It's All So Tiresome

Bitcoin is close to becoming worthless.

Now what's the Bitcoin? Bitcoin's like rat poison. Yeah. Oh. The greatest scam in history. Let's get it. Bitcoin will go to fucking zero.

Welcome

back to the Bitcoin Brief, the show where me and q and a catch up every two weeks to talk about Bitcoin, privacy, open source, keeping your Bitcoin secure, and the news and software updates that matter.

I just wanted to say a massive thank you to everyone who's been supporting Ungovernable Misfits, and a big thank you to Foundation Devices for supporting the show. If you haven't already checked them out, go to foundation.xyzed.

They make cipherpunk tools for fuckwits, and anyone can use this, even me. If you have any questions or you want to reach out, feel free, and I'll be happy to go through things with you. For anything super technical, I'll pass you on to queue. If you wanna buy one of these incredible passports, use the code ungovernable.

It will get you a discount, and it will let them know that I'm shilling. I'd also like to say a huge thank you to the Cake Wallet team. Not only are they supporting this show, but they're also bringing out some incredible features.

For those of you who actually use Bitcoin and actually care about their privacy and security, Cakewallet make it incredibly simple for you to live outside of the traditional financial system.

You can use Cake Pay within the app to buy gift cards for food, petrol, and whatever else you might need day to day. You can use silent payments, and, of course, you can use Monero. You can connect both Bitcoin and Monero nodes, use coin control, and this team are constantly innovating.

And I'm really excited to be working with them. If you have any questions, you can reach out to me, but check them out at cakewallet.com. Download the APK or start using this today on Mac, Windows, Linux, iPhone, or, of course, your Android device.

Enjoy the show. Yo. Yo. Yo. Yo. How's it going? Very good, mate. And we got the countdown right there. We did. Yeah. I kept my mouth shut this time and let the you do the talking for me.

How's things? Are you well? I'm lucky. Very good, mate. Yeah. Very good. Enjoyed our Freedom Tech Friday with Max. That was a good one. That was a highlight. It was a good one. Yeah. I've just been going through the the clips and stuff to share for this week, and

he he's just a class act, isn't He he messaged me on signal afterwards saying, you know, how did it go? And I I thought he said I felt like it flowed pretty well. And I just said, look, when you've got somebody who really knows what they're talking about on the other end of the stream, it really makes life so much easier.

Yeah. Yeah. He absolutely just flowed through that one. So, yeah, that was really good. Enjoyed that. Looks like we got a bit more of a news heavy one today as well, so looking forward to getting into that. I've been a miserable bastard for, like, a few weeks now, but one good thing happened,

which put a big smile on my face. You know, last week, we said, oh, it'd be nice if one of the ungovernables recorded notes from the inside. And I like in my misery, I was like, I don't if was gonna fucking do it. It's gonna be end up being ass, me, me, me, me, all that. And then, Silas Thornbrook, the absolute legend,

who posts all of our shows and messages and does all sorts of things for the show all the time, messaged me and said, yep. I've recorded it. Let me know if you can edit it and get it out. So he's actually stood up and done that. So thank you to Silas.

Now I just need to get that edited now, and hopefully, that'll be this week. So know, the longest well well, thank you, Selas. For the longest time, I've I I haven't vocalized this until this very moment, but I was convinced that that was somebody else's sock puppet account, that it was somebody on the team.

That's what I thought as well. We thought the exact same thing. Yeah. It's exactly what I thought. Could be. Could be. Well, it's definitely not me because I had the the wondering, and it seems like it's not you either. So whoever you are, thank you. I'm I'm looking forward to hearing your voice.

That would be a real, a clever play if it was me, and I've actually recorded something in a different voice and then edited it myself and then pretended that I'd had that communication. It'd be very layered.

It would. It we we certainly had me fooled anyway. But, yeah, thank you, Silas. You put a smile on my face there, mate. When's that one dropping? Whenever I get around to it. I mean, hopefully, this week, I've got a load of editing to do on it and then the artwork and stuff. So I I will try and get it out this week is my plan.

Nice. Alright. Well, the next one that comes along, I wanna you don't necessarily have to publish it, but I've I've seen a couple of open source voice cloning tools.

And I just when we get the next one that you wanna do, I just wanna try it out to see whether and any of these open source voice transcription AI powered ones are any good. So maybe we'll use that as a test. And if it is good, we can publish it's if it's shit, then, you know, it was a worthwhile test for me to know that they're shit.

You know, before the first one dropped, I don't know if you knew this or not, but I spent, like, three solid days trying to clone Keone's voice and then got to a point where I just wasn't allowed to use it because of some restrictions.

And you could only use it to that level of quality if it was my own voice and I could verify it. And I couldn't even verify my own voice, so then that tool got just binned. And I was just fuck you. And that's actually what sent me down the AI rabbit hole and starting to use this more. I was like, I want at least, like,

like, hosted self hosted stuff. It sent me down that rabbit hole. So I like, fuck you. Don't know. Tell me what I can and can't do. Because I actually got it nailed. Like, it sounded so good, and then I was like, no. I can't do this.

Well, that's the beauty of these open source locally hosted ones. Right? Like, there's no gatekeepers. Exactly. So I'll I'll I'll happily be the guinea pig on that one. I remain skeptical on these sorts of things because

my my Twitter algorithm at the moment is, like, every time I scroll up, there's, like, some sensationalist post. It's like, this service just got killed by AI, and you're just like, yeah. Fuck off. Like, most of it's probably bullshit, but seen a couple of these these voice ones now, and it's just like 11 labs just got killed.

And I'm like, yeah. Okay. We'll see. Well, it's worth trying out. Yeah. Definitely. We don't need spending another three days on it. No. What's new in my world? Working hard as always. Prime time's going well. Got the last one tomorrow.

That's gonna be nice. Gonna be showcasing some of the vibe coding I've been doing because the the premise of this final prime time is that it's like what's next for possible prime, basically. So showcasing the the developer kit and, you know, what you can do with it even if you're

a bit of a an idiot like me. You know, you can still achieve some cool shit. So looking forward to doing that. Obviously, it will already have happened by the time this goes out. So it will be on the foundation YouTube if you wanna go and check it out afterwards.

And outside of that, got some holidays coming up. Going away with the boys on Thursday. We're doing a driving trip around Europe, which I'm very much looking forward to. Oh, it's that holiday?

It's that holiday. Yeah. We're in France, Monaco, Italy, Austria, Germany Wow. Belgium. Then I'm I'm very jealous. Big loop. Yeah.

I'm very jealous. That sounds like a lot of fun. Are you ending up in that same place that you went last time where you can go quite fast? The Nurburgring. Yeah. We've got three days there. That's not the last that's the second to last stop.

But, yeah, that's obviously the the trip highlight, but we're going all the way down to the South Of France first, and then working our way back up through Italy and Austria before we get back to Germany.

Oh, all that hard work is paying off. Yeah. Yeah. Looking forward to it. Lots of long days in the car. We're we're gonna be averaging, like, seven or eight hours a day driving. Mhmm. So we're we're apart from the Nurburgring, the track, we're we're only staying at one night in each place.

