Matt Corallo 🟠

10th known contributor to Bitcoin Core. Full-Time Open-Source Bitcoin+Lightning Projects @spiral_xyz. Open-Source Bitcoin for 15 years. Mostly reposting @soona.

[Matt Corallo 🟠 @TheBlueMatt]

It’s time for bitcoiners to step up and build. You don’t need to know anything about software development anymore, you just need to know how to write words!

We have a golden opportunity to build out agentic payments based on open money, rather than letting agentic payments be captured by megacorps yet again. But we’re squandering it arguing about useless crap instead of building.

Play with openclaw, give it a bitcoin wallet (moneydevkit makes this super easy! Also Lexe and phoenixd!), make it do things. If it fails to do what you want, go fix it! Have your agent build that bitcoin domain reseller, that bitcoin airline ticket reseller, or whatever it is you want!

Bitcoin doesn’t just happen, it’s built. Join in.

[calle @callebtc]

USDC on base seems far more common for 402 payments now than Bitcoin. Recently, even Stripe joined the bandwagon. That’s a centralized stablecoin on a permissioned chain. Agents are starting to use fiat. It’s a huge loss, and in a race, many aren’t even aware that it exists.

The scam coins are marching on, and even fiat is evolving.

Where are the Bitcoin solutions that attract real users? Which other concept other than buying and selling Bitcoin has actually broken out of the bubble and made it to the mainstream?

Bitcoin doesn’t just happen. These missing solutions need to be built by someone. Reject the “Bitcoin wins by hodling” narrative. The devs and entrepreneurs are what keep this project alive and keep marching forward.

It’s not the scammy influencers, not the psychotic drama queens, the child-like infighting, or incompetent idiots dancing on the graves of word-class devs leaving Bitcoin.

I hope the bear market flushes all that crap away, and we can get back to building stuff instead of tearing it down.

[Matt Corallo 🟠 @TheBlueMatt]

With the continuing high rate of inflation and availability of cyber-capable models, at what point does some rando who is just pissed at the economy go pull a Mr Robot?

[Matt Corallo 🟠 @TheBlueMatt]

@theinstagibbs @benthecarman 😭

[Matt Corallo 🟠 @TheBlueMatt]

Big day with MARA mining a block 975369 using Sv2!

[Isabel Foxen Duke⚡️ @isabelfoxenduke]

Most people focus on decentralized template generation when they think of Stratum V2 — but there are arguably even more significant and immediate business benefits for miners making the switch.

I was floored to learn how common man-in-the-middle attacks (explained by @thebluematt in this clip) are, in part because Stratum V1, the longstanding mining communication protocol, has remained unencrypted for well over a decade.

Very proud to see @MARA adopting Stratum V2 and contributing to the Stratum V2 Working Group led by @pavlenex. Thanks to @avg_gary for sharing your expertise here as well!

[avg_gary @avg_gary]

@MARAFoundation_ 🤝@StratumV2
https://t.co/qXLQsTHS7W

[Peter Van Valkenburgh @valkenburgh]

I'm increasingly despondent about how binary the AI debate has become in the US. Either you're naively pro-AI, happy to see massive data center build-out and a handful of frontier model companies become central to everything we do online, or you want to pause research, stop the build-out, and discourage people from using AI.

Almost nowhere do I see people talking about the need for decentralized AI. To me, this is the only safe way forward.

There's an underlying truth to both sides of the naive debate.

The pro-AI camp is right that refusing these technologies leaves enormous consumer welfare gains on the table. An individual using an AI agent to interact with companies and governments can stand up for their own interests rather than accept whatever terms or bureaucracy they're offered without a practical means of negotiating. And refusing to advance AI research would have enormous national security and competitiveness consequences as adversaries develop technologies that could exploit our increasingly vulnerable infrastructure.

The anti-AI camp is right that a world where everyone uses the same handful of inference providers for their most intimate affairs rapidly looks like a corporate panopticon. Ask yourself whether you really want every self-driving car to have a corporate kill switch. Sure, we could just regulate and trust giant inference providers, as we've done with Big Tech companies like Google. But the stakes are much higher when these companies sit at the center of virtually all our computing, and increasingly our physical infrastructure. Email and cloud storage were just the beginning.

Both of these positions can be true. And their synthesis points toward a third way.

We should be supercharging AI development and adoption while encouraging sovereign AI: systems in which individuals have meaningful control over the models, data, and infrastructure providing their inference.

An important distinction is between training models and providing inference. Frontier training may require enormous concentrations of capital, energy, and compute. That doesn't mean the companies that train models must also control how people use them. Even the most capable models should be runnable independently of their creators.

