Wait so let me get this straight. Luke’s (obviously) trying to rig the PoW function selection for his coin, probably cause he has ASICs for one option. So….he’s just trying to create a coin he can premine so he can dump it on the BIP 110 followers? Man that’s low af.

People got this weird idea after segwit that a “UASF” is this magic thing where a bunch of people on social media get together and start making threats and suddenly Bitcoin’s consensus rules will change. That’s nonsense. I’m sorry if you were told that the thing that activated Segwit was a UASF and nothing else but you were lied to.

lol https://bip110.fail

I missed that 110-coin isn’t even banning the subset of data BIP 110 seeks to ban, and probably never will. bip110.fail

Yet more phishing attempts.

It’s still early, but it’s not at all the case that we cant learn anything from this and do better. If I were a hardware wallet manufacturer, I think my takeaways/changes I’d make are: 1) i fallbacks or hashing in weak entropy should be explicitly verboten. Unless it’s 96 bits or higher, do not include it! 2) Anything generating keys on an embedded device should have at least two random inputs and should check them with even basic randomness tests. This requires pulling lots of extra bits in before they’ve been whitened which isn’t possible on all hardware, but hardware that does whitening usually will do tests for you so make sure you’re checking it! 3. (Obviously) Everyone should be doing regular LLM reviews of software and firmware. 4. HWWs should have an explicit QA step where each input to the RNG is logged and the result of adding those inputs together to build a seed is done on a separate device with a reimplementation and compared against the device's seed. This should be done for each firmware release. I doubt almost any HWWs today do 2&4.

I’m gonna be honest, as much as I think bitcoin is important for freedom in the long term, it really doesn’t feel great working in bitcoin this weekend.

LLMs are very two-sided for security. On the one hand, long-latent bugs are finally surfacing. On the other hand, before you choose to use a product, you can get your own code review done for incredibly low cost*! In the short term it’s incredibly bad, in the long-term it democratizes code review greatly. “Don’t trust, verify” finally becomes an actual possibility for normal people! * of course LLMs do still make up issues when asked, push any such review to write PoCs to check their analysis!

Migrate them funds!

Worth pointing out, multisig is only fine in an N-of-M where N is greater than the number of cold cards! 2-of-2 with two cold cards is not safe!