So I'd imagine it is gonna be a tiring trip, but we there's so much that we wanted to pack in and, you know, my my the passport with the wife only only gets me so far.

Talking about passports, I received my parcel. Thank you. So I should be having something arriving with me or someone on my behalf received a parcel and therefore it will be with me in, like, the next two to three weeks. So I'm looking forward to unwrapping that. I was very shocked how quickly it came.

Oh, it's remarkable. It was like, you said you're gonna send it, and then it was like, it was there. I think it was, like, literally Was it thirty? Hours? Yeah. It was it was like it was ridiculous.

So That's the normal shipping, by the way. We didn't use any expedited services. Like, that's what we we just use the same one as always. So maybe we just Say what you will about Q, but, you know, the shipping is remarkable.

There you go. There you go. So, yeah, the next couple of Freedom Tech Fridays are gonna be queue less. So I'm leaving here. Mhmm. You lovely listeners in the capable hands of of the rest of the clan.

Yeah. We've got Zach on next, haven't we, I think, while you're away? Yeah. Zach's on on Friday and then Yep. No. Sorry. Zach is a week on Friday, I think this Friday is Friday. The one of the AI solutions.

Okay. Me and Seth actually met the guy in in Vegas. Can't I can't think of his name now, but I'm a bit gutted I'll be missing that one. I might even be able to listen to it live actually while I'm on the road. Oh, yeah. Very nice. Whittling my way down to the South Of France listening to you boys

talking about AI. That sounds like sounds like a fun few hours. You'll you'll struggle to hear it over that crackle of the Lambo, won't you? Yeah. Well, it's I'm not taking the Lambo. I'm gonna break them a clap. Leave that at home. Okay. Yeah. Fair enough. Keeping miles down on the Lambo.

What else have we got? Just a bit of AOB. Obviously, as you know, we front load all of the the samurai, kionne, bill sort of stuff. Since the last show, Keone's posted, obviously, via Lauren onto his Twitter with a bit of an appeal.

I'm actually gonna read it in full because it, you know, it warrants doing so. And this was posted on the May 6, so literally like a day or two after we recorded last time. So it's it's kind of old news now, but it's it's new if you your your new source is us.

Mhmm. So Keoni said, I'm writing from f p c Morgantown Prison in West Virginia. It's been about five months since I first surrendered myself in December, and I will be honest, the prospect of a presidential pardon is very low.

There was some hope during the Bitcoin twenty twenty six conference, but that has now come and gone, and one must now come to terms with the fact that I am simply a federal prisoner without money, power, or influence, and I will serve my full sentence.

It will be years before I can even attempt to rebuild my life, which is why I'm now writing this appeal to you all now. There are things are dire and we need your help. Lauren and I need your help desperately more than ever before.

We have over $2,000,000 of debt due to legal fees. We have a $250,000 fine that the judge levied against us. And every day, I get letters and calls from anxious lawyers looking to be paid.

Or the DOJ demanding that I start making payments on my fine, which a quick break, by the way. This is me now. How how can they demand that he starts making payments while he's fucking locked up? Does that make any sense?

I genuinely believe a lot of this stuff is just, like, humiliation ritual kind of, like, mental torture kind of stuff because it it seems to happen every time I speak to anyone who's in a somewhat similar position. There are these kind of things that are so outrageous and stupid and impossible and infuriating

that it it seems it is that. And if you think about the type of people that you're dealing with, they're sick individuals. And so Yeah. I I think it's that. So as shit as that is, like, sometimes having that view of knowing, okay. This is this is here to test me is a better view than, like, letting things

build up in your head and get, like, get you frustrated. You're like, yeah. I expect the worst from these people. Yeah. Anyway, I'll continue. Perhaps it was denial or delusion, but I had hopes that hope to do what I've always done and dig myself out of this hole myself.

But with the reality of serving a full sentence, that is just not possible. I hate to ask for your help in this way, but we are entirely out of options. We need to pay off these legal bills and other debts accrued attempting to defend myself.

We desperately need your help now. For ten years, Bill and I built and published open source code and tools for Bitcoin users. Those same tools and code are what the government says were criminal.

The tools and the code still exist. They're out there right now and always will be. The creators, however, are locked away in federal prison. The creators are the ones whose lives have been decimated.

The creators are the ones who have been financially wiped out. The creators are the ones who desperately need you now. Please donate whatever you can to insert Bitcoin address will be linked in the show notes.

And we have to get this albatross from around our neck. Samurai had well over 100,000 users. These users pushed over $2,000,000,000 through our open source tools. We need those users and any Bitcoiner who appreciates the work that we put into this industry for over a decade decade to help us now. Please donate whatever you can right now.

If you require a private address, please d m my wife at lauren into her handle. Again, it will be linked in the show notes, and she will provide one. Please do not delay. Time is of the essence.

Please help us. Kyone. I don't really know what what to say, man. It's just really difficult to read that sort of shit. And obviously, it goes without saying I would urge people to, you know, donate whatever they can if you've ever been

in and around the samurai ecosystem. Like, these people really, really need your help. So just just do whatever you can. Yeah. Do we have any sort of insight on what's been done so far or, like, has it moved the needle at all? Can we see anything like that? Or

It's a static address, so I'm just pulling up mempool. Space now. Let me see what's in there. Wow. Okay. There is 1.69 bit coin, a $131,000 across 257 confirmed UTXOs. So more than I was expecting, I'll be honest. That's that's

very good to see. Yeah. I believe there was a a couple of sizable donations in there. Mhmm. So it's good to see. Yeah. Look, there's there's two UTXOs, both 0.5 bitcoin in size. So that makes up the bulk of that number.

So so clearly some very generous people out there. So if you are listening to this, if you are one of those people, like, thank you so much. That that's huge. Yeah. Thank you. Obviously, you know, it it's a small dent into a a a $2,000,000

hole, but, you know, it's a start. That is a sizable amount of money. We just need to keep filling the gas and doing what we can. Yeah. Absolutely. Okay. Let's move on to the news. Lots to talk about this week.

First of all, the biggest headline from this fortnight for for our audience, I would say, is that the BISC trade protocol had an exploit. On the May 1, the BISC team disclosed via their pub their forum that someone had managed to drain 11.59 bitcoin out of 10 users on their v one trade protocol.

Bisc for anybody that's new to it is obviously the decentralized peer to peer exchange Runs, you know, no KYC, runs over Tor, no central server. And that's why, you know, a lot of people care about it and use it.

The the bug itself is the interesting bit. There was a missing validation check on inputs coming from the let me think about this. On the taker side of the trade, makers and takers are supposed to use the same minor fee, which is part of how the the the kind of math of the the best protocol holds everything together.

A malicious taker was able to publish a bad fee value.

And through that math, what came out the other side was a multisig output of just 0.001 bitcoin with all the rest of the funds redirected into the takers own change output. Essentially, they shrank the legitimate side of the trade down to dust and pocketed the difference.

All 10 of the affected trades were altcoin trades, which is interesting. And, obviously, this was almost two weeks ago now. As I say, it happened just after we recorded last time. So there has been a a response and some action since.

