S16 E2: Liam Eagen on Crypto(graphy) Research & Innovation
Search this conversation
0:46Vlad CosteaHello there and welcome to the Bitcoin Takeover Podcast. This is Season 16, Episode 2. We are live with Liam Eagen, one of the most talented and prolific young cryptographers out there, and he's working on a lot of interesting stuff. But before I tell you about Liam, I've got to tell you about the sponsors of the show: SideShift.ai. Right now we're also joined by Citrea, and there's going to be a question about that; LayerTwo Labs, NoOnes and Hodling.ch.
1:15Liam, you are working for Alpen Labs right now, as far as I know, that's your main line of employment, but you have so many contributions, both academic and also I guess freelance-ish in the space. You're pretty respected, I've seen you at MoneroTopia speaking on stage, they love you for the work that you did on Full-Chain Membership Proofs. I've seen that you also worked with Jonas Nick on Bulletproofs++, and you also have the other project with Jonas Nick and also Robin Linus, and that one is called Shielded Client-Side Validation.
1:52We had an interview about that one in the previous season. So my first question for you, I guess, is like a continuation of the previous conversation that we had. We spoke about Shielded Client-Side Validation, and it was like this new and exciting paper. I'm curious to know if anything happened to that one or if it's going anywhere.
2:15Liam EagenYeah, I don't think there's any major updates. I talked with Robin and Jonas a little bit about like actually implementing it, but since we last spoke, as far as I know, nobody has actually started doing that. Yeah, I mean, we've been working on it for a while, so I've sort of taken a break from thinking about it, but I think all of us are very interested in seeing it implemented and Robin was talking about trying to organize something more intentional to actually do that. But I don't know, I don't think the lift is that high.
3:00There's like one feature that's missing from a lot of libraries for SNARKs that would be very helpful in implementing it, but I mean, it's, you know, not impossible. It's just, yeah, like, so no, I think the short answer is no, nothing really major.
3:21Vlad CosteaYeah, if you don't remember what Shielded Client-Side Validation was, it's basically a protocol that's built on top of Bitcoin, which brings privacy and scalability and also pretty low fees when you're using it.
3:36Liam EagenYeah, yeah, the headline is like 64 bytes of on-chain data for every transaction, regardless of its size and structure, and this allows it to be like a private meta-protocol for Bitcoin and, you know, just normal caveats. It requires some kind of bridge to actually work with Bitcoin, the asset, so this is kind of where Robin's interest in BitVM and mine, I think, maybe originally came from because Robin had worked on a previous idea a little bit previously called ZKCoins, which Shielded CSV is like a kind of elaboration of and has a similar evolutionary history, but yeah, yeah, so 64 bytes per on-chain transaction and perfect privacy, so.
4:29Vlad CosteaDo you see that happening in the near future and that being a protocol that's actually implemented in Bitcoin as opposed to a research paper?
4:38Liam EagenYeah, I think there's a pretty good chance that something will be implemented. And it's, yeah, yeah, I think so, I think so.
4:52Vlad CosteaI had this conversation with Burkett, David Burkett, the creator of the MimbleWimble Extension Blocks on Litecoin, and he told me that the reason why this stuff never gets added to Bitcoin is because Bitcoiners have weird fascinations with technology and then they discover something new and they move on, and that's why stuff like MimbleWimble never made it to Bitcoin, and maybe that's why we don't have Zerocoin yet, because there's always another rabbit hole to discover, and I'm actually curious if we're going to get Shielded Client-Side Validation because I got pretty excited about that one.
5:32Liam EagenYeah, well one nice thing about Shielded CSV that originally drew me to it is that except for the bridge part, it doesn't require modifying Bitcoin, so it doesn't require cooperative integration with Bitcoin, it's just inscribing this data into Bitcoin. For the bridge, right, I mean you could talk about things like CAT or other sort of soft forks for SNARK verification basically, which would be necessary for like a trustless two-way peg with the same kind of security you'd get from a SNARK verifier on Ethereum. But Shielded CSV by itself, or if you wanted to just use it for stablecoins or something, doesn't require changing Bitcoin, which is why I liked it.
6:28Vlad CosteaYou mentioned OP_CAT, and this one is pretty popular among cryptographers apparently, because you can build some really cool stuff like ZK-STARKs, you can even have drivechains with OP_CAT. I think Super Testnet is the one who did the research on that one. Do you have any opinion on existing proposals to add covenants to Bitcoin, or do you believe OP_CAT is not a covenant and should be added separately from this conversation?
7:02Liam EagenI see. Well, I think it is a matter of fact that one can do covenants with CAT, so I mean in that sense it's a covenant. I know there's that big table that I've been... I don't think I added my thing to it yet, but...
7:20Vlad CosteaYeah, I think it's by the floppy disk guy, 1440000bytes. I think that's 144 million bytes or something.
7:31Liam EagenOh, okay.
7:33Vlad CosteaHe's the one who made it.
7:35Liam EagenI don't know, in terms of covenant proposals, I mean, I'm biased by, I think, what I work on and what I'm interested in, which is adding privacy to Bitcoin and also scalability, and so I really want SNARK verification, or just some kind of proof that we can verify on Bitcoin. For me, this unlocks everything, because SNARKs have this nice recursive property where once you have this initial lift, you can verify arbitrarily large things inside of the STARK or the SNARK or whatever it is.
8:20I like that, and I think CAT is a way to achieve that. It's probably cleaner than the BitVM approach, which has a lot of complexity, because you're working around all of these limitations and it has this optimistic component, and then building a bridge around it is a lot more complicated, and it would be a lot simpler with CAT, but I respect people's concerns about MEV or MEVil or whatever you want to call it, but short of that, I don't know, I don't have really strong opinions. That's what I want, so things that get there, like CAT or big integer arithmetic would be another thing that we could add that maybe is less controversial, I'm not sure, or even just regular integer multiplication.
9:10All of these things are very appealing to me, but yeah, I don't know. There's a whole big list of things, and I don't really have intelligent opinions about most of them.
9:22Vlad CosteaWait, this is new to me, so what is integer arithmetic, and is it presented under the form of some sort of soft fork proposal for covenants, or is it something entirely different?
9:35Liam EagenSo right now, Bitcoin Script supports 32-bit integer addition, so in script you can add two numbers and that's more or less it. You can do stack manipulation, and you can do signature verification, and these things. Previously, before Satoshi deactivated them, there was a whole other set of opcodes that let you do things like multiplication or division or bit shifting and bitwise operations. By big integer arithmetic, I mean both adding multiplication, and addition and subtraction, which are already there, and then extending them to support integers that are, say, 256 bits or even larger.
10:26I think, I might be wrong about this, but I think originally the arithmetic opcodes didn't have a bit limit, so we could go back to operating on full stack elements. So then you could do something like RSA verification, which might be interesting. But if we increased the limits and added 256-bit multiplication, then we could do something like a Groth16 verifier in script. I think it would fit in a block. It is probably worth pointing out that I think 256-bit arithmetic probably also enables covenants in the same way or a similar way to CAT.
11:13I'm not sure. I think 128-bit arithmetic might not, but certainly if it went all the way up, because you can do CAT with adding. You can just take something and multiply it by a power of two to shift it up and then add it to something else, and then it concatenates the bytes. That's what I mean by integer arithmetic. Any improvement in integer arithmetic would make my life and the lives of people trying to do SNARK verification on Bitcoin much, much easier. I mean, it's on the order of 10,000 to 100,000 opcodes to do one 256-bit field multiplication, which has come down a lot.
12:00A lot of people have worked on that at Alpen and elsewhere, but it's still enormous. If you added this big integer arithmetic, it would be like three opcodes or even one.
12:19Vlad CosteaYou mentioned the name of Alpen Labs, and I'm actually wondering, what are you guys building? Is it just a ZK rollup or is it much more than this?
12:27Liam EagenYeah, so Alpen is making Strata, which is a rollup for Bitcoin.
12:38I would describe it more or less like a rollup. We're working as part of the BitVM Alliance, which is this group of companies that Citrea is part of and Robin and a bunch of other people, to implement BitVM 2. BitVM 2, for people who don't know, is the most recent version of this BitVM protocol that Robin originally authored, and has evolved and has this confusing naming history of being a bunch of different things. Anyway, BitVM 2 is what people are currently working on, and the BitVM Alliance is trying to implement a Groth16 verifier in Bitcoin Script, and then use BitVM 2 to build a protocol.
13:34Alpen is also working on the bridge, which the BitVM Alliance is also working on, but I think conceptually the bridge and the BitVM part are different. So anyway, we're making the bridge and then also an EVM compatible rollup. In principle, the EVM part is sort of modular. It's convenient because of how much stuff already exists in that ecosystem, but the really core component that's missing is the bridge. And once you have the bridge and a SNARK verifier, like I was saying, it opens up everything. So you can have, you know, WebAssembly or even like Liquid or something that ran using the same kind of bridge with more development.
14:28But yeah, so I'm not sure... that was a little bit of a weird, windy answer. But yeah, basically building a bridge for a ZK rollup on Bitcoin, and a ZK rollup, caveat: It's not a proper ZK rollup because BitVM is optimistic. So it has this kind of thing where people have to challenge if there's fraud, but it's not the same thing as like an optimistic rollup. So it's like an optimistically verified ZK rollup. It's all very, very complicated.
15:01Vlad CosteaI'm not even sure I know the difference between an optimistic rollup and an optimistically verified ZK rollup.
15:09Liam EagenYeah, OK, so for people who aren't familiar, there's this class of rollups like Arbitrum or Optimism that are optimistic. And what that means is if I'm the rollup operator, I claim something happened on the rollup. And then if I lied, there's a protocol where you can submit a fraud proof and prove that I lied. Or there's an interactive game that we can go through and force me to provide evidence that I'm lying.