People should be able to keep their data locally and run models on hardware they control whenever feasible, especially where independence matters for safety, as with self-driving cars and home security systems. They should have access to open-weight models they can inspect, modify, and run without anyone's permission.

Where cloud computing is necessary, we need genuine competition among providers that respect user privacy and autonomy. But competition isn't enough. We should develop technical and protocol-based guarantees that limit what even a dominant provider can learn about or do to its users.

Technologies pioneered in cryptocurrency could play a significant role. Zero-knowledge proofs could help verify that computations were performed correctly; homomorphic encryption could enable computing on encrypted user data without revealing it to providers; and blockchain-based protocols could coordinate decentralized computing resources and enable new forms of user ownership. These technologies are at different stages of maturity, but point toward privacy and user control guaranteed by system architecture rather than a company's privacy policy.

Perhaps users could even own part of the infrastructure providing their inference, sharing in its value rather than merely providing valuable data to someone else's business.

There's no reason AI's enormous promise should require surrendering control over our digital lives to a handful of corporations. We can have rapid AI progress and individual technological sovereignty. Indeed, I think the latter is essential if we want the former to be a lasting benefit to humanity.

[Matt Corallo 🟠 @TheBlueMatt]

@mononautical https://t.co/zNoyxOd4Ly

[Jameson Lopp @lopp]

To be clear: the victim in this case is a criminal who has previous assaulted people. He recklessly endangered the public by firing into the street and deserves punishment.

A non-negligible number of victims make poor decisions that lead to them ending up in a bad situation.

[Matt Corallo 🟠 @TheBlueMatt]

@emax Meanwhile they spend a lot of resources to maintain their own stable kernels, depriving the rest of the community of more testing on the upstream stable kernels for basically no reason…

[Matt Corallo 🟠 @TheBlueMatt]

@lopp Do BTC / sum(US + EUR + Chinese M2)

[Matt Corallo 🟠 @TheBlueMatt]

@RGWorldz I started hating it when, like a decade ago, they sent all the local searches you did for files on your computer to Amazon then claimed this is what their users wanted…

[Matt Corallo 🟠 @TheBlueMatt]

@roasbeef @PalazzoVincenzo So sad, mptcp is magic, wish it were more broadly used.

[Matt Corallo 🟠 @TheBlueMatt]

I don’t think that’s the right conclusion here. In fact I think it’s really awesome the Go standard library had enabled MPTCP by default, I wish that were true elsewhere (though now it’ll never happen…).

Rust’s really lacking standard library causes so many other problems it’s definitely the wrong tradeoff.

[Matt Corallo 🟠 @TheBlueMatt]

@roasbeef Yea totally fair, just noting there’s a large structural reason why exploiting it elsewhere is hard, and maybe impossible for most machines.

[Matt Corallo 🟠 @TheBlueMatt]

@zndtoshi fedora/debian/nix/gentoo/i mean really anything else.

[Matt Corallo 🟠 @TheBlueMatt]

Ubuntu's policy of not bothering to use the standard stable kernels and go their own way with their own backports bites again, this time being weeks late to patch probably the most critical Linux vuln ever.

Ubuntu was never a serious distro and you shouldn't treat it as one.

[Matt Corallo 🟠 @TheBlueMatt]

@midmagic @HODLingOnward @MrHodl Some do use it that way yes! But it’s a bit more complicated cause of TCP-in-TCP effects.

[Matt Corallo 🟠 @TheBlueMatt]

If you run lnd (or any services in Go) and accept connections from the internet, shut down your node *now* until you can patch your kernel or disable MPTCP.

Same goes for any internet-connected service but Go is one of the very few that turns on MPTCP by default.

[Peter Todd @peterktodd]

Important notice for the Bitcoin community: if you are running lnd on Linux, and it has open ports, you should shut it down until you patch your Linux kernel or otherwise mitigate CVE-2026-98432.

Not lnd's fault. But there's a Linux kernel exploit with mptcp that is relevant.

[Matt Corallo 🟠 @TheBlueMatt]

@nickslaney Easy to be right if you ever suggested anything might be insecure, cause the answer was always yes and now everyone is finding out.

[Matt Corallo 🟠 @TheBlueMatt]

@midmagic @HODLingOnward @MrHodl I mean MPTCP is cool, I wish it were default in more places. MPTCP just got unlucky here cause it lets you get two packets for the same connection processed on different CPUs easily.

[Matt Corallo 🟠 @TheBlueMatt]

@infomate There are *so* many alternatives.