The head maintainer filed a reimbursement plan on GitHub on the May 3 with payouts in BTC with BSQ, their colored coin as an optional alternative. Going through the the best Dow vote around, I believe it's scheduled for next week on the May 25 to, like, you know, accept that this is a, I guess, an acceptable reimbursement

plan to those affected. The hotfix for the vulnerability landed in landed into bisque two days ago on May 16 with broader hardening on top. So we've got trade, protocol checks, network message validation,

supply chain hardening, all that sort of stuff. So they didn't just patch the hole. They've they've kind of widened the entire audit and looks like they've, you know, belt and braces type thing.

Mhmm. And the other thing that Bisc said is, and this is where it gets a little bit more interesting, is that they explicitly flagged the incident as likely an AI assisted exploit. Yeah. I saw They detail exactly how they think AI was used, which is fair given how, you know, fresh all of this is.

But the fact that the, you know, the best project itself is calling that out is is worth worth a mention. And probably gonna see a lot more of this, if I'm being honest, in in the the coming weeks, months, and years.

More vulnerabilities in general. I mean, yeah, if you can throw you know, even if you're a dev, even if you're a good dev, you can sort of throw weeks and weeks and weeks and weeks to try and find an issue and find wormy way into something. Well, throw an AI at at, like, it the cost is practically zero. So

in a way, like, you can look at this as a good thing because it's gonna find these vulnerabilities faster because someone's gonna find them. And, like, even at especially at, like, protocol level with Bitcoin stuff, like, if we're attacking ourselves, it means that the bigger attackers, the more problematic attackers have a harder time.

Yeah. I I was thinking about this the other day when I was out walking with the dog with this whole, like, AI exploits and penetration testing and things like that. Like, we're going into a bit of a wild place where the people that get access to the the latest and greatest frontier models, and I'm thinking about things like

the the the mythos one from from Anthropic, like, whoever gets access to that first, like, has, like, a clean shot of, you know, attacking all of the monetary targets, I guess. So it gets yourself into a weird position where, you know, people like Anthropic and OpenAI are in a weird position where they're like,

do we just release this to the world and let people handle it? Do we give it to who we you know, to people who we deem, you know, white listed? Like, it's a difficult problem to solve, isn't it, really? If you you you you're able to wield all this power in in by having such a powerful model that can, you know, clearly break

what we're just scratching the surface with what it can break. But clearly, only go trending in one direction at the moment. Like, I don't know how they're gonna navigate that. Like, do they Well, I do. I know exactly what first, they're do. Aren't they? Yeah. It's exactly what they're gonna do.

And then they're gonna put some sort of, like, safeguarding way around, like, they release it to, and there's a white list just like you said. It doesn't get released to the public. And then

those people who are white listed will be the absolute biggest criminals in the world, and then they're actually gonna do worse than just releasing it and just, like, letting nature take its course.

And it's gonna be the same because it is always it's always the same pattern. It's like, whatever industry and whatever technology or whatever, it's always the same. And it's like, give a trusted group of untrustworthy individuals access before the plebs.

Yeah. Well, as always, we'll see how that one unfolds. But We'll see. As always, sounds like we're aligned. Just before we go any further, on the bisque stuff, there's just a couple of things I wanted to point out. When you said it was interesting that it was an old coin trade, I'm 90% sure.

Last time I talked to Seth about BISC when we're on Monero monthly, he was saying it was something like I think it's like 80 or 85% of all trades on Bisq are Monero trades. And so I mean, I'm not a 100% sure.

If if I'm wrong, someone can shout at me and call me an idiot in the comments and and, like, with a generous boost attached, and we can go into that. But I'm I'm I'm pretty sure it's like the majority of all trades on Bisc are Monero.

So that's one thing I wanted to point out. And the other thing is there are also other attacks on BISC that go on all the time where it's not actually protocol level, but when it's banking level.

And so a trade will go through and then, like, a a a really close friend of mine that happened to recently for about I think it was, like, $10 or something like that. And they got so they got stung.

He did the trade. They sent the Bitcoin. They'd already traded with this person before. Then the money landed in their account,

and then there was, like, from the other bank to their bank, oh, this is fraud. We need a charge back, return of money, return of funds. This person then said, well, no. No. No. No. Look. Here's proof. Like, I bought this Bitcoin, and here's the, you know, here's the evidence of that and blah blah blah, and I've traded with them before.

And they still took the money. They still reimbursed it. And then they had three months of battle, and then they closed their account, and they didn't get the money back. Oh, man. Yeah. So that's I only say that as a BISC is great.

Just example. Using it for large amounts of money when you're doing things with banks even if these things get patched with, like, protocol level with BISC, and they're gonna reimburse you. Like, that's great. It's great to hear that they're doing that. I've got a lot of respect for them doing that.

You're still dealing with the banking system. So Yeah. Don't start thinking because it's decentralized and it's, like, all cool and, like, edgy and, like, bitcoin y. Don't think that that then negates the fact that you're using the banking system because that's what's gonna fuck you. And if you can do something with cash

or using gift cards, like I keep saying or whatever system rather than doing this, I would suggest that. Like, I just I've the fact that and this person isn't somebody who, like, $10 isn't a lot to them. It's like, that's a fucking huge, massive kick in the bollocks.

So just be careful. That's that's my point. Yeah. Absolutely. Alright. Next one. Lola over at the rage. Sharp as ever on the latest piece about the Roman Sterling of appeal hearing, happened recently.

Quick reminders. Roman Sterling of is the guy who was convicted in connection with the Bitcoin Fog custodial mixer. He's been appealing a conviction, and on the May 12, the appellate court reviewing took place.

The judges openly in the hearing suggested that Mixer's, quote, legal in theory, but not in practice once criminals start using them. I'm just gonna read that again. Legal in theory, but not in practice.

They also questioned whether running an intentionally sorry, internationally accessible service forces the operator to comply with the licensing regime of every single jurisdiction that the service could be reached from, which is again completely absurd.

You know, if that's the bar, then you basically cannot run any privacy preserving service from anywhere because someone somewhere will eventually use it. There is also, obviously, a samurai parallel here.

Both were prosecuted on the theory that providing privacy tooling makes you responsible for what users do with it. Now that the court is essentially saying that out loud, yes, that is the rule, even if the statute does not actually say it.

If this view survives the appeal, then the well, that will be the de facto standard in The US for every privacy tool, every coindering coordinator, every developer of anything that's such as financial privacy, which is obviously not good.

Mhmm. The question on the table is basically whether writing privacy software or running it is a crime in The United States, and we're getting closer to that answer. Absolutely fucking mental.

Mhmm. And again, just a quick recap, like, this this is the guy that basically got convicted because they they they said that he was the guy that was running it because he his IP address, his shared IP address basically, he was using a VPN, and and they said that his IP address was used to log in to another cryptocurrency service

around the same time as the alleged operator of Bitcoin Fog, and that's what they nailed him on. Completely agree. It's so mental as well because it's like, if anything, it just highlights how much you need VPNs and CoinJoin.

Like because if you don't use it, then you can be mixed up with things that have no relation to you, and you can end up in a cage. It's it's fucked.

Right. But, like, the point here is that he was, I believe, using a VPN, and so but so was the operator of Bitcoin Fog. And they've put that's enough evidence for them to say, oh, it must have been you.