15:41So these are very efficient and scale well, but they have this problem where suppose I'm running a rollup and the data of the rollup is not available to you. This is called like a data availability fault. So if the data isn't available, then you can't produce a fraud proof. And this creates a safety violation. So data availability faults lead to safety violations for optimistic rollups. The ZK rollup, by contrast, instead of this optimistic fraud game where you have to interact with me and initiate a challenge, I, the rollup operator, proactively prove that everything happened correctly.
16:25So even if I withhold the data... and sort of, I'm using the term rollup here a little bit loosely because strictly speaking, a rollup puts the data on the chain like on L1 so that you cannot have data availability faults. But, you know, for a ZK rollup, you prove that the data is correct. So even if you, the challenger, don't have the data, you can be sure that I haven't stolen your money. You can't, I can't have a safety fault. But you still have a liveness failure.
16:56Like if I don't provide the data or something like this, right, depends on how the specifics of the rollup are designed. But an optimistically verified ZK rollup is, it avoids the data availability safety issue of an optimistic rollup by only using the optimistic part to verify the proof. So rather than verifying the rollup optimistically, you're verifying the ZK proof optimistically. And the ZK proof itself is really small. It's much smaller than the amount of data you'd need to verify the whole rollup transition. So even if you don't have the rollup, you can still have this proof put on chain.
17:51And this is crucially important for working with BitVM, because in order to, the way I describe it is like to make data legible to the BitVM sort of game, you have to sign it with this thing called a Lamport signature, which increases the size of the data that you have to put on chain by a significant factor. So by putting the proof on chain, we take a really small thing and multiply it by a large number. So it's only a moderately sized thing that we have to put on chain, say.
18:26We use the optimistic protocol to verify the proof. So you avoid the safety violations and you kind of still have this interactive element. So it's not quite a ZK rollup. It's kind of somewhere in the middle. If you think about it that way.
18:46Vlad CosteaThere's someone in the chat who asked, is it sort of how headers can be used to prove your transaction was in a certain block?
18:58Liam EagenI don't know. I'm not sure. I guess the crucial difference is, well, oh, you mean like in the context of an optimistic thing? I mean, maybe. I don't know. I'm not sure. I'd have to think about it more.
19:17Vlad CosteaOkay. He also added: without seeing the entire block's transactions.
19:26Liam EagenOh, I see. Yeah. Yeah. So if you don't have, there's a sense in which this is related to like the data availability stuff. You could prove that you have a transaction in a block very succinctly via like a Merkle inclusion proof. But if you don't have the block, then you can't construct the Merkle inclusion proof. This kind of thing, this shape of issue shows up like all over the place. It's like one of the big UX issues of like privacy coins is the need for the client to keep a lot of data because they have to be able to construct their own proof.
20:05Whereas like for something like Bitcoin. Well, I suppose if you don't care about privacy, you could always outsource it. But yeah, so anyway, yeah, this data availability stuff is, it's really, really, there's some, I don't remember who said it, but there's a funny thing where like, SNARKs turn everything into a data availability problem. Because you can validate like as much stuff as you want. But if you don't have the stuff, then you can't make progress. So yeah.
20:40Vlad CosteaIt is interesting. And I guess this is the reason why for example, Zcash could not have functioning mobile wallets for a while they needed to find much more efficient cryptography to be able to not compromise on the privacy for mobile phones.
20:59Liam EagenI suspect I don't know the specifics of that. But that sounds very plausible. Yeah, yeah. And also phones got better. So that helped.
21:11Vlad CosteaSure. I'm not sure how much better. But I guess the cryptography also evolved over time.
21:17Liam EagenOh, definitely. Yeah, yeah.
21:20Vlad CosteaBut I gotta ask you this. And let's imagine this scenario where you are at a conference somewhere. And you speak about all of this cryptographic research. And the fact that you're thinking way ahead in terms of what Bitcoin can have. And you're mentioning ZK-SNARKs. And you're mentioning the verifiers, the bridges and everything. And someone comes up to you and says, you know, I've heard about SNARKs in Zcash. And I've heard about data availability in Ethereum. And I heard about bridges also in Ethereum. You're trying to bring shitcoins to Bitcoin.
21:59You're enabling shitcoin tech on my holy Satoshi-made chain, which is supposed to only function in a way that I can understand and verify with my node and do basic arithmetic. If I want to understand what's going on. How do you respond to that?
22:17Liam EagenI don't know if I've actually ever had an encounter like that IRL. So that's nice. But I suppose if I did, I think for me, I'm not personally interested in shitcoins. I am very much interested in privacy, and also scalability. But I don't know, I mean, I've been in Bitcoin for a while. And so I remember when there was kind of, it felt like the dream of, you know, decentralized permissionless, maybe even private, although, you know, obviously, it wasn't but internet money was like alive.
23:07And that's what I want. I want to be able to do payments and like, be private and have cash on the internet. And so as it stands, that vision is not, I mean, you know, I guess it's a matter of taste, but I feel like we're not living up to that ideal, and we could do more to achieve it. And I think the only way to do that is via SNARKs. Basically, right, so some kind of SNARK verification. And this is a motivation for working on Shielded CSV to make private, scalable Bitcoin payments.
23:51And I think that the, yeah, I think there's a certain unbridgeable gap, right? Like people have different views of what Bitcoin should be. So if somebody disagrees with that, or they, like, don't want to have scalable private payments with Bitcoin, then, you know, so be it, right, I guess. There's nothing wrong with that. But I mean, it's not worth trying to convince them. I think that the shitcoin stuff is, I don't know, I mean, yeah, I guess kind of unavoidable. It's tricky, right? Like, it's hard to slice it in a way where you don't end up like enabling some kinds of things that people don't like.
24:39And I mean, you know, for what it's worth, it's not obvious to me that the things that I'm interested in actually do much. I mean, you know, we've all seen, right, like ordinals and inscriptions and NFTs on Bitcoin, and nothing has changed to enable that. I mean, people say like Taproot, but I mean, I don't even know if that's true. It's just made it like a little bit simpler, right? So I don't know, I think I'd probably politely try to disengage. But like, if somebody is interested in private scalable payments on Bitcoin, then I think that I could probably convince them that this is sort of the only way to actually achieve that.
25:26Or the most robust way to achieve that.
25:31Vlad CosteaWell, but they will say Lightning is private or Liquid is private.
25:36Liam EagenYeah, yeah. I mean, I used to work at Blockstream, and Liquid has confidential transactions. It has a certain amount of privacy, but it is also a federation and a sidechain. So it's not trustless. And what you need in order for the version of things that I'm most interested in seeing is like a bridge that can operate kind of more like an autonomous smart contract on like Ethereum, right? If it requires interactivity from someone in order to work, that person is vulnerable to, you know, attack by repressive governments, say.
26:16And without that, your privacy is not guaranteed. And Lightning privacy, I mean, it's true, Lightning has more privacy than Bitcoin. But it's sort of, I think it is fundamentally different. You know, they're, I mean, I'm not a Lightning expert, so I don't want to say anything that's wrong. But I think that the kind of privacy you get from something like Shielded CSV is stronger than Lightning. And you're able to do things like cleanly prove that you don't leak any information besides what's leaked via interacting with the network, right?
27:02So you don't leak any information about amounts, you don't leak any information about senders or receivers. And yeah, so perhaps there are ways to make Lightning adequately private, but I don't see why one wouldn't sort of strive for the most privacy you could get.
27:28So, yeah... go ahead. No, no, I mean, the Lightning comparison is interesting, because it's like, yeah, I don't know. I don't know if I have anything else to say about that. Yeah.
27:40Vlad CosteaYou said you're not interested in shitcoins. But if you do have any shitcoins, check out sideshift.ai, which is this place where you can swap any coin for BTC, you can be, you know, the most orthodox of Bitcoiners by using SideShift. You can swap your, you know, XRP, or you can swap your Liquid BTC, I think, or you can swap even I think they support Fartcoin or whatever. So if you somehow receive Fartcoin from someone and you don't think it's a good idea to hold it on the long term, swap it for BTC on SideShift. The fees are pretty low.
28:19And also they have a lot of liquidity for this. And also, if someone pays you in stablecoins, don't hold stablecoins in a bull market. This is actual financial advice. Don't hold stablecoins in a bull market. We're past 100,000 today. Just don't. Yeah, I guess you haven't looked at the price. Anyway, SideShift.ai. And two other sponsors of the show, and I guess these two come with actual questions that tackle your expertise. There's LayerTwo Labs, which is building drivechains. Right now they have on Signet a bunch of actually working software for various sidechains.
28:58So you can try an Ethereum sidechain. You can try a Zcash sidechain. You can try a Namecoin sidechain and also something with prediction markets. You can test to see how they interact. You can send coins between the various clients that you're running on your computer. And I think they have these test versions of the software on macOS, Linux, and Windows. So you can pretty much try on every operating system. So it's not just an idea, it's an actual implementation that you can try today on layer2labs.com/download.
29:31And then there's Citrea. And I guess it goes back, and I'm going to ask you about this once I'm done with the ad, but there's this conflict between what's the scaling way for Bitcoin, right? You have the sidechain and you have the rollup. The sidechain has been around for a decade. The rollup is more recent and it comes from Ethereum. But Citrea is trying to build this EVM that also enables you to do advanced contracts and financial services to unlock a lot of this potential for DeFi on Bitcoin.
30:05For example, they can help you issue stablecoins against your BTC so that you can make payments without actually selling your Bitcoin. Or you can have stuff like Celsius and BlockFi on a protocol level without actually having any trusted institution in the middle. It's just code you can audit. And there are some interesting DeFi applications that can get built on Citrea. And they also have their own testnet version that you can try today if you want to see how it works. And it's citrea.xyz, if I'm not mistaken, that's the URL.
30:41I've also interviewed both Paul Sztorc and Orkun on the show and you can search for these interviews and understand more about the philosophy behind the projects. And my question for you, Liam, after all of this talk is, where do you stand in this conversation between sidechains and rollups? Do you believe rollups are a much better way to go or do you think that sidechains have this untapped potential?
