and two BSA categories