Matt Visser

CEO @ Sonic Labs
Also a thinker, writer & human. Personal account for personal views.

[Matt Visser @MattVisser]

Long week, some note so far.

There are more private supporters than public haters. Interest in us and our future remains enthusiastic.

[Sonic @SonicLabs]

Tune in as @MrMinter_eth takes the stage to break down how the L1 landscape has evolved over the past few years, and where it's heading next.

[Stelian Balta @stelyb]

At @HyperchainC, our support for @SonicLabs and its team remains unchanged. We are very excited for what comes next. The future isn’t shaped by comfort, it is shaped by those who keep building when it’s hardest.

[Matt Visser @MattVisser]

We will keep focusing on fundamentals, everyone wants ‘number go up’, so do we, but near-term price changes are mostly just noise. Long-term returns are driven by a company's underlying fundamentals, like earnings, competitive advantage and management, not by daily market sentiment.

[Matt Visser @MattVisser]

Long week, some note so far.

There are more private supporters than public haters. Interest in us and our future remains enthusiastic.

[Matt Visser @MattVisser]

I wouldn't have taken on this challenge if I didn't think we could win and yes, I took the time to look at lots of angles and it's tough at the moment, but the best revenge is success.

[Matt Visser @MattVisser]

1% seems small until you start stacking it daily.

There is still loads to do and much more to come, including our own dapps, welcoming builders and their long missed protocols & products back onchain, B2B business development, leveraging our strengths, and turning Sonic into a world class leader.

[Sonic @SonicLabs]

https://t.co/CWMksIwFHf

[Matt Visser @MattVisser]

@lymbothecat @SonicLabs @flyingtulip_ Official updates will come from @SonicLabs - another one shortly, think that's fair and appreciate everyone's enthusiasm but also want to give the right people space to do their jobs. We're not going anywhere soon.

[vx-underground @vxunderground]

the tl;dr of the drift protocol shenanigans

> be drift protocol
> decentralized trading thingy
> built on solana or something
> april 1st
> april fools
> jk $280,000,000 (approx.) stolen
> rewind
> fall, 2025
> drift people at conference
> crypto nerds approach them
> crypto nerds say theyre at some fancy place
> want to integrate with drift
> crypto nerds sneeky
> crypto nerds only talk to specific people
> wtf how they know who is who?
> crypto nerds hang out in person
> meet at multiple conferences
> crypto nerds smart af, know crypto fr
> these_guys_are_chill.jpeg
> december, january comes around
> setup private group chat
> long meetings about strategy and stuff
> contracts and on-boarding stuff
> fancy_meetings.mp4
> crypto nerds put up $1m in cash for investment
> these_guys_are_legit.mp3
> hang out more in person
> start collaborating with coding projects
> april 1st
> $280,000,000 missing
> cool bros missing
> wtf?
> all chat logs gone
> all software sharing stuff gone
> wtf?
> 1-800-help-us-mandiant
> digital forensic and incident response time
> mandiant looks inside
> 1 drift person compromised from code sharing stuff
> 2nd drift person compromised from some test thingy
> wtf who is this
> look inside
> UNC4736
> unironically north korean spies
> sent abroad to do in-person social engineering
> crypto forensic nerds tie it to radiant capitol hack
> mandiant still investigating right now

tl;dr north korean nerds leave north korea, act like total bros, hang out at conferences, have tons of money, bamboozle people in long-term social engineering and espionage stuff to steal hundreds of millions of dollars

[Andre Cronje @AndreCronjeTech]

The UX difference between Ethereum and Sonic never ceases to amaze me. Sonic feels like web2.

[Matt Visser @MattVisser]

The accuracy that the scam drainer websites are produced with now is almost as scary as the speed that they're kept up to date.

Remember to check the domain and url. Some sneak attacks read really well.
Don't confirm or click on anything you didn't initiate and help your crypto frens by reporting & blocking obvious scams. $FT

[Matt Visser @MattVisser]

@DoctorDeFi @aimeehall_eth Got another account to block and report, scammers coming in thick. Do the thing. https://t.co/jIHxjRrjDw

[ZARP Stablecoin @ZARP_Stablecoin]

The ZARP ecosystem is growing with use cases we never imagined for a Rand stablecoin. So much more to come 🟢💫

https://t.co/3muEoBUJ9T

[Matt Visser @MattVisser]

"user experience" and "security" are thus not separate fields.