31:09Liam EagenI think you get better, like, okay, so for me, right. I think you get stronger guarantees from a rollup. You don't have to... the, like, categories are a little murky and sometimes people use words in ways that are confusing or potentially incompatible. What I think of as a sidechain is it kind of has its own separate consensus system and then some kind of bridge back to Bitcoin. And then what I think of as a rollup is it actually puts the data on Bitcoin, or the L1.
31:51And then it has some mechanism, some contract or bridge for moving from this like rollup world back to the L1. And so the main difference, I think, is sort of how you handle the data and reorgs. So a rollup should not be able to reorg unless the L1 reorgs. So it gets the kind of like ordering of everything from the L1 because you're embedding all of your data into the L1. So you inherit Bitcoin's probably most powerful feature, which is finality, say. A sidechain sort of fundamentally doesn't have this.
32:37I guess, like I say, you know, in some sense, right, a sidechain is like a bigger category, maybe like rollups are like a type of sidechain or something. But if we think of a sidechain as having its own consensus, then it does not have that. Then the data availability issue is also big, right? Because if you're a rollup and you're putting your data on Bitcoin, then you can't have data availability faults. So you can't have safety or liveness violations in the case of a ZK rollup. That has a huge asterisk, right?
33:12You need to be able to withdraw if the operator goes offline. So, you know, it's not like a fundamental property, but at least you could achieve this. For a sidechain, I think, again, it's fundamentally not possible. So the advantage of a sidechain, however, is that it scales very well, I think, and it doesn't run into these limitations. So if you try to do a rollup on Bitcoin, right, eventually you're just going to run out of space to inscribe things into Bitcoin. So there's only so much data you can put there.
33:44And that maybe you can 100x the number of transactions on Bitcoin, say, order of magnitude, but that's still small and maybe not where we want to be. So the advantage of a sidechain or one of these like intermediate things. So I've kind of alluded to this, but there's also like a validium, which has sort of commitments to the data that you put on Bitcoin along with proofs. But the data itself isn't there. So that's, at least in the way I've been thinking about things, not necessarily a sidechain because you inherit the same, you know, reorg resistance from the commitment.
34:28But you also can have data availability faults, unlike a rollup, a proper rollup. And then you've got like a volition where you can choose where you put your data. And so, yeah, all of this is to say I think rollups are more compelling because of their, you know, better properties, I guess. But I think everybody should do what they want to do and see how it works out. Right. Like, yeah, you can have both like different people doing different things.
35:06Vlad CosteaI would love to see that to have an actual competitive market for scaling solutions. But right now it's like nobody can actually build. We're waiting for various activations to happen and we're negotiating with each other saying, well, can we get consensus on this one? Maybe that other one. Oh, no, there's a new one right now, and it seems to include the previous one, too. So can we negotiate on this one instead? It's a bit silly, but I was wondering if you looked into drivechains, if you have any opinion on the idea and the proposal.
35:41Liam EagenYeah, I've heard of drivechains. I'm aware a little bit. I think it's kind of like, I don't know if this is reductive, but you sort of allow miners to vote on the outcome of the drivechain. Right. I guess the advantage of this sort of approach is that it's simple or, you know, the disadvantage is that miners can steal. So it has just kind of a fundamentally different security model.
36:19I don't know. I guess it's definitely impressive that they have working stuff and it's implemented and that's to their credit. But I think that it's possible to get stronger guarantees from something like a rollup or a volition or something. I mean, yeah, with the performance increases that we've seen in SNARKs over the last 10 years, or, you know, go back as far as you want, it's probably going to be feasible to prove almost anything you want. Right. Or you can run.
36:58So I don't know. I think using a SNARK makes a lot of sense, because it will become so cheap that, why wouldn't you?
37:10Vlad CosteaOkay, so what do you think about Citrea compared to what Alpen Labs is building? What's the difference?
37:18Liam EagenYeah, we're, I think, broadly in this sort of... direct competitors. Right. We're both building Bitcoin rollups. At least that's my understanding of what Citrea is doing. We're both part of the BitVM Alliance, both doing research on substantially similar things. I think we're actually fairly cooperative. I mean, at least as part of the BitVM Alliance, everybody's cooperating a lot.
37:51Yeah. In terms of like product offerings, I think maybe there's differences, but I'm not super sure. There's also, I think, I mean, this stuff changes a lot, but there are subtle technical differences, maybe in approach or like how the bridge will work. But I don't know. I mean, yeah, so it's probably not a super satisfying answer, but I think they're pretty good. They do good work. They've been nice to me. I like them.
38:32Vlad CosteaThis should not be a criterion, by the way. They've been nice to me. But it's nice when people are collaborative.
38:38Liam EagenYeah, no, it's good. There's a prevailing atmosphere of collaboration in the Bitcoin L2 space right now, which I certainly prefer. I hope it continues. You know, who knows?
38:54Vlad CosteaI remember when the situation was a lot more tense with Super Testnet saying, oh, but these Citrea guys are not even using BitVM and they're not doing a real rollup, according to my definition. Citrea makes this claim that they have created the first ZK rollup on Bitcoin.
39:13Liam EagenYeah, that's a strong claim. I don't know. I mean, I don't know what Super's definition of rollup is, but depending on what one means by ZK rollup, I think if you ask them, they probably would concede that it is an optimistically verified ZK rollup or however I defined it previously, because that is what they're doing. It isn't possible to verify a SNARK on Bitcoin via a smart contract. So calling it a ZK rollup is a bit, I don't know. I think it's whatever.
39:53It's smaller. It's simpler. It's easier to say.
39:58Vlad CosteaLet's take the conversation one step back and ask an existential question like, why do we even bother with this? Why does Bitcoin need any kind of privacy? I think someone on a podcast last week told me that it's perfect money. You should not fuck with the money. It's already perfect. Why bother? You know, BlackRock seems to like it. So why should I care?
40:21Liam EagenI don't know that BlackRock liking it is the criteria by which we should judge the perfection of our money. But I think, I don't know, I think Bitcoin is like alive. I mean, I don't know. I mean, even in the most kind of pro-ossification view of Bitcoin, it will always be alive. Bitcoin is maintained by people, it's software that has to be upgraded to work with the real world. It's composed of people who use it. And there's a social construct element of everybody believing that this is Bitcoin and not some other thing that people want to call Bitcoin is Bitcoin.
41:08And so, I mean, I don't know, I think of it as alive. And I also think that it frankly lacks the properties that I'm most interested in, like privacy and scalability. And so, yeah, I mean, I understand where the fear comes from in terms of like, you don't want to mess up a good thing. But, you know, I don't know. I think it's like a mindset shift that's occurred over time. I don't know. I wonder if, like, we could go back in time and test how people felt in 2014 about Bitcoin, and see how they would feel about what it is now versus what I want it to sort of be.
41:56And there are tradeoffs and, you know, I guess everybody's entitled to their opinion. But the reason that I'm interested in all of this is private, decentralized, uncensorable Internet money. I think that it should exist. And it's like a natural right that people should have it. And I think that I mean, for me, right, like, I guess there's an interesting similar question, which is like, why do it with Bitcoin, right? Because it exists, to varying degrees, in other projects, Zcash, Monero, etc. And I want to add privacy to Bitcoin because it is so like powerful, right?
42:44It's the most resistant to being banned. And so if we can add privacy to Bitcoin, then we won't make privacy illegal because there is enough vested economic interest in keeping Bitcoin around. So, you know, I think I don't I hope this doesn't happen. But something like Monero is fairly marginal, right? It's not owned by your grandma in her IRA or whatever, but Bitcoin might be. And so the political capital necessary to ban Bitcoin, it may exceed what is possible to muster. I mean, I don't know. I mean, I'm not a politician, but this is my hope.
43:25And this is why I'm interested in adding privacy to Bitcoin. Because it'll be more durable.
43:31Vlad CosteaThis is so beautiful. I'm going to make a short clip out of that. But there is this tiny Italian guy, to avoid lawsuits, I'm going to call him Guacamole Zucchini. And he made a presentation back in 2018, I think. And I found this slide from his presentation. It's called the four universal truths. Number one, everything which is not Bitcoin is a scam. Number two, every attempt at changing Bitcoin is a scam. Number three, every attempt at pushing people to spend Bitcoin is a scam. And number four, we shouldn't be nice to scammers.
44:07Liam EagenI see.
44:08Vlad CosteaI guess it should be more like we shouldn't be nice to scammers. It goes like that. But how do you reconcile with the fact that this guy's following is going to refer to you as a scammer by virtue of this presentation, which went viral? Because you're trying to change Bitcoin, right? You're trying to make it private and scalable.
44:32Liam EagenYeah, I mean, technically, right, I'm working on Bitcoin as it is, at least via Alpen, right? So nothing I've... Well, I guess I've said I would like CAT, but, you know, like BitVM doesn't require changing Bitcoin. And Shielded CSV doesn't strictly... It's a bit like modularized, so it doesn't require changing Bitcoin. But... I don't know. Yeah, I guess some people aren't going to like you. That's okay. But like, I don't think... Yeah, I guess I sort of just disagree. I think Bitcoin as money is interesting, is why it was interesting in the first place to me, the uncensorable aspect of it.
45:26And yeah, I think it's a bit... If you really unpack the idea that Bitcoin will never change, it's probably... Well, I guess the idea that Bitcoin should never change is itself a change to what Bitcoin is, if you include as Bitcoin the like, you know, beliefs of the people who constitute the users of Bitcoin. I don't think this was always the case. I don't think everybody has always agreed on that, as evidenced by the fact that Bitcoin has changed. So, like, which version of Bitcoin should it be that we should have and never change?
46:11However, I will say, I think that the resistance to change is healthy, to a certain point, and that, like, one should not just change because something seems cool, right? It should be measured and considered and all of this. But yeah, from my perspective, I want private, scalable payments with Bitcoin. So that's... that's the status of a belief, right? I just... And if you think that... Yeah, I don't know. I don't see how that's a scam, but maybe different definitions of words.
