S17 E4: {ideal} BitVM Optimizations (Robin Linus, Liam Eagen, Ying Tong)

0:47Vlad CosteaWelcome to the Bitcoin Takeover Podcast. This is Season 17, Episode 4. This episode is sponsored by Braiins, Bitcoin.com News, LayerTwo Labs, NoOnes.com, and SideShift.ai. And we are live right now with the {ideal} team or the {ideal} group. Three people who decided to start a true revolution with BitVM. They already made it like a couple thousand times more efficient over the last couple of weeks. I saw the announcement. It's amazing. Liam Eagen, he's the genius cryptographer who has already been on the show. Robin Linus is the creative genius who came up with BitVM, which is one of the two reasons why I'm still optimistic about Bitcoin on the long term.

1:32And there's also Ying Tong, who is here, and she's part of the team. She's also a cryptographer, and it's her first time on the show. It's really good to have you guys.

1:43Robin LinusThanks for having us.

1:44Ying TongGood to have you.

1:46Vlad CosteaSo how did you come up with this concept of {ideal} group? What are you building and what's up with these brackets or accolades that you're using for the name?

2:04Liam EagenSo I guess I'll go. I've been working on the scheme Argo with Ying Tong for a while. I was previously at Alpen, and I left Alpen. We've been working on this new garbling scheme, and I think it's pretty cool. It is significantly better than the state of the art, as you said many thousand times better. And we think that this enables sort of better bridges, better BitVM garbled circuit style bridges. So that's what we're working on. We're working on shipping Argo and then building a bridge around it, basically. I don't know, Robin can speak to the brackets, maybe, around the name.

3:00Robin LinusYeah, so naming things is hard. So inventing the scheme was easy for Liam, but then finding a name and finding a domain was pretty hard. And we had like dozens of sessions and then took us forever to find a name. And then we thought some mathy pun would be funny. And in ring theory, there is a thing called ideal.

3:30And then we thought that's it. And then we thought maybe it's a bit too pretentious. So we added brackets to it. No, it's brackets ideal. It looks cool.

3:49Vlad CosteaIt's interesting because the brackets are also how you start and you end a program in C++. Did you think about that? Because C++ was the original programming language in which Bitcoin was written. And basically you put that like the beginning and the ending.

4:08Ying TongThat's why we put the brackets on it.

4:14Vlad CosteaOkay, it's a much easier explanation than saying, well, we search for a domain and tatata. But that's a very nerdy reference right there.

4:29Robin LinusBut that's okay.

4:33Vlad CosteaI'm sure that the right people will notice it. I'm curious how you guys were able to get funding. And Paul Sztorc actually has a question for you directly, Robin. Like how much did Michael Saylor pay you for this?

4:49Robin LinusYeah, we sold out to Michael Saylor. He loves Bitcoin updates so much. So he thought, hey, those are the right guys. We need to give him funding. So he gave us half of his Bitcoin and now we can do rocket research.

5:09Vlad CosteaRight. So how did you get funding for this? I know that David Bailey was offering a million dollars in any project that you guys or you specifically, Robin, might launch. Did you access that or did you find some other investor? Are you basically draining your coffers, your own savings?

5:28Robin LinusNo, we don't have any investors yet.

5:32Vlad CosteaOh, I understand. That's why you're here, right? You know who's listening to this.

5:41Robin LinusNo, we are actually not even raising right now.

5:46Liam EagenYeah, I think we would like to kind of bootstrap as much as is feasible. And so far that's worked out. I mean, who knows what the future holds, but we're, you know, I mean, we're only three people.

6:05Vlad CosteaYeah, but you three people were able to come up with something which is thousands of times better than what other teams are working on. I know, for example, that Rootstock were very capable and competent. They have a bunch of cryptographers. They came up with BitVMX, which is like their own version of the first iteration of BitVM. And as far as I know, it's not even close to the efficiency of what you guys are building. And I know that Alpen, the team that you, Liam, left recently, they were also working with garbled circuits and BitVM 3.

6:43And Citrea, they're also working with a version of BitVM 2. So you just pushed it to like a whole different level. How do you even do that? I know that Matt Corallo came up with like a 5% optimization in Bitcoin and what that led to was an inflation bug.

7:03Liam EagenI think that the garbled circuits for BitVM type protocols is kind of a unique problem that not a lot of other people have thought deeply about. Like this problem of privacy-free garbling a SNARK verifier is interesting, but I don't know that, at least as far as I'm aware, it wasn't something that a lot of people like in academia were thinking about. So when you encounter problems like that, and then coupled with the application, which was recently discovered, there's often like a lot of room for improvement, low-hanging fruit, so to speak.

7:47And our garbling scheme works quite differently from the kind of state-of-the-art that Alpen and Citrea and the BitVM Alliance are working with. And so by exploiting kind of the specific structure of the SNARK verifier, which is quite algebraic, you can build like a better garbling scheme that's just much more efficient than if you were working with a general circuit, which is usually the setting that people are working with with garbled circuit protocols.

8:25Vlad CosteaYeah, I was part of the Citrea ceremony, and that's why I have this construction hat helmet in the background. And I had one of their team members come here to Romania, and we basically ran the whole ceremony software, and then we destroyed the computer and we made a video about it. And when I asked him, why don't you guys just use the latest version of BitVM, he said that that would take them another year of just changing the code and going for another audit, which takes up to six months.

8:57And they would delay their launch for far too long. And I think it was Alpen that was the team that was supposedly going to work with the latest version of BitVM. But you guys just launched the version, which is so much better that I think that maybe they will not launch anytime soon. Like, do you ever think about the fact that entire teams are delaying their work because of you guys?

9:22Ying TongI think this concern about auditing is a real one. And the nice thing about our implementation is that it's really small. Like, it's 4000 lines of code. And because we don't break abstractions, we can make use of very popular and very widely audited cryptographic libraries for like finite field and elliptic curve primitives. And so