[vitalik.eth @VitalikButerin]

How I think about "security":

The goal is to minimize the divergence between the user's intent, and the actual behavior of the system.

"User experience" can also be defined in this way. Thus, "user experience" and "security" are thus not separate fields. However, "security" focuses on tail risk situations (where downside of divergence is large), and specifically tail risk situations that come about as a result of adversarial behavior.

One thing that becomes immediately obvious from the above definition, is that "perfect security" is impossible. Not because machines are "flawed", or even because humans designing the machines are "flawed", but because "the user's intent" is fundamentally an extremely complex object that the user themselves does not have easy access to.

Suppose the user's intent is "I want to send 1 ETH to Bob". But "Bob" is itself a complicated meatspace entity that cannot be easily mathematically defined. You could "represent" Bob with some public key or hash, but then the possibility that the public key or hash is not actually Bob becomes part of the threat model. The possibility that there is a contentious hard fork, and so the question of which chain represents "ETH" is subjective. In reality, the user has a well-formed picture about these topics, which gets summarized by the umbrella term "common sense", but these things are not easily mathematically defined.

Once you get into more complicated user goals - take, for example, the goal of "preserving the user's privacy" - it becomes even more complicated. Many people intuitively think that encrypting messages is enough, but the reality is that the metadata pattern of who talks to whom, and the timing pattern between messages, etc, can leak a huge amount of information. What is a "trivial" privacy loss, versus a "catastrophic" loss?

If you're familiar with early Yudkowskian thinking about AI safety, and how simply specifying goals robustly is one of the hardest parts of the problem, you will recognize that this is the same problem.

Now, what do "good security solutions" look like?

This applies for:

* Ethereum wallets
* Operating systems
* Formal verification of smart contracts or clients or any computer programs
* Hardware
* ...

The fundamental constraint is: anything that the user can input into the system is fundamentally far too low-complexity to fully encode their intent. I would argue that the common trait of a good solution is: the user is specifying their intention in multiple, overlapping ways, and the system only acts when these specifications are aligned with each other.

Examples:

* Type systems in programming: the programmer first specifies *what the program does* (the code itself), but then also specifies *what "shape" each data structure has at every step of the computation*. If the two diverge, the program fails to compile.
* Formal verification: the programmer specifies what the program does (the code itself), and then also specifies mathematical properties that the program satisfies
* Transaction simulations: the user specifies first what action they want to take, and then clicks "OK" or "Cancel" after seeing a simulation of the onchain consequences of that action
* Post-assertions in transactions: the transaction specifies both the action and its expected effects, and both have to match for the transaction to take effect
* Multisig / social recovery: the user specifies multiple keys that represent their authority
* Spending limits, new-address confirmations, etc: the user specifies first what action they want to take, and then, if that action is "unusual" or "high-risk" in some sense, the user has to re-specify "yes, I know I am doing something unusual / high-risk"

In all cases, the pattern is the same: there is no perfection, there is only risk reduction through redundancy. And you want the different redundant specifications to "approach the user's intent" from different "angles": eg. action, and expected consequences, expected level of significance, economic bound on downside, etc

This way of thinking also hints at the right way to use LLMs. LLMs done right are themselves a simulation of intent. A generic LLM is (among other things) like a "shadow" of the concept of human common sense. A user-fine-tuned LLM is like a "shadow" of that user themselves, and can identify in a more fine-grained way what is normal vs unusual.

LLMs should under no circumstances be relied on as a sole determiner of intent. But they are one "angle" from which a user's intent can be approximated. It's an angle very different from traditional, explicit, ways of encoding intent, and that difference itself maximizes the likelihood that the redundancy will prove useful.

One other corollary is that "security" does NOT mean "make the user do more clicks for everything". Rather, security should mean: it should be easy (if not automated) to do low-risk things, and hard to do dangerous things. Getting this balance right is the challenge.

[Peby 🥧 @pebtrocious]

It this doesn't convince you to go https://t.co/7pbWXRVkLY
then I don't know what will

[Matt Visser @MattVisser]

Today's spirit animal is an old smoker telling a young vaper how the world should work..

[Matt Visser @MattVisser]

@D_Hastie Comment for the algorithm sir 🤙🍿

[Chris Monteiro @Deku_shrub]

If you're thinking about writing about the murder for hire scammers arrest, read my summary first https://t.co/sjRVpAyvO4