So, you know, if you extrapolate that out and, you know, let's say I'm using Proton VPN and there's some not nice person accessing images that they shouldn't be on the Internet and it's using a shared IP address because they're also a Proton user, then

that the the the the book of law could be thrown at me because we share the same IP if you kind of extrapolate that out. It's completely insane. Like, that's not evidence. No. It's not even close to evidence. It's it's like, oh, you drove through Manchester

and there was a shooting there, which means that you roughly drove through in the same week and therefore, we're gonna pin that on you. It's it's like that level of idiocy. Yeah. Yeah.

Okay. Next one. Sticking with more regulations. The Clarity Act, which is the The US digital asset market Clarity Act to give it its full name, was passed out of the senate banking on the May 15.

Once again, Lola has been calling this one the pro law enforcement bill, which is on the evidence and more honest name than clarity. As always, she's got a finger on the pulse. Here's what was in it. The Bank Secrecy Act gets integrated into the bill 16 separate times.

Yes. 16. They've also added new Patriot Act special measures, which is the regime that lets the treasury cut off banking access to entire jurisdictions or services on, quote, national security grounds.

Privacy advocates have, of course, flagged how broad the data collection on ordinary Americans is going to be under this thing. People who've done nothing wrong, who has not suspected of anything will be inside another much wider surveillance net than they currently are today.

There was another wrinkle worth noting in this. They called out section six zero four, the BRCA, which protects open source developers from money transmitter liability. That did survive the markup, which is one of the pieces of good news in the bill. And Coincidence published an open letter on the fifteenth essentially saying,

do not give this up at conference because that is the next risk. The full senate or the conference committee could just strip that out. Yeah. But does it matter anyway? Because, you know, look look where we are. It's it's currently in law that you can back that way and you're still in a cage. So, like, you know, to some extent,

what does it fucking matter what the law is? Because they just do what they want anyway. Yeah. I agree. Keoni's wife actually obviously did a deep dive on this and called it out as well. And there is a carve out here, so it's not all as rosy as it may seem, especially with the the money transmitter liability,

but I'm desperately trying to find that out, find where she put that because I forgot to put it in the show notes. Here we go. There is a major flaw in the BRCA of the proposed clarity act.

Clarification of treatment explicitly states that the protections in subcheck subsection c do not extend to or modify the application of USC nineteen sixty blah blah blah for specific subset of conduct by initial person.

So, basically, this is the exact nineteen sixty subsection now being used to target developers. So she's saying her interpretation is that there is actually no protection for developers in the Clarity Act while this carve out remains. So as always, they've been very clever with with the wording

that there is still a carve out that they can still get people under the same vein as they have with Bigfoot Fog and Samurai, etcetera. So Yeah.

I don't know what else to say. What a depress it's such a depressing show so far. Yeah. Why is it so why is everything so fucking depressing? It's Yeah. So

I mean, we've we've memed it for years, like, oh, then they fight you stage. I guess this is the reality of it, mate. It is, isn't it? It's it is literally ever since the samurai arrest, the the mood within at least, I can only speak for, like, the ungovernable crew and, like, surrounding people. The the the mood and the

are you winning some kind of feeling is is very low. It's really low. I don't know how you ever get that back other than I don't know. Like, you because you can you can only separate

you can separate money from stay and all the stuff and all the memes and blah blah blah. And, you know, you can have your sort of separate systems. You can live one foot in fiat land and one foot in Bitcoin land, and that's all great and rosy, and you can trade between one another and blah blah blah.

You still have to physically set your feet in a certain jurisdiction, and it seems like almost all are trying to just completely destroy your ability to transact or live your life, like, as a normal person. So it's without getting, like, too depressed about the whole thing, it's it's kind of

not pointless, but it sometimes feels that way because it's like you still have to stand in that jurisdiction, and they can still just fucking make it up as they go along, and good people could be put away. And, like, that that kind of giddy, excited, we're gonna win feeling is not

really there at the moment, and I don't know whether that comes back. Agreed. Yep. Next on the list. What do we do? Can we start a a country? Can we do or we just get invaded, I suppose. But just like, there's gotta there's gotta be something where it's like

a left alone ville. Like, you can go somewhere and you just be fucking left alone. Maybe not. Maybe not. Who knows? Maybe not. Let us know if if you know and left a note Aloneville or you fancy starting one, and it's got a really good military as well to defend us. Let us know in the comments.

Yeah. Quick technical detour. Bitcoin OpTech newsletter four zero five released a couple of days ago has the public disclosure of CVE twenty twenty four five two nine one one. This is a use after free in parallel script validation in Bitcoin Core.

No idea what that means. Affecting version 0.14 all the way through to 28 or all of the 28 versions. And a fix has been in core version 29 since release. So this is long since been patched, but obviously now, as with all vulnerabilities, they talk about it after the fact. Yeah. So what does it mean in plain English, my trusty AI summary?

There is a class of memory bug where the program is using a piece of memory that is that it has already freed. In parallel script validation, that means an attacker could potentially trigger the bug by sending the node a specially crafted block.

The catch is that the attacker would need to supply enough proof of work to make the bug fire. So a practical attack window was pretty narrow, and it wasn't a kind of drop your node by sending a tweet kind of bug.

But this bug did sit undisclosed across many years of Bitcoin releases, and it was patched quietly in version 29 and then only now publicly disclosed, which is of course the responsible disclosure pattern working as you would expect.

Mhmm. So the actionable bit, I guess, for the listeners, basically, is if you're still on version 28 of Bitcoin Core or earlier, then you probably need to take some action. But if you're a start nine or Umbrella user that's relatively up to date, then you have nothing to worry about.

Good. Good. Alright. Next one on the list, Bitcoin knots version 29.3 has been released. And I know this is a software release, but I'm talk we're still in the news category here. But worth talking about because this one enables the BIP 110 fork off countdown.

So obviously, slightly more contentious one, but Bitcoin knots is the alternative node implementation maintained by Luke dash junior and pretty much only Luke dash junior. They released version 29.3 a couple of weeks ago on the May 9.

And this release enabled the bit one ten soft fork enforcement on by default. And Jameson Lop has set up a a public countdown timer called where's my link now? Is that what it's called? No.

It's called the Nazi death march countdown. Link link will be in the show notes and it's literally just a countdown page. It says, this countdown timer tracks how long it will be until people running bit one ten nodes will be forked off the Bitcoin network, most likely to a dead network that produces no new blocks.

Mhmm. And he's got links in there to, you know, layman guides to bit one ten and other various sources on the subject. Clearly, he views this through the, I guess, the Bitcoin Core side of Mhmm. Of the the argument, much like most of the population, myself included.

And, yeah, currently, eighty one days, three hours, forty six minutes, and twenty one seconds until until they fork themselves off the network. Well done, guys. Good work. Yeah. Good work. Is it worth recapping or not? No. No. No. Absolutely pointless.

Check out Jameson's link if you wanna wonder why they wanna fork off. Alright. Next on the list. This one was a remember the Bybit exploit for I think it was like $1,500,000,000. Blockstream have done a pretty good post mortem on it.