46:49Vlad CosteaYeah, the mentality which is borrowed from the open source space, I guess, from the Linux development, is that you have these altcoins for the purpose of testing features which maybe are half-baked or you're not sure what's going to happen on the long term with them. So you test them, you test Zerocoin on Zcash and Firo. These are the two big ones that are trying this technology right now. There's also Pirate Chain, but it's basically a fork of Zcash which is trying to keep up. So it's not that innovative.
47:22You're testing ideas. I think Monero has Bulletproofs and it's going to get Full-Chain Membership Proofs, which is interesting. And it's also useful for Bitcoin. And this was always the conversation, I guess. This was the Bitcoin maximalist talking point, that you're going to just take the best of what's being developed and put it to Bitcoin. But right now the conversation has changed to a point of complacency where we say, well, being a maximalist means just accepting Bitcoin the way it is because it's perfect and it was given to us by some time-traveling alien who made sure that we have everything we need and everything else is a scam.
48:06And it's very difficult to reach any consensus if you don't accept the fact that there is a need for privacy and for scalability to exist in the first place. And it seems like this lack of improvement is also convenient to centralized services like exchanges, like custodians, and they're taking full advantage of the limitations to come up with the service. So, of course, without OP_CAT we're not going to have we're not going to have proper rollups and covenants and sidechains. So there's going to be some business that's regulated and KYC/AML compliant, and it's going to fulfill all the functions, granted that you trust it and you put your coins in some custodian's address, and most likely you're going to get rugged in the long term.
49:00And then you get people like Luke Dashjr who say, you know, at least there's someone to sue as opposed to having this wild protocol built on Bitcoin where people can steal from you. So it's better for a business to steal from you than a native layer of Bitcoin to do the rug pulling, which is mind-blowing.
49:19Liam EagenYeah, I personally don't understand that sort of bit towards the end there of, like... there is a recognition, I think, amongst everybody that, like, if you want this to be used, it will need something more, right? And the idea that using centralized custodial services is an acceptable solution, and never change anything, I don't know, it doesn't make sense. I don't understand that, because it feels like, why even have it in the first place? I don't know, I am... yeah.
50:06Vlad CosteaYeah, my question for you was going to be, before going on this long rant: The question is, do you believe there is like a reasonable timeframe for testing and after that you can say, okay, this actually works and we have tried all the possible vulnerabilities or all the concerns have been obliterated by the existence of this on a live network? Or do you think it's reasonable to say, well, maybe that in 10 years there's going to be someone else who comes along and breaks this?
50:38Liam EagenThat's a good question. I think, so, there's a certain part of it that's a matter of taste or like opinion. So I think there's two issues that sometimes people muddle. One is, is there some like unknown unknown about activating CAT that will be catastrophic or really bad? Whether we can comprehensively rule that out via research? I don't know. I mean, probably not. Maybe, I don't... I'm not sure. I do think we can be acceptably certain that there are no unknown unknowns and the amount of time, I think it probably makes more sense to measure it as like amount of interest, which is pretty high right now.
51:42So like interest over time, there's a lot of people thinking about it and talking about it more recently, say versus like the very long amount of time that it's not been activated. Or like you said, put on testnet or something, right? But I don't know. I mean, I've heard people say like a few years basically, but I don't know. I guess I'd have to think about it more. But the other point that I wanted to say is that there are tradeoffs. So there are like known potential risks that like cannot be mitigated, that you either have to accept or reject on the basis of.
52:26So if you're concerned about having covenants at all, then you will not be... No amount of research will convince you that activating CAT is a good idea because it will enable them. Or if you're worried about STARK, like if you oppose STARK verification, then it's not like a research question. It's a political question whether or not that should be enabled. So I think that it would be helpful to have more clarity around like whether something is worth doing or whether the risks are too large. So like sort of break down people according to that, and then consider things like existential risks, like unknown unknowns, or like another version of this, which isn't exactly the same is like, will we figure out a better way to do it, which is a very valid concern.
53:28And if you look at the history of SNARKs, this is essentially what happened. Things have improved very dramatically. And so like fixing something 10 years ago would have been a bad idea.
53:43But yeah, I think like for something like CAT, say a few years of like intensive research probably will be sufficient to rule out any like major unknown unknowns. I mean, there's also, of course, the risk that there's some sort of weird, I don't know, SHA-1 pre-image covenant thing that's already possible, right? It's like we might figure out how to do something weird and bad without changing Bitcoin. And at a certain point, it's unclear that, like, the probability of that weird tail risk thing goes up with changes or like, yeah, so I don't know, I don't know.
54:30I think it should be decided by the community. I mean, you know, people should have opinions and weigh in. But yeah, at a certain point, it's basically political. And I don't know. I mean, I assume we're not that far off from that. Maybe a year or two.
54:48Vlad CosteaYeah, I did have ColliderScript... one of the authors of the ColliderScript paper, Avihu, he was on the show and he spoke about it. And they did figure out how to enable ZK-STARKs without CAT. But it's super expensive. So not everyone can afford it.
55:10Liam EagenTrue, true. It requires some sort of weird, like, SHA-1 collision ASIC that's like $100 million or something to deploy. And yeah, yeah.
55:30I don't know. I think also, just personally, not enough attention is given to the, like, larger risks that come from outside of Bitcoin, that don't actually have anything to do with changing the protocol at all. So for something like MEV, there's always the risk of some kind of meta protocol, like, say, ordinals and inscriptions or runes or something else that screws up the incentives in a way that is similar to having an AMM on chain, which is an example of one kind of MEVil people are worried about.
56:15And so maybe like somebody designs a meta protocol that requires you to run some kind of Flashbots thing as a miner and it has all the same negative effects, but doesn't change Bitcoin at all. That's like totally outside the scope of these discussions. And so I don't know, it feels like neglected or unconsidered this risk.
56:42Vlad CosteaYeah, my example is usually that Taproot... not Taproot, SegWit was activated just a few months after it went live on Litecoin. And maybe that the times were different and there was more of a sense of urgency to activate something. But now some people are disappointed in SegWit and they say, you know, this one actually enabled ordinals to exist. But on the other hand, it also enabled ZK rollups, and we could never even conceive such an option in the case of Bitcoin if it was not for Tapscript and also SegWit.
57:19Liam EagenI think another good point to add here is there is, people may not be aware, like a whole universe of even more fancy cryptography than just SNARKs. So people may have heard of things like witness encryption or functional encryption or indistinguishability obfuscation. And people are seriously working on trying to develop a form of indistinguishability obfuscation, which, I'll say, we can think of it... It's not exactly this, but it's basically you can take a program and obfuscate it. You take this program, you run it through an obfuscator and you get a black box.
58:06And the black box only allows you to run the program. You can't do anything else. You can't inspect the program state. You can't like run it halfway and then see what it did. So what you can do with this is you can build kind of smart contracts on Bitcoin because you can take a program that contains a private key and obfuscate it. And now you have this block of code, this opaque block of code that will sign things for you, but maybe it has some conditions. So it says only if this SNARK is valid will it generate a signature.
58:39So you can build a signature oracle that doesn't require a trusted third party. From my perspective, if we had indistinguishability obfuscation, it would enable all of the things people are worried about enabling SNARKs on Bitcoin, plus everything else. And this has nothing to do with Bitcoin at all. In fact, it's probably impossible to stop if you have indistinguishability obfuscation, which currently is a very theoretical and not practical thing. But I don't know. I mean, it makes certain elements of these discussions kind of complicated because it feels a bit like a matter of time, right?
59:22Unless something like this is fundamentally impossible. If we have indistinguishability obfuscation, you get smart contracts and rollups and two-way bridges and all of this without changing Bitcoin at all.
59:40Vlad CosteaThere's so much that you can do, but it's not necessarily the most efficient way to do it. And the way in which I look at OP_CAT and I look at CTV and I look at all the other covenant proposals, I don't see any personal benefit. And I think that's the biggest issue, right? Because unless you're a developer or you're a company that's going to finance these layer 2s, you're not really incentivized to care about this stuff. But as an end user, I do want that stuff to exist and I do want scalability and privacy solutions to compete with each other.
1:00:14And I do want builders to stay on Bitcoin as opposed to go to Ethereum. So I do see the value of this and I do want this to exist because Bitcoin should have this competing market for development, which you don't see too much. There are only a handful of companies which are vetted, quote unquote, and you say, you know, you can trust Blockstream because they're pure Bitcoiners. And then there is someone in the chat complaining right now about Citrea because it brings Ethereum stuff. You can't really win, you know, but it's a good idea to have competing solutions and see where the users are going and get more users to use Bitcoin as opposed to allow them to go to some other chain like Ethereum, Solana, or if they want privacy, go to Monero or Zcash.
1:01:10I don't know how you see this. Maybe that for you is just the ability to work on something as opposed to just talk about what you can do.
1:01:19Liam EagenIt's certainly gratifying to work on something. I mean, but I agree. I think the benefits that people will see will be privacy and scalability. And that's what I care about and what I hope other people care about too.
1:01:40Vlad CosteaYeah, that was a pretty short explanation, but it's important to keep the builders working on Bitcoin because there was a huge brain drain for a few years to Ethereum because it pays better and they invested a lot of research and researchers and academics. And I guess you also worked on something related to Ethereum.
1:02:05Liam EagenYeah, yeah, I've worked with EF people. I also consult with this company Aztec. They're doing an Ethereum rollup. They're using one of my SNARK papers that I wrote with Ariel Gabizon. And so they're trying to do private smart contract stuff. But I don't know, I think like the bad blood between different crypto communities is a little bit like, I don't personally understand it or resonate with it. Maybe back in the day, it was a little bit fresher, but I hope that there's not so much like that.
