Title: S16 E51: Sean Bowe on Bitcoin, Zcash & Scaling Privacy with Tachyon
Podcast: Bitcoin Takeover Podcast (host: Vlad Costea)
Guest(s): Sean Bowe (Zcash cryptographer/engineer; Halo / Halo 2; Project Tachyon; inflation-bug fix)
Published: 2025-10-18
Duration: 3:39:34
Episode URL: https://bitcoin-takeover.com/audio/?name=2025-10-18_s16_e51_sean_bowe_on_bitcoin_zcash_scaling_privacy.mp3
Audio: https://bitcoin-takeover.com/audio/media/2025-10-18_s16_e51_sean_bowe_on_bitcoin_zcash_scaling_privacy.mp3
Transcript: CORRECTED. Base: the pipeline's local Whisper medium.en transcript (int16) with speaker diarization (Guest A → Sean Bowe). Second opinions compared word by word: bitcoin-forks-research S16E51 clean + .en.vtt; zcash-documentary S16E51.plain.txt / .timed.txt / .unique.txt / .en.vtt; zcash-documentary/ceremony_laptop/clean_S16E51.txt; findings/_results/S16E51.json; feed.xml chapters/description; podscan partial transcript (first ~10 min). No clip re-transcription: available RAM was under the 6 GB threshold for most of the pass while the live pipeline held a diarization worker on another episode, so stretches that neither transcript settles are marked [unclear: ...]. Speaker turns repaired where diarization switched a few words late or early. Names and jargon checked against the title, feed keywords/chapters and the web: Sean Bowe / Halo / Halo 2 / Project Tachyon / oblivious synchronization / shielded aggregation, Zerocash vs Zerocoin (Firo, formerly Zcoin), Zashi / Electric Coin Company (ECC) / Zebra / Orchard / Sapling / Sprout / turnstile / nullifiers, trusted setup / zk-SNARKs / zk-STARKs (Eli Ben-Sasson) / Pedersen commitments / moon math, BIP 39 (Slush / Stick / Thomas Voegtlin of Electrum), Wasabi / CoinJoin / Samourai / Dark Wallet (Amir Taaki), Greg Maxwell, Liam Eagen, Zooko / Andrew Miller / Peter Todd / Luke Dashjr, Citrea / BitVM / Alpen Labs, LayerTwo Labs ZSide drivechain (layertwolabs.com), Bitcoin.com News, SideShift.ai / CrossPay, Nostr / Zaps / Lightning / LSP (Breez / Phoenix), Avalanche pre-consensus / eCash, Monero debates, quantum / self-transfers / shielded dust / long-term storage pool, Polkadot, Shielded Labs, DarkFi, Solana, sponsors Citrea / LayerTwo Labs / Bitcoin.com News / SideShift. Light clean verbatim: ums, false starts and stutters removed; factual slips kept as spoken. Intro music (before 00:00:47) omitted. Remaining doubtful words are marked [unclear: best guess].
================================================================================

[00:00:47] Vlad Costea: Welcome to the Bitcoin Takeover Podcast. This is season 16, episode 51. Probably episode number 300 overall. I gotta check that, but I was getting very close to this milestone. We are live with Sean Bowe, a brilliant cryptographer and engineer who's been working on Zcash for a decade. And he is responsible for finding a fix for the hidden inflation bug, which was not exploited. And you're going to have to explain how we know that it was not exploited. You also came up with Halo and Halo 2, which was the way to eliminate the trusted setup, which, by the way, is the reason why I think Bitcoiners were not so keen on Zerocash back in 2013 because of the trusted setup.

[00:01:28] Vlad Costea: You came up with a solution to that. And now you're working on something which is incredible. It's called Project Tachyon, and it aims to scale zk-SNARKs to billions of people, which is incredible. For the longest time, we have been saying, well, privacy doesn't scale. You can't have both privacy and a lot of transactions. So it's really good to have you, Sean Bowe. You're a legend. There are guys like Liam Eagen, who is a legend also in Bitcoin, who look up to you. And I've also heard stories of other engineers and cryptographers learning from you and being mind blown that you're just so good.

[00:02:08] Vlad Costea: And you're also one year younger than me, which I find amazing. It's good to have you on.

[00:02:13] Sean Bowe: No, it's really awesome. I don't really do podcasts and stuff like that very often, but I really wanted to be on this one. I think that would be a really fun conversation. So really appreciate coming on.

[00:02:24] Vlad Costea: Something else that I have to mention before we start, because I can already anticipate what some Monero people will say. We established that we're going to do this like a month ago, as in we set the date of the interview. It was before the massive pump. It was before. I don't know if you were aware that this was going to happen. It's October, but anyway, it's a weird coincidence that at the same moment when we're doing this, the price is above $200. And I said, I will do the dance on livestream if it hits $200.

[00:02:54] Vlad Costea: And it's a weird coincidence, man. So I got to clown myself once again and become included in memes and whatever. And I'm pretty sure if the price goes below $100, Monero Bros will copy this and make fun of me.

[00:03:12] Sean Bowe: Oh yeah, that's why I'm working up my courage to cringe myself or clown myself a little bit.

[00:03:21] Sean Bowe: Historically, I've been pretty shy about celebrating whenever the Zcash price is up, because I just don't want that being taken. When the price is down, I'm like, oh, look at you celebrating before you get in the end zone sort of stuff. There's a long way to go. There's always a long way to go, but it is good the price is up. So sure, I'll take the pump dance. That's fine.

[00:03:45] Vlad Costea: Okay, do it.

[00:03:47] Sean Bowe: All right. All right.

[00:03:54] Vlad Costea: That's really good.

[00:03:56] Sean Bowe: To be able to hopefully edit that in, put in some laser eyes or something.

[00:04:02] Vlad Costea: I'm going to ask someone to do this.

[00:04:04] Sean Bowe: You got to get the cringe out really early, because I actually hate doing talks and things like that, because I really don't want to screw up. But at the very beginning, if I screw up like a little bit and have to correct myself, the rest of it goes really well. Oh, I already screwed up. So I don't really care. Now I don't really care at all.

[00:04:25] Vlad Costea: Okay, so let's start the more serious part of our conversation. And by the way, I set this up. So I put a QR code in the middle of our video, you can send encrypted messages using shielded transactions. So if you have any questions for Sean and you want to send that in a shielded transaction, I can read that out loud. I was thinking maybe I could basically show the screen from Zashi wallet, but I don't want Monero Bros to send me anything that's going to take us.

[00:04:56] Vlad Costea: I don't know, to get YouTube to ban us or whatever, just because that's on screen. So I'll be a bit cautious, just a bit. But I guess I'll be reading messages through the episode. And you can send encrypted messages because Zcash is not just the money platform. It's also this messaging, encrypted messaging app, which is amazing. Is it better than Signal in this way?

[00:05:23] Sean Bowe: No, I mean, if you're using it as a messaging app and you don't have forward security and all kinds of features that you would have in Signal that a messaging app should have, I wouldn't say that it's better in the cryptographic sense, but it's really useful. It's I guess with sealed sender and Signal, I'm not really sure if you could argue whether or not the anonymity is better. I'm not sure. I don't like using it as a messaging platform, but a lot of other people do. That's something I've had to get used to over the years.

[00:06:02] Sean Bowe: If purely from a protocol design perspective, it irks me that we have these memos because they're so big and they take up resources. All the transactions they take up space in the blockchain, and it's not a scalable feature that we at least as implemented, it's not scalable. And so any time we're thinking about ways to improve the payment protocol, memos comes up and I get hounded about it once or twice a week. Somebody will say, hey, I really love this feature in Zcash. Are you going to get rid of it in Tachyon?

[00:06:37] Sean Bowe: Please don't get rid of it. And I feel like some obligation to figure out some way to incorporate that in the strategy. But it is something that people love.

[00:06:51] Vlad Costea: Yeah, it's super cool. Monero cannot do this, and I'm pretty sure that the Monero bros are not happy about it and they would not acknowledge it. But let's start with your story. Like you have been around in Zcash for a decade. Do you have a past in Bitcoin? Have you been involved with building Bitcoin? Were you part of the group that was promoting Zerocoin or Zerocash in 2013?

[00:07:18] Sean Bowe: So, yeah, I have a I guess my background is I used to follow I used to be kind of like pseudo involved in Bitcoin really early on. I have a million stories that are interesting, some of which I might tell someday. But yeah, I just used to sort of lurk a little bit in the Bitcoin development spaces. And so I've interacted with all the OGs and the characters and stuff in that in that community. And over the years, I started doing little experiments and learning on my own about consensus algorithms and cryptography and all that kind of stuff.

[00:08:03] Sean Bowe: And when I had this sort of hobby project where I was actually building, it was like a sort of like a private cryptocurrency version of Bitcoin. I don't even remember how it worked. But I know it was nothing like Zerocash. But when the Zerocoin and Zerocash papers came out, I became a little groupie on the Zerocoin and Zerocash, like subreddits and hanging out and kind of waiting. When is this going to come out? I stopped working on my hobby projects. I'm like, oh, this is pointless.

[00:08:36] Sean Bowe: You have these brilliant cryptographers. You have SNARKs and stuff that are coming out, which are amazing. Those even work, especially that they're so small. So, yeah, I sort of gave up, just wanted to see, OK, when is this thing going to come out? And by chance, I was hanging out with Andrew Miller, and he's a friend of Zooko. And he said, hey, Zooko's hiring. He's actually working on Zerocash. It wasn't even called Zcash, I think at the time. This was in 2014 or something. And I was like, oh, cool, that sounds awesome.

[00:09:14] Sean Bowe: And after a long time, I mean, they had to raise money and all this other stuff's going on. But after a long time, eventually, I was sort of asking, I was on Bitcoin dev or Bitcoin wizards or something like that on IRC. And I was asking about any developments with SNARKs since the last time I talked to Andrew Miller and some of these other people. And Zooko saw that I was still really interested in this. And he's like, hey, you want to come meet me? And it turned out that he lives around Boulder.

[00:09:42] Sean Bowe: So that's been a help to have him nearby. So I live in Colorado. So I just got the job. And I love this stuff. I love privacy. I love cryptocurrency stuff. And I love cryptography. So it just worked out great, I think. That's how I ended up. And I wouldn't have believed that I would be working on the project at the time, but it worked out really, really lucky. Really lucky.

[00:10:13] Vlad Costea: It's a pretty cool story. And how old were you at the time? I think you're 32 right now. So you're 22 when you started working on Zcash. So you're much younger when this was happening.

[00:10:24] Sean Bowe: Yeah, definitely. I think when I first talked to Andrew Miller about this, I just turned 21. In fact, I had my first drink, I think, in Las Vegas. I was in Vegas, hanging out with him when my birthday just happened. And yeah, so pretty fun stuff. I was pretty young.

[00:10:52] Vlad Costea: So when did you discover Bitcoin? And what was it that drew you towards it?

[00:10:59] Sean Bowe: So Bitcoin. I hung out with lots of hackers and script kiddies and all that kind of people on the internet growing up. And being able to send money around in those communities, you could only really rely on shady or unreliable companies. Like if you just wanted to send your friend some money because you bet him that the Broncos were going to win the Super Bowl or something like that. Which of course they didn't that year. How do you do that? Well, you can't really rely. Like my friend is anonymous.

[00:11:38] Sean Bowe: I didn't know who he was. And he was like, I've known him for so long. And he didn't want to tell me his name. So how do you interact with people financially on the internet? Just for wholly legitimate non-criminal things. Where you're just trying to keep your financial history private. And you're not trying, especially you're not trying to allow somebody else to just take your money. Like PayPal does all the time. Take your money and freeze it and then demand that you send them KYC stuff in or whatever.

[00:12:13] Sean Bowe: So Bitcoin, when it came out, there were a lot of other things that people have been building over the years that hadn't really worked out. And so I figured at first that it would probably fail. But when I looked into it, and this was maybe back in like 2011, maybe earlier than that, I forget. When I looked into it, I saw how it worked technically. And I'm like, oh, that's awesome. And that's one of the brilliant parts of the Bitcoin white papers. You can be pretty much an amateur.

[00:12:41] Sean Bowe: And at least at the time, and I was just a kid. So I could look at that and go, oh, I see. I see how this solves that problem and how nobody had thought of solving Episode, Sean Bowe on Bitcoin, Zcash & Scaling Privacy with Tachyon. So I was really excited about it. Just permissionless, sending money around. But I also knew fundamentally there'd be new advances in cryptography that would make it private. And so I was just waiting and hoping maybe I could contribute to making it more private in the future.

[00:13:13] Sean Bowe: But yeah, pretty much that's my backstory in Bitcoin. I never really contributed to Bitcoin's development. I did sort of, I was, like I said, I lurked on things. I was one of the co-authors of BIP 39. It was all the seed phrase stuff. Oh,

[00:13:29] Vlad Costea: That's amazing. Because I know it was Slush. It was Stick. And it was Thomas from Electrum who later decided to withdraw from the project.

[00:13:39] Sean Bowe: Yeah, I don't know. I just jumped in and sort of just cleaned up the documentation and just random stupid things. But it's nothing serious. I never really contributed seriously to Bitcoin's development in any way or into any real BIPs. I was just lurking.

[00:13:59] Vlad Costea: So when was the moment when you realized that this is not really private? Was it early on or did it take you a while to figure it out?

[00:14:08] Sean Bowe: Oh, it was obvious it wasn't private from the beginning. So it was just a matter of time before. I mean, it was totally broken when it came to privacy. There wasn't a moment I ever thought that, I thought it was fundamentally flawed from the beginning. Most cryptographers, that's how they felt too. They absolutely know. If you're a cryptographer, you know that you have to, if you're going to say that something's private, like the protocol itself, that is, you have to have some sort of notion of what it means for it to be private.

[00:14:42] Sean Bowe: And then you have to rigorously prove that it satisfies that notion. And there's so many ways that can go wrong, which is why the notion has to be really, really strong. Bitcoin had obvious issues, fundamental issues that you could see without even having to study it rigorously. But definitely, it was nowhere near close enough to have good privacy and people tracing, people have always been tracing the source of coins and stuff like that in Bitcoin. It was just a property of the system that it was not private at all.

[00:15:17] Sean Bowe: It was obvious to everyone at the time. Hopefully obvious to everyone now. It's kind of amazing how I was seeing something on X yesterday where somebody was like, Bitcoin's already private. And it was just the biggest cope in the world.

[00:15:31] Vlad Costea: He's basically conflating privacy with deniability, as he's saying, well, there is no proof that once I post this address, the person who's sending me the transaction is really the person who owns that UTXO. I think that was the argument that plausible deniability. And you can say, well, it could have been someone else. It doesn't have to be that person. But you can say the same with bank accounts, right? Like, maybe someone else was using the person's card or whatever to make a payment.

[00:16:01] Sean Bowe: Yeah, just like authority, custody. The other thing is, the other argument that you see a lot and I was seeing a lot yesterday was, oh, I'm going to post an address, find out where who I am or find out who this person is, which is just a really lazy argument. For how, I mean, it just, there's so many things wrong with that argument. There's so many different kinds of adversaries that you'll have when you're sending money around or doing anything on an online protocol. And just saying, DocsMeBro on X is such a silly reductionist way of thinking about privacy.

[00:16:45] Sean Bowe: So, you see that not just from the Bitcoiners, but also from other privacy projects in the space as well, where they say, oh, you don't think our privacy project is private enough? Then figure out where my money is coming from or whatever, which is just not, it's just not how you should think about privacy. That's not how cryptographers think about it, and that's not how your adversary thinks about it. They have more resources, they have more information, they have more context. They can be a different party to you than just some random person on X.

[00:17:18] Sean Bowe: They can be somebody targeting you, they can be someone sending you and receiving payments from you. So, yeah, that's not how you should think about privacy.

[00:17:28] Vlad Costea: Yeah, you said this just before. I was going to mention that the fact that there is a QR code on the screen means that people who are skeptical about Zcash's privacy can actually try to figure out how many transactions were sent and which amounts were sent. But then again, you're mentioning that this is the wrong way to look at privacy.

[00:17:50] Sean Bowe: Yeah, when you're talking about the QR code, what do you mean?

[00:17:55] Vlad Costea: I put the QR code for people to ask questions, right? I already got like six or seven of them. But when people scan the QR code, they can see the address and then they can paste the address in a block explorer and they're not going to see anything because it's shielded.

[00:18:11] Sean Bowe: Right, right.

[00:18:13] Vlad Costea: But this is the wrong way to look at privacy, right?

[00:18:17] Sean Bowe: No, that's, that seems like a total privacy property you should have not knowing when other people pay an address, that seems like a fully legitimate. That happens to be a property that we have in our system. It's a property that we simply just added because we needed to, we considered the address not to be a capability to also see when payments are sent. We actually have the conversations like that when we're doing protocol and UX design all the time in Zcash and even comes up in Tachyon where we actually have to say, okay, if you if you could have an address where you see when it receives payments, but it was intended to be a one time use address.

[00:19:01] Sean Bowe: Does this change the scalability properties of the protocol? Is it more efficient? Does it change the payment flow in some way that's beneficial? Is it worth the trade off of adding that capability? So I guess I guess the answer to your question is, yeah, we should think about privacy in terms of we should analyze it in terms of capabilities and strong security notion, strong notions and try to prove those notions hold categorically, not just plug leaks by going, Oh, I can I can figure out this and that.

[00:19:34] Sean Bowe: Okay, I'll turn my coins or, or Oh, my values are public. So I'll just throw a Pedersen commitment there. But the transaction graphs broken under, you know, quantum adversary or something. It just a total fundamental think comprehensive analysis of privacy is something that we try to do throughout everything we do.

[00:20:01] Vlad Costea: Yeah, in Bitcoin, I have been a big fan for a long time of a privacy wallet that's called Wasabi that does CoinJoins, and what I liked about it is how it does both divisions and consolidations of UTXOs. So it adds an extra layer of deniability. It's not privacy because you cannot hide the amounts. And basically, your anonymity diminishes or perishes over time, as some of the actors involved in these CoinJoins are registering to KYC exchanges, and it becomes much more obvious which one of the inputs could have been you.

[00:20:40] Sean Bowe: Yeah, that's an example of sort of plugging leaks, where you haven't taken a comprehensive step, you've sort of just obscured or hidden information from some parties, or made it so that certain things don't have to be end up on chain. But it's really hard to explain to a user what privacy properties they're actually getting from your system. If there's so many contexts in which the user has no idea that their behavior, which seems sensible, which the wallet is allowing you to do, will screw up their privacy.

[00:21:14] Sean Bowe: And so they have to take active steps to understand how it's working fundamentally. That is another aspect of privacy. We shouldn't rely on the users having to think about it. It should just be private.

[00:21:27] Vlad Costea: Well, yeah, but isn't that contradictory in the context of Zcash's design where privacy is optional? Like the users do have to think about privacy, and they do have to voluntarily shield their funds.

[00:21:41] Sean Bowe: Yeah, I think what matters is that the user's wallet, the privacy that you get, ultimately, whether the protocol is private or semi private or whatever, it doesn't matter. The privacy you get is up to your wallet. So if your wallet informs you, what you're doing is not keeping you private, or is hurting your privacy. If you don't have privacy in some way, then that's okay. But what your wallet does should be, by default, making you private by default. I mean, if there's any default, it's determined by the wallet, in my opinion.

[00:22:15] Sean Bowe: So for example, Zashi. Under normal situations, you can't really do things with Zashi that would ever reveal any information about how much money you have or the history of your transactions to your adversary, which would be the person you're paying or whatever. You don't accidentally reveal that sort of information using Zashi because the wallet deliberately uses the protocol in a way to keep your funds, your transparent funds, your non-private funds from mingling with transactions that could reveal that information, for example. So, yeah.

[00:22:56] Vlad Costea: I just want to acknowledge that there's zero darts in the chat and he said, this is the best episode maybe. And Joe said, Vlad Loki gonna be the next roaring kitty for Zcash. I like the coin.

[00:23:14] Sean Bowe: Are these are these messages on your Zcash wallet or are they on?