I got a quick summary here. So the buyback exploit earlier this year, I believe,

got a kind of public postmortem by Blockstream, which is very good, which is why I've included it. And the lesson that they've kind of included in the postmortem is that Bybit was running multisig.

They were using hardware wallets. So by every, you know, quote, buy one of these products and you're safe because your Bitcoin is offline, they get sold to everybody. They were doing all the right things, and they they still lost a billion and a half dollars anyway.

The Blockstream piece on this is is pretty clear about why. The compromise wasn't in the keys themself. It wasn't in whatever signing mechanism they were using. It was in the actual user flow.

The UI, the process around the device itself, and the way that the transaction got approved. Somewhere in that chain, the people approving the transactions were basically not seeing what they thought they were seeing.

So they signed off themselves on the drain with their hardware wallets, with their multisig software exactly as they designed the system. Their system worked perfectly. It just was not protecting what they thought it was protecting.

Obviously, I won't go into all the gory details of of base but, basically, the the software that they were running was able to be hijacked and passed malicious information over to whatever wallet software sorry, whatever signers they were using. And because it was very difficult to properly verify, I believe it was on the Ethereum chain,

what was actually happening with these complex scripts on a tiny screen that Mhmm. It just looked like a normal transaction. Little did they know it was draining 1 and a half billion dollars.

I was gonna say, because just just jumping in here, as you were saying, I was like, but surely you're looking on the hardware device to make sure that it matches and you you're like, okay. Yeah. You know,

take the last six digits at the back and take some in the middle and randomly look. Is it all the is it the same? Yeah. It's the same. Right. Fine. Let's go. But you're saying because it's Ethereum, it's different, and you're not you know, like, if I'm on if I'm on my passport and I'm looking on my phone and I'm looking across,

I can check and verify, like, okay. This is the same. Like, it's it's telling me the same thing on both. Yeah. So so I've got a I've got a I found a quick summary here. So nearly three weeks before the theft, Aku's compromised the developer's machine at SAFE, the firm running the multisig wallet infrastructure that Bybit used.

Using hijacked cloud credentials, they got access to SAFE's hosted web front end. Two days before the heist, they injected malicious drop JavaScript into a single file in that interface. The code was surgical.

It only activated for Bybit's specific wallet addresses. When Bybit's operators initiated what looked like a routine transfer, the malicious code silently swapped out the transaction payload.

The interface showed a normal looking transfer, and what was actually being signed was an instruction to hand over control of the wallet to attacker controlled addresses. All three ledger hardware signers approved it.

Each device displayed structured data fields, but couldn't decode what the transaction data parameter actually did. There was a critical change buried in there, a parameter switching from a standard call to something called a delegate call, where it just appeared as a numeric value with no readable context.

No signer could tell what they were actually authorizing. Two minutes after the drain and this is very clever. Two minutes after the drain of funds was completed, the attackers removed the malicious code from the front end and the theft has been attributed to the Lazarus Group based in Wow. Wow.

So when when did they find out this, that it wasn't actually Lazarus Group and blah blah blah? Like, how long did it take to get to that conclusion? Do you know what? I'm not sure. I'm not sure. What I'm reading from in the news article that's linked in the show notes is, like, the Blockstream post mortem.

I'm guessing they probably noticed straight away because, well, you would with a billion and a half dollars going missing. Quite a lot, ain't it? Yeah. Yeah. Yeah. Just it's not exactly down the back of the sofa change, is it?

Yeah. So, yeah. I mean, I know that, again, that's not new new news, but the way that Blockstream positioned it, I thought it was well worth a mention, especially when you just to, like, frame it around, like, you can feel as secure as possible,

but, like, as soon when you start dealing with, like, complex scripting and stuff, like, you you're going into a whole new ballgame, especially when you've got Ethereum and all that sort of stuff as well, which is way more complex.

Keep it simple is generally the way, isn't it? Yeah. Like, you know, even even though you would expect that a company that's managing that amount of money would be, somewhat capable. And, well, you know, it happens over and over and over and over again. So it's yeah.

It can happen. Yep. Next on the list, Poland has passed the EU Mica aligned crypto bill. So for those of you that don't remember, MICA, m I c a, markets in crypto assets, is the EU framework that all member states have to bring into local law by July.

Poland has just ticked that box. Now the interesting part around this with regards to Poland is that the vote landed alongside an active investigation into an exchange called Zonda Crypto, which is a Polish exchange that collapsed and took roughly $96,000,000 of user funds with it.

The prime minister Polish prime minister Tusk has been floating the possibility that there may be foreign influence angle in the Zonda Crypto collapse, which is predictably made the bill itself more politicized well, from both angles, I guess.

The the takeaway for European list is, I guess, is fairly straightforward. MICA is now the default regulatory environment for crypto in all of Europe, or it will be by July if there are any laggards.

So if you're using the European regulated exchange, you will be operating inside MICA and all of the compliance and reporting and limits and bullshit that comes with that. Mhmm. For the non Europeans, I guess the the wider point is that this MICA framework is sold as, as always, as bringing regulatory certainty.

As we know certainty. What yes. What it actually does in practice is harmoniously and fairly strict surveillance, in this instance, across 27 countries. This is kind of the model that The US wants to replicate with with clarity.

So, yeah, more bullshit. It's it's also tiresome, to quote the Korean meme. Yeah. Alright. We're gonna we're gonna finish off with two positive news items, Max. Oh, because I'm feeling a bit down after all that. Yeah. I am as well. Let's let's spice it up. Let's have some happy stuff. This is a really fun one. I was very

I had a a good chuckle with this one. And and especially, you know, because we've been talking about AI a lot on across all of the shows recently. A user on X who goes by CPRKRN, on the May 14, posted his story about recovering 5 Bitcoin from a wallet that he'd been locked out of for eleven years.

Yeah. The wallet was a blockchain.com wallet from 2015 when Bitcoin was around $250. So 5 which so 5 BTC now, what's like $400,000, something like that? Ish. Yeah. So the way he lost it is the part that you're gonna enjoy.

He says that he was stoned, changed the password, and then forgot it. I saw what the password is. It's fucking excellent. Yeah. Eleven years he spent eleven years trying to get back in, basically. And what finally worked was he dumped the contents of his entire computer into Claude, basically, and said, help.

There is some nuance here because the the there are some, you know, usual clout chasing viral headlines around this. Claude sorry. The viral headlines are basically saying, oh, Claude's like cracked a wallet, and that's not specifically true.

What's actually happened is is arguably more interesting that Claude went through the entire file system. It found an older backup from this wallet that was actually made in late twenty nineteen.

Mhmm. Which predated the password change. So the old password he's he did still have written down in a notebook actually worked on his older backup. He just didn't realize it. Mhmm. So and then the second layer is that he ran the open source tool BTC recover against the old backup.

Claude actually spotted a bug in BTC recover itself because the tool was concatenating a shared encryption key with the password in the wrong order during description, which sounds trivial, but might have been there for ages.

Claude fixed that bug in the BTC recover software, ran it again, and was able to get the private keys out of the lost wallet. Wow. So BTC recovery is like

you you don't have a password for a a wallet or you've lost a a, you know, whatever, like a pass phrase or something like that, and it just throws a million different options at something until it cracks it. Is that right? Or I think it actually operates around a number of different ways.