1:02:50The research is shared amongst everybody, right? So something like MuSig and FROST: I think FROST was originally paid for by Zcash, or Chelsea's grant was from Zcash, and MuSig, obviously Blockstream, MuSig2 too. And so, I don't know, I want to see collaboration. I want to see people work with Bitcoin. I think there's interest in doing that. And yeah, yeah.
1:03:22Vlad CosteaWould you say that Monero or Zcash are scams? No? Would you say that something like Litecoin is a scam?
1:03:32Liam EagenI don't think so. No. I mean, I don't really follow Litecoin, but I think it depends on what you mean by a scam. This is also one of those word definition things. But like, people definitely use Monero and Zcash for their intended purpose. And they have like real communities of people who actually work on them. And yeah, so to equate that with, I don't know, FTX or something, which maybe was a little bit more of like literally a scam. This is reductive. I don't know. I mean, I know people object to different things, like pre-mines and the, like, sketchiness with different projects and how they start and whatever.
1:04:26But no, I don't think that, it's not obvious to me that, no, I don't think that Monero, Zcash or Litecoin are scams. Although I haven't looked at Litecoin in years, so I don't really know what's going on there.
1:04:45Vlad CosteaWell, I think it's more interesting now. I mean, Litecoin, because they have the MimbleWimble Extension Block, which gives them scalability. And they can also increase the block size on the MimbleWimble Extension Block from now on, so they don't have to work on the base layer to change anything. They can just soft fork and increase the capacity of that one, which is also prunable. So it's not a huge burden on the node runners. Of course, the privacy is not as good as something like ring signatures or SNARKs or STARKs or whatever.
1:05:21But it's pretty good for the purpose of having this money you can spend. And that actually works. So they have this peg-in, peg-out mechanism that lets you pay directly from the extension block to a main chain address. And they also have Zero Conf, which makes it easy to use in commerce. I mean, yeah, it's philosophically different from what Bitcoin is doing. But I guess there is still something to be learned because Andrew Poelstra... and some people, when they see you, they think you're his brother, by the way.
1:05:53Andrew Poelstra presented this proposal back in 2016 about adding MimbleWimble to Bitcoin with an extension block. But the Litecoin people actually coded that.
1:06:03Liam EagenYeah, that's super cool. Yeah, that's good to see. I'll check it out. I think I've heard of this, but I haven't actually looked at it. It's nice to see people using MimbleWimble. That was always a fun idea. Very simple.
1:06:21Vlad CosteaThere is someone in the chat who says that Citrea is marketing itself as a trustless zkEVM rollup, but it's actually a decentralized database... a centralized, sorry, a centralized database. And my question for you, because you work for Alpen Labs, and you know a little bit more than either of us, I guess, the guy in the chat and me, about how this works. But is there any way you can make it more decentralized, or would you say that it's unreasonably centralized and it should not be so?
1:06:58Liam EagenYeah, so there are different parts of the system that have different, variable degrees of centralization. I don't know what the commenter is talking about exactly, but the sequencer... actually, I will say, I don't know what Citrea is doing exactly. But I suspect, or hypothetically, that they could have a centralized sequencer. And what that means is that there's sort of one party that executes the rollup. So they take all of the rollup transactions, they sequence them, and then just assume for simplicity that they also build the rollup blocks and that they also construct the proofs for the rollup blocks.
1:07:48So there's just like one person who's doing this. Now, this still inherits the double spend resistance or reorg resistance from Bitcoin and the data availability properties of Bitcoin. But you do have centralization risks from the sequencer, so the sequencer could censor you, and that's bad. Now, there are alternative rollup designs. There's like a very large literature of different rollup designs. And so you don't have to have a centralized sequencer. You could have a network of sequencers that all compete with each other to construct blocks.
1:08:30And they have some kind of consensus mechanism that's used to select which sequencer. It's important to clarify this is not the same kind of consensus mechanism the side chain would use. It's only used to pick the sequencer. So, for example, you could have miners do sequencing, or I think people call this based sequencing. This has MEV implications, and that's sort of the big trade off. As soon as you have a decentralized set of sequencers, miners can participate as sequencers, which then means that the incentives are complicated for miners.
1:09:10Because ideally you want them to just be mining based on Bitcoin incentives, but then they would also be incentivized to mine based on what's happening on the rollup. The advantage of a centralized sequencer is that they are able to absorb all of the MEV. So there's just one party and there's no incentives that are sort of passed through to the miners. They just collect all the MEV. Maybe they rebate it back to the users or whatever. They rebate some of it to the miners. But that element of a rollup is centralized.
1:09:45You can work around it. Or you can get all of the nice things that you'd want from a system, even though you do have a centralized sequencer. So you could have the ability to take your money out of the rollup, even if the sequencer doesn't cooperate or goes away. You could have forced inclusions so you can post things on the L1 that the sequencer can't censor.
1:10:12Yeah, I think, I mean, calling it a centralized database, I think, is a little bit reductive, but there is probably a centralized sequencer. And that is an element of centralization and it can be eliminated, but it also has trade-offs.
1:10:26Vlad CosteaYeah, I guess the person commenting is happy with your answer. And I also want to talk about Bulletproofs and Full-Chain Membership Proofs because these are actual proposals that can be implemented in Bitcoin. I guess they do require some sort of forking but they are pretty interesting. Before that I've got to mention the other two sponsors of the show. One of them is Hodling.ch. They are based in Switzerland and they are experts in self-custody. So if you hold a lot of Bitcoin or else you're part of a company that is planning to add some BTC to its balance sheet, they are going to advise you on how to make your setup, how to have a quorum, whether or not you require hardware wallets, how to do a multi-sig, how to back that up.
1:11:13And all sorts of advice. The two guys behind the project are Polto and Darko and you can listen to them in the previous season of the Bitcoin Takeover Podcast. And they also have this service that they can offer to you if you've lost your keys and you only remember some specific details from your seed phrase or about how you did your backup and stuff like this. They can try to help you recover it. So check out Hodling.ch. And last but not least there is NoOnes, which is noones.com.
1:11:44It's an exchange that is peer-to-peer created by Ray from Paxful. That's how he used to be known. Now he's Ray from NoOnes. His full name is Ray Youssef. He's very committed to onboarding the Global South to Bitcoin and he believes in this mission that money that is sound and exists on the internet should be used to help those who need it the most. Not just enrich Silicon Valley and Wall Street guys. So if you want to participate in this peer-to-peer economy, you can sell gift cards or you can just buy and sell stuff in this p2p market and Ray says that everyone eats which means that there is a small percentage that everyone makes along the way.
1:12:34So check it out. It's noones.com. It's a peer-to-peer exchange. I guess it can be a fun weekend experiment to see how much money you can make on it. Anyway, we got to talk about the two research papers that have your name on them among the contributors. One of them is Bulletproofs++ and there are two versions of it that I can find. One is from a few years ago and has been updated. And there's also Full-Chain Membership Proofs, which is a very fancy name for basically having an anonymity set consisting of every participant on the chain, if I'm not mistaken.
1:13:15That's what it means. So you get to choose which one you talk about first.
1:13:24Liam EagenI guess I'll talk about Bulletproofs++. So people may have heard of Bulletproofs, from several authors, like Benedikt Bünz, and there's also some Blockstream guys, I think Andrew Poelstra, Pieter Wuille and Greg Maxwell. I think Dan Boneh is an author. But anyway, it introduced a kind of proof system that's based on elliptic curves, but does not have a trusted setup. So people may have heard of trusted setups, like other proof systems have: Groth16, for example, or PLONK. They have trusted setups of different types. So Bulletproofs was like a pretty impressive paper.
1:14:13It improved on this earlier technique of Bootle, which did sort of a substantially similar trick and also would have enabled them, but it reduced the proof size by a factor of like six or something like that. Yeah, I think the story of Bulletproofs is cool. I think that Blockstream sort of approached Dan Boneh and suggested this problem as like something that would have industry application. And so it's kind of an interesting example of very early collaboration between academics and industry, say, or you know the crypto world outside of academia, which has ended up being pretty fruitful.
1:14:56Like, Dan has participated in a lot of stuff, and Benedikt and others. Anyway, Bulletproofs++ is also a proof system that has no trusted setup and is designed for confidential transactions, which is also the problem that Bulletproofs is trying to address. A confidential transaction keeps the amount of money involved for all of the inputs and outputs secret.
1:15:23Bulletproofs++' primary contribution is introducing this technique called like reciprocal argument. It has come to be called, like, logUp or logarithmic derivatives, and is implemented in, I think, most modern kinds of proof systems. So, like, zkVMs use this, and it's a kind of, you know, I call it like a multiset equality check basically. But we use it in Bulletproofs++, which Jonas Nick, Tim Ruffing and Sanket Kanjalkar are also authors of. So I was with them at Blockstream. I wrote the first version of the paper before joining Blockstream and then they helped like implement it and like substantially improve the paper.
1:16:19We ended up submitting it to Eurocrypt where it was accepted. So that's like the history of the paper, but I don't know, it's probably not interesting to people. Anyway, the proofs themselves, they're like five times faster to prove and they're like 400 bytes, something like that. I think, so, 300-something bytes. So they're quite small. They're like 30 or 40% smaller than Bulletproofs, and they're like 25% smaller than Bulletproofs+. I think that actual numbers are in the paper. So if people are interested, but the really significant improvement is like prover time and verifier time.
1:16:59Bulletproofs have this unfortunate property that the verifier runs in the same asymptotic time as the prover. So the prover is not like work saving. The proof itself is really small, but it's still takes a while to verify. So this is important for something like confidential transactions, where you're putting proofs on chain. You know like with MimbleWimble or with Liquid, you have to have everybody verify these proofs. Yeah, so the short description of logUp.
1:17:34Basically you have this problem a lot in SNARKs where I have a sequence of values, call it A and another sequence of values B. I want to check that A is a permutation of B so I can swap the elements of A somehow and get B. One way to think about this is you want to like forget some of the structure of A and B. You want to forget specifically the ordering information. You only want to keep just the set of things, because then you can just check if the sets are the same.