[00:23:18] Vlad Costea: No, no, I'm gonna get started with that because I got a bunch of them and I feel like the people are pressuring me at this point to read them out loud. The question that goes first is where does Sean get his smartness?

[00:23:33] Sean Bowe: So I know it's turning is starting to turn into a little meme that I'm smart and that's, you know, whatever, but I'm definitely not smart. I know that for sure, because whenever I'm in a room with other Zcachers, I'm like the dumbest person in the room by far. So I'm not smart, which is okay. I don't care if that doesn't matter to me. It's just I think I probably overcompensate by working a lot harder. Or I try to anyway. That's the only way. Yeah, exactly. I just have to overcompensate for it and think about this stuff all the time.

[00:24:07] Sean Bowe: My memory is not nearly as good as a lot of other people that I work with, whether it be other engineers and cryptographers at ECC or just like Zooko or whoever else. In the project, they live and breathe this stuff in a different way than I do. Yeah, I'm not smart.

[00:24:28] Vlad Costea: Someone said no question here. Just wanted to say the dance was amazing. Heart emoji.

[00:24:39] Vlad Costea: Okay, next one says, where do you get your ideas from? Double question mark.

[00:24:50] Sean Bowe: Well, it's funny because actually everything I've ever done that's been technically interesting or novel in the Zcash project has all been scale related. If you squint a little. Improving the performance of the ZK SNARKs, anything that I would have done that you could even say was novel or interesting or clever would be in service of making those perform better. So they could run on phones or improving the performance or scalability of the trusted setups, which we needed to do in order to actually run them and make them more trustworthy till we got rid of them.

[00:25:27] Sean Bowe: The thing with Halo, it was the idea was how do we make recursive proofs? Yes, without a trusted setup. But part of the reason why we were trying to do without a trusted setup was because there's this sort of relationship between cryptographic assumptions that are really strong that rely on bilinear maps and pairing the pairing friendly elliptic curves and stuff and also structured reference strings, these things that the trusted setups are used to create. And I was trying to avoid the really expensive things to build recursive proofs that required these trusted setups almost just by association and it ended up getting rid of trusted setups.

[00:26:14] Sean Bowe: But that was motivated entirely by performance at first. I would have actually been totally happy with Halo at first if it didn't solve the trusted setup problem for recursive proofs. But the fact that it did was really, really awesome. Tachyon obviously is a scale performance thing. So if there's anything novel, I came up with that. And that's also entirely motivated by, inspired by making Zcash scale, making it more performant in one way or another, I think. So that's my inspiration. So bottlenecks are an inspiration, for sure.

[00:26:49] Vlad Costea: Someone sent an amount that spells leet. So it's 0.0001337 Zek. And he published this quote from Oscar Wilde, the picture of Dorian Gray, which is related to privacy. And I guess I do have to read it. It says the commonest thing is delightful if one only hides it. When I leave town, now I never tell my people where I'm going. If I did, I would lose all my pleasure. It is a silly habit, I daresay, but somehow it seems to bring a great deal of romance into one's life.

[00:27:31] Sean Bowe: Thanks, chat.

[00:27:33] Vlad Costea: Someone else said read out a loud zmeow. There you go.

[00:27:42] Sean Bowe: Have you had to filter out any comments yet? No, I haven't. That's wonderful. Excellent. Thank you, Zcash community.

[00:27:51] Vlad Costea: There is someone called Arjun Kemanee, I think. Arjun Kemanee, maybe? That's right. He says, when does Sean solve aging and death?

[00:28:06] Sean Bowe: I'm going to leave that to other people. I could squint a little and maybe come up with an argument that's a scaling bottleneck, too. By the way, he is one of the authors of this book that I have on my website. Which I don't even have the book and I haven't read it yet, but I have it coming, but I just wanted to plug it. Lords of the cosmos.

[00:28:27] Vlad Costea: So Arjun Kemanee, what's the name of the book?

[00:28:31] Sean Bowe: Lords of the cosmos.

[00:28:32] Vlad Costea: Lords of the cosmos.

[00:28:34] Sean Bowe: From stasis to stars.

[00:28:37] Vlad Costea: There's another question that says, what does Zcash network state mean to you?

[00:28:44] Sean Bowe: Zcash network state? It means to me that there's people socializing and talking about Zcash, at least. I think there was some event in Singapore, which I didn't go to, that had people and it was something like that, Zcash network state. There's this whole philosophy surrounding a new, I don't know how to describe it, it's Balaji's universe of exiting when the system isn't working. And building permissionless societies or whatever the hell it is. And how Zcash plays a role in that. I don't know, I don't really follow that.

[00:29:27] Sean Bowe: I just know there's a lot of people socializing, talking about Zcash, and I just wanted to do math, so I stayed back and did math instead. So hopefully that answers the question, it probably doesn't.

[00:29:39] Vlad Costea: That's a good question. That's a good answer to the question, and I do have another question which spawns some other question, because this guy sent zero. And this is possible. It is possible to send a zero transaction, which only pays the transaction fee. And I'm curious if, in the light of this conversation... that we are having in Bitcoin about what is spam. Is this considered to be spam in Zcash, where you send zero and you only pay the transaction fee?

[00:30:10] Sean Bowe: This is awesome. Here we go. This is cool. So in Zcash, at least theoretically, it may not be implemented now, but totally within the way the protocol works today. You don't really pay anything for transactions that haven't been spent yet. I mean, technically you do right now, because it takes up blockchain space. But in a future design of it, the validators don't actually need to care about these things that are analogous to UTXOs that are called notes, or note commitments really, in Zcash. Validators don't need to keep track of all of them like they do in Bitcoin.

[00:30:54] Sean Bowe: And so I know in the Bitcoin world, the idea is that you want to prune the state, so that if I spend some money and it's been 100 blocks or 1000 blocks or whatever, the validators can just get rid of that, anticipating that there won't be a rollback. So they only have to keep like 100 megabytes of state or whatever it is. And yeah, we don't really have that problem with the notes themselves. So it doesn't matter to us really how much value is in a note, if it has zero or not.

[00:31:29] Sean Bowe: Dust isn't really a thing in our system. Ironically, it's actually the mechanism that we use to prevent you from double spending that consumes the resources. So it's the spends in a sense that cost us, not the newly created coins. It's the infrastructure, the mechanisms and the cryptography used to prevent you from cheating and counterfeiting coins. That's the thing that adds extra state for the validators to keep track of. That's the main thing or one of the main things that Tachyon addresses is that state growth in that part of the protocol because it blows up to a completely unmanageable size for even a small amount of transactions per second.

[00:32:17] Sean Bowe: So addressing that problem, it removes like the last asymptotic performance bottleneck in the actual cryptography in Zcash without compromising on the really, really strong privacy guarantees that the protocol provides.

[00:32:33] Vlad Costea: Yeah, so now I do have to read the question that was addressed using a zero amount of ZEC, which is what timeframe does Sean have in mind for Tachyon to succeed? And this was signed by Next Is Crypto.

[00:32:49] Sean Bowe: Yeah, so like our previous shielded protocol upgrades, like, well, even including our launch back in 2016, which was a marathon to get that finished. And we didn't have like millions and millions of dollars left over after we launched. We had almost nothing. So that launch, the launch of Sapling a couple of years after that, the launch of Orchard four years after that, it's really hard to build these protocols and ship them when there's a lot you have to do. But we were able to go from conception and idea and cryptographic research phase to main net pretty quickly in a lot of cases, like 18 months or so.

[00:33:38] Sean Bowe: And in that span of time, like, for example, for Sapling, we had to do trusted setups and stuff. We don't have to do those anymore, which is nice. So that cuts the lead time significantly. And then also the way that I think we're going to be rolling features out in Zcash isn't going to be like in previous network upgrades where we have to ship the shielded transaction protocol for something like Tachyon and it has to be used immediately. My goal over the next year is to get into main net a protocol that can be used and integrated into the wallets, which development will happen in parallel with that on the wallet side and the user facing side to incorporate the changes, but they won't happen at the exact same time.

[00:34:27] Sean Bowe: So doing all the hard core cryptography and getting it shipped in the protocol so we can actually play with it and integrate it with the wallets in parallel. That stretches like users obviously have to upgrade their transactions and their wallets and their coins to move it over through the turnstile to the new pool. So the whole process is a very long process, but my goal is just to get it get the protocol integrated into Zcash main net next year, essentially. So that's my timeline. That's the only timeline I'm publicly willing to commit to currently.

[00:35:07] Vlad Costea: I do want to ask you more about Tachyon, but I was thinking the approach to this interview should be rather chronological. So we'll get there. For those of you who want to learn more about Tachyon, we'll get there. There's someone who just said Zabubu and I'm not sure what's supposed to mean. Is this going to be like a meme?

[00:35:28] Sean Bowe: There's some there's some like thing that kids like literally like elementary school people get and then they open boxes with these little dolls or something like that. I forget what they're called. They're not for elementary school

[00:35:42] Vlad Costea: Kids. Trust me.

[00:35:43] Sean Bowe: Oh, no. OK.

[00:35:45] Vlad Costea: They're like the new Beanie Babies. Adults are trading them.

[00:35:48] Sean Bowe: Oh, no. OK. Either way, whatever. Whatever. Whatever people like. Yeah, I guess that's the new meme for Zcash. Billionaires buying Zabubus.

[00:36:03] Vlad Costea: I've received a very good question, which I was going to ask myself if it wasn't addressed here. So back in 2013, we had this raging bull market and Bitcoin. A lot of people got involved and a lot of so on one hand, you had the suits and the VC investors were like, yeah, we should put tokens on Bitcoin and we should do stuff with this. And that's how you got Counterparty and Omni, which was called Mastercoin. And then you got Ethereum. And that's like the financial side of it.

[00:36:35] Vlad Costea: It was called Bitcoin 2.0. But on the other side of the spectrum, you had a bunch of academic cryptographers who started paying attention and taking Bitcoin more seriously. And they said, well, we can make this more private with zero knowledge proofs. And Matthew Green, I think, was involved in both of these papers. The first one that was published was called Zerocoin. And the second one, which improved upon the model, was called Zerocash. And Zerocash is basically the successor as an altcoin because Zerocoin and Zerocash were soft fork proposals for Bitcoin meant to improve the privacy of Bitcoin.

[00:37:14] Vlad Costea: And someone is asking in this note, could you explain in simple language what is the main difference between Zerocash, today's Zcash, and Zerocoin, today's Firo? It used to be Zcoin before that. For shielded transactions.

[00:37:29] Sean Bowe: Well, I don't know if Firo currently uses the same protocol, the same old Zerocoin protocol. I mean, they originally did. I don't know that much about that project. I actually don't know that much about Zerocoin. It was a very flawed proposal. And as the authors would admit, it had some major issues. And it wasn't practical. It was a goofy protocol. I don't actually remember that much about how that protocol works. I know that what Zerocash did was it sort of threw SNARKs at the problem. Whereas we had these sort of special purpose zero knowledge proofs in Zerocoin to handle the transfer mechanisms and statements that had to be made in those transactions.

[00:38:22] Sean Bowe: And Zerocash had just said, okay, we'll just solve everything with a snark. So we'll have a circuit that does the whole statement, general purpose. And then we'll use these insane new cryptographic primitives that just come out and just became practical with the Pinocchio and some successor papers just that year or the year after that. And it seemed like, oh, okay, cool. We have this like 600 byte at the time or something like that proof that can prove anything. So we'll just design the protocol around that and then go from there.

[00:38:58] Sean Bowe: I don't want to get inside the authors heads of Zerocoin and Zerocash. Personally, I would never have been optimistic about actually incorporating Zerocoin and Zerocash into Bitcoin. If you ever interacted with the Bitcoin developers back then, maybe they hadn't. They were more optimistic. They were absolutely not going to ever add something like that, even back then. And certainly today, I mean, you can't even change a line of code in Bitcoin anymore without spending like years on it. So there's no way it was ever going to happen.

[00:39:32] Sean Bowe: So I don't know if they were ever seriously thinking that it was going to be incorporated into Bitcoin or they were thinking this is a good way to pitch it to get our paper accepted into a conference or something. I don't know. I'm just speculating. Personally, just off hand. I'm not sure.

[00:39:51] Vlad Costea: Honestly, I think it was very serious. Offer that was taken into consideration. If you go back to Bitcoin talk, it was the post by Greg Maxwell in the summer of 2013, where he came up with this concept of the CoinJoin in Bitcoin. And the context for the CoinJoin was that until we get Zerocoin or Zerocash, this is the second best thing we can actually get like a decentralized mixer that is helping users get some privacy. And he also explained that it's a good way to put it.

[00:40:27] Vlad Costea: It's not strong enough privacy, and it's just something temporary, but it was the best we could get at the time. What's interesting is that it took how long? Four years or something until Samourai Wallet came around. And then another year for Wasabi Wallet to get published. And before that, the only serious implementation which never actually shipped in its fullest form was something called Dark Wallet built by Amir Taaki. Yeah.

[00:41:02] Sean Bowe: See, when Greg says that, like until we get zero, I haven't read that post in a long time, if ever. So I'm not really sure what exactly he said in that. But I think he's always been really skeptical. Maybe he was talking about Zerocash to protocol, but it was just a non-starter that it required at the time, these SNARKs. I think actually, Greg Maxwell coined the term moon math, if you ever heard that term. At least that's what I've heard. Maybe it's not true. But I think he coined that term to make fun of the cryptographic assumptions, specifically, I believe the knowledge exponent assumption that the pairing-friendly or the pairing-friendly elliptic curve-based SNARKs that were coming out at the time depended on, which, yeah, I mean, I think is ridiculous to call that assumption moon math at this point.

[00:41:56] Sean Bowe: There's way more ridiculous assumptions and security models that people work with all the time in cryptography today and take it for granted. And that's totally fine. It was kind of an overly conservative thing. But I think around that time, Greg Maxwell actually felt that way about the cryptography in these constructions. And so maybe he was bullish on long-term on Zerocash, but I don't know that he was actually totally okay with it. It wasn't just a matter of it developing Zerocash. It was a matter of getting rid of those strong cryptographic assumptions, probably,

[00:42:34] Vlad Costea: I think. Well, in the post he says, so he's actually referring to Zerocoin as a point of reference. And he says, how does this compare to Zerocoin? And he starts by saying, as a crypto and computer science geek, I'm super excited by Zerocoin. The technology behind it is fascinating and important. But as a Bitcoin user and developer, the promotion of it as the solution to improved privacy disappoints me. And then he explains why he doesn't like the limitations of Zerocoin. And then he says, above all, Zerocoin requires a soft forking change to the Bitcoin protocol, which all full nodes must adopt, which would commit Bitcoin to a particular version of the Zerocoin protocol.

[00:43:20] Vlad Costea: And this cannot happen fast, probably not within years, especially considering that there is so much potential for further refinement to the algorithm at lower costs.

[00:43:30] Sean Bowe: Oh, yeah, totally. I mean, that's a pattern, by the way, you're going to see in Bitcoin.

[00:43:40] Sean Bowe: Just naturally, there's going to be a lot of like these new interesting things with bit VM and all that kind of stuff, where they're going to get really close to shipping something and then realize and then papers going to come out and say, Oh, I have a way to do it 10 times faster and with better trust assumptions. That they're never going to, it's going to take a long time before they feel comfortable shipping anything like that. Knowing that around the corner is a breakthrough that makes it much more efficient or something like that.

[00:44:13] Sean Bowe: I'd be I'd be worried personally, just as an engineer, implementing something knowing that any day now on ePrint, there's going to be just something that drops that makes everything I'm working on and getting audited and trying to ship just totally obsolete. That would scare the crap out of me, I wouldn't be motivated at all. If you're putting those kinds of constraints on your protocol, which Bitcoin people do that have to do, then it's a lot harder to execute and chip quickly. In Zcash, we don't care about that as much because we're willing to take what we have that we know works and change the protocol completely to implement it and integrate it as fast as we can and as fast as we can safely.

[00:45:01] Sean Bowe: And so we move a lot faster and we're a lot less scared of new papers coming around and obsoleting what we're doing, which we try to be anyway.

[00:45:15] Vlad Costea: You're making my work very easy right now because I do have to plug some sponsors and one of them is Citrea, which is working with BitVM, and they're trying to build this ZK roll up that's going to bring Ethereum features on top of Bitcoin as a layer two. And they are working with BitVM version two, as far as I know. And then there's also BitVM version three and Garbled Circuits, something that their competition, which is called Alpen Labs, they came up with this. And the difference between the two of them is that Citrea is going to launch this year and they are just content with having something that's good enough for now and then they can upgrade.

[00:45:58] Vlad Costea: Well, Alpen has this approach where they're pursuing to build the best version of it that they possibly can, but there is always this risk that there's another paper coming out and then they have to redesign their system from scratch. And I don't know, it's just two different approaches. Citrea, youu can actually test it today. The URL is Citrea.xyz. And I think the end goal for that is to tap into the liquidity that's available on Ethereum right now for wrapped Bitcoin to bring it to a layer which is inheriting the security guarantees of the Bitcoin network and is also potentially more expressive or closer to the hearts of Bitcoiners.

[00:46:42] Vlad Costea: So check out Citrea, it's citrea.xyz, and you can download the software to run it on the Bitcoin testnet today. I think they're going to be launching within a couple of months. And then there's also LayerTwo Labs, which has this ZSide drivechain, and they are basically building according to the philosophy of bringing all the interesting features from altcoins to Bitcoin on a sidechain. And not just the federation like Blockstream decided that they're happy to have, but as a proper two-way peg sidechain, but secured by the miners.

[00:47:20] Vlad Costea: And they have their software ready. I think they have the latest version of Ethereum, the latest version of Zcash, the latest version of Namecoin, if you want to do serious asset kind of stuff. Some prediction market and also big block version of the Bitcoin network, which allows a lot of transaction throughput and is prunable. You can test the software today. It does require a soft fork, unlike Citrea, so in order to have drivechains, we would need BIP-300. And the software works on the Bitcoin SIGNET.

[00:47:55] Vlad Costea: You can download it at layertwolabs.com slash download. LayerTwo is with letters, so it's l-a-y-e-r-t-w-o-l-a-b-s dot com. And check it out. I think it's really exciting. I think it's my favorite approach to Bitcoin maximalism. And it's actually about bringing more use cases and more utility to the existing 21 million coins. And I'm hopeful that this is going to come true one day. But for the time being, when I look at the level of Bitcoin debate in this course, it's a bit discouraging, to say the least.

[00:48:35] Vlad Costea: But it's good to be optimistic, good to have some kind of purpose and goal. And let me plug one more ad and then we can get to the next question. This is about Bitcoin.com News, which has rebranded over the last year. They're no longer the green Bitcoin website, which promotes Bitcoin cash and says that BTC is slower and more expensive. They moved on with the trends of the market and now it's orange. And they have news from across the entire industry, which I think are more balanced than Bitcoin magazine or Coindesk, where I think Bitcoin magazine is too political and biased at it while they're at it.

[00:49:18] Vlad Costea: And Coindesk is sort of oriented towards institutions. They're not about small projects and they don't report on some stuff. And I think Bitcoin.com News is more open to some community projects and some op-eds, which I think are interesting and they cover parts of the world you usually don't hear about. And they also have news about Zcash. If you type Zcash into the search box on news.bitcoin.com, you're going to find out that the newest article says Zcash leads the change.

[00:49:57] Vlad Costea: Oh, leads the charge. Double-digit gainers ignite 4.12 trillion crypto rally. So there are news about Zcash. You can check them out on Bitcoin.com News. And thanks to these sponsors for making this possible. Now, the next question is more of a suggestion or order. I don't know how I should take this. This person says, sell him my laptop, please. And it's signed by Peter Todd. And I'm sure that this is not Peter Todd. And he's talking about one of the six computers that was used during the first Zcash ceremony, which, if I'm not mistaken, was called the Sprout.

[00:50:38] Vlad Costea: And I have this.