It will it can descramble, like, seed words in the wrong order. It can try and brute force wallet file passwords like it did in this one. Yeah. Basically, if you've, like, screwed up with a Bitcoin wallet and you've got, like, some information,

they have various different methods to try and help out with that. I'm sure passphrases is one of them as well. And

yeah. So so Claude found a bug in it, which was preventing this BTC recover software from actually working and finding this guy's wallet password, fixed the bug, and then BTC recover worked, and he got his 5 bit 5 bitcoin back.

Have you got written down what his password was? Because I saw that. Might be Oh, do know what? I don't have it in the notes. Go on. What what remind me. I can't remember exactly, but it was, like, after Claude had cracked it, he got to see what it was, and he'd made it while he was high. And it was FuckThePolice42069

or something like that. Yeah. So I was just like, that's classic. It was it was I've just found it in the tweet. He said the best part is my password was Lol420 fuck ThePolice.

Lol420. Love it. Love it. It. Love it. Very good. Very good. Yeah. That makes me happy. I like stuff like that. This is all the negative stuff about AI, but fuck me. Like, cheers, Claude. That's just changed someone's life.

Yeah. Next level. Next level. Forced forced huddle and then, like, oh, well done. You can buy a house. Yeah. Pretty wild. So congrats whoever you are. Enjoy it. Yeah. Well done. Yeah. Lowell, for Alright. Last one. Last one on the lit the the news list. More AI stuff. It's creeping into all aspects of our life, isn't it?

On the May 12, Spiral and Block have published a a substack post announcing a new project called Loop, l o u p e, which is a free AI powered vulnerability scanning service built specifically for open source Bitcoin projects.

The what it does basically is it uses an LLM to surface security weaknesses in code repositories. The the key design decision and one that kind of separates it from what most of the people will do in terms of like throw chat GPT at a code base and say, find me some bugs is that loop requires demonstratable

test cases for any vulnerability report. So no vibe coded findings. If it cannot prove the bug with a test, it doesn't get filed, which cuts down on things like false positives into something that's actually usable, which I know actual engineers in the space are really struggling with. And I know some projects are actually moving to

close down pull requests and things like that because of the amount of AI slop pull requests that are coming through, which is interesting. Spiral blocker are funding the scans themselves.

Reports go to the maintainers confidentially before any public disclosure, which is good. And the initial set of participating projects is the core of the Bitcoin stack, I guess. You know, you've got Bitcoin Core, BDK, LDK, Rust Bitcoin, Cashew, Botshin J, Bitcoin J and SRI.

I'm not sure what SRI is. So, yeah. The rollout is in three phases, selective scanning with feedback iteration first, then the expansion goes to more repos and then transitioning the project ownership to individual maintainers so they can run their own scans independently.

And, obviously, they've built this in a way that's agnostic from a specific LLM vendor as well, so you're not logged into using this just with Claude or just with OpenAI or whatever.

Very good. Okay. Right. Let's we do some boosts. We actually have an apology to make before we do the boost, Max. Yeah. We do. We do. We're sorry. We missed the boost on last episode, and we just both completely overlooked it. So sorry about that.

Yeah. Right. Let's go alternative, Max. I'll kick us off. Shadrach,

who also, by the way, did I don't know whether you saw this, but Shadrach booted a Linux distribution directly from the file system of his passport prime a few days ago. I did hear that. Yeah.

Pretty wild. He didn't even message us or anything like that. He just posted it on us. I was like, holy fuck. So I need to actually slide into the m's and just get a bit more information here. But, like, if you're listening, Shadrach, hats off. Well done, mate. Yeah. Very cool. He boosted 9,393

sats and just said thank you, hashtag forty hours per week. Late stage huddle sent 6,006 sats and said, I love you both, but dot dot dot, you forgot to read the boosts. And I forgot to boost when I first listened, so I forgot what I might have commented on.

Keep up the good work. Let's both do better next time.

Thanks, late stage. We'll try. Welder Ian boosted 2,222 stats and said, absolutely average show, boys. Cheers.

Distinctly average. Thanks, mate. Appreciate it. Chad Farrow streamed 1,730 sats. Open mic streamed 924 sats. Lou for Lou streamed 910 sats. Chris, you know streamed 470 sats. Eric p p streamed 320 sats.

Madhatter boosted a 121 sats and said, thank you, gentlemen. Always ungovernable. Stay free. Noster gang with a 101 sats. Don't put all your dick in one basket, fellas. Yeah. That is the downside of us doing this more, like, unedited is that things like that do fall

through the cracks now and make it to the live show. So you're welcome. They'd make it they'd make it anyway. We wanna keep things like that. Don't it's it's great advice. So Yeah. Don't put all your dick in one basket. I'll keep that in mind tonight.

And the last one, user 12931825 boosted a 100 stats and said, loan payback is legally avoiding taxes. It is not niche. If interest is lower than the taxes avoided, it is a strict win, not even counting potential BTC appreciation.

Yeah. So this was the the pushback on me saying I struggle to see a not a use case, but, like, the the the the big benefit of doing that sort of thing. So they're saying, basically, if if interest rates are lower than than the taxes that you would avoid, which, you know, is on average, what, 25%

of your profits, give or take, depending on where you live. Yeah. Good point. But you do you do you did mention not not even counting potential b to c appreciation, you know, that's equivalent of such both ways. Yeah. Oh, yeah. Yeah. It goes both ways. And, yeah, there are other

potential issues. You know, you can lose your funds if you don't have the right LTV, and

you can't always guarantee that when you put your stats up to to do the loan that you're actually not gonna get them locked because they see some sort of issue because it's been near a whirlpool or whatever the fucking useless stupid shit they come up with.

So it's not necessarily quite as safe in my view. But I understand the point. I I completely understand the point. It makes a lot of sense. Although I did see in one of the obscure groups that I'm still a member of, something popped up about The UK.

If you do one of these loans, they're actually still they're gonna try and tax you in some other country way, which doesn't surprise me at all. And I didn't read I didn't read any further past that because it's no longer really my problem. But, yeah, I'm I'm pretty sure if you are in The UK and you're listening to this, don't just assume

that because it's a loan, they're not gonna try and fuck you and you just avoid the CGT and there's no other issues other than the interest because my understanding is that might not be true. So just do some research.

Yeah. Good good basket of boosters and streamers there. Thank you very much, guys. It was awesome to see. A lot of streaming. More streaming than we normally have. Love to see it. Yeah. Thank you, everyone. Appreciate you.

Okay. Onto the software updates. There's loads here, so I'm gonna rattle through them relatively quickly. Okay. But stop me if there's something that you wanna talk about. Bitcoin Core and Bitcoin Notes, we've mentioned in the news section.

Core Lightning version 26 o six. They've got a new command that lets you prepare CLN for clean shutdowns, the kind of thing that your future self will thank you for the first time you have to restart a busy routing node.