1:18:08And so logUp is a way to do this more efficiently than previous protocols.
1:18:17Basically if you commit to both sequences, then you choose a random value and you check that the sum of 1 over the random value plus each value in A equals the sum of 1 over the random value plus each value in B. And because addition is commutative, the sums will be the same only if the sequences are the same, or, they will be the same if the sequences are the same. And because you pick the value randomly, if they're not the same then the sums will almost certainly not be the same.
1:18:50So you can use this to build like a lookup argument. And this is what we do in Bulletproofs++ where you check that each digit in a number belongs to some allowed set. So if we were working in base 10, you'd have a list of all the digits and you want to check that each one is a number from 0 to 9. And then this logUp technique lets us do that. The other cool thing is it lets us check multi-asset transactions. So if you have a bunch of assets coming in and a bunch of assets coming out, you want to make sure that the amount of each asset coming in is the same as the amount going out.
1:19:24And logUp lets us do this in a really clean way, or I should say the reciprocal argument, because logUp is like the lookup version. But in the reciprocal argument, like I said, instead of having two sequences now we kind of have sequences of pairs where you have like an amount and a type. And so you put the amount in the numerator and the type in the denominator. And then when you add them up, it just adds up the amounts for every type and keeps them separate.
1:19:50And then on the other side it adds up the amounts for every type and keeps them separate. And then you can check that they're the same. So this is what Bulletproofs++ does. And I think it's cool. I mean, it is a confidential transaction paper, meaning it does not provide anonymity. It doesn't provide any hiding properties for the relationships between transactions. And that's what you get from something like Full-Chain Membership Proofs and Zcash, like these commit-nullify, or nullifier, schemes. Yeah, so that's missing from Bulletproofs++, but it's focused on this other aspect.
1:20:38And in a sense, right, like the techniques, maybe not the proof system itself, but the techniques transpose very naturally into a larger proof system, which also hides the, you know, graph.
1:20:54Vlad CosteaOne of the Zcash community members, ZeroDartz, commented on Twitter and said, is that your twin brother?
1:21:02Liam EagenThat's funny.
1:21:04Vlad CosteaYeah, that's funny. Anyway, to simplify your explanation, I will say that Bulletproofs++ are basically a way to hide the amounts that you're sending in a transaction. You're not hiding the sender or the receiver. You just hide what's between them.
1:21:22Liam EagenYes, and the types.
1:21:24Vlad CosteaAnd that's the amount of coins.
1:21:26Liam EagenThe amounts and the types. So if you have Tether and Bitcoin in one transaction, you don't learn that you have, like... you don't learn that. You only learn that you have some inputs and some outputs.
1:21:40Vlad CosteaOh, now I understand why the Zano people praised you. Okay. They use that too, with their confidential assets. Nice. So this can be used to hide amounts, but how scalable is it? Because there's always the argument that obfuscation adds up a lot of data and makes transactions much larger in size.
1:22:04Liam EagenYeah, I think it scales pretty well. I mean, the proof itself scales logarithmically in the number of inputs... I'd say outputs, basically. The way you'd build a transaction protocol is you need a range proof for every output. And assuming that the inputs come from previous transactions, you don't need range proofs. So it's like 300 plus 64 times the log of the number of inputs and outputs. So the size of the proof is comparable, maybe a little bit bigger than a normal Bitcoin transaction. And it scales such that if you have bigger transactions, it becomes a small fraction compared to just like, you know, writing down the public keys or something, which scales linearly.
1:23:00It scales better than Bulletproofs, or it scales the same as Bulletproofs, but it is concretely smaller than Bulletproofs and Bulletproofs+. And another aspect that's important, although difficult, there's some caveats, but it's faster to verify, which is a big deal when you have lots of, say, transactions in a mempool and you want to check which ones of them are valid. And it also supports batch verification, like Bulletproofs. So, I mean, like as it stands, I believe Liquid still has the old, like, Borromean ring signature confidential transactions.
1:23:44So compared to that, Bulletproofs++ are dramatically smaller and faster, like a factor of five or 10 smaller.
1:23:55Vlad CosteaYeah, that's pretty cool. Are these Bulletproofs++ implemented in Monero right now, or are they just the normal ones, the Bulletproofs?
1:24:06Liam EagenI think in Monero right now they have Bulletproofs+, which was an improvement over Bulletproofs. Bulletproofs++, there was some interest I think a while ago, but I think at this point they're just doing Full-Chain Membership Proofs, which kind of render this sort of proof system obsolete. Or, like, in the sense that you just do the full-chain membership proof and you'd include inside of it something like a confidential transaction as part of what you're proving. So no, it's not implemented, or I think there's an implementation, but it's not like deployed in Monero and I don't think there's any intention to do so.
1:24:50Vlad CosteaOkay, so what about Full-Chain Membership Proofs? What are they and why are they such a big deal? Because Monero people are so excited about this. They say it will finally work much better than it did with ring signatures and decoy addresses and stuff like that.
1:25:06Liam EagenMm-hmm, right. So Full-Chain Membership Proofs bring to Monero the same level of privacy you get from Zcash, like Halo 2 or the older Zcash protocols.
1:25:23So I'm also not an expert on exactly how Full-Chain Membership Proofs work, but the broad structure of how these kinds of protocols work is every transaction has some list of outputs. And these outputs are added to a big tree and then it has some list of inputs. For each input, you need to prove that it corresponds to some output in the tree. So it's basically a Merkle inclusion proof for this big accumulator of all of the previous outputs. What this means is that you have perfect privacy for that input amongst all of the outputs of every previous transaction or every transaction before some time.
1:26:10This is in contrast to a ring signature where you specify some small relative to the total set number of outputs and you say it's one of these. Ring signatures, I think the classical argument is that you can, say, spend it several times, and then your potential candidate set grows larger, as it grows exponential in the depth. But with a full-chain membership proof, you just get sort of the best possible privacy for your input immediately. It's simpler, easier to use, cheaper, all these things.
1:26:51So you prove that your input corresponds to an output and then you also prove knowledge of a nullifier. I don't know what they call them in Monero, but it's the same thing; people call it different things. The nullifier is essentially like a hash basically of some sort of secret associated with the input that you're spending and it's deterministic. So there's exactly one nullifier for each previous transaction output. You reveal the nullifier and you prove that it's valid. When you reveal the nullifier, this is what prevents double spends because if you try to spend, like if you sort of think about it a little bit, privacy and double-spend resistance are kind of in tension because I don't want to reveal which output I'm spending, but if I don't reveal any information about which output I'm spending, then I can spend the same output twice because then you can't tell.
1:27:49So the nullifier solves this problem. It's some deterministic data that's derived from the output, but doesn't reveal which output it is. It's kind of like a hash. You publish the nullifier and these nullifiers are also accumulated on chain. Every node checks that when they're given a new transaction, it has the proofs of membership, it has all the nullifiers, it checks that the nullifiers are not already published, so it checks there's no double spends. It verifies the proof, which proves that each input is a valid output. And because the nullifier hasn't been published and because the input is a valid output, we know that that input is in the UTXO set.
1:28:37Because the nullifiers are like the spent transaction outputs and the set you're proving inclusion into is like all of the transaction outputs. So the difference of these sets is the unspent transaction outputs.
1:28:52So the bulk of this proof is like proving these Merkle inclusion proofs and some other stuff. And my understanding of the Full-Chain Membership Proofs that Luke and others have been working on is that they're using a paper I wrote about proving elliptic curve operations in circuit as part of the proof system. So I think that's probably my contribution to the full-chain membership proof stuff. I haven't really done that much with it. It's mostly just this piece.
1:29:29Vlad CosteaOkay, so do you believe that Bitcoin could get Full-Chain Membership Proofs and Bulletproofs?
1:29:36Liam EagenSo... I mean, I don't know, maybe, right? Things are hard to predict. But one of the motivations for working on Shielded CSV was feeling like that was unlikely to happen. One of the downsides of the approach that Monero and Zcash and others have is they put the proofs on chain. And by putting the proofs on chain, they require a lot of data. I mean, the proofs themselves are like a couple of kilobytes. So it's bigger than a Bitcoin transaction. If you don't increase the block size, this would reduce the amount of transactions you can perform by a lot.
1:30:28There are advantages over Shielded CSV. I think I mentioned last time, or I've mentioned in the past, like, Shielded CSV requires that clients like communicate data one way out of band, which is not strictly necessary for, like, a full-chain membership proof design. But I think short answer, probably no, not natively via like a fork. It just seems politically, I mean, I'd love it. I think it'd be great. But it's pretty, pretty far outside of the Overton window. I mean, we're talking about something like CAT not being activated because it's too, you know, complicated or speculative.
1:31:15And full-chain membership proofs are just a whole other level of complexity. I think this is a place where the like old line about letting other coins experiment with features makes sense because, well, another issue is enshrining the proof system. In Bitcoin, it'd be very hard, probably impossible to enshrine a proof system in the chain, like as part of consensus, whereas in Monero, this is already the case. So it totally makes sense. Yeah, so I think with Shielded CSV and a bridge, we can get the same level of privacy.
1:32:00It's a little bit unwieldy, like it's a little bit more complicated in the sense that there's like two steps. But yeah, that is, in my opinion, the most viable path towards bringing privacy to Bitcoin.
1:32:15Vlad CosteaI guess the classic argument against this is that people will not be able to look at the blockchain and understand if there's any hidden inflation. That is the biggest concern. And how do you explain to people that this cannot happen or do you think that this is a possibility?
1:32:39Liam EagenYeah, it's always a risk, right? If you have, like, basically in systems where you have, instead of the amounts directly on chain, you have commitments to the amounts that are hiding and secret. There's always a risk that your proof system, like, has a bug basically, and this has happened. Zcash had an inflation bug in their, like, old, old, old version. I think other people have, I mean, certainly, yeah, so it's always a risk. The, I think, probably like the mitigation that makes the most sense for Bitcoin is to have a shielded pool.