[00:50:41] Sean Bowe: Yep. Yep. There you go. Nice. You know, what's funny is that there was a time when I would have considered buying that in a panic and like desperation. There's this funny side story. I don't know how this plays into the questions you wanted to ask, but there's this funny side story that's kind of an untold story of the inflation bug and that fix in Zcash.

[00:51:11] Sean Bowe: Basically, what happened was in Zcash is we had this bug where the ceremony had produced a transcript that you needed to verify in order to see that the ceremony even took place at all. And what the transcript was, more or less, is it's a concatenation of all the contents of those DVDs. So those six DVDs that you have in that box form little slices in that transcript file. And it turns out that there was a mistake in the cryptographic protocol in the SNARK itself, which said to produce these elements during the setup, during the setup phase of the ceremony or during the setup phase of the SNARK.

[00:51:57] Sean Bowe: And those were left in the transcript even though they weren't used and they shouldn't have been used at all in the protocol itself. In fact, if you had access to those elements, essentially, of the transcript, then you could create counterfeit Zcash. So we had launched Zcash unknowingly with this mistake that you could only exploit to get access to that transcript. And I can go over the whole story and of course there's a lot of discussions about it. There's a Radiolab episode and a bunch of other stuff.

[00:52:33] Sean Bowe: But after it was discovered, we had this transcript publicly, so what we did was we just deleted it publicly because we needed to use it to exploit. And then we had to think about what's our plan to remediate. And so we came up with a plan, which I can go over, but at one point we did have a copy of the transcript. I had a copy in my house and we decided as a team, OK, well, we can't find this anywhere else on the Internet because it was so big that nobody else really downloaded it and stored a mirror of it anywhere.

[00:53:07] Sean Bowe: And I couldn't think of anyone who would have a copy. And it turns out no one did. No one else did that I know of. So I had probably the only copy of this thing, and so I encrypted it with a key and gave it to Zooko. That way we would still have custody of it, but you'd have to get to Zooko and to me in order to get to this transcript. And we debated for a long time what to do with it. In parallel, if you wanted to exploit the trusted setup, the ceremony, you'd have to get these DVDs because the transcript is just a concatenation of them.

[00:53:50] Sean Bowe: And the DVDs that you have in that box, actually one of them, I forget if it's the D DVD or the F one, I forget. But one of those contains the data in it that lets you create counterfeit sprout funds in the original version of the protocol. And so when we ended up deleting, yeah, I think it's probably disk D, probably, if I remember correctly, but either that one or disk F, not sure. And it only happens to be in those DVDs, which is really weird.

[00:54:23] Sean Bowe: And so we actually had this copy of this transcript for a long time and decided to delete it, which was a controversial thing, but we decided to delete it on our end. And so after we did fix it in Zcash, we had to get the transcript back because there were people asking, you know, where's the transcript? Because you needed it in order to see the ceremony work. So we really did want to produce it if we could. It wouldn't be the end of the world if we couldn't.

[00:54:55] Sean Bowe: But if we could produce the transcript and we could show people, OK, here's the proof the ceremony took place, even though there was this bug in it for a couple reasons. And so after we fixed the bug and what I started doing is going around and trying to find out how am I going to reconstruct this transcript? And in order to do that, I needed all these DVDs from all the participants in order to reconstruct it. And Peter Todd was not going to help if we had messaged him.

[00:55:28] Sean Bowe: And I think Zooko even tried to message him, hey, would you mind sending us a copy of your DVDs that you had? And Peter Todd is like, ha ha. Yeah, right. I'm not going to help you guys out or something like that. I forget what he said, but he wasn't interested in that, which we expected. And there were some other DVDs that we had copies of because for accidental reasons or because they were uploaded by participants in the ceremony. So we could get copies of that. And it's like putting together this puzzle.

[00:55:57] Sean Bowe: You had to have every piece to make it work so that you could reconstruct it. And if you don't have all the pieces, you're screwed. And we just got so lucky that this videographer who had been recording some of our early ceremony stuff happened to have downloaded some of the DVDs from that we needed in order to reconstitute the transcript. Now, some of the files they downloaded were corrupted. And so we talked to him, and I was really worried that the file that we needed, the last one that I couldn't reconstruct entirely, I wouldn't have been able to get a hold of it.

[00:56:34] Sean Bowe: But it turned out it worked, and I didn't need Peter Todd's help to reconstruct the transcript, and we could post it publicly. So it was this kind of crazy little story that nobody really would care about said something like that. But we really cared about things like that.

[00:56:54] Sean Bowe: Being able to say that, hey, this is what happened and be able to prove that it happened, that little tiny detail in the story needed to be fully solid. And I spent months trying to think about how to solve that problem.

[00:57:12] Vlad Costea: I do agree that this is an artifact and maybe it belongs in a museum. And someone actually reached out to me, his name is Shielded Mark on Twitter, and he asked for more information about this to document, basically to put more information in an article. And he said he's also working with some people who deal with art. And if I get this appraised, I can potentially donate this to a museum and get a tax deduction or something out of it. But I can't. That's the funny part, because I'm not a US citizen and I'm not aware of any museum here that can potentially accept this as an artifact.

[00:57:53] Vlad Costea: I don't think they care at all about Zcash. And I think the only solution to get this in a museum is to sell it to someone who wants to get a tax cut. So someone's going to buy this from me and donate it to a museum. And then if they sell coins during the bull market, they're going to be able to not pay tax.

[00:58:17] Sean Bowe: I'm not going to be a speculator, so I'm not going to buy it from you. I'm not interested. No, it's fine.

[00:58:23] Vlad Costea: It's just 10,000 ZEC.

[00:58:25] Sean Bowe: Yeah, right. Exactly. Yeah.

[00:58:27] Vlad Costea: And I said it's 10,000 when the price was like $70. And now it's $210.

[00:58:35] Sean Bowe: Yeah, you got to stick with it.

[00:58:37] Vlad Costea: It's a good question, but I should use Zcash as a unit of account or it should be denominated in dollars.

[00:58:50] Vlad Costea: Yeah. Anyway, interesting story. Like this was such an interesting cypherpunk experiment to have this ceremony of six people. There was also Edward Snowden. There was the guy from Coin Center, David Van Valkenburg. Is it David? Peter. Peter Van Valkenburg. Yeah. And there was also Zooko and his brother. Who else? Peter Todd.

[00:59:22] Sean Bowe: Wow. Actually, I don't remember if Zooko's brother was one of the participants. Bryce. Bryce is Zooko's name, but yeah, I don't know. So I know Zooko, Peter Todd, Edward Snowden, NCC Group.

[00:59:44] Sean Bowe: Was Andrew Miller a participant, too? I think so. I forget what the sixth one is. Wow. See, my memory is coming. I can't remember exactly. I know we need to find it somewhere.

[01:00:03] Sean Bowe: Andrew Miller, Derek Hinch, Peter Todd. Yeah, Andrew Miller, Peter van Valkenburg, pseudonym John Dauberton, which was Edward Snowden, Zooko. Derek Hinch was an engineer, researcher, or whatever, security person at NCC Group. And then Peter Todd. Those were the six that were in the original series.

[01:00:24] Vlad Costea: I'm actually curious how many of these devices that they used are still available.

[01:00:31] Sean Bowe: I'm not sure. I know that some of them are still available. Some of them got destroyed in elaborate ways. It was totally up to the participants. We didn't want to tell the participants what to do with the hardware afterward. And in general, we actually just didn't want to tell them to do anything in particular more so than they needed to in order to participate so that they could, if they chose, to do unpredictable things that would prevent an adversary from being able to compromise whatever they were doing or make it unpredictable.

[01:01:11] Sean Bowe: So, yeah, so those are the six that participated. Actually, Edward Snowden, I didn't know that Edward Snowden was participating. I knew that three of them were pseudonyms. And so I had no idea. Actually, I don't even remember who picked it. Probably Zooko who picked the participants there. But so I was sort of the emcee of the ceremony. So I was running the coordination server that handled all the, intercepted all the communication between the participants and did some of the math in between steps that made the ceremony function.

[01:01:49] Sean Bowe: And so, yeah, I wasn't, I was not aware of who all the participants were. And there's this funny moment where after the ceremony was done, I was, I had a group chat with some of my roommates at the time. And they had sent some, they had been talking, and I got this message. That sounded like, like someone from like an army base was talking about something. I forget what it was. So I responded to my roommates with that stupid like Navy SEAL meme. That thing on 4chan.

[01:02:23] Sean Bowe: I forget how the meme goes anyway. Who do you think you're talking to, you little bitch? Or whatever. That stupid meme. Thinking it was talking to my roommates, but I was miss Chan, miss Channing. It was it was actually to the group to the ceremony group chat. And it was, I think it was Derek Hinch that was posting something because he's just like this really hardcore security person. So he was talking in this really robotic, high security, high stress kind of language that I had misinterpreted. And the next day, the next day, I saw Zooko and I was kind of holding my head.

[01:03:02] Sean Bowe: I'm like, sorry. Like, yeah, what was that? And I'm like, yeah, I thought my room, I thought it was my roommates. It got the wrong channel. But it turns out I posted the stupid meme and all that. I posted it in a chat with Edward Snowden. So when I found out it was Edward Snowden launched much later, I was like, oh, crap. That's embarrassing.

[01:03:26] Vlad Costea: That's a funny story.

[01:03:30] Vlad Costea: And to be honest, it was such a cool experiment. And afterwards, Peter Todd spent like a year going to conferences speaking about I think the title of his presentation was privacy theater or security theater. And he was also calling you guys dishonest and said that the ceremony was useless. And it did not accomplish what it was set to do.

[01:03:54] Sean Bowe: He hated it. Yeah, he hated the whole thing. I think what happened probably is that he got—and he—I really appreciate that he participated. But from his perspective, it didn't, it landed legitimacy to Zcash that he didn't want to lend. And he probably didn't realize that at the time, and then he had to like, go back and kind of go on a apology tour, sort of amongst the Bitcoin people to for having participated in the ceremony. I think it was valuable that he was part of it.

[01:04:30] Sean Bowe: And then he was very into antagonistic and negative toward it. And he's really skeptical that he's coming up with ways that it didn't work. Like these ridiculous, I think, oh, the rust compiler could have been backward and things, you know, whatever is really, really funny., I think it was valuable. He participated. I know he probably regrets it, but whatever.

[01:04:55] Vlad Costea: I guess that's why he sold this laptop for 1000 bucks, and I was able to pick it up. And at the time, I think it was past the NFT mania where everyone was obsessed with collectibles. And I was thinking, Oh, this is so cool. And I haven't opened it until I had my interview with Zooko. So I kept it in the box seal.

[01:05:16] Sean Bowe: Yeah, that's cool. I thought I thought you just were really disciplined and he didn't want to open it up for a long time. I guess you were. That's pretty cool.

[01:05:27] Vlad Costea: I just so I was saving it for a YouTube video. And I never had time to actually do it properly. Like I would need someone to hold a camera and do close ups and make it look professional. Yeah. And I was waiting for the right moment to do this. And then when I realized I was going to interview Zooko, I said to myself, Oh, maybe this is the right time. Maybe having the right person to explain the context of this and tell stories about what happened is actually a much better setting than just me reading a bunch of articles and listening to that radio show or whatever it was.

[01:06:04] Vlad Costea: And then coming up with just a summary of that. Yeah. But to be honest, if I did a YouTube video, maybe it could get more views than a six hour interview. But I digress. Those who have watched the six hour interview, I have a lot more respect for them.

[01:06:28] Vlad Costea: What else was I going to say? Oh, yeah. Last year I was at a conference and I interviewed Peter Todd. And I've asked him for the names of free altcoins, which he thinks are legit and are not shitcoins. And he named Litecoin, Monero and Zcash. And I've actually asked him, like, hey, did you just name Zcash after all the history that you have with them? And he said, yeah, but the technology is actually interesting and they have made great progress. So it was good to see that he acknowledged that his opinions can change and he's paying attention to the new stuff.

[01:07:06] Vlad Costea: Maybe it was really him who sent me this message.

[01:07:10] Sean Bowe: Maybe, maybe it was. Yeah, I think Peter Todd, there's a lot of people who have really strong opinions and maybe they come across really negative and hurtful at times towards Zcash. But especially if they're technologists, they appreciate the merit of the cryptography. And I think that a lot of these characters that are maybe negative at times, I think you'll find that at the very least, they're very sincere people. Like, I think Peter Todd is a very sincere person, even if I don't. Or most of the time he's sincere anyway.

[01:07:43] Sean Bowe: I don't know him that well. And other characters, like, for example, Luke, who I know is really controversial. Luke Dashjr is really controversial in the Bitcoin space, especially right now. I've never had a pleasant interaction with him. But if you kind of step back and just think of all these people as characters, and you don't take it too personally, and you kind of hear about these people indirectly from other people, you realize, oh, actually, these people are very authentic. They're sincere about what they mean, usually. And it's a healthier attitude that you can carry with you in life, I think.

[01:08:29] Sean Bowe: Years ago, with Luke in particular, I remember this a long time ago, the only time I ever really talked to him was when I was building something for Bitcoin for a friend. And I needed to use the Bitcoin RPC in some way that essentially admitted that in some situations, a from address exists in Bitcoin. Of course, from a conceptual perspective, and definitely from a protocols perspective, there isn't such a concept as a from address, even though in some situations you can interpret a transaction as having a from address in some limited cases, if you feel like it.

[01:09:09] Sean Bowe: And that's how a lot of people who use cryptocurrencies can often think that there is a money's moving from this address to another address. On a technical level, that's not exactly what's taking place. But anyway, whatever I was building, it sort of tacitly admitted that these from addresses could exist or could be, you could consider them existing. And Luke Dashjr did not want me to build whatever I was building and did not want to help, didn't want anyone else to help me build it because he was emphatically opposed to from addresses.

[01:09:51] Sean Bowe: So I'm on this IRC channel trying to get help, like, why can't I use the RPC to get this information? He's like, no, there's no such thing as a from address. Sorry. I'm like, okay, well, I didn't ask you. I was asking other people, like, you know, I'd want someone else's help and advice. And he's just interfering with me. And I got all mad at him or whatever. And Greg Maxwell messaged me and said, Hey, don't be such a jerk to Luke. Why are you being such a jerk to him?

[01:10:18] Sean Bowe: And I was like, Oh, I'm really sorry. I was really respected Greg Maxwell. And I was like, Oh, I'm really sorry about that, whatever. 20 years later, I actually I don't feel exactly the same about all the characters involved. But I know that I at the time, I really thought Luke was a really annoying and antagonistic person. But I don't care about that anymore. He might think I'm a horrible person, a scammer, or whatever you'd say about me. I probably doesn't even know who I am. And maybe if he does, I don't think he cares.

[01:10:48] Sean Bowe: But I genuinely think that he would, he would probably save my life if I was, if it didn't risk his own life. He would save my life. He saw me like drowning on the side of the road or something. I think he like, from what I've heard about him, he actually seems like a good person, even though I don't agree with him about all his his technical decisions. And I'm not a knots fan. I'm not a his his opinions on like the opportunity stuff and all the rest that although I don't really follow it that much.

[01:11:23] Sean Bowe: I'm not really on his side on that. And I have no reason to like defend him at all. But from what I've heard, he's actually a really sincere and honest person. So I helps to keep keep in mind that all these people are just characters. Let's think of him as characters and I'll take it to personally.

[01:11:41] Vlad Costea: It took me a long time to understand this, that Twitter is not real life. It's so obvious in hindsight, but you take these people seriously and you think that they really mean what they're saying. And then you stumble upon this cult, which is saying, well, I never sold a single Bitcoin, I'm going to pass this on to my grandchildren, and blah, blah, blah. And then you meet them at conferences in person, and you see them wearing fancy watches and bragging about the stuff that they have. And you're like, so how did you get this if you never sold a single Bitcoin and they wink at you or they just laugh like, okay, that was never real.

[01:12:22] Vlad Costea: Yeah.

[01:12:25] Vlad Costea: There's another message that I got. It says when you get to the deep dive on Tachyon, can Sean please explain how moving the secret off chain will retain the existing level privacy? Where will the secret be stored? How can we be sure it will stay private?

[01:12:43] Sean Bowe: It very good questions. I can let's let's add that to the stack somewhere else.

[01:12:49] Vlad Costea: Is there any way I can bookmark this? I can add a note to it so I can write important note. Okay, so we'll get back to this. On the topic of the ceremony, which we discussed, a lot of people remember Zcash as the network that had to fix an inflation bug. And a lot of Bitcoiners say they stopped paying attention to Zcash in that moment when they realized that, okay, after the ceremony and all of this complex setup, there could still be an inflation bug. And Monero people still use this against Zcash.

[01:13:30] Vlad Costea: They say, well, maybe that there was an exploit in the inflation bug. How can you be sure? There's this mechanism that's called a turnstile, which I'm not sure I understand very well. But I would be happy if you could explain what really happened and how we can be sure that the supply of Zcash is the one that we see.

[01:13:52] Sean Bowe: Yeah, so the way that shielded transactions are added to Zcash in the protocol is we have the standard Bitcoin style transactions. And then we have these other parts of the transactions that can interact with what we call a shielded pool, which is where all the shielded money exists. And you can move your money from the transparent world of the Bitcoin world into the shielded pools. And when you're doing shielded transactions, everything about the transaction is private, like completely private. So you can't actually tell the difference really between two arbitrary shielded transactions.

[01:14:31] Sean Bowe: They actually look like just random. You can't distinguish between the two. That's how we prove that it's secure. And that's how we prove that it's private, this indistinguishability property.

[01:14:47] Sean Bowe: So money can go in and in the pool, can come out of the pool, and we can keep track at the boundary of how much has gone in and how much has gone out. Now, obviously, if more goes out of the pool that came in, then there must have been an inflation bug. And the inflation bugs can exist anywhere in a protocol. But if they exist inside the shielded pool, then it's because the cryptography was broken, quantum computer showed up, there was a counterfeiting bug in the circuit, there was a ceremony bug, like the one that actually there was a bug, and somebody exploited it, obviously.

[01:15:20] Sean Bowe: And in that case, and then it became obvious to everyone when they tried to take more money out, or when not when they did, or not when they tried to take all the money out. But when other people who still had money in that pool, tried to take all their money out that they had sitting in there. And so for years and years and years and years now, how many years has it been? Like seven years, the sprout pool has been sitting there waiting for somebody to take the rest of their funds out, and it's dwindled down over time.

[01:15:53] Sean Bowe: And it's sort of asymptoted at like, I don't know, 20,000 or something, ZEC is sitting there. And if there was anyone who had, especially with the price being lower a lot, during most of this time, there was anyone that had that even a slightly significant amount of funds in the sprout pool, during any of that time and wanted to take it out, sell it or do whatever, they would have triggered this public failure, the turnstile would have caused a consensus fault, or whatever it would, there's a there's actually an actual mechanism that would alert everyone that this happened, there's an error.

[01:16:35] Sean Bowe: And so everyone would know that more money came out of sprout than went in, no matter how the cryptography works, no matter if the setup was working or not working. And this is the case for all of our shielded pools. And the shielded pools are in isolation. So you can't just move money from sprout to the new protocols that use the more advanced trusted setups, or to the new protocol that everyone's using now, which is Orchard, which doesn't have a trusted setup, you can't move between these without going through that turnstile without making the value public temporarily in order to keep this 50 amounts that went into in and out of each pool, public knowledge so that this this accounting can actually be enforced.

[01:17:15] Sean Bowe: So that's how we know we know with with certain with with some certainty, that it would be easy. It would have been difficult for us to for this to be expected. It would have been easier for us to be able to be able to be exploited at any time in the gadgets history without us knowing that this turnstile would have been violated at some point. And it would have been actually, it would have been easy for that condition to be triggered. Anyone could trigger it if they just had money in sprout.

[01:17:43] Sean Bowe: So somebody or so many people have some Sprout funds that they just forgot about or whatever. But not very many. And so if there was counterfeiting, what is the worst that could have happened? Well, 20,000 ZEC was counterfeit. And it just so happens that all the people it just so happens that the amount of funds that were left in the pool inadvertently or not, maybe, maybe on purpose, I don't know, by the people who haven't taken their money out, and who didn't counterfeit is just slightly higher than whatever was actually counterfeit at any given time.