Mhmm. They've got news new RPC commands and they've also got a Bolt 12 payer proof support. This is a cryptographic proof that you, the payer, were the one who paid a given Bolt twelve offer, which has been one of the limitations really with some of these static solutions is that because there's no

kind of specific invoice for a specific person for lack of a better technical explanation Yeah. Yeah. It was kind of like you have a bucket and people can just throw funds into that bucket, which is fine for like donations and stuff. But if you need like merchant solutions, then you kind of need that,

I guess, paper trail for like refunds and stuff like that. So it sounds like that they've now got cryptographic proof that you can do that with with Bolt 12, which is good for merchants that wanna run Core Lightning on their stores. Okay.

Bitkey app has got a new update, which is a security patch, but they're shit with release notes and I can't really tell you anything more than that. Trezor Suite version twenty six point five point one been released. Legacy labeling migration, wallet connect insufficient balance warning, trade comparisons, new DeFi token section,

all very boring. Bitbox app version 4.51, they have oh, that's also for the desktop as well. Address formatting now groups in four character blocks like the rest of the industry. Nice.

I love stuff like that. It's like really minor tweak to how you do things that can make a really big impact. You do you know what I'm talking about here with the the way that they render the addresses?

Mhmm.

Surprised that BitBox are normally right at the front, the cutting edge of like new shit. I'm surprised it's taken them this long to do it, but anyway, hats off. Yeah. Well done. Ledger Live desktop 4.4 o, nothing interesting.

Same with Ledger Live mobile. Bull Bitcoin mobile, few releases there. The headline, significant release they've integrated with Ledger hardware wallets. So you can now use your Ledger devices with Bull Bitcoin.

They've got a new FSS hybrid storage strategy, which is about how the wallet keeps your data resilient across devices. You've got a new onboarding wizard, page join privacy enhancements, and 11 new language translations.

I have a bull Bitcoin question. Mhmm. A listener asked me the other day. They said, this bull Bitcoin payment thing, you know, like bill payment thing, I'm sure we've covered it on the show before, Is it just available in Canada, or is this a global thing? Because quite potentially useful for people.

I had a look through their website. Everything that I could see seemed to point towards that it was Canada only. But I just wondered if you knew anything different because it it's quite interesting because there's a big gap where gift cards don't work and these other payment cards don't work, and you've gotta pay,

you know, like, an electricity bill or you gotta pay something. And with this meaning you don't then need the bank account, which is always the problem in the middle. It's always the, like, oh, it's a Bitcoin thing. Oh, I'm gonna close you down and fucking investigate you.

You can sort of sidestep that potentially. Any thoughts on that? Do you know? Yeah. So I know their services in general are available in Europe, Mexico, Costa Rica, Argentina, and Colombia and Canada, of course, which is where they originated.

In terms of the bill payment stuff, I'm I'm honestly not sure. I know it was first was only in Canada. I feel like if it was available in Europe that we would have heard more of a of a fanfare around it. I've personally not seen or heard anything to warrant that.

So I would believe, I think, it's just in Canada for now. Well, if anyone knows, let us know. This is a European asking. And

I thought, oh, yeah. This would actually be really useful. So let us know if you know. It seems weird that it would just be in Canada because it's Canada is one of the worst countries in the world. Like, you I put sort of The UK, Canada, Australia as, like, the three

like, it's not the five i's. It's the three g's. They're just the worst of the worst. So the fact that you can do it there makes you think, well, fucking hell. If you can do it there, you can pretty much do it anywhere, can't you?

Yeah. Yeah. Before it's it's it's a good wallet out, by the way. Very well architected. They've they've done quite a lot in a short space of time. Is it Francis who runs that? It is. Yes. Yeah. Maybe we can maybe we can speak to him. If anyone is

listening and knows, and if not, then maybe we can speak to him. We could do a little show on it. Sorry about the bang. I was just killing a fly on my desk. Oh, nice. Did you get it? I did get it. Yeah. Oh, well done, mate. Like, I got the reaction to the cat, mate. Oh, yeah.

Back to the list, Bitcoin Safe version two point o release candidate has been released. A comprehensive redesign of the wallet setup wizard, which is the part most users actually struggle with on multisig.

They've added support for cold card, Trezza seven.

The bigger architectural shift is two point o is a plug in architecture. Third parties can now ship plug ins via external repos, which is the right direction for any wallet that wants to grow without bloating the core. So very much aligned with the likes of Umbrella, Prime, Start Nine,

that sort of thing where it's like we have a core set of apps and you can also do this cool shit if you want to, but you only install it if you want to. Mhmm. Nice. I wonder whether they do they've updated the UI because last time I checked, Bitcoin's safe, the UI look like Electrum is horrible.

That is one of the worst or was one of the worst Oh, god awful. UIs. I don't know if it still is. I I used it years and years and years ago, and it was fucking awful.

Yep. What else have we got? We've got mister Craig Raw back back to releasing. Frigate version one point five point zero has been released. And for some reason, I don't have any notes on that. So let me click the link. What we got so Frigate, by the way, just a quick reminder, is the

why am I drawing a blank? It's the Electrum server that works for silent payments, which is bit three fifty two. It performs all of the silent payment scanning on the the server side. Craig initially released it as a proof of concept and said,

basically, you know, I don't wanna maintain this and and be the guy that does it, but it seems like he's fallen into that trap and is still releasing updates. So version 1.5 was released four days ago.

Loads of technical improvements and optimizations. There's like a list of 20 bullet points here that I'm not gonna not gonna run through, but seems as though it's basically faster, better, harder, stronger.

K. Did you get that reference? I did. Yeah. Yeah. Oh, nice. Nice. Very good. I always like to check. Yeah. I don't wanna pat you on the back too much. Blockstream Green, iOS, Android, desktop, they've all had updates.

They're migrating the lightning back end in green from Breeze to Greenlight, which Greenlight, again, remind you, is Blockstream's own lightning service provider, where they have the their own LSP essentially, where they host the server but the keys live on the service itself.

Quite surprising that they are only just doing this now actually, given that Greenlight's been around for years. Very strange. I wonder why they did that. Mhmm.

Not sure. Is a lot of releases time around. Yeah. Well, I've actually been doing some, it won't be a shock to you, some more vibe coding to to bolster up my my resource.

How can I put it? Your resources. Your Yeah. My resources sent to that. I'll show I'll show you. It's not ready for for prime time for public yet, but I'll show you after this. And Okay. You know, it's it's much better at doing research and monitoring projects and stuff like that. So hence why Good. I'm catching a lot more now.

Okay. Onto Lightning. Zeus version thirteen point zero point one and two both got released stability point releases. What we got? Rapid gossip sync, more stabilization for lightning nodes.

Yeah. I'll be home one point twenty two point two. They've added core lightning support with which is cool, actually. They've Albihub has been LND only since launch. So big ad to to get CLN support in there. So if you are a CLN user, you can now use your Albihub.

Beyond that, they've added new AI and agents page, more AI stuff, which is their Nostalotic Connects driven integration is now got AI agents in it, so agents can transact on your behalf. Scary.

Bolt's back end, 3.1 Bolt's back end three point thirteen point three. They have now got full arcade swap support. So Bolt's now does swaps into and out of arcade, the new Bitcoin layer two.