1:33:28And so you can opt in to this risk. If you want privacy, first of all, if you want privacy, this risk is unavoidable, like you must adopt the risk. But if you are willing to accept it, then you opt into the shielded pool, which, you know, maybe isn't great. Maybe we'd like it if everything was private. But if you want to protect against hidden inflation, then all the hidden inflation happens within the shielded pool. And if there is hidden inflation, maybe someone can drain the whole shielded pool and steal everybody's money, but it only affects the people who opted into the system.
1:34:02So, yeah, that's, I think, probably the best you can do. I think it's also worth pointing out that the proof systems have matured over time. I mean, everything should be treated with a great deal of scrutiny. But like, you know, the likelihood of inflation bugs should go down over time. Right. It's still high. People are still developing or it's still not high, but it's non-zero. It's something you should be aware of and concerned about and take seriously. But over time, it becomes less likely.
1:34:43Vlad CosteaYeah. And I guess we should remember that also Matt Corallo inserted an inflation bug in Bitcoin by changing something trivial. Just trying to make this 5% optimization.
1:34:56Liam EagenSure. Yeah. I mean, the nice thing about an inflation bug, though, in normal Bitcoin, is that it is recoverable, or, well, I mean, in principle recoverable. Whereas, in a privacy system... or, it's detectable and recoverable. In a privacy coin, it's really not detectable. I mean, it probably would eventually be detectable, right? If I printed 10 to the 80 Monero and just started like giving it to people, people would notice. But it's not recoverable. So it's different. But yeah, I mean, you can always have bugs.
1:35:36Vlad CosteaThere are two questions in the chat right now. One is from LongSats, who wants to know, what's the paper you're referencing that highlights running sequencers with mining equipment? I'd like to read this material, thanks in advance.
1:35:51Liam EagenI think the term you should search for is based sequencing, like B-A-S-E-D sequencing. It'll probably be mostly Ethereum-focused, but I don't have like a good paper on hand or off the top of my head. I would say just search for that and see where it takes you.
1:36:14Vlad CosteaIt sounds like the only kind of sequencing I would enjoy. The based type, you know?
1:36:20Liam EagenYeah, yeah.
1:36:23Vlad CosteaAnyway, the other question, and it's also sort of a suggestion. Maybe I should do this. I don't know. So Satoshi Spirit says, can we ask every guest if Bitcoin should increase the block size and keep running the poll for all guests to answer? So do you believe Bitcoin should increase the block size? Not now, maybe in the future, or sometime?
1:36:46Liam EagenI recently had my perspective changed about this, or actually, I don't know if it changed, but a different way of framing the problem. I think, yes, the Bitcoin block size should probably increase in the future broadly. But I think what matters more than the Bitcoin block size is the Bitcoin node validation overhead. So I think the real issue with increasing the block size isn't the data per se. It's like the overhead, right? If we made the Bitcoin block one gigabyte, then the number of computers that could verify blocks within a certain amount of time would drop dramatically and it would harm decentralization.
1:37:44So strategies that make Bitcoin blocks take less time to verify should sort of enable block size increases without harming decentralization or, you know, up to a point. So yeah, I think the Bitcoin block size should be increased eventually and that Bitcoin block validation time matters more than the block size. And more exotic proposals like rolling up all the signatures into a STARK and then just verifying that, that would make Bitcoin block validation much faster. And therefore potentially enable larger blocks with no effect on decentralization. But it's also an empirical question, right?
1:38:38Like the reason why you don't want to increase the block size is decentralization and cost of being a miner, which you want to keep low. So I think we can increase the block size without harming those things or, like, keeping them in an acceptable range.
1:38:59Vlad CosteaI can tell that you're not working for Blockstream anymore, because otherwise you would say, no, that's horrible. It's a scam. You should use Liquid.
1:39:08Liam EagenI mean, it's been a long time since that. I wonder. I wonder. Yeah.
1:39:16Vlad CosteaBut there's a lot to be said because back in 2017, when this narrative was created that we should never increase the block size and SegWit was just good enough, you have to understand that the average Internet speed was much lower. Storage was more expensive. And there are fewer users of Bitcoin who are interested in running nodes. Now you have more nodes, you have cheaper storage, and you have much faster Internet. You have services like Starlink. Because always, when you say, you know, Internet is much faster today, there's going to be that one guy who's going to say, yeah, but in this village in Africa, they don't even have Internet access.
1:39:57And now we have Starlink. Okay. And of course, the same person is going to say that they cannot afford it. But with Starlink, you can have from any place in the world, very fast Internet access, right? If you're not happy that this person cannot access the Internet at a fast enough speed, you can actually pay for it. You can pay for someone to use the Internet that way. Or you can wait a few years and it's going to become more competitive.
1:40:25There's going to be a wider market for this and you're going to have cheaper satellite Internet so that anyone can actually access the Internet with broadband speeds or 5G or whatever you set the standard as. And at that point, it makes no sense. It becomes just some sort of religion, this keeping the block size small. Of course, I do believe that Bitcoin should scale in layers. And we're going to get pretty good layer 2s, we're going to get sidechains, rollups and whatever. But you do want users to be able to unilaterally enter and exit these layers.
1:41:02Because if they cannot, then you're going to go back to the trusted situation that I guess Bitcoin was made to solve. And you do want everyone to be able to hold their own keys and that's another problem. Because you have more users than the capacity for Bitcoin to process transactions. You have a lot of them on exchanges. And can Bitcoin actually handle a mass withdrawal? We do like to say that January 3rd is proof of keys, when everyone should withdraw their coins from exchanges. But is there actual capacity for that to happen?
1:41:37And that's another question.
1:41:41Liam EagenYeah, yeah, I agree. The point in my view of small blocks or not making blocks arbitrarily large is decentralization. You want to make sure that Bitcoin doesn't become Solana or something. Very far, far from that. And yeah, so with that in mind, I think increasing the block size makes sense.
1:42:11Vlad CosteaYeah, and I feel sorry that BSV sort of destroyed any credibility for increasing the block size, you know, because it was such a shit show. And it was such an easy target to point at and say, Oh, look at them. It was always a bad idea. It was so obvious. But Bitcoin Cash only has, I think, 32 megabytes. And has been like this, I think they enabled dynamic block size now, but they were more conservative. And they followed what was described as Bitcoin Classic and Unlimited and stuff like that, which was proposed for the Bitcoin community before it split.
1:42:50But there's a question in the chat. And I've actually had this thought in the shower at one point that maybe we can reach a consensus and have some sort of hybrid proof of work proof of stake system in Bitcoin, where you also incentivize node operators to keep their node running and give them some sort of reward and have a few blocks a day being proof of stake being given to the people who run nodes or something like this. But the question in the chat is from Zoidberg.
1:43:23And he says, What is your opinion on switching Bitcoin to proof of stake? Do you think it's likely to happen sometime in the future?
1:43:30Liam EagenI think it is not likely that Bitcoin will switch to proof of stake.
1:43:40So I'm not like a consensus person, really, or not an expert in these things. But from what I understand, proof of stake systems tend to be very complicated. I mean, there's like a nice kind of simplicity to proof of work, especially Bitcoin, which is, I think, most people would agree, pretty easy to understand. Simple, like, evidently works pretty well. Yeah, I mean, I think the arguments for proof of stake are, well, I don't know, I don't personally find them very compelling.
1:44:29But who knows, right? Maybe, maybe. Or, like, I don't know, I don't actually know how they do it. But, like, if, like, the data availability sampling things from, like, Celestia or Avail or whatever, like reward clients for doing that, I don't know. I mean, these things are fun to think about. But for me, these things, this is where the concerns about affecting Bitcoin are more. Like more, at least for me, because I don't understand a lot of this stuff, I would treat this with a lot of skepticism.
1:45:12Maybe it's just because I already know how SNARKs sort of work and have a pretty good grasp of them that I don't feel like that's as big a change. But changing the consensus system of Bitcoin is a very, very big change. I mean, Ethereum went through like a very long, complicated process to make this work. And, you know, there's all sorts of cryptography that's been researched and trying to make it work, VDFs, where they're going to use them and then they're not going to use them.
1:45:45So I would be very surprised if Bitcoin adopted proof of stake, or even a hybrid system, like you were describing, your shower thought. But they're interesting to consider, maybe. I mean, in principle, if there were some magical consensus system that delivered the same kinds of guarantees as proof of work, and didn't require work, that would be very cool. I mean, I'd be very interested in that. But that's not really the status quo.
1:46:28Vlad CosteaYeah, this is maybe beyond our lifetime. But once the block reward runs out, it's going to be interesting to see if there's enough demand for block space to keep the miners going, or mining is going to revert from its industrial scale and become more of a hobbyist activity. And it's going to be, basically, you're going to have the network secured by the people who own enough Bitcoin to care about its security and want their transactions to be included in blocks, but it's not profitable anymore. Who knows? But I do see, you know, our kids will have to figure this out and establish their own consensus about what Bitcoin is.
1:47:10And whether or not proof of stake is a good idea at that point.
1:47:16Liam EagenYeah, or I mean, you know, other kinds of exotic changes, like tail emission or something would probably end up being seriously considered at that point.
1:47:32Vlad CosteaI think that's a much more radical breach of the social contract in Bitcoin, because everyone seems to agree on the 21 million cap. I think it's the most powerful meme that you have in Bitcoin right now, the limited supply. And once you break that and you prove that you've created a precedent where you have broken that, I think, I don't know, maybe the project is not as valuable anymore.
1:48:02Liam EagenYeah, no, it's a good point. It's true. It is kind of the central tenet of Bitcoin. You could kind of do demurrage or something like that, and then rebate that as a continual block subsidy. But I don't know. Yeah, these are questions that people probably should consider, but they seem, at least right now, to be a bit longer term.