[01:18:16] Sean Bowe: And for years, we haven't even had the ability for you to be able to put money into sprout. And we stopped that, like, I don't know how many you're like, five years ago, or something like that, or four or five years ago, we didn't add money into that pool anymore. So there's no way it was exploited, I think. And if it was, then there's a, there's a cap on the impact that it has on the rest of the network. And so that's my answers. I'm not too worried about that protocol.

[01:18:44] Sean Bowe: I don't think anyone seriously engaging in speculation over whether that bug was exploited, can argue that if they're being honest, can argue that it was exploited by any, in any significant way, if at all. Yeah, that's my that's my personal thinking. If somebody's coming around saying, Oh, how do we know or whatever, depending on how they're phrasing it, I would be inclined to assume that they're being disingenuous with all that evidence.

[01:19:14] Vlad Costea: Right. So worst case scenario, there were 20,000 ZEC that were counterfeit?

[01:19:21] Sean Bowe: Yeah, I mean, like, worst case scenario, I don't know. You have to assume

[01:19:24] Vlad Costea: That if someone had access to an inflation bug, they would do something much worse than that.

[01:19:29] Sean Bowe: That's, that's a good question. What would they do? What would you? It's not a really easy answer. Like, what would you do if you had that if you were if you're evil doer, and you wanted to make as much money as possible? How would you exploit a counterfeiting bug in a shielded pool, knowing that if you exploit it now, you probably, and it's discovered, and somebody else exploit, you don't know if other people are going to exploit it, you don't know when it's going to be discovered.

[01:19:58] Sean Bowe: You don't know what the price is going to be like in 10 years. Like, what's the price now versus what it was when the bug was out versus what it was four years ago or three months ago. This totally affects what an adversary would choose to do in order to maximize how much they could stand to benefit or profit from exploiting the vulnerability. It's not clear to me that there's any solid strategy besides exploit it as fast as possible. And dump the coins. I'd be open to discussion over what the best way to do that is.

[01:20:41] Sean Bowe: But then again, I've been trying to block that kind of thinking out of my memory because what's at stake is like this thing I've worked really hard on, would have its credibility in shambles if that were to have happened at all. And so I really hate even speculating over that sort of thing. It's not very motivational. I'll let other people speculate, but I don't think there's any real scenario, realistic scenario where somebody is exploiting the bug and they leave those funds sitting in the sprout pool for that long strategically.

[01:21:20] Sean Bowe: It just seems ridiculous, I think.

[01:21:23] Vlad Costea: Yeah. And for context, when there was the inflation bug in Bitcoin back in 2010, they mined 184 billion BTC and Satoshi fixed it. But the point is that when someone is actually malevolent, they're trying to print a ridiculous amount of money to destroy the credibility of the system.

[01:21:49] Sean Bowe: Definitely. Well, in that case, I'm not sure. I don't remember exactly all the details of that bug, but I think it was glaringly obvious that something was exploited because of it. Oh, it had to overflow, so it had to be a large amount of money, maybe. I forget. But of course, if you're counterfeiting in a shielded pool, the amount that you counterfeit is not public, right?

[01:22:13] Sean Bowe: So we couldn't possibly know what actual strategy a counterfeiter in particular would take.

[01:22:24] Vlad Costea: Yeah. There's another question. What kind of music do you listen to and what is the model of those Sennheisers?

[01:22:33] Sean Bowe: Oh, these are HD 800s. I don't know if they still sell these or not. What kind of music do I listen to? Is that what they ask?

[01:22:39] Vlad Costea: Yeah.

[01:22:41] Sean Bowe: Oh, God.

[01:22:45] Sean Bowe: I'm not too strict on what kind of music. Electronic music of a wide variety. I hate talking about the music I listen to because nobody likes my music. I just keep it to myself usually.

[01:23:04] Vlad Costea: Someone says that he is monitoring the situation and he is some kind of emoji while the stream is going. I don't know what this emoji is trying to understand.

[01:23:18] Sean Bowe: If they're monitoring the situation, it's probably MERT. That's what he's good at doing.

[01:23:25] Vlad Costea: Your thoughts on the 1559 implementation. Why do tokens that are burned have to be reintroduced? Why can't they be left burned? Will not this change the supply schedule?

[01:23:39] Sean Bowe: No, it doesn't change. I mean, one of the...

[01:23:41] Vlad Costea: For context, what is the 1559 implementation?

[01:23:44] Sean Bowe: Yeah, So we have this... We have to introduce a fee market in Zcash long term. Even if our protocol probably scales, probably we still want a fee market of some kind because there's always going to be constraints. Over the next many years, we're going to have bandwidth constraints and things like that in the protocol. So, we're going to need a fee market that's private. We don't have one of those right now in Zcash. So, the way to do that usually is to adjust the base fee that everybody needs to pay or the required fee for the transactions.

[01:24:24] Sean Bowe: Adjust it on a per block basis potentially based on the usage of the amount of transactions that are taking place currently to adjust to usage dynamically. And to do that privately, you have to apply the same rule to everyone. Again, it's one of those things with privacy. You have to do your best to make it so that everyone's transactions are as indistinguishable from everyone else's. So, having a fee market and making that property hold requires you to do things like this. And so, the question was about adding that and then why...

[01:25:06] Sean Bowe: So, there is a mechanism in the proposed fee market for Bitcoin or, sorry, for Zcash where the coins... part of the coins actually get burned or something happens to them that doesn't allow the miners that mine the blocks to actually take them as fees. And the reason for that is that the miners have influence over the actual number of transactions that are included in a block, so they're the adversary. So, you have to imagine a possibility where they might try to manipulate the fees to increase fees in order to benefit themselves.

[01:25:43] Sean Bowe: So, to prevent that, you add some mechanism that would take some of the fees and take them away from the miners so that if they were trying to manipulate it, they would be punished. They would be spending their own coins to do so. Now, the question of the supply cap, I mean, in the Zcash community, I'm pretty sure 99.99999% of everyone in the Zcash community is strongly in favor of maintaining a strict maximum supply cap of 21 million coins. And that's just like... it's in our DNA for our project.

[01:26:22] Sean Bowe: It's something we set out from the beginning to enforce. But the question of what happens to coins when they get burned when... another question is what happens to coins in the Sprout pool. We had the Sprout pool we were just talking about where there's 20,000 or some odd coins sitting in that pool. What if nobody claims those coins? Do they just get burned too so that no one ever accesses them again? Because we're not going to keep Sprout around forever. In 20 years, if we have Sprout around, that's ridiculous.

[01:26:47] Sean Bowe: So, we're going to get rid of it someday. So, what happens to those coins? Well, is it really a violation of... it's not a violation of the supply cap if the coins are recycled. It's not really a violation of the inflation rate or the issuance schedule because we're not issuing new coins. We're just taking coins that were already issued and using some mechanism to redistribute them. So, it is a good question. I don't really have strong opinions on what should be done with the coins. I suppose you could burn them, but I don't know.

[01:27:22] Sean Bowe: I don't think about those kind of market incentive things very often. Something needs to be done where the coins are taken away from the miners, that's for sure.

[01:27:33] Vlad Costea: Right, so are you implying that the network is going to transition to proof of stake?

[01:27:41] Sean Bowe: That's an orthogonal, I think. The fee market thing is something that could be added with or without proof of stake. I think proof of stake possibly will help a lot with solving certain kinds of problems like certain bottlenecks in our protocol, time to finality, things like that. And arguably, depending on who you talk to, security improvements in the consensus protocol. And I think there's a lot of enthusiasm for adding proof of stake right now. The community sort of expects that we're going to make a lot of progress doing that.

[01:28:21] Sean Bowe: So, that's another thing that I'm like, you know, I don't think too much about that stuff. I have enough on my own plate. But there's a lot of enthusiasm and work being done right now by Shielded Labs to build and also propose to the Zcash community concrete hybrid proof of stake, proof of work consensus change in Zcash that the community could consider for inclusion in the protocol. Hopefully, next year sometime. That would be cool.

[01:28:53] Vlad Costea: Is it necessary to burn the fees? Is this a way to also improve the privacy in some way? Because if you're a sophisticated attacker, you can basically look at the amount of fees being paid for transactions and backtrack from there to make assumptions.

[01:29:09] Sean Bowe: No, no, no, it's the point of, you don't have to burn all the fees, you burn some portion of them so that the miners, if they include a lot of transactions in their blocks in order to manipulate the metric that's used to determine what the fee rate changes are, which is some deterministic function of the number of transactions that are in the block or something like that, they can manipulate that metric by creating their own transactions that send money to themselves and paying a fee. In the absence of any burning, they could just send the money back to themselves via the fee mechanism because they're mining their own transactions in their own block.

[01:29:45] Sean Bowe: So they can manipulate the actual fee market, they have influence over it, which burns them more in fees. So that creates a bad incentive structure for the fee market. So to discourage that, you just make it so that some of the fees are not given to the miner. Of the block, because if you did, they have some incentive to manipulate it, some of them are burned, and some significant portion of them are either burned or taken away in some mechanism away from the miner, so that they can't, because they're not incentivized to manipulate the fee market, basically, because they would be burning or giving their own coin in this attacker scenario, they'd be giving their own coins away.

[01:30:30] Vlad Costea: Something that Monero people usually point out, too, is the fact that Viya BTC owns right now 73% of the hashrate. And they say that this is an attack vector, the network can become insecure, get 51% attacked by Viya BTC. And the next two pools are two miners with 6%, and pool with 2.8%. Supernova with 0.4%, Mining Dutch with 1.4%. And there's also an untruth. There's also an unknown portion of the hashrate, which is 15.5%. So to which extent is this a concern?

[01:31:07] Vlad Costea: And what is the development team doing to mitigate this?

[01:31:13] Sean Bowe: So, like the developers and people working on Zcash have a lot of, wear a lot of different hats, and my hat's like the crypto hat.

[01:31:25] Sean Bowe: And a lot of these things that have to do with consensus mechanisms and fee markets and security and things of those kind of portions of the protocol, I don't think about too much. So I'm only just totally speculating based on my thinking, but I consider it a problem. But I also consider it a problem in Bitcoin, too, that there's just a few pools. I mean, the fact that there's a few pools in Bitcoin is mainly a manufactured appearance of security theaters. Speaking of security theater, like that's just BS, basically.

[01:31:59] Sean Bowe: Those pools, if they felt like there was any threat to the price of Zcash or the price of Bitcoin, they would just divest some of their hash power somehow to other pools, even artificially, even just to put on appearances if they had to. So that's just like, there's a serious centralization problem with the pools in Bitcoin, there's a very serious one in Zcash as well, that needs to be fixed. And that's another reason why the work on Crosslink is exciting a lot of people in the community, because that helps at least to alleviate the concerns a little bit by adding another mechanism.

[01:32:43] Sean Bowe: This is a hybrid proof of work, proof of stake protocol, another mechanism to secure the protocol, the consensus protocol that might work now in Zcash and in Bitcoin. And unlike in like Monero, for example, our proof of work is generally almost entirely mined using ASIC devices. So the people mining have like this long term incentive in the value of their hardware that they invested in, they're trying to get a return on. And if they were to attempt to attack us or Bitcoin, they would be nuking their hardware, right?

[01:33:26] Sean Bowe: Because the Zcash developers would just say, okay, well, you're destroying the network, so we're just going to change the proof of work. Or we're going to switch to proof of stake or whatever we'll do. If we have to treat it as an emergency and existential crisis for the network, then that's what we'll do, for sure. Absolutely. So the miners know, the pools know this. And so to the extent that they, I don't think they would want to willingly participate in something that obviously threatened this, the liveliness of the network, or the behavior of the network, or doing anything that would cause the price to go down or anything like that.

[01:34:09] Sean Bowe: They just want to do their job as pools and hope that they get as much fees as they can from the miners and the miners think the same way, trying to get return on the investment in the hardware. The other thing is that in our protocol, unlike in Bitcoin, we're less concerned about censorship. Because, you know, shielded transactions, again, are indistinguishable from each other. So you can't really target certain users of shielded transactions while not targeting all of them, which is an important property, I think, that's undervalued in Zcash.

[01:34:53] Vlad Costea: Yeah, that's also something which is very relevant for the privacy conversation in Bitcoin, because people say, well, we don't want privacy because it's going to get delisted from exchanges and maybe the number will stop going up and whatever. And then it's going to be back to being presented in the media as this criminal coin because you can hide stuff. But in reality, if you want the system to be censorship resistant, you do need to make transactions indistinguishable from each other. And for as long as there is this social layer where you can say, well, I don't like where this coin is coming from, and it's associated with this, I don't know, maybe it comes from a Silk Road wallet, maybe it comes from North Korea or whatever.

[01:35:39] Vlad Costea: There's going to be a filtering system and some nodes will refuse to relay the transaction, some miners will refuse to mine the transaction. But the reason why this works is not technical, but it has to do with game theory and the fact that there is an incentive for someone to mine that transaction. It's the reason why we say that Bitcoin is both censorship resistant and somewhat permissionless. But these guarantees, which are provided by game theory, may not be enough. Incentives are not always the only reason. Of course, as long as there is at least one mining pool that's outside of these sanctioned regions and is free to mine all transactions, this is not much of a concern.

[01:36:24] Vlad Costea: But by default, the system should not allow people to discriminate. And it's something that I like to tell Bitcoin people when they say, well, we don't need privacy on the base layer, we should have it on second layers or whatever. But this is exactly why you should have privacy on the base layer. If there was privacy on the base layer today, there would be no debate about spam or ordinals or whatever. These ordinals would be meaningless because you can inscribe data as ordinal inscriptions, but the rest of the network does not see that you did that.

[01:36:58] Vlad Costea: And you can only selectively reveal it to other people. And this sort of diminishes the value of your transaction and sort of crashes the whole NFT market on Bitcoin and makes it even more hardcore pro transactional. And I would love for that to happen. And I still hope that sometime in the future, we're going to get like a good version of Zcash on the base layer with the Zerocash soft fork. But what's important is that we keep talking about it and mentioning that this technology is exciting and it's great.

[01:37:33] Vlad Costea: And the Zcash team has actually shipped. In Bitcoin, we like to brag about low time preference and persistence and being committed and thinking long term. But you guys have been shipping stuff for 10 years and Zcash has only gotten better. Like I can think of other coins which have been around for a longer time, but the amount of improvements that they made is not as significant. But not to praise you guys too much because it's going to feel like this is some sort of marketing interview or whatever.

[01:38:12] Vlad Costea: A lot of the industry today works with Zcash technology and Fluffy Pony actually jumped in to comment on one of my posts and said, well, Zcash didn't really invent anything ZK and you can go back all the way to the 80s and you're going to find literature that describes some of the stuff that they do. And then I actually had Roman, the creator of Tornado Cash, who commented on that and said this is disingenuous because without Zcash all of that would be purely theoretical. And you would have no libraries to actually implement zero knowledge proofs for different purposes.

[01:38:51] Vlad Costea: So I do respect the work that you have done and I do think that you're way ahead of your time and I think Zcash as an altcoin was way ahead of its time. It was launched nine years ago with concerns that maybe were considered to be silly at the time or paranoid. And nowadays I think the surveillance and everything concerning invading the privacy of your transactions has gotten so much worse and your concerns were validated. And I think the need for Zcash today is greater than it was nine years ago, which is also why I believe in this pump.

[01:39:29] Vlad Costea: Because Monero Bros, they say, well, this is not organic. It looks like it came from VCs or whatever. I do believe that the demand for this technology is going to be much higher and the price is following the technological progress. And then as soon as people realize that this went up, they're going to start researching more about it and start using it, which I think is the perfect storm. This is how you make privacy part of the mainstream. First you attract the greedy side of people and then they will stick around and say, well, I think this makes humanity much better.

[01:40:08] Sean Bowe: Yeah, for sure. There's a lot in that. I think your comments about the zero knowledge stuff and the development of the space and yeah, so Zcash basically introduced ZK Synarchs to the world. There wasn't a public product that used zero knowledge proofs, like general purpose zero knowledge proofs or Synarchs or any of that in any industry, not just even the blockchain, but in any product ever. That had ever shipped before Zcash. Zcash did it first. And when we did it, we did it so early that not only did a lot of people think, whoa, my God, they've accelerated the timeline of SNARK development and deployment and production by years, which I've heard from many people.

[01:40:58] Sean Bowe: But also, we did it so early that it didn't perform that well. We did it earlier before we had a really good product to actually integrate it into. And so we had to invent our way out of the problem by making it more efficient. And a lot of those improvements to the cryptography, to the math, the science, and then also the implementation work and just other practical things. Just being the first to take a certain step also helps clear the way so other teams feel comfortable investing time and resources into going in the same direction, learning from us, making their own improvements.

[01:41:38] Sean Bowe: But all those things Zcash was able to do for years and our elliptic curves and our code and our papers and all this stuff that we've built to improve Zcash over the many years, which we've actually implemented in Zcash. We haven't just done papers and talked about it. But this stuff is all used throughout the industry. Like every major project that does scaling or privacy work is using one of the things that we invented for Zcash somewhere in the stack. At least one. So that is something that we're definitely proud of at Zcash.

[01:42:12] Sean Bowe: But I'm far, far more proud of having actually developed the technology and then actually integrated it and shipped it into Zcash. That's way more important. You can be clever and everyone can praise you for how smart and clever your tricks are and ideas in your papers and stuff. And that's great for your resume, but it doesn't actually do anything if you don't actually integrate it and ship it to the users. And you go through the pain of having like the counterfeiting bug or having to actually deal with wallet migrations and having users on Mainnet that depend on your cryptography and dealing with it.

[01:42:54] Sean Bowe: You know, they're running into problems. Their funds got stuck and dealing with all that stuff while you're trying to ship and still delivering. That's something we've done in Zcash. And that's why I'm way more proud of that than any of the contributions we've had in this space, which I'm also very proud of. But shipping is crucial.

[01:43:13] Vlad Costea: Yeah. And to your credit, you guys have shipped. I got to present two more ads and then I'm going to get to the next question and then also get into Halo, get into Tachyon, talk about the spicy stuff. So if you want to get a drink, this is the right time. SideShift.ai is the place where you can swap something that you have for something that you want much more. So, for example, if there's someone who's paying you in stablecoins, we are in the middle of a bull market.

[01:43:40] Vlad Costea: And let's say that you want to buy Zcash because it's going up. Well, one way to do it to avoid going to KYC exchanges would be to put that USDT, send it to SideShift, get some BTC or LTC out of it and then install Zashi wallet. And it has this integration that also lets you swap from BTC to ZEC. And that's actually a good way to get onboarded to Zcash. Unfortunately, SideShift does not work in the USA, but if you really want to use SideShift, you can find workarounds, wink, wink.

[01:44:19] Vlad Costea: And what else is there to say? They have pretty good liquidity and low fees and a lot of trading pairs, which unfortunately don't include privacy coins due to various regulations, which sucks because they have the Trump coin, but they don't have Zcash. It makes me angry when I think about it. Add Zcash SideShift and the URL is S-I-D-S-H-I-F-T dot IO. I'm going to win a spelling contest by the end of this episode. And last but not least, there is No One's.

[01:44:52] Vlad Costea: In the previous episode, you have seen Ray Youssef, who is the former CEO of Paxful, and now he's the CEO of No One's. It's a peer to peer marketplace whose goal is to empower the global south. For him, the mission of this entire space is to get people who need banking services and need to have permissionless and somewhat private transactions to onboard them and enable them to empower themselves with this economy. And No One's has a lot of users from Africa, has a lot of users from the Middle East, from South America.

[01:45:31] Vlad Costea: Basically what Ray Youssef refers to as the lions of the global south. And if you do decide that you want to trade on No One's, you're giving liquidity to these people so that they can feed their families and hustle and do whatever it is that they do with their coins. The URL is N-O-O-N-E-S dot com, which is funny because the website also has 8-bit graphics. I think it's an interesting pun. And yes, 8-bit graphics. And they also have a spot exchange, a gift card, marketplace, a debit card if you're into that and you want to spend your coins.