They've also got EVM commitment swap lock up flow. So is that Electrum stuff? That's Electrum. Is that EVM is Ethereum chains, isn't it? So it sounds like they're expand expanding to do stuff other than Bitcoin and liquid, which is interesting.

Interesting. Yeah. Bolts is one of the best projects. Like, it's Love it. So fucking useful. Yep. Well done, bud. Yeah. It's amazing.

The path the EVM commitment swap lockup flow, which is the path for swapping between Bitcoin and EVM chains using on chain commitments. Yeah? Interesting. I didn't have that on my bingo card. No.

The arcade stuff's cool as well. I like that. I don't know anything about arcade, I'll be honest. We should probably get somebody on to talk about that. I know Seth knows quite a lot about it, but we can get somebody from from the ArcLabs ArcLabs team. I know it's the core.

Right. Okay. It's Arc. I was just I was like, Arcade? I've never even heard of it. Right. Got you. Yep. There's been updates to Arcade itself. We've got NodeGuard, ThunderHub, and Blink have all got minor releases as well.

What we got on the e cash front, FediMin SDK Canary release.

This fix drops the fix in this drop are React Native support transport fix, persistent callback, and more boring stuff. Okay. Next on the list, Umbrella, two fairly big security patches back back to back actually.

On the first one on the May 5, which patches the CV twenty twenty six three one four three one bug, which is the copy fail vulnerability in the Linux kernel, which obviously powers Umbrella.

And then one point seven point three patched another vulnerability called dirty frag, which was also in the Linux kernel, which I believe both of those were also found by AI. So we're seeing a theme come out here. Both

releases are flagged as mandatory by the project. So if you do run an umbrella node, you need to be on one point seven point three sooner rather than later to to protect yourself. Okay. This one is a new release and I'm very very happy to see it. Did you see whirlpool.observer?

I did not. Yeah. So they I I believe it's vibrant b t c who's behind it, released the the open source version of the website, which I believe the URL is worldpool.observer? Yes. It is. Oh, I did see this. It was in the it was in the So bitcoiner telegram group.

So it's now on GitHub version one point o point one, first public release. It's a self hostable Bitcoin blockchain reader and dashboard for observing Whirlpool activity on chain. Very nice to see. So what we you know, at current block height, 949942.

There are 89.25 bitcoin in the the bull pool, post mixed pool. Nice. 13.75 bitcoin in the 2,000,000 sat pool, 75 bitcoin in the 25,000,000 sat pool. It's got some nice graphs on there to show like volumes over time.

It's got all of the recent cycles in order, chronological order. You can, oh, nice. Yeah. You can oh, very nice. You can click on the t x I d of all of the recent

whirlpool coin joins, and the link takes you to am I dot exposed so that you can see like all the visuals of the thing as well. So that's very cool linking of two very cool projects. Good work. So well done Vibrant and nice to see Vibrant's been vibing. I I love to see it.

Yeah. Join market n sorry? I said, what a world. Love to new devs. All these dormant Nims is now they're all devs. Yep. Absolutely. Join market NG version 0.29 dropped on the May 12, which is a reminder, join market NG is the community continuation of,

I guess, what you'd classify as the original join market. This release has some good stuff actually. The Tumblr script now has a review resume flag. So if a tumbling plan fails part way through, you can pick up where you left off instead of starting from scratch.

We've got dual offer splitting, which now randomizes fee points. So each offer covers a distinct size range without leaking underlying unrandomized fee structure to people watching. Improvements to order book watches.

Yeah. Good to see joint market still being continued alongside Whirlpool as well. And then LDK server was the last one that got announced. There's no public release yet, you won't find any any anything tangible in the release notes. But I

believe this was announced in Vegas actually, but I'm only just picked it up via a blog post. LDK server is a fully functional lightning node in daemon format built on top of LDK node, which is the lightning development kit.

It's an API first exposing language agnostic gRPC plus protocol buffers interface. Wow, that's a mouthful. With the goal to be an easy drop in Lightning node into a payment processor, wallet software, or anything else that needs Lightning functionality without having to integrate the Rust library yourself.

So it sounds a lot like PhoenixD, but obviously built on top of LDK.

That was a lot.

But we're at the end. Oh, some quick educational pieces, loads of Bitcoin, OpTech newsletters, some good stuff in there if you wanna get technical and super nerdy. And, yeah, that's the end of the list, mate.

You're on mute.

What a prick. What a prick. Us know, actually, listeners. Now that I have the ability to do more detailed technical stuff, like, do you guys even care about that? Do you want me to go into the details of it? Do you want me to just have them in the show notes for you to read and we just go deeper into the news or on a specific topic?

Let us know. I'll cast you're I'll cast my vote, if I'm honest. I always know what you're gonna say, and I agree, but go on. Do you? You're say I'm gonna say. You're gonna say, let's not go through the release notes like that because it's boring.

Yeah. Pretty much. It was a slight variation of that, which is let's only read releases where I think they're particularly interesting or there's, like, a big enough change. Like, if I if I hear, like, x y zed project does a minor update and bug fix,

I honestly don't care. I don't think anyone cares about that. I think it should be like, x y zed project makes this change, which allows this thing, and it's good because or bad because. Then it's like, yeah. Okay. Let's let's add that in. But minor bug fixes and, like, little, you know, change their UI slightly.

They added dark mode or things like that. I I no. I think, personally, that's boring. Tend to agree. Listeners, let us know if you agree. Okay. I'm more than happy not to go through a long long list of things.

Someone might love it, though. You never know. Like, we might get loads of people coming back. No. No. We really wanna know about minor bug fixes. Well, if you let us know. If you do and you want to read about all of the the minor bug stuff and you want to be updated very regularly about that, then stay tuned to my socials

over the course of the next couple of weeks. Here we go. Might be a bit longer than the next couple of weeks, actually, because I'm on holiday. So but coming soon. Announcement of the announcement.

I have two questions. One, name for the show. Any thoughts here? Is it just a big list, or, like, we got something different?

Less clarity after clarity act or, like Clear as mud. Yeah. Clear as mud. That's quite good. Clear as mud. Okay. We'll think on that one. And the other question is, are we also tiresome. Oh, yeah. I mean, that is hit the nail on the head there, mate. There you go.

Are we gonna do

live, but not live, but live going forward? You said you may be gonna have a listen as you were going to the airport the other day and sort of have a listen through, see if you think it's up to your standard. What do think? Month. Ship it. Yeah? Yeah. We're that good. We're that good. Just ship it. Just ship it. Okay. Alright.

If anyone has an issue with that, let us know. It doesn't mean that we'll actually, listen to it or acknowledge it, but just let us know anyway. Alright. Love you all. I'll,

see you in a few weeks after my holiday. Alright. Enjoy your driving. Be safe. Don't crash because we need you. I'll do my best. Alright, mate. Speak to you later. Bye. Before you go, mineinbox.help keep your online presence hidden.

They provide anonymous server hosting solutions, virtual, private, and dedicated servers, domain registration and DNS parking, they don't require any of your personal information and you can purchase using Bitcoin, Lightning or Monero.

No personal information required. None. Zero. Minenbox.io. Stay ungovernable.