1:48:28Vlad CosteaI mean, you got to get BlackRock onboarded, right? You got to sell them some idea. You got to get your local politician also to, you know, have bullish speeches about Bitcoin and run for office accepting Bitcoin donations. I think we're at this point in adoption where they're trying to make it ominous and then we're going to talk about the issues more seriously, if ever. I don't know. Maybe that talking about the issues in Bitcoin will always be some sort of ivory tower activity, while everyone else will just celebrate perfect money and the invention of the first truly honest and transparent form of money ever.
1:49:16Even though I'm not very happy about the transparency part. To me, you know, this privacy problem in Bitcoin is not really about privacy because there is no privacy. There is just deniability. You can say, well, it wasn't me. It was someone else. But the more time passes and the more information gets added to an old UTXO, the more you actually know about what happened. And it only takes one mistake where you maybe join some KYC exchange or you send to the wrong person and that person doxxes you.
1:49:51Or there's going to be some sort of event where you're going to break all of your good practices from the past, and there's going to be linking directly to your old wallet and who knows where that's going to lead. So even if you have perfectly good deniability today in Bitcoin, the advancements in blockchain analysis and the possibility that you're going to make a mistake are much worse. And you can still maintain perfect practices, but someone who sent you a transaction at one point may not. And it's just like your phone number.
1:50:27Maybe that you don't want to give your phone number to everyone, but then one person who has your phone number is going to leak it somehow. And it's not private anymore.
1:50:39Liam EagenYeah, yeah, yeah. And having the ability to use SNARKs or something does prevent this catastrophic information leakage. Everything is sort of individually and atomically deniable. You don't learn any information from new things that are posted.
1:51:07Vlad CosteaDo you believe in a Bitcoin-only world where everything is going to be divided by 21 million coins? Or do you think it's always going to be multi-chain and maybe that some of today's chains will be just like the Visa and the Mastercard, some alternative that you have for the payments that you make?
1:51:26Liam EagenI don't know. I mean, I treat this as empirical. I wouldn't be prescriptive about it. I don't think that... So I guess there's different forks in the road. I think that, assuming Alpen and others are successful in creating Bitcoin L2s, it will draw a lot of attention, especially from people that want to use Bitcoin for ideological reasons or because they want to use it as collateral or get yield on it or all of these kinds of things. So there will be a lot of interest that comes to Bitcoin from Ethereum and other places.
1:52:14I think that something like Solana is interesting because if you're willing to bite the bullet and trade off decentralization for performance, clearly some people find that compelling. So maybe there are philosophical differences that will just never be reconciled, and there's some barrier that even with SNARKs and whatever fancy stuff you want to conjure up, you'll never be able to compete with somebody who just doesn't care about decentralization. So maybe they will continue to exist forever. I don't know, I think it's possible that a world where Bitcoin exists will, or Bitcoin...
1:53:02I mean, I don't think other coins will go away completely unless they make trading meme coins illegal. People seem to enjoy doing that, so they'll always exist. For something like Ethereum, it's interesting. I don't know. I think its future is difficult for me to predict right now.
1:53:26Something like Zcash and Monero, I mean, they continue to provide privacy. People actually use them for payments, and so they'll continue to exist. But I don't know. I don't know. I do also, I will say, I don't know. I think forms of credit money will probably exist. So whether or not you think that that's Bitcoin is...
1:53:55Well, I guess it wouldn't be. It'd be some kind of weird kind of debt instrument that's backed by Bitcoin. People might use that for cash instead of Bitcoin. Because being deflationary, people are disincentivized to actually use Bitcoin to do a lot of purchases. So maybe some kind of derivative stablecoin thing. Oh yeah, stablecoins also, right? Maybe in the very, very long term countries cease to exist and we just have Bitcoin. But for the time being, I don't expect stablecoins will go anywhere and the demand for them will only go up.
1:54:37So, kind of a hedgy answer, but I really don't know.
1:54:43Vlad CosteaI really don't like the term stablecoin because it entails that there's stability when in fact you're just creating an asset that is a digital representation of something which is just as volatile as everything else and might as well go to zero.
1:55:00Liam EagenSure, maybe it's stable with respect to this other volatile thing. They vary the same. But yeah, yeah, yeah, yeah, I see what you mean.
1:55:15Vlad CosteaSo here's the classic question. Where do you see Bitcoin in 10 years? Do you think it will remain the same and we will still fight about OP_CAT and other, maybe improved, covenant opcodes? Or do you believe that we're going to build some significant stuff that will change the way in which we understand it and use it every day?
1:55:38Liam EagenYeah, I mean, the reason why I decided to work at Alpen is because I think Bitcoin L2s have a real chance of working and making a difference. Assuming that works, Bitcoin L2s will enable scalability and privacy with Bitcoin that is not possible today. So I think that the landscape could change quite a bit. A lot of what I think of as the original spirit, people actually doing payments privately with Bitcoin will hopefully come back and 10 years I think that will either have worked or not.
1:56:17There's also like, I guess it's a little bit non-technical, but like the effects of the ETFs and the potential friendliness or not of big governments to Bitcoin will probably make 2034 look a lot different than 2024. There are a lot of people who own a lot of Bitcoin that are not interested in privacy and in fact are strongly opposed to it. And so I think that that conflict will play out at some level. Countries could buy Bitcoin, you know, I mean, who knows all of these things.
1:57:03I suspect in 10 years things will look quite a bit different in terms of how people use Bitcoin. I think that there's been a bit of a lull in terms of like, you know, what I would like to see, but privacy and scalability and all that over the last however many years. So hopefully that changes and it feels like it has, like the vibe has changed quite a bit, I think. Like people seriously talking about activating CAT would have not happened a few years ago, I think.
1:57:40Vlad CosteaYeah, but people also have expectations when they talk about activation and they set arbitrary goals and they say, you know, we got to get it done by the end of the year or by next year or something. And then you also have the Taproot Wizards, who maybe are helping with spreading awareness about CAT, but at the same time, they're also triggering all the wrong people. And then you're going to get these quote unquote defenders of Bitcoin saying, you know, this is an attack by VCs and shitcoiners and they're trying to radically change the way that we use and understand Bitcoin.
1:58:18And once again, it's shitcoin tech. You don't want this, just use the holy tools that were endowed to you by Satoshi and Blockstream.
1:58:29Liam EagenYeah, I guess. I mean, the Taproot Wizards are definitely inflammatory and get the people going, you might say.
1:58:42Yeah, I don't know. I think the arbitrary deadline thing is more an artifact of companies, right? You know, the nice thing about something like Bitcoin is that it should outlive individual companies, right? You know, it is decentralized. There's a lot of stakeholders, a lot of people have different incentives. And so one company can't really force anything, even a big company, even a company that people have heard of that really, really wants some specific change in some specific timeframe. That's good. You know, it provides stability to the system.
1:59:15But 10 years is a long time. I think that CAT either will have happened or will not have happened in 10 years. I don't see many worlds where CAT takes 20 years to activate. That doesn't really make sense to me.
1:59:32Vlad CosteaWell, we shall see. In principle, I told you I'm very much in favor of keeping builders on Bitcoin and advancing protocols to the point where they can actually compete. Because right now, I think there was too much emphasis on Lightning and there was a lot of hope that it's going to finally work and it's going to become the scaling layer that everyone onboards. I don't think it played out as expected. And I'm quite disappointed that the attempts to make it more efficient also brought more centralization and more custodians.
2:00:09And once you get to that point, it's sort of useless when you think about it.
2:00:18Liam EagenYeah, well, I certainly don't want more custodians and more centralization.
2:00:27Vlad CosteaThere's a comment in the chat saying that the Wizards think they are white knights in digital armor, protecting Bitcoin's purity and virgin status.
2:00:39Liam EagenThat's funny.
2:00:41Vlad CosteaThere was also someone who said in the comments of this video on Twitter, he said, Ctrl+C, Ctrl+V. Like we're just a copy-paste version of each other, because we look alike a bit.
2:00:58Liam EagenYeah, I guess the crypto people have a look.
2:01:04Vlad CosteaNot really. I can't think of, wait, if Super Testnet lost some weight, maybe we could look a bit like each other.
2:01:15Liam EagenI haven't seen him in a while. He had longer hair. I have gotten the Poelstra comparison a few times.
2:01:25Vlad CosteaBut he's shorter and he's more skinny than you are.
2:01:29Liam EagenYeah, well, we also used to both work at Blockstream, so it's funny.
2:01:33Vlad CosteaDid anyone ever call you Andrew?
2:01:37Liam EagenNo, no, no. Everybody there knew, but yeah, it's funny.
2:01:46Vlad CosteaThank you very much, Liam, for your time. I think I sort of ran out of questions at this point, which is unfortunate, because you're a treasure. I enjoy listening to you.
2:01:57Liam EagenOh, that's nice. I appreciate it.
2:02:00Vlad CosteaI like that you're honest. You don't have, at least not that I can tell, you don't have an agenda. You're not trying to sell me anything, you're telling it how it is, and that's exactly what I want on this show.
2:02:15Liam EagenYeah, I mean, I guess my wanting SNARKs on Bitcoin for privacy is an agenda, but it's not really selling. It's just... but yeah, thank you. I appreciate that.
2:02:28Vlad CosteaSo where can people keep up with your work, learn more about what you're doing?
2:02:35Liam EagenI am on Twitter. It's my name, Liam Eagen, E-A-G-E-N. The ePrint is where the papers go. I think Alpen puts out stuff too, so it's good to follow them. They're a bit more social media savvy. Yeah, I don't know. I'm not that... You can email me too. I don't think it's that hard to figure out what my email address is. But yeah, I don't know. I try to be pretty responsive, but I don't post so much on Twitter.
2:03:24Vlad CosteaOkay. And I would like to thank the sponsors. Once again, SideShift, Citrea, LayerTwo Labs, NoOnes and Hodling.ch. Thank you to everyone who commented and was active during this live stream. I hope that I answered your questions, or Liam has answered your questions, because honestly, you don't really care what I think. You already know. And what else? Thank you very much, and I'll see you in the next one. Thank you.