[01:46:08] Vlad Costea: I'm not a big fan, but if you do like tapping your card every time you spend stuff, you can do that. And now they also have a marketplace for goods and services that you can actually check out. So it's No One's dot com. Thanks to all the sponsors for making this possible. Now let's get to another question concerning Halo and the fact that after you had that experience with the trusted setup and the possible inflation bug, which most likely was not exploited, you came up with Halo, which was the system to remove the trusted setup.

[01:46:45] Vlad Costea: You said previously that it was for you a way to make scaling more efficient and it had the side effects of also obsoleting the trusted setup. But I do want to know more details, and especially if you are a video gamer who played Halo because the next one was Halo 2. And to be honest, that's one of the best multiplayer games ever on the Xbox.

[01:47:09] Sean Bowe: Yes, I played Halo when I was younger. I didn't play Halo 2 that much. I played the first Halo a lot. I used to like mod Halo and stuff when I was a little kid. So I was a fan of that. That wasn't why we called it Halo, though. That wasn't even my idea to call it that. So, yeah, so like, just to be very specific, what Halo was, was it was a way to do this specific kind of thing in cryptography, which is to create these recursive proofs, recursive SNARKs, which are used in a lot of different blockchain projects, or I guess not very, it's actually not deployed in very many, actually.

[01:47:54] Sean Bowe: But it is a very useful, theoretic tool to solve certain kinds of bottlenecks. Like you can make succinct blockchains with them, or you can build the things in Tachyon, which I can talk about later, but essentially allows you to distribute a computation and incrementally verify it at the same time, such that you have this really short proof that attests to that entire computation. It's like SNARKs and steroids, basically, especially since you can take that proof, again, since it's a recursive, you can verify it and add more computations to it as you go.

[01:48:33] Sean Bowe: And the history of these proofs is that actually the people that founded, some of the scientists that founded Zcash actually were the first to develop like the formalisms behind how to build protocols with these, using these proofs, something called proof carrying data. But then also had created their own, had discovered their own way of actually implementing them, which is very tricky to do. You have to use these, at least at the time, you had to use these really gigantic elliptic curves that were pairing friendly at form cycles with each other.

[01:49:11] Sean Bowe: And there's this huge multiplicative blow up here and there throughout the protocol to figure out how to deal with these huge key sizes and everything. So it's totally impractical. And before we launched Zcash, there was a lot of things that we were looking at solving using these recursive proofs, like the problem I mentioned earlier about the nullifiers. I don't know if I mentioned the nullifiers, but the double spending problem where the state growth increases, which is the nullifier problem in Zcash. And that problem can be solved partially through these recursive proofs.

[01:49:44] Sean Bowe: And we knew this like way early on in the development of Zcash, probably even before I joined the project. But we also knew these recursive proofs were really expensive to create. And even if we could make them efficiently, like the protocol would have to be radically different in order to incorporate actual changes that made it practical to solve the problem. So we never really solved it then. And we spent years thinking about how to use recursive proofs. For scaling purposes, almost just to speculate how it could be possible to do it.

[01:50:18] Sean Bowe: And so there were some other teams that were working on recursive proofs at the time. And we were talking to some of them and trying to figure out how to do it ourselves more efficiently. And I guess just stumbled on this technique that allowed us to use normal smaller elliptic curves, like the one that's in Bitcoin or specially crafted variants of it, these cycles of Koblitz curves. And we figured this technique out and wrote this paper, Halo, that described it. And one of the consequences is that you could do these recursive proofs without a trusted setup for the first time.

[01:51:04] Sean Bowe: It was practical. Now, in theory, you probably could do it with existing cryptography, but it just would have been super expensive. I don't know exactly what the current performance is of recursive proofs that don't require these techniques that were in Halo today, but certainly for many, many years, the best way that you could do recursion was through these things called accumulation or folding schemes that are sort of formalized variants of the technique in Halo. So we posted Halo and there was this explosion of new papers in the field, probably like dozens of major papers that were based on Halo that came up with ways to do it even more efficiently in certain ways.

[01:51:50] Sean Bowe: But the same technique is just coming up with more clever ways to use it. So now recursive proofs are like a bog standard tool in any protocol designer, in any cryptographic protocol designer now. Certainly in Zcash, we don't consider that a bottleneck, like theoretically or practically. We can deploy and ship things with recursive proofs any day. So the question after that was, how do we use the recursive proofs in a practical way to solve the double spending bottleneck in Zcash? And that's where Tachyon gets involved and we can talk about that later.

[01:52:25] Sean Bowe: But yeah, that's the story of Halo essentially.

[01:52:30] Vlad Costea: Oh, sounds beautiful. But what it really accomplished was basically to remove the biggest criticism concerning Zcash. Like this trusted setup was the reason why some people did not take it seriously. And once you had Halo, I remember hearing Amir talk, you talk about Halo and he was mind blown like four years ago or something. He was like, man, you got to look into Halo. That's the top notch cryptography. It's the coolest stuff ever. He's also building his DarkFi using Halo 2.

[01:53:03] Sean Bowe: That's cool. Yeah, no, what it did was it sort of unlocked, again, these recursive proofs without having to do trusted setups because of this technique. It didn't require them basically. And that's a huge unlock because now we don't have to go, oh, OK, I can deal with the trusted setup if we can solve the scaling problem. Now we don't have any trusted setup problem that we have to even worry about theoretically. There's no performance advantages to the trusted setup now. There isn't. With these recursive proofs or any other parts of the crypto stack that have to do with pairings or anything like that, which we don't use those either anymore.

[01:53:41] Sean Bowe: So, yeah, it was a huge change in our thinking about how the protocol should be developed. And we integrated Halo into Zcash, specifically the parts of Halo, not the recursive part, but the parts that the recursion uses. These special elliptic curves and some of these other techniques and optimize the hell out of them so that we can actually bring them to users. And most users of Zcash right now that use the shielded transactions, they're using these Halo 2 proofs right now in Zcash, which don't require trusted setup.

[01:54:20] Sean Bowe: And that's really awesome. It's like a vibe shift in some ways. It helps dispel criticisms that we've gone over about the way it was set up. I mean, we use trusted setups because we had to. And now that we don't, we were not attached to them at all. We were willing to throw them out the second that we didn't need them, for sure.

[01:54:44] Vlad Costea: Yeah, it's really amazing. But it took you like, what, five years or something to get there?

[01:54:50] Sean Bowe: Yeah, I mean, well, we had a lot of other things going on, too. But yeah, probably less than that, actually. I mean, it was 2019. We posted late 2019. We posted Halo and we launched Zcash in 2016. So and then we had shipped a new version that improved the cryptography so you could run that on phones less than two years later.

[01:55:13] Vlad Costea: That was such a major stepping stone because the biggest criticism of Zcash was that you could only use shielded transactions on a computer. And you had to run the Node software or something, which is maybe computationally intensive and something that most people are not willing to do. But now you have possibly the best phone app ever with Zashi. Like it has all the features you would want. Hardware wallet integration. And this is not a paid ad or something. It's just me geeking about the features that you find there.

[01:55:45] Vlad Costea: You have a swapping integration. Basically, if you have Bitcoin or something else, you can swap that into Zashi into Zcash using Zashi. It's really amazing. And it's so simple the way it generates a new address without even telling you that it does that. The user experience is incredible and it optimizes for privacy. Sometimes if someone sends you Zcash from a non-shielded address, you just press one button and you shield it. That's what good user experience looks like.

[01:56:20] Sean Bowe: Yeah, huge props to the Electric Coin Company for shipping all those great features in Zashi. That's fantastic. That's my favorite crypto wallet to use at all. I get really frustrated when I use crypto wallets throughout the whole world just to see how each one does the UX a little differently. There's all sorts of clever ideas how we can improve Zashi by learning from other projects. But I get really frustrated when I use some of these other wallets. To their credit, they're not really trying to solve the privacy issues and Zashi is.

[01:56:56] Sean Bowe: And Zashi is being developed by people who actually care about privacy and are like cryptographic engineers and privacy experts. So they understand the privacy implications on the UX that users have to be exposed to. The number of concepts that users have to be exposed to and things like that. They understand that very intuitively and they think adversarially when they think of ways to improve the wallet. So it's a very stable, well-engineered wallet. It's very intuitive to use and it does protect your privacy. It's the thing between you and the protocol that makes sure that it's using the protocol right in a way that protects your privacy.

[01:57:35] Sean Bowe: It does a great job. I love it. I love Zashi.

[01:57:39] Vlad Costea: Yeah, I wish. So I do wish some of the software for macOS, for example, was updated. I tried to run a node on my Mac and I realized that the software is very old. And if I want to run the main, I'm not sure if there's a main or reference client, but I did find something on the Zcash website or the Electric Coin Company. But I would have to get a Linux machine if I want to take this seriously and I will probably do that.

[01:58:10] Vlad Costea: Just the ThinkBook. That would be nice. ThinkPad, not ThinkBook. ThinkPad. I mixed MacBook with ThinkPad and I said ThinkBook. I want to acknowledge at this point that we have more than 3500 people who tuned in so far for this stream. And thank you, guys. Really amazing. And I received more than 20 questions using shielded transactions. If you have a new question, just use this address below and type your inquiry and we're here to answer to whatever question you may have, as long as it's decent and not offensive.

[01:58:55] Vlad Costea: In any way.

[01:58:59] Vlad Costea: What else did I want to say? I think we're good for now. Halo 2. Like, what is the main difference between Halo and Halo 2? You said that there was like a two year difference between them.

[01:59:13] Sean Bowe: Well, yeah, so Halo is like a lot of things at the same time. And maybe we were kind of overloading the name Halo with the concepts that it represents. The main thing that I'm proud of with Halo is just the technique that we used and also applying it and coming up with a way to apply it in order to do recursive proofs without a trusted setup using standard curve cycles without pairings, basically, is the mouthful that I would use to describe that. Now, we never deployed the original Halo construction in Zcash because soon after the Halo paper was posted, or around the same time anyway, maybe just before, there was this explosion of new papers that came out.

[02:00:00] Sean Bowe: It was called SNARKtember. There's a bunch of papers that came out in September and October of 2019, I believe. And they proposed all sorts of new constructions and techniques for doing really efficient SNARK stuff, or SNARKs with different models, or how the assumptions and things like that for the cryptography. And so we needed to learn a lot from that. We wanted to deploy Halo cryptography into Zcash to learn from the experience of doing that. But we needed it to perform really well to compete with our existing proofs, so we had to incorporate those techniques into this new protocol we designed called Orchard.

[02:00:49] Sean Bowe: And we built a new thing called Halo 2, which implemented Plonk and a bunch of other stuff to do that, to incorporate all that cryptography that we intend to use for the recursive proofs, and that we still intend to use for Tachyon. And so a couple years later, we shipped Orchard, and that's what everyone's using now. So what we're hoping in this next evolution is to actually, what I'm hoping to do is to actually use the original Halo construction, not just the technique that's in the Halo paper, but actually it's actual SNARK construction that we used in the original protocol, while borrowing some of the ideas that have come out over the last five years or so from academia of how to make those constructions more efficient, and to sort of deploy the OG Halo protocol using the cryptography we shipped in Orchard into the next generation of the crypto stack with Tachyon.

[02:01:46] Sean Bowe: So that's sort of how I mentally see the evolution of things going forward.

[02:01:52] Vlad Costea: I also want to acknowledge that the price went up to $214, which is still lower than the 2021 high or the 2018 high, but still we're getting there. And I'm challenging people to do the dance on video because I told them it's going to hit $200 this week. They did not believe me, my Told You So tweet has 150 likes so far, and I'm getting more followers because of it. I don't want to be this guy who's calling the price. I'm just saying that nothing can stop a technology whose time has come.

[02:02:29] Vlad Costea: And it seems like a lot of people are waking up right now and realizing, well, this is exactly what we need in this time and age.

[02:02:38] Sean Bowe: Yeah, Like I said earlier, I don't like to celebrate too much about price changes. Or at least the way I put it the other day I posted on X, I said, I don't like being discouraged when the price is down and I don't like being distracted when the price is up. I also don't like premature celebration because we do have a long way to go to succeed as a project and as a mission for what we're trying to build for the world. And for the legacy we're trying to leave with Zcash.

[02:03:09] Sean Bowe: That being said, I mean, I do have a little smirk on my face when you mention the price changes because it's good for the project. It's also really good for the ZEC holders. And that's something a lot of other projects in the space sort of dismiss. I know in the Ethereum world, at least historically, they've sort of shied away from caring that much about whether the Ethereum is worth a lot or not. But if you believe in the technology and you're buying ZEC, especially when it's low and especially when the project's on life support and we're delivering and trying to make privacy better.

[02:03:45] Sean Bowe: And a lot of our technologies are being used by other projects now. The ZEC holders need to get something in exchange for doing the right thing, which is supporting privacy and supporting Zcash. And so the value of Zcash, of ZEC improving, is good for rewarding good behavior, pro-social behavior, like supporting privacy. So that's very good. I support that. And it's also like the engine that drives our project. If the value goes up, then we have more resources to hire more cryptographers and engineers to improve Zcash.

[02:04:24] Sean Bowe: And the people who are getting, the whales that are getting super rich off Zcash, especially the ones that just bought in and have been sitting with these heavy ZEC bags for years, aren't just sitting on the ZEC. They're thinking, how am I going to use this to make Zcash worth more? A smaller slice of a bigger pie, so to speak. So they're doing, there's a lot of philanthropy going on right now, and it's really good for the project. And so there's this feedback loop of positive developments and price is a huge portion of that, I think.

[02:05:02] Sean Bowe: I do sort of celebrate it quietly, and sometimes I do the dance, but I need to be careful not to celebrate. There is a lot more to do.

[02:05:17] Vlad Costea: This is something that's relevant for our conversation, because a week ago when the price started going up and it was trending towards $100, I don't think it even hit $100, but you tweeted that you are hiring more engineers to work on Tachyon. And I sort of reacted to that and said, you know, this is actually cool because as soon as there is more market demand for this, they are moving on and hiring people to work on something that's useful and meaningful. This is not something that you see immediately in Bitcoin, because in Bitcoin you have all of these suits who bought a lot of coins and after they get rich, sometimes if a developer wants to build something cool, they have to go and pitch it to these VCs or to Michael Saylor or Jack Dorsey or whatever and see if they can get funding.

[02:06:12] Vlad Costea: And it's slower, it's lesser efficient, and it also comes with some compromises in some cases. But what you guys are doing is more direct. Maybe it's a good side effect of or maybe it's the intended effect, not the side effect of this dev tax that you have, which is part of the protocol.

[02:06:35] Sean Bowe: Certainly, that's a component, especially historically, that's been important. I'd say right now, yeah, it's definitely important and going forward will be important, but actually a lot of development is taking place right now that has nothing to do with the so-called dev tax. I'm not working with dev tax resources. Shielded Labs isn't either. Those are two major parties in the development of Zcash right now. We're not taking money from the inflation schedule in order to fund the work that we're doing. We're all working with our own resources or with the resources of private donors who are ZEC holders who want Zcash to succeed, want privacy to succeed.

[02:07:20] Sean Bowe: They're long privacy and they're long Zcash too, and so it makes sense for them to fund development. I don't know why there's this cultural problem in the Bitcoin world about donation. I've heard this a lot where, I don't know, there's a lot of people who are in Bitcoin and this is just me speculating, but I think that they see Bitcoin like a progress bar to financial independence. And so maybe some of them are like 42%, like they could go off grid and they could buy an island or something in a few more years if the price goes up a little bit more.

[02:08:00] Sean Bowe: Maybe some of them are like 10% and they don't think about making Bitcoin more valuable. They just think about how do I get more Bitcoin and how do I get this progress bar to go further to the right? And you don't do that by spending your Bitcoin, which is a problem, and you also don't do it by donating it. And that's why there isn't really many people in Bitcoin compared to how many people own Bitcoin. There aren't very many people spending it on any, and it's a cultural thing because it's a, how do I, I don't want to work a low-wage McDonald's job someday, so I'm just going to buy Bitcoin.

[02:08:39] Sean Bowe: It's that sort of mentality that has its pluses and its minuses, but it does mean that there's this, there's a problem with the self-sustaining development and improvement of the project as a downside for sure.

[02:08:59] Vlad Costea: You also have a question that you received right now via a shielded message. Do you follow other privacy coin development? Did you ever get any insights or ideas from how other projects implement privacy solutions?

[02:09:14] Sean Bowe: I'm sure, yeah. The thing is, there aren't very many other projects. I mean, now that's changing, right? So, other teams are thinking about and prioritizing and caring about, at least publicly, in their cons. They're saying, oh, we really care about privacy because it's now, now it's a, now it's an important play, like it's an existential play for the industry. So, they care a lot, but there hasn't been very many projects that actually deployed privacy. I know you can think of some on the top of your head, but if you think about it, they're actually just deploying the stuff that we deployed in Zcash years ago, or the protocols that they're actually deploying.

[02:09:54] Sean Bowe: I know in Solana, they had something new that came out recently that was like confidential transactions built on top of Solana. That's an idea that's been around forever. Tornado cash is a, basically just an, is a fork of the cryptography from Sapling, like literally. Using just the curves that they needed to in order to make it work in Ethereum, but it's the same. It's the same protocol that we, and it uses the same hash functions we designed, all that stuff. There's nothing new there, architecturally. There's other projects that are, that haven't shipped yet that are working to improve privacy and add features.

[02:10:34] Sean Bowe: And there's some that have shipped that are still struggling. Yeah, there's just not many examples to draw inspiration from, unfortunately. And I think that'll change, hopefully, with this new renewed interest in privacy. Unfortunately, a lot of other projects make trade-offs in the privacy where they say, oh, let's make the privacy good enough for this trade-off. And so we can't learn much from them because they're making trade-offs with privacy. We don't do that with our on-chain network. On-chain privacy is as good as it gets.

[02:11:10] Sean Bowe: If anything, we're only trying to make it more quantum resistant. But other than that, it's as good as it gets. And it's been that good since our launch. We don't do upgrades in Zcash to improve the privacy, I like to say. We haven't done them before because our privacy was already ledger indistinguishability from the very beginning. So we improve things around the chain privacy and the network privacy and stuff. But we haven't really done that. We haven't really improved the actual on-chain privacy guarantees in the project.

[02:11:42] Sean Bowe: It's because we've been so strict about the maximalizing along the privacy dimension that a lot of trade-offs haven't been available to us, which has slowed us down on scale. But I think that we're making a lot of progress on that now with Tachyon.

[02:11:56] Vlad Costea: I do want to get to Tachyon, but I also want to touch upon quantum resistance and this idea that, as you mentioned, even if quantum computers become a reality, they will not be able to decrypt Zcash transactions. They are still indistinguishable. But in the case of Monero, for example, and I think about this a lot, the privacy is not permanent. It's perishable. When someone figures out a way to break the cryptography, anyone who holds a copy of a full node for the Monero network is going to be able to basically turn that into what we see today on Bitcoin, where you see all the transactions, where they went and which amount.

[02:12:40] Sean Bowe: Yeah, absolutely. The actual guarantees against quantum computers and Zcash is more nuanced than that. We've never actually went public and said officially as a project, we are quantum resistant, because it's in certain contexts we are. For example, in Zcash, unlike in Monero, in Zcash, the transaction graph is totally opaque, even to a quantum adversary. So, a thousand years from now, quantum computers take over the world. They still will not be able to break the anonymity properties of the protocol. It's completely zero knowledge, and that's something that the quantum computers can't break.

[02:13:19] Sean Bowe: There's other parts of the protocol that have similar kinds of guarantees. But for full quantum resistant privacy in Zcash, they actually need to be in the specific situation where your adversary doesn't have your payment address, more or less. And so, that's an obscure condition that might be common, might not be, I don't know. But it's an obscure condition that we wouldn't categorically tell people, oh, yeah, you're quantum resistant, you have quantum resistant privacy, as long as you don't give people, as long as your adversary doesn't have your address.

[02:13:57] Sean Bowe: That's such a weird and non-intuitive thing for us to do, or to claim. So, we've never claimed that. What we can do is actually make quantum resistant in all cases, for privacy. And that's what we're doing in Tachyon, actually, as sort of an accidental byproduct. Because we've designed the protocol so robustly against quantum adversaries at every step, that even this last component that we haven't quite made quantum resistant yet, once we do with Tachyon, we don't have to go through and change the whole design of the protocol, because we've been careful along the way to make sure that it is quantum resistant for privacy.

[02:14:41] Sean Bowe: So, that's where Zcash stands currently on the quantum stuff.

[02:14:46] Vlad Costea: Yeah, usually. So, let's imagine that I'm FluffyPony, he's gonna come here and say, well, but Zcash is not a serious privacy project, because it's not private by default. And most of the transactions are happening on exchanges or are happening with unshielded T addresses. And there's also this argument of the anonymity set. They say, well, if there are only 100 people using the shielded pool every day, then you have very low anonymity set, especially if people mention on Twitter that they sent a transaction. How would you reply to that?

[02:15:24] Sean Bowe: Well, I mean, these are not serious objections. I don't think they're actually serious at all. They're conflating absolute or concrete security with like, in the hypothetical, let's say there's only 100 people using shielded transactions, so you're not very anonymous. Yeah, if you have a protocol where only 100 people are using it, then you're not very anonymous. Sure. But the security guarantees of the transactions in it are separate from how many people are using it. In Zcash, we actually have way more than that, that have ever used the protocol.

[02:16:00] Sean Bowe: And if you do a shielded transaction, you're anonymized virtually through the whole history of that shielded pool. Whereas if you do the same thing in Monero, you're anonymized among a few other people in the transaction graph, which isn't anonymous at all and dies to set intersection attacks trivially. So there might be more people using a protocol that's crappier with privacy or has no privacy. That doesn't mean it's better with privacy just because it has a little like a little goofy situation where you might be a little private under ideal scenarios and circumstances.

[02:16:36] Sean Bowe: Versus a protocol where even if less people are using it, but you have more, you have a larger anonymity set, it's a totally different conversation. As for like, t-addrs, that also is sort of like, how many people use t-addrs doesn't affect your anonymity with shielded transactions in Zcash. There could be a trillion people using t-addrs and transparent transactions not even touching the shielded pool. And that would be irrelevant to your privacy and anonymity properties both concretely and theoretically in the shielded pool. Doesn't affect it at all.

[02:17:14] Sean Bowe: It doesn't. That's just how the cryptography works. So I like to think of t-addrs as like, imagine a lot of commerce took place on like a wrapped Zcash token that exists on like Ethereum or something. That's essentially what happened. If most Zcash transactions took place because people were trading it on Ethereum on some wrapped token or whatever, like some token that was bridged over to the Zcash blockchain. It would have the same consequences for privacy of shielded transactions on Zcash that the t-addrs have on Zcash.

[02:17:54] Sean Bowe: You might as well just think of them as t-addrs and transparent transactions as just being bridged tokens on a non-transparent blockchain. It's effectively the same implication for Zcash users. So any claim that related to the t-addrs has to overcome that obstacle, that sort of rhetorical and logical obstacle in order to be taken seriously is an argument in my opinion. So that's why these arguments are crafted that way. I think it is, again, disingenuous.

[02:18:32] Vlad Costea: Yeah, But it works, at least on Twitter. You have all of these accounts that go into your mention. They don't let you parade and celebrate too much because they're like, oh, but did you know that Zcash is this Israeli honeypot which has mostly transparent addresses and only poses as a privacy project? And there might be inflation, there might be this other thing, like you don't even know it's zero knowledge proofs. At least with Monero, you see that drug dealers are using it to sell pot on the dark web.

[02:19:04] Vlad Costea: And that's how you know that they put their liberty on the line to prove that the network works. And of course, there is no way for you to know that these are actual people who are dealing drugs and not feds just trying to collect data about who's using the stuff.

[02:19:22] Sean Bowe: Yeah, I don't know. All I can do as a technologist is just build good cryptography. And other cryptographers agree that what we've built is good, is actually great, is as good as it gets. And that the cryptography that some media on Twitter says that their stuff is better, and it's not. And all these cryptographers are saying, no, that's much worse. And that's really all I can do. Maybe other people can fight the narrative. In other ways, Zcash users can do that. Marketing people can do that. I just work on the best tech.

[02:19:55] Sean Bowe: The best tech is zero knowledge proofs, by far. But these arguments, like you were just mentioning with the darknet markets accepting, that's another disingenuous argument. In my opinion. The reason why the darknet markets accept Monero is mostly historical reasons, like that Monero is around before Zcash. And so all these darknet markets actually have huge XMR bags, and so do the dealers on them. And there's liquidity limitations with holding all this stuff. But also, these people also stand to benefit a lot from increases in Monero's price. That's probably even more potentially than the actual illegal commerce they're engaged in.

[02:20:47] Sean Bowe: And I think downstream of criminal enterprise and that sort of antisocial thinking about risk is zero-sum thinking. I mean, criminals engage in zero-sum thinking all the time. I mean, that's sort of like a property of criminal enterprise. So if Zcash succeeds, Monero is going to fail, or vice versa. It's just like when drug dealers are thinking about perf wars and things like that. It's the same thing. It's this very toxic and self-defeating attitude that is not a serious argument for why one particular privacy technology might be better than another.

[02:21:32] Sean Bowe: There's a lot of reasons that have nothing to do with whether the technology has better privacy or not. From an individual dealer on a darknet market's perspective, the risk of them going to jail for selling DMT to some kids or something is pretty low, all things considered.

[02:21:52] Sean Bowe: And drug dealers in general, their risk tolerance is negative. Their floor for risk tolerance is negative. Because criminals are opportunists, right? So they think, how much do I stand to benefit from the risk that I will go to jail for 20 years?

[02:22:13] Sean Bowe: It's not just the only factor is the technology. It's also what they stand to gain from it. And one of the things they stand to gain from it is the price of XMR increasing. And if their mentality is that the price increasing depends on other projects like Zcash failing, then that's the attitude they're going to have. And they're also going to have this sort of culture of celebrating criminality and also appeals to authority and other fallacious kind of arguments where you'd say, oh, well, the drug dealers are accepting XMR.

[02:22:48] Sean Bowe: So that must mean that it's the most private thing, which is not the only risk calculation that a criminal is making. It's not true. And if you doubt that, just ask yourself, does that make sense? Or how does it make sense that all the cryptographers in the world, essentially, all the reputable cryptographers are saying that the privacy stack in Monero, for example, is far worse? Why would they be saying that? And then you're believing the drug dealers and their opinions on cryptography? Well, yeah,

[02:23:23] Vlad Costea: But that's another appeal to authority, right? And usually these people dislike any kind of academics and they say, well, they're a bunch of soy boys and cucks who get paid by their governments and are under the paycheck of three letter agencies to say that Zcash is better than Monero. So no matter how deep you go in this argument and you try to dispel what they're saying, they're just going to resort to name calling and labeling you as something that they don't like.

[02:23:54] Sean Bowe: That's honestly, I mean, that's how they feel like engaging. That's OK. I mean, I don't think it makes them look serious and it prevents them from adapting and improving and like self-reflection. They make strategic mistakes all the time. Don't interrupt your enemy when they're making a mistake, I think kind of applies here. Not that I actually really consider Monero the true final boss of privacy. It's not at all. It's the state, it's an oppressive state that's trying to deprive us of our rights to financial privacy.

[02:24:32] Sean Bowe: That's the real adversary that I'm concerned about. Whether or not Monero succeeds at all, it can succeed and Zcash can succeed at the same time. That's totally fine. But if the Monero people want to engage like that, they can. All I can say is that I work on privacy tech. I'll let other people make arguments for their own projects, however it is that they want to. If they want to decline themselves, then that's their prerogative. But engaging with those kind of silly arguments and fallacious arguments and appeals to authority and name calling and all that kind of stuff is just lowering yourself to them and that's why I don't talk about Monero that much.

[02:25:14] Sean Bowe: I probably shouldn't even talk with them at all, but yeah, just my thoughts on the topic.

[02:25:22] Vlad Costea: I do understand that in the case of Monero, the brand, the name and the reputation of the project is much stronger than the privacy guarantees that it offers.

[02:25:34] Sean Bowe: Amongst some people, yeah, potentially, like terminals.

[02:25:39] Vlad Costea: To their credit, they did have, so usually when they lose the technical argument, they say, well, but Zcash is funded by this and this and look at the names on the Zerocash paper and look at the people who funded Zcash and the dev tax and everything and just think that Monero started from nothing, just a fork of a protocol that was dumped by the creator and had this unfair premine. And we decided to launch it fairly and it was bootstrapped organically and it was grassroots and I think this is the most merit that they have is that they bootstrapped this network by themselves voluntarily with minimal resources and they were able to keep it alive for such a long time.

[02:26:27] Sean Bowe: Yeah, this is the reason why I don't say that every single project, every project is different in this space. Monero has its advantages and disadvantages. I mean, unless our projects were exactly the same, which they aren't, you would have no competitive advantage if you were exactly the same, if you made the same trade-offs. And so some of the trade-offs and decisions and historic decisions and things like that Monero made or Zcash made appeal to different audiences and in Monero's case, they have this sort of origin story that they like.

[02:27:04] Sean Bowe: We have an interesting origin story as well. You can totally criticize and make fun of the Monero origin story if you try really hard, right? I mean, if you really steal mana, you can figure out a way to come up with, again, disingenuous criticisms of it if you try. You can do that to Zcash. All these Jewish people or Israeli people are building cryptography. I mean, that's silly because a lot of cryptographers are from Israel. And so that's just silly just in general, but I don't know.

[02:27:47] Sean Bowe: I don't like engaging with those ridiculous arguments. I kind of just lose brain cells thinking about it.

[02:27:54] Vlad Costea: And we would not want you to lose brain cells of all people.

[02:27:59] Sean Bowe: I only have a few left, so please, yes.

[02:28:03] Vlad Costea: Someone sent a shielded memo and said, is it a memo? Is it a message? I'm going to have to... It's a memo. It's a memo. He says, can you comment on network level privacy on Zcash, Tor, Freenet, I2P or something else? Does it even matter?

[02:28:23] Sean Bowe: Definitely matters. It totally matters.

[02:28:29] Sean Bowe: Our wallets, like Zashi, is starting to add all these features and they're integrating Tor into the wallet. And that's been a thing that's been going on for a long time now. I don't have very many opinions on the actual network privacy stack because research in that area is so foreign to the kind of cryptography and privacy research I do. There's so many active attacks that are different categories of attacks than the ones that I study, like more mathematical in nature. So it's really tricky. There's a lot of obfuscation and heuristics that you have to use in that sort of privacy world, which is why I don't have much of an opinion on it.

[02:29:17] Sean Bowe: It always makes me feel uncomfortable when you're using those kind of arguments because in Zcash, we actually get away with our on-chain privacy. It doesn't really need to think about those kinds of attacks because we can just work under this really simple umbrella of making transactions indistinguishable. But that being said, yeah, network privacy is very important for certain kinds of adversaries and for certain kinds of users and certain kinds of economic activity. We're making progress there. I don't have any particular thoughts, but there's a lot of technologies, mixnets and things like that, NIM, a lot of kind of stuff that is exciting.

[02:29:58] Sean Bowe: I'm not the guy to ask, really, but I think that is important. I can think of scenarios where your privacy might be on-chain perfect, but you can totally be targeted. And that needs to be resolved as well.

[02:30:14] Vlad Costea: Did you take a look at NIM, which is this project building a mixnet?

[02:30:20] Sean Bowe: Yeah, exactly. That's what immediately comes to mind is NIM, for example. And a lot of our thinking about payment protocols for Zcash, actually we take a step back and go, does NIM solve this problem? Does NIM like things? Do NIM like mixnets and things like that? Do those solve this particular problem without having to degrade the UX or whatever? And memos come into that as well because how are we going to send memos to a recipient in a scalable blockchain world where we need this highly available mechanism to communicate with the recipient?

[02:31:01] Sean Bowe: And that's one of the elements at Tachyon we can talk about where we need to do these communications out-of-band. And if we're doing them out-of-band, then we have to ask questions about things like mixnets and network privacy.

[02:31:20] Vlad Costea: I'm sort of bullish on NIM, but at the same time they do have to figure out some details about their setup. Right now they're selling their VPN subscription at a 90% discount and you can actually buy that with shielded Zcash. They implemented this using something that's called BTC pay, which works with shielded Zcash. Very interesting. And I wanted to take just a step back. I have more questions that I received as shielded messages, but I wanted to take a step back and reflect on what you said about zero-sum thinking and privacy and the fact that you have this warfare happening between projects.

[02:32:03] Vlad Costea: And maybe the obvious one in this conversation is Monero versus Zcash, but if you look at messaging you're going to see that there is Telegram versus Signal and there is no coin or token there to be pumped or there is no financial incentive. It's just people who believe that if they leverage geopolitics as supposedly Telegram does, then you are more censorship-resistant and potentially more private because the servers are in Russia and the NSA has a harder time collecting data from that supposedly. Maybe your computer is backdoored and compromised or your connection.

[02:32:41] Vlad Costea: Anyway, and then there are people who believe in cryptography and they use Signal and they say they would rather trust the cryptography assumptions of Signal than trust in the politics of Telegram. And if you take a step back even more, you're going to see that for mobile phone distributions of Android forks, which are hardened for security and privacy, you have CalixOS versus GrapheneOS. And these people don't get along at all. They fight and they're involved in flame wars all the time. And a few years ago I was involved in the battle between Samourai Wallet and Wasabi Wallet in Bitcoin.

[02:33:20] Vlad Costea: And I was on the Wasabi camp because I felt like these guys are actually paying cryptographers and engineers and people to actually push the boundaries of what is possible with this limited concept of a CoinJoin on Bitcoin, whereas Samourai were super kind of overconfident. They were saying, well, our product is already the best. We don't need to improve anything. If you don't like it, you're an idiot. If you think that this is a problem, that maybe you should learn how Bitcoin works, you're stupid, blah, blah, blah.

[02:33:50] Vlad Costea: Wasabi actually improved and were hiring researchers to write papers to make their software better, to improve their UX, which I think was a major stepping stone. And yeah, there's always, there seems to be two sides which are dominant in the field of privacy, and they don't seem to get along. And my theory about this is that there are a lot of Feds infiltrated and they stir the pot and they try to make it look like no product is good enough. So that normies who are watching this battle are going to be like, yeah, this is suboptimal.

[02:34:26] Vlad Costea: Maybe I should not get involved in this. Look, everything has trade offs I don't like. Maybe I should not use privacy at all.

[02:34:37] Sean Bowe: Yeah, I do think that's unfortunate and it is a trend. I've noticed that as well. I don't know why. I think maybe it's something to do with just the topic. Privacy is such a, you have to have paranoid thinking to defend yourself against assaults on your privacy in like every sense, politically, technologically and so on. And so I think that the kinds of people who are really passionate about a privacy technology are probably also like evangelists for it. And evangelism isn't necessarily zero-sum thinking, but it gets even worse, I guess, when there's money involved.

[02:35:17] Sean Bowe: So that's why you see a lot of tension in the cryptocurrency world when it comes to privacy projects feuding, probably. I don't really get the incentive and the motivation behind trying to tear privacy projects in like Android distros or messaging apps feuding with each other. But I don't really see a lot of, I think there's always one side that's right that I'm on the side of, even though I think there's always room for competition and people making different tradeoffs. The Signal people don't sit around all day like insulting the Telegram people, I've noticed.

[02:36:01] Sean Bowe: They just work on making their product better. And sometimes they make decisions that piss off people who really like Telegram. Why haven't you added this feature that's in Telegram? And the Signal folks are really disciplined in saying, no, we're not going to add that feature. I know you really like it. I know you're going to call Telegram much better and easier to use and stuff. But we have to add it right to the Signal. We have to do it for the right reasons. And I'm biased a little bit toward that.

[02:36:31] Sean Bowe: And also the cryptographers. Obviously, just the tech is better with Signal. Graphene OS, I really like Graphene OS a lot. I use it. I don't know that much about Calix OS or whatever it is that you mentioned. I know that community or there's other people in that world that hate Graphene and vice versa, maybe. I don't understand the point of that. But I think it is just paranoia and adversarial thinking that leads to that. Cryptographers fall into this problem when they think of... This happens a lot in protocol design with cryptographers.

[02:37:14] Sean Bowe: They think, oh, no, that assumption, that's unfalsifiable. So we can't depend on that, which is really stupid, I think. An early example would be in Zcash. We were going to rely on these really strong assumptions for our soundness of our protocol to prevent counterfeiting. But we didn't rely on strong assumptions for privacy. And there was this tendency for the cryptographic experts, not just that were working with us, but also people around us in academia, to be really skeptical of the assumptions we were using. Ones that are used all the time now.

[02:37:54] Sean Bowe: But if you think about it, it would be much, much worse if the privacy depended on these assumptions. The privacy in Zcash doesn't depend on a trusted setup. And it doesn't depend on... It never has. And we're totally okay with the protocol breaking. I mean, it's not good, but we're totally okay with it breaking as long as the privacy is okay. We maximize along that dimension, that risk trade-off. That's a pragmatic thinking about protocol design and adversarial thinking, I think. Because the alternative is that you don't have good privacy tech at all, but possibly.

[02:38:34] Sean Bowe: So there's a lot of traps that cryptographers and privacy experts fall in, and adversarial thinking, and just the mentality that's involved in designing these protocols. So I'm not surprised to see that stuff throughout the whole privacy ecosystem, but it is unfortunate.

[02:38:55] Vlad Costea: I'm just trying to delay the topic of Tachyon to get into more stuff. Because I feel like once we get into Tachyon, that's the main event. That's basically what people came to see, and I just keep pushing it. Hoping that right now we exceeded 4,000 viewers on the livestream, which is amazing. Thank you guys for joining. There's another question as a shielded message. And it says, is running a full node for an average home user a goal in Zcash? Is there a block size where that could happen at some point?

[02:39:29] Sean Bowe: I would love it if in Zcash someday you could run a full validating node, no matter how many transactions are taking place at Zcash. That would be awesome. When we get there, I don't know. But in some ways, the work that I'm doing with Tachyon and the work that not with Tachyon necessarily, but in future upgrades that use some of the same cryptographic techniques, we can actually incorporate changes that remove the bottlenecks that would prevent full nodes from being ran on just your laptop or your computer at home or something like that.

[02:40:03] Sean Bowe: I think there's probably still going to be some heavy constraints. But we should, I think, endeavor on making it as widely accessible to be a full node as possible in Zcash. So I totally think about that all the time. I think that's important, for sure.

[02:40:20] Vlad Costea: So what would you say are the system requirements to be able to run a fully validating node?

[02:40:26] Sean Bowe: Well, I mean, I run a fully validating node, but I have a beefy computer. I'm sure it would be more painful with crappier hardware, but doable. But it's hard to say that because we haven't really, we're not talking about how many people are using Zcash. If more people are using Zcash, are we going to, are we going to sacrifice the requirements or the permissive requirements for full nodes or not? Can we afford to with the cryptography that we have? Yeah, that's really tricky. And also, how do you compare the requirements?

[02:41:06] Sean Bowe: Like, the state growth problem is a separate kind of requirement, qualitatively different than a requirement of how much memory you need to have, or how much bandwidth you need to have for your internet connection to run a full node. It's hard to, it's hard to figure out exactly like, which of those metrics to optimize for. I don't know, I wouldn't, I wouldn't be able to just offhand give you numbers of like the requirements or anything like that. That's something that people have to think about. I just want to make them as low as I can.

[02:41:42] Sean Bowe: That's all I care about. Make the requirements as low as possible. And if there's a bottleneck in the cryptography that's causing the requirements to be higher than necessary, then I want to fix that. Whether it's, if it's in our cryptography, I'd like to fix that. If it's something that other teams in the blockchain space are fixing, they're in their own way, I feel like we should just take whatever the bad options are that other teams are using and use that Zcash for sure. I just want to make sure our privacy isn't sacrificed and we keep that rock solid.

[02:42:17] Sean Bowe: That's important.

[02:42:19] Vlad Costea: Yeah, there is other ZK technology, which is sort of a spinoff from Zcash and it's called STARKs. And they claim that—they don't claim, it's actually possible—that you can basically sync a full node just by validating this ZK proof. And also they claim to be quantum resistant and much more scalable than zk-SNARKs. It's also made by Eli Ben-Sasson, who is one of the authors of the Zerocash paper back in 2013. And some of these ideas were supposed to be available to Bitcoin. Now they're on Ethereum waiting for their day to also become available on Bitcoin.

[02:43:04] Vlad Costea: What do you think about zk-STARKs?

[02:43:05] Sean Bowe: I think STARKs are awesome. And I hope that they continue to be developed. Obviously, over the last several years, they've been developed primarily for scale. And they're using a lot of the techniques, especially the thing you just mentioned, that actually has to do with things like recursive proofs and stuff like that. To build these validators that can take a huge amount of computation and to verify it in a small amount of time with tiny proofs, no matter how big the computation is. That's I think what you're alluding to that they're doing with STARKs for some of the stuff they're building.

[02:43:45] Sean Bowe: And that's the same thing as the recursive proofs thing I was mentioning earlier. But in STARK-land, they're building this using cryptography that's lighter in some ways and doesn't require making hardness assumptions on problems that are not quantum resistant. They get the scale and they get the performance with the quantum resistance as a byproduct, it seems like, which is cool. That's awesome. I want them to keep developing that. And obviously, in the Bitcoin world, that's the best. If you could have no trust assumptions, quantum resistance, and really, really, really fast verification, that's awesome.

[02:44:38] Sean Bowe: And so that's what we're trying to do also, except we're a little bit more sensitive in Zcash to the proof size currently in our current architecture, and STARK proofs are much larger. So that's the real downside. And that could just be a temporary limitation of our architecture. We're overcoming bottlenecks that are more serious and working our way down to the less serious ones. I don't think it's STARKs. We want to integrate those in our current stack, but we're totally open to integrating whatever makes our protocol better.

[02:45:17] Sean Bowe: So I'm bullish on STARKs, for sure.

[02:45:21] Vlad Costea: Oh, that's so nice to see this ZK space supporting each project. Anyway, you got another shielded note. This guy is asking, what do you think about Nostr? Could you see Zcash being used for zaps at some point?

[02:45:38] Sean Bowe: I've never used Nostr before. I know of it, and it's cool and stuff. That's nice. I don't really have any idea. I wonder if this is being asked because there's something to do with the memos that has to do with the question. Do you think, maybe? Is that what part of the question is? No, I don't think so. In Nostr, basically

[02:46:04] Vlad Costea: Everything is public. So if you have the same asymmetric cryptography setup with a public key and a private key, everyone who's interacting with you can see the public key. And if they just paste the public key into the login screen, they can see even your DMs but only with whom you're talking. So not the content of the DMs, but they can see basically with whom you've been exchanging messages, what time and stuff like this. And also your feed, like what kind of stuff you're interested in.

[02:46:38] Sean Bowe: So it just sounds like a peer-to-peer social network that uses Bitcoin's public keys?

[02:46:46] Vlad Costea: No, it doesn't use the Bitcoin public keys. It uses kind of the same model for setting up an account. And it kind of sucks because if your account gets compromised, if someone gets access to your private key or you forget your private key, there is no recovery system. Like that account is gone, you have to start from scratch. Cool. You have to get your followers once again.

[02:47:11] Sean Bowe: I think that the question was paying for things with Nostr?

[02:47:19] Vlad Costea: So you have Zaps, which is a way to use the Lightning Network, mostly custodial, but this is the state of the network right now, to basically tip people for their posts. So if you like what they have posted or you like their idea, you can send an amount of Bitcoin to them.

[02:47:37] Sean Bowe: I would love to support Lightning invoice payments with Zashi. That would be really cool. Zashi has this feature called CrossPay for viewers that aren't aware, where you can take an address in Solana or Bitcoin or whatever address and you can send payments to it from Zashi. And what it will do is unshield your ZEC as necessary and then swap it using your intents and pay it out to the recipient on the chain that you're sending the payment on. Which is really cool because it keeps your entire transaction history private and detached from the economic activity that you're engaged in.

[02:48:22] Sean Bowe: So it keeps you nice and private and safe, but allows you still to transact with people on other blockchains. I don't think that there's support for Lightning invoices in that protocol, but it would be really cool if there was an intermediary or whatever that could handle the Lightning invoices for you. So you could pay those in ZEC with the CrossPay stuff. That would be really neat. Then you don't care, right? Who cares if NOSDR does anything or whatever. They could add Zcash support and use the same mechanism if they wanted to, to do this kind of CrossPay thing if they wanted into their apps or whatever.

[02:49:06] Vlad Costea: That's possible with what they call an LSP like Breez or Phoenix, which basically provides you the infrastructure for the channels and you just open the channels yourself with your own funds. And of course there's a bottleneck for scaling. Maybe that's Zashi can basically open the channels and let anyone send transactions to Bitcoin via Lightning. I'm not sure how this would work, if there would be a swap or even that there could be an atomic swap if this is optimized the right way. So it's trustless.

[02:49:41] Sean Bowe: Totally. I mean, yeah, the transaction on the Zcash chain can just do the same swap logic that the HTLCs or whatever and for the Lightning channels use. Yeah. [unclear: In theory]. That's kind of interesting.

[02:49:55] Vlad Costea: It could be amazing. But then again, Lightning has turned out to be a disappointment overall.

[02:50:01] Sean Bowe: Unfortunately, yes, it's cool. But then also, yeah, practically it has been.

[02:50:07] Vlad Costea: The only way in which it works well is when it's more centralized.

[02:50:15] Vlad Costea: My God, my notifications are so full right now. Anyway, someone wants to know, does shielded Zcash have a dust problem? For example, will Vlad have a problem sending a shielded transaction with all the small transactions from these questions? I don't think he understands. He thinks these are separate UTXOs, but I think that in the shielded pool, it sort of works like the account model, right?

[02:50:46] Sean Bowe: No, it doesn't. It will cost you money to, it will cost you more money to spend from any of those particular notes if they're smaller. So in that sense, I see what it means. Dust attack or whatever. Yeah, you have to pay per UTXO. Now, there are ways to solve that don't require an account model. Account models actually are really hard to make private. It depends on how the architecture works, but you can do like roll up spends of multiple transactions for sure. You're probably going to end up paying still somewhat proportional to how many notes you're spending.

[02:51:23] Sean Bowe: So every one of those transactions, if you're getting like one Zatoshi, if you want to spend it, if it's worth anything for you to spend, then you're going to have to pay to spend it probably more than it's worth, for sure. So I wouldn't consider those spendable notes in your wallet. And I wonder if Zatoshi actually just throws those in like a corner of your wallet and doesn't even consider them spendable, possibly.

[02:51:53] Vlad Costea: Yeah, I was thinking about this too when you mentioned the issue of quantum resistance and the fact that, for example, this QR code that I put right here on the screen, it's vulnerable to quantum attacks. So basically, if I wanted to take my, how should I put them, donations or whatever, they're small amounts. If I wanted them to not be stolen by a quantum computer in 30 years or something, then a good idea is to just send all the funds to another address. And I'm going to pay a high transaction fee, I think, for that.

[02:52:25] Vlad Costea: But at least that address is not leaked publicly, so I get much better security. It could be cool if there was just one button to do this, so you don't have to set it up yourself to do a self-transfer.

[02:52:38] Sean Bowe: There's this thing related to this that is being discussed and developed in the Zcash world right now amongst the protocol designers called the long-term storage pool, or a long-term storage pool, which is designed not for making payments, but for putting your money in long-term storage in such a way that, for one thing, it's quantum resistant. There's a simple protocol that allows you to thaw your frozen funds, maybe for price, but allows you to thaw them to get their money out into your hot wallet that uses some future shielded protocol, I'd say.

[02:53:21] Sean Bowe: And it's really easy to design these protocols when they're meant specifically for long-term storage and not payments, especially quite nice. So we've been thinking about how to incorporate that with some of our other protocol design trade-offs and things like that, especially with Tachyon. That's been an interesting point to consider.

[02:53:47] Vlad Costea: Okay, I think this is the last question before we move on to Tachyon. This person wants to know if you have looked at the Avalanche pre-consensus like eCash has implemented. Great for rapid finality that you expect from a digital cash.

[02:54:04] Sean Bowe: I'm just going to hand-wave this away. I'm not a consensus person. I really don't. I don't know. No clue. I do crypto, like cryptography. Consensus stuff is there's so many variables involved and so many trade-offs. I just trust experts that work on that stuff. Maybe Avalanche has got a good design. Maybe not. I don't know. I have no idea.

[02:54:37] Vlad Costea: Okay, now let's get to Tachyon, which uses something that's called, if I'm not mistaken, oblivious synchronization.

[02:54:45] Sean Bowe: Yeah, so this is really exciting. I was mentioning earlier that we had been working on using these recursive proofs to scale eCash, even way early on in the project, thinking of ways that we can solve problems like the double spending problem. How do we solve that with recursive proofs? And we knew that they were going to be incorporated somehow, but we didn't know exactly what the architecture would look like and whether it would be practical or not. And then with Halo, we made the proofs practical, but still we hadn't figured out the whole scheme.

[02:55:19] Sean Bowe: And after some development and going through some dead ends that didn't work, and some other teams actually had been thinking about the same problem and hadn't really gone anywhere, I was more open to some radical changes to the actual protocol itself that would make it so that we can prevent double spends in such a way that we can actually outsource the problem of creating these recursive proofs. And also outsource the bandwidth exposure of the user's wallet to the activity on chain to a third party. And this third party could construct the proofs and do all this stuff to solve the scaling issue with preventing the double spends.

[02:56:05] Sean Bowe: And can we do that in a way that makes the protocol private still, keeps it as private as it is today? And it turns out with some changes to the architecture, we can actually build this thing, which is called an oblivious synchronization service, which does exactly this. You don't trust the service. It doesn't learn about anything about your wallet. It doesn't even gain an advantage in distinguishing your transactions on chain from anyone else's. So it's totally trustless. And you're not married to this service at all. You can use any service that's willing to provide that for payment or whatever it is, however they're incentivized to do this.

[02:56:48] Sean Bowe: And they do all the hard work of making sure that your coins in your wallet are spendable because they haven't been spent before. And they send these proofs back to your client and your client kind of finishes the job a little bit. And validators, as a result, don't need to keep this list of all these objects called a nullifier that scales linearly with the number of transactions that ever take place in the protocol. They don't have to keep this list anymore. They can prune it continuously, which means that you can do something you can't do in Bitcoin and pretty much any other protocol, which is that validators can completely prune the state continuously.

[02:57:33] Sean Bowe: All shielded transactions in the Tachyon model can be pruned forever by fully validating nodes. They don't need them to verify new transactions, as long as these proofs are constructed by these syncing services that operate over the history of the blockchain. And the privacy model is strong. I mean, you could potentially do that already in some models, but it's hard to get the privacy right. This gets the privacy perfectly right. So that's the point in the trade-off space we've nailed with this design. That's why I'm really excited about it.

[02:58:11] Sean Bowe: And that's like the core component of Tachyon is building this part of the protocol. It requires actually changing the way that our zero-cash-based protocol in a shielded pool stuff works in some subtle ways. It changes the way that these so-called nullifiers work, but it's totally doable. It's totally doable. That's what I'm building.

[02:58:35] Vlad Costea: I think I've seen from this presentation that you attended last week a slide that said that you are expecting this to be shipped next year. And that you also believe that this launch is going to give Zcash enough time to be the leader for at least three years. You're going to be ahead.

[02:59:01] Sean Bowe: In some ways, we already are a leader. I mean, still. And shipping and privacy tech, we haven't compromised on that. But on scale, we're making the first jump, first major jump in a while on scale. And the architectural changes that are needed to solve this problem without sacrificing the privacy are so different and so non-intuitive to the way that a lot of projects in this space that are building privacy-based, like cryptocurrencies and layer twos and all that kind of stuff, it doesn't really work with their plans right now.

[02:59:43] Sean Bowe: And they're just trying to ship main nets, or they add ship main net, and they're trying to get customers and stuff like that. We're in a really good spot to actually invest in scaling research and deploy it into our protocol right now and make these massive architectural changes to the way the protocol works. We can do that while our system is functioning and while people are using it, which is awesome. That lead time is something we have to keep maintaining by shipping and building continuously.

[03:00:17] Sean Bowe: I really treasure that sort of lead time and that credibility that gives us also for having... We don't just talk about building things, we just continuously actually ship these things.

[03:00:35] Vlad Costea: This is something that I really respect and maybe it's also the reason why we see this massive pump right now. For many years, if not decades, we have had this concept where added privacy meant larger data size, larger signatures, larger everything, which requires more computation, more memory, more resources for everything. When you came up with Tachyon and I looked at the paper, I was like, this is like the grail of privacy, because it provides privacy that is scalable without significant compromises. We've had MimbleWimble, which was sort of similar in its scope, but it never really took off and the privacy guarantees of MimbleWimble are much weaker than those that you get from zk-SNARKs.

[03:01:32] Vlad Costea: To be honest, it feels so exciting when you think about it that from now on, once you ship Tachyon this argument that, well, privacy doesn't scale, it will not be part of the conversation anymore and it might just solve the trilemma, right?

[03:01:49] Sean Bowe: Yeah, I guess the nuanced view of what we've done is we've actually just removed the privacy. Yeah, like you said, the privacy doesn't scale argument doesn't work anymore. We are putting ourselves to be... The nuanced take is that we're putting ourselves in the same position that non-private chains are, where they're bandwidth constrained, latency constrained and all that kind of stuff. Our cryptography doesn't impose any, with Tachyon, doesn't impose any new bottlenecks on top of that in order to get the strong privacy guarantees that we have.

[03:02:24] Sean Bowe: That solves some sort of dilemma or trilemma in the design space by basically getting rid of the worst bottlenecks, but we're still going to have bottlenecks and scaling issues that could be solved with even better architectures maybe in the future or... And we can obviously leverage the work that's being done by other projects that don't even incorporate privacy into their product, into their blockchains or whatever. We can leverage those techniques now that we have the privacy at the ground layer and we can solve the other issues.

[03:03:00] Sean Bowe: I mean, that's kind of the advantage of the way that we've been developing Zcash is that we started with a very strong layer of privacy that we didn't want to compromise on and then we worked on scale on top of that and usability rather than doing it in the other direction where you build all these features and you scale them and you create a scalability architecture for your protocol, but then you want to add privacy on top. The only way to really do that without having to redesign the whole thing and blow up your entire product market and everything is to bolt on crappy privacy on top layers, on the top layers, on different pieces to plug leaks, which isn't how protocol engineers think about security and it definitely isn't how cryptographers think about privacy.

[03:03:42] Sean Bowe: The layers below will compromise the layers above and especially with privacy because you cannot undo damage when it comes to leaking private information you've done, metadata, et cetera. So, you need this stuff baked into both the fundamentally in the protocol and also pervasively through the protocol stack all the way up to the user experience in the wallets. And so, we've been doing that first and then thinking about scale, which puts us in yet another like a strategic advantage that we can take advantage of for like having a multi-year lead time on other projects.

[03:04:25] Vlad Costea: Where does this claim that it can scale to billions of users come from? Is there any actual test about it or is it just math?

[03:04:34] Sean Bowe: Well, in a sense, it is just math because there's no longer a actual like real cryptographic bottleneck in the zero-cash construction anymore. You don't need to scan the whole blockchain for your transactions. You don't need to – validators don't need to have this state growth that grows completely out of control, which has historically been like a reason why most projects are like, oh, we can't add privacy to our thing because if we do it strongly like Zcash does, then it just – the state growth blows out of proportion or there's other things too that they were concerned about.

[03:05:14] Sean Bowe: We've resolved all those problems over the years and now with Tachyon, this last problem in the cryptography scales great. So now there's not really an excuse for why privacy can't scale to billions of users. I mean, if privacy can't now, then nothing can, is the way I think about it. So if your project in this space and you think you can scale to billions of users, there's no reason that we can't. So it's math and it's just – it's also vibes too, those are important. Vibes.

[03:05:50] Vlad Costea: I've actually received a very cool transaction from someone who said, this is for your dust fee, thanks Vlad and Sean for doing what you're doing. And let's get to the Tachyon related questions. Is the Tachyon project an upgrade of the Orchard pool or is it a new privacy pool or neither?

[03:06:12] Sean Bowe: It's very likely to end up, I think probably 99% is going to end up as a separate pool than Orchard. So it's something that people have to upgrade to and there's some advantages and disadvantages of that and I think the advantages, having thought about it from both perspectives and kind of changed my mind a little bit throughout the process, making it its own separate pool is probably the best approach. It keeps the architecture simpler, there's fewer ways the privacy can get screwed up in order to support the legacy protocol during transition periods of the way the architecture works.

[03:06:50] Sean Bowe: So yeah, it's just simpler that it be its own pool and it's not, the downsides aren't really that bad, I think. One of the reasons why we've tried to shy away from building new shielded pools is because some of our photographers, including myself, have had this bias against introducing turnstiles because there's been this heavy cost the user has to pay. Usually it was in the form of new addresses or how does it work when I cross shielded pool boundaries when I'm making payments and stuff, but we've largely mitigated these in different ways with the way that our wallets work and the way that our addresses work and we're also just like really cognizant of that pain when we're developing payment protocols and so I think that we're in a good spot to make it so that this is like the least disruptive new shielded pool that we can introduce, hopefully.

[03:07:47] Sean Bowe: And it would be much better if adding new shielded pools didn't, it wasn't a scary process, it wasn't like, oh no, the users have to deal with another pool. Hopefully pools are not something, these shielded protocols within Zcash are not something that users have to care about and if you use Zashi right now, I don't even think you are exposed to the distinction between, at least in any of the UX that I've seen, that you're exposed to the distinction between like orchard and sapling, for example, they just look like addresses to wallet and your wallet just handles it.

[03:08:27] Sean Bowe: So hopefully we're in that spot.

[03:08:32] Vlad Costea: There's also someone who sort of asked the same questions, he said started late but did you say there will be a new pool for Tachyon, please ignore if you answered already, signed by Zecrimony. I just wanted to read this because he sent the transaction and I respect it. Okay, cool.

[03:08:51] Sean Bowe: I'll ignore it to answer yes.

[03:08:55] Vlad Costea: Once we get to deep dive into Tachyon, can Sean explain how moving the secret off-chain will retain the existing level privacy? Where will the secret be stored? How can we be sure it will stay private?

[03:09:08] Sean Bowe: So the secret thing that this person is talking about is this concept, this part of our protocol, which is the last part, by the way, that's not quantum resistant right now or quantum private, post-quantum private in our protocol right now is the way that the sender gives the recipient secrets they need to spend their money and the reason why those secrets even exist in the first place is because we need to make it so that the data that they need to spend is random, basically, or re-randomized, indistinguishable from everyone else's coins or notes, and so that's part of it, and so we also need to communicate some other things that aren't secrets that I can go into later, but communicating those secrets, to an extent the memos also are part of that, it's actually put into the same component of the transaction, the shilu transaction, distributing that to the recipient.

[03:10:10] Sean Bowe: It's really hard to do in a scalable way, not just the quantum stuff, but the scale that's the concern, and so we have a large number of options how to do payment protocols that don't involve what are called in-band secret distribution, where the actual transaction, the secrets are in the transaction itself that goes on the blockchain, which doesn't scale. And I don't think anyone has argued that we're going to be able to plausibly scale the protocol by putting ciphertext on the blockchain like that. So we're exploring the different UXs, and UX consequences for different payment protocols that don't rely on in-band secret distribution.

[03:11:00] Sean Bowe: That requires us to think about a whole host of other issues, like how viewing keys might or might not work, how wallet backups and restore functionality from chain history would or would not work, and how to replicate those behaviors and user expectations of features using a layer that it does scale or that is at least detached from the core protocol, the Zcash protocol, where the actual payments take place. There isn't necessarily a reason for most transactions for you to actually need to send these secrets over a global broadcast channel that archives all of the messages or all the ciphertext in a highly available storage space.

[03:11:50] Sean Bowe: There's no real need to do that. In fact, we have usually the complete opposite requirement, which is just that the sender and the receiver have a channel open already, and the sender can send a payment to the recipient on chain and can send all the secrets over their existing communication channel via signal or via NFC on their phone or QR codes or whatever. They're in person, so they can, in a lot of cases, they can do that. So there has to be some trade-off in between where we get really good UX, but then we also don't have the scaling problems, I think.

[03:12:26] Sean Bowe: I think we'll nail it. We'll figure it out. But that's more of a UX thing. And then a protocol thing. The core protocol definitely cannot scale and never will be able to scale if it has ciphertext attached to the transactions the way it is now. It just doesn't work.

[03:12:46] Vlad Costea: How will wallet syncing work with Tachyon? Will it need an outside server?

[03:12:52] Sean Bowe: Yeah, so syncing with this oblivious synchronization model for how it uses recursive proofs and proof carrying data and all that with remote servers, basically the user isn't exposed to the size of the chain or all the transactions and stuff that are taking place or have historically taken place. They can have a third-party server do that, not just for figuring out the money, how to prove that they can spend the money, but also to prove that they haven't spent it yet. They can defer that with this oblivious synchronization model to this remote service, and the remote service takes on all the bandwidth costs and computational costs, or most of the computational costs.

[03:13:31] Sean Bowe: And so the answer is that the scanning doesn't, to the extent that any kind of syncing takes place on the client, it's extremely cheap, and anything that would be expensive can be outsourced to a third-party that you don't trust. You don't have to trust them. They don't learn anything about your wallet. And to the extent that your client would normally need to scan the blockchain for incoming transactions with the payment protocol changing, the user also is not exposed to that cost, not nearly as much, because this, again, this in-band secret distribution stuff is being removed.

[03:14:12] Sean Bowe: So that is no longer really a concern either. I guess that hopefully answers the question.

[03:14:19] Vlad Costea: Yeah, I hope so, too. Is there anything about Tachyon that I did not ask you about and is super important?

[03:14:29] Sean Bowe: The last component, so there's three major components in Tachyon. There's the oblivious sync that we just talked about. There's the removal of the in-band distribution, which we all, the secret distribution, which we also talked about, payment protocol stuff. And the third part, which also comes hand in hand with this, is this other thing called shielded aggregation. And the idea is that if you have a bunch of shielded transactions in a block, you don't want to have the separate transactions that have to be validated independently or that take up independent space.

[03:15:03] Sean Bowe: And so just like with signature aggregation, we should be able to merge them together, more or less, so that the marginal size of them is considerably smaller than it is now or that it would be without in the absence of this feature. And also the verification time is, the marginal verification time is extremely small as well. And we can do that with, there's protocols that people have developed over the years to do that, which have different scalability trade-offs and complexity trade-offs. The best protocol, asymptotically speaking, would use recursive proofs, just like we're using with the oblivious syncing system.

[03:15:43] Sean Bowe: And so with recursive proofs, you just do exactly that. The block reducers block contains proofs that all the shielded transactions inside are valid. And all these components of the shielded transaction, the recursive proofs that are within each one of them, get folded together into this main shielded aggregate in the block, or one or more of them. And this makes the marginal cost of the, marginal size and verification time of the transactions comparable to Bitcoin-style transactions, which is great, without having to change the privacy model at all.

[03:16:26] Sean Bowe: That just, you know, that increases throughput, and that just, that really helps with scale as well. So, those are the three components, and they're all being designed in conjunction with each other because they rely on related either cryptographic primitives, like the recursive proofs, or related changes to the key structures or other kinds of changes to the protocol design. So, those three are happening at the same time in Tachyon, and they solve different problems, but pretty much all of the scaling problems they solve with the core cryptography.

[03:17:08] Vlad Costea: Another question says, is this Tachyon sync server just a Zcash full node or a different type of node running next to the Zcash full node?

[03:17:19] Sean Bowe: It's going to have to do stuff that a full node doesn't do, so I wouldn't say it's the same thing. It needs to probably be, well, I don't know if it necessarily needs to be a full node or anything like that. It does need to be exposed to all of the, or all of the pertinent contents of blocks, and needs to be able to read those as new blocks are produced, and then construct proofs about the stuff in those blocks that it can then reuse later to service requests from clients.

[03:17:54] Sean Bowe: So, yeah, the answer is that it's sort of, it's kind of like a service that's built on top of a full node, and that does extra computational work, and can amortize some of that computational work across many different wallets, more or less.

[03:18:15] Vlad Costea: I think it's super cool. How many people are currently working on Tachyon, and how many are you hiring?

[03:18:22] Sean Bowe: Oh, okay. So, there's a lot of people who are excited about it in the Zcash world, and I've had conversations with very in-depth technical protocol design conversations with people at the Electric Coin Company, and other people in the ecosystem that have their own thoughts on the UX and the cryptography. So, there's a lot of people that are thinking about it, and thinking especially of the implications on the wallet UX currently, but in terms of just pure protocol development, it's just been me so far until recently.

[03:18:56] Sean Bowe: I made one hire, Tal Dery, or Dery, and he started this month, and I am hiring at least one more Rust engineer, probably more than that, Rust engineer, to help also work on not just the cryptography, but also the integration work into the protocol itself. So, definitely, if anyone's interested in working on this, this is very exciting, novel stuff. That's very fun, and it's for a good cause, too. So, if you're interested, please reach out to me and see if you're a good fit for the team.

[03:19:41] Vlad Costea: So, how big of a team do you think that you need for shipping on time?

[03:19:46] Sean Bowe: For the protocol changes that I want to do over the next year with Tachyon, I think we could do with a team of like three or four engineers, and you don't have to be a genius cryptographer to do this stuff. It would be one thing if we were talking about… like, blue sky research that still needs to be done or whatever. We're not in that situation now. Like, the whole… it's obvious what cryptographic criminals we have to use. We just have to engineering design the integration with the protocol, which we've done like three times before in Zcash's history.

[03:20:23] Sean Bowe: So, we're just doing that again. And it just… it gets more complicated and more interesting, because that's how it always goes. So, yeah, I'm not really convinced that I need… a huge team to do this, nor do I… nor am I convinced that I need, like, genius SNARK experts. A lot of the SNARK stuff, actually, we've done the engineering and research and development of that already. Like, what we're going to deploy, likely in Tachyon, will just be based on the cryptography we designed six years ago, heavily, inspired by some recent developments, but more or less, it's the same thing.

[03:21:00] Sean Bowe: So, yeah, I'm not really needing a big team or… or a team of, like, academics or something. It's totally doable.

[03:21:13] Vlad Costea: It sounds nice. So, what's the ETA one year from now?

[03:21:19] Sean Bowe: Yeah, sometime next year, I would like to ship as early as possible, because there's always delays and stuff. So, the sooner that I get things out, the less… the more tolerant I am to delays and other problems that might be out of my control. Plus, you know, if we have to… renew… we have to deal with, like, auditing results that come back and say, oh, there's a flaw or whatever, security proofs that don't work or something, and we have to handle that as well. So, there needs to be… there needs to be a… an effort to really ship quickly, because if you don't have that kind of thinking, then you can't handle the inevitable delays.

[03:22:04] Sean Bowe: And so, I'm on a real fast-paced schedule right now, working on that. I'm working on this stuff. So, my… yeah, my ETA is to get this in the protocol next year. Now, getting it into the wallets after that is, like, I mean, it's something I'm going to be thinking about working on to an extent before shipping it into the protocol, for sure. But the wallet upgrade process, the UX changes and all that kind of stuff is… is going to… is going to be a slog, for sure, after the protocol is added.

[03:22:35] Sean Bowe: And that's been the case, also, with our previous shielded pools.

[03:22:43] Vlad Costea: Yeah, when I was doing some background research on you, I've been told that you have a superhero story, like an actual superhero backstory, and I was wondering what that is.

[03:22:57] Sean Bowe: It's a secret. It's a secret. It's not something I'm, like, super shamed of or anything like that. It probably gives me street cred, and it's probably, like, interesting and cool. I should be bragging about it, but I just don't… I don't like telling people about it or talking about it yet. But someday, I know that superhero backstory is alluded to a lot, but I'm just, like, I've been doing a lot of crazy crypto and hacking stuff since I was a kid. And so, I've done some things that I couldn't even believe.

[03:23:38] Sean Bowe: Now, I was looking back that I'd done pretty amazing stuff. I can't wait to brag about it someday, but I have too much to work on, and I don't want to be distracted. And that would definitely be a distraction to talk about.

[03:23:52] Vlad Costea: Okay. There was also a story about Greg Maxwell not citing you in a paper about ZK's stuff.

[03:24:04] Sean Bowe: No, I wouldn't… I'm not going to… I'm not going to play into that. I'm not… I don't feel aggrieved by Greg Maxwell. That's not a… that's not a concern for my… Other people may feel that way, but I don't… I don't feel that way.

[03:24:24] Vlad Costea: I also read the story about you explaining to a bunch of… I think they were from… what's the name… Polkadot. A bunch of cryptographers from Polkadot, and basically breaking down all the stuff related to ZK SNARKs and explaining it to them. And how they were all taking notes. And how a lot of them got jobs specifically because they had to study the stuff that you built.

[03:24:51] Sean Bowe: Yeah, I had this fun conversation with some of those people where they actually came afterward and put me aside and said, hey, the reason why I'm doing all this stuff is because of reading your code and working on this paper. And I was like, wow, that's really cool to leave a legacy like that. That's the kind of legacy I like to leave. Going forward, I'm hoping I'm actually contributing more to the next generation of really smart people that work on crypto tech and privacy tech. And encouraging them and motivating them and setting them up for success.

[03:25:28] Sean Bowe: Because they'll do far more than I would ever dream of. And that would be a much better legacy than me sitting around solving problems myself here and there every once in a while, every few years maybe. Making incremental improvements. I think there's a huge value unlocking getting more people involved. And so I'm really glad to hear stories like that. That's really cool. That's the smile base for sure.

[03:25:53] Vlad Costea: What was your username on Bitcoin talk? Because I've been told that you also have a pretty interesting activity there.

[03:26:01] Sean Bowe: Oh, if you if you search for it, and you find it, then you deserve this. You deserve it. I'm not gonna make it that easy. But yeah, I used to in high school years, or three highs through well, yeah, early high school years, I used to hang out, obviously, Bitcoin talk. And one of the things I did long time ago is I invested in one of those like early ASIC mining companies, actually, the first company that actually shipped a sick miners, butterfly labs. Before then, it was before butterfly labs were able to ship these, it was a Chinese company that I don't know, it found I think, or something like that.

[03:26:46] Sean Bowe: Maybe maybe it was supposed something else. But anyway, they shipped something called the ASIC miner block eruptor blade. And they were first to market their first the tape out, so to speak. And I bought an auction one of their I was like a shareholder in this company was really weird. They went, they went public on the Bitcoin talk forums, and to go like a ton of money to afford to do their tape out. They succeeded, and then pay dividends back on this like, shady pseudo securities market that existed, I forget what it was called.

[03:27:28] Sean Bowe: But they paid all their investors back and then some, which was really just crazy, because they were just some anonymous Chinese company. They're long gone now. But I invested in them, I actually have a Bitcoin miner right now. Let's see if I can swivel my I'll swivel my camera so you can see the Bitcoin miner. There it is. That's the ASIC miner that I bought a long time ago. But I bought it at auction because it was one of the first 10 that ever first 10 ASIC boards that had been produced for Bitcoin.

[03:28:09] Vlad Costea: Are you still working on Bitcoin stuff? Or are you still paying attention to the development?

[03:28:17] Sean Bowe: Well, not, I mean, I kind of pay attention, I'm not, I'm not too involved in it. I'm kind of pessimistic about that world, because it doesn't move quickly. And a lot of the people there don't feel like there is a need to because the Bitcoin price goes up without problems being resolved. So from their perspective, there isn't really an impetus to actually improve the tech and the privacy, especially., but but instead of being pessimistic, I wanted to like you had mentioned something earlier, way earlier in the podcast episode where you mentioned that you had been kind of pessimistic, especially with some of the debates about like the op return stuff and everything else that kind of made it was a little discouraging for you.

[03:29:02] Sean Bowe: , I'll leave, I think I'm gonna, I think I'm gonna call it quits on the episode. I'm getting a little getting a little tired. But I do want to leave with some optimistic notes. And one of them I want to leave is that Bitcoin does have a superpower, which is that it's extremely constrained. And that's not me just being like, I mean, I sincerely constraints breed creativity. And some of the clever things that are being built to overcome the constraints in Bitcoin are things that nobody would have thought of doing were not for the fact that those constraints existed.

[03:29:44] Sean Bowe: And some of those things like shielded CSV and the bit VM stuff and Glock and all the rest of this stuff that's been coming out over the last several years will be useful outside of those constraints eventually, I'm sure. And also will improve. And there's some really brilliant cryptographers working on all that, as you know, and so I'm really excited to see how things develop there. So I don't think Bitcoin is the end of the world for Bitcoin. There are benefits and there are downsides to the, like, ossification and to the restrictive nature of the consensus building in the community, in the tech stack.

[03:30:31] Sean Bowe: So I wouldn't count them out yet, but I certainly, from a personal perspective, we can execute way faster in a chain like Zcash. We can ship this tech years before other coins can, and obviously Bitcoin would probably never be able to ship some of the stuff that we shipped like 10 years ago. That's why I work on Zcash. That's why I believe in Zcash.

[03:30:57] Vlad Costea: Yeah, you mentioned that you want to go, but I do have one last question that I got as a shielded message. Can you talk more about the developers involved in Zcash in general? The GitHub has almost 500 contributors. Are they all part of the team? Who decides what gets accepted in the code? Who decides? Who repeats the question?

[03:31:23] Sean Bowe: Historically, the Zcash network has been built on top of this C++ node that was a fork of Bitcoin and called zcashd, and that was maintained by the Electric Coin Company, which I used to work for. And we've slowly been migrating to a Rust language implementation of Zcash called Zebra. And one of the goals there was just to be able to iterate quicker. And also the old legacy architecture we forked off from Bitcoin is really crummy. And it doesn't really correspond well with the kinds of changes we made.

[03:32:05] Sean Bowe: That's philosophies in the Bitcoin world, especially around soft forks and hard forks and things like that. We haven't entirely embraced those in Zcash, among other things. So a ground up rewrite of the Zcash protocol in Rust with Zebra is going to potentially unlock a lot of quick iteration and speed. And one of the ways it will do that is that there's going to be a lot of forks at the Zebra code base and people independently contributing their network upgrade code, different teams, and getting other teams to agree and getting the community at large to agree.

[03:32:45] Sean Bowe: And the question exactly how that governance works is there's other people thinking about that much more than I am, but it's a very widespread process that involves a lot of people and involves a lot of different signals from the community to decide whether things are considered like a legitimate improvement to the protocol that everyone's kind of consenting to. And there's always the threat that the coin will fork, that Zcash will fork. And this is something that we've embraced since the beginning. We call it friendly forks. So we want to help people fork Zcash and make competitors to us.

[03:33:24] Sean Bowe: If they think that our protocol is changing in ways they disagree with, or we try to fiddle with the parameters in some way, or they think they can execute better, or we're blocking the changes that they want to build, whatever, we totally embrace forks. And there's been many forks over the years in Zcash. None of them have really succeeded, but we definitely encourage them because they are the ultimate check on our project to make sure that we build consensus and then it gives users a way to exit in case they disagree with the progress we're making or disagree with the progress we're not making.

[03:34:04] Sean Bowe: So that's sort of my thinking. To answer the question about merging, well, I mean, there's different forks of Zebra. There's a zcashd repository. There's different kinds of full nodes you can run now. You don't really have to ask for permission to develop and improve Zcash, but getting everyone on board is much trickier. And it's not just one team and one developer. There's no benevolent dictator of Zcash currently and probably there won't be anytime soon.

[03:34:40] Vlad Costea: Thank you very much for your time and for everything. Thanks to everyone who asked questions using these shielded messages. It's very cool. But as you said, they're sort of bloating the blockchain.

[03:34:55] Sean Bowe: That doesn't mean they're bad. It just means that we need a different way to, it potentially just means that we need a different way to technically integrate that into the protocol than the way they're currently integrated. People really love those memos. They're really cool. They've been really fun throughout this episode.

[03:35:15] Vlad Costea: Yeah. And thanks to them, we've added 20 more of them to your turn pool. So basically we increased everyone's anonymity. Not by much, but it's something people look at. Like there's the Havano, I don't know what you call this. It's a peer-to-peer marketplace on Monero and he's hating in the comments right now. It says 95% of, he calls it Ztrash, transactions are completely traced. And if you think their niche Zashi wallet will fix their privacy, you didn't learn a damn thing during the lockdowns, clutch shot mandates and social distancing.

[03:35:57] Vlad Costea: The primrose path to non fungible hell is paved in Ztrash. This is harsh, man.

[03:36:08] Vlad Costea: I wish they actually listened.

[03:36:10] Sean Bowe: That person paid you to read that out or are they just talking crap on Twitter?

[03:36:14] Vlad Costea: No, they're just talking crap on Twitter.

[03:36:16] Sean Bowe: Oh, they got, you got to screw that. You need to at least add a little bit of civil resistance, a little bit at least to this. You need to accept Zcash only for chat.

[03:36:28] Vlad Costea: I mean, they did propagate this conspiracy that I'm sort of paid by the Electric Coin Company foundation—I don't even know at this point or that I'm on the payroll or something. And that's why I post so much about Zcash. But to me, it's super exciting that it's evolving. It's 100% compatible with Bitcoin. If Bitcoin ever decides to add privacy, this is the way. And this is the best way so far. There's also the Mimblewimble extension block that was shipped on Litecoin, but it doesn't offer the same privacy advantages.

[03:37:05] Vlad Costea: It's sort of weaker. It scales better, but it's not as powerful as zk-SNARKs. And I'm super excited about this. People come up with theories like, what the hell? Why is this guy talking about Zcash now? I was so right about the price. I did the zebra dance. There's going to be a short clip of that. I've asked someone to do it by tomorrow. And also, where was I going with this? I'm also getting a bit tired. Oh, yeah. Someone moved the goalpost. Some guy from the Monero camp and said, OK, it's sort of obvious that he's not on the payroll, but maybe he's receiving some anonymous donations or transactions from the Zcash team.

[03:37:48] Vlad Costea: And I was like, so did you just acknowledge that Zcash is anonymous? It's like, oh, no, I did not say that. Anyway, I just got paid with these small transactions that I received. This is more than I would ever expect. It's cool that it works like this. I wish Bitcoin had it. It was supposed to have it back in 2013. We never got it. Maybe this time. Who knows? Maybe if the price goes up to like a thousand dollars, Bitcoiners will stop shitting on it and pay attention to what's happening.

[03:38:23] Vlad Costea: And we have another debate and they're going to be like, hey, maybe we would not have this filter conversation if we couldn't know what's inside the transactions.

[03:38:36] Vlad Costea: I don't know. I'm just daydreaming right now.

[03:38:40] Sean Bowe: Let's hope. Let's hope for sure.

[03:38:42] Vlad Costea: Thank you very much, Sean. Where can people follow your progress with the work on Tachyon?

[03:38:48] Sean Bowe: For now, you know, I have my X account, ebfull, and my blog, seanbowe.com, which I'm going to be doing some posts on there soon about some recent developments, and then I'm setting up a Tachyon website, which is coming up soon. Be on the lookout for that. And I'm hiring, by the way. Reach out if you're interested and you like Rust. Like crypto and privacy.

[03:39:18] Vlad Costea: And for the record, this interview made the number go up by $14. So take that haters. Thank you guys for listening. Thank you, Sean, for your time, and I'll see you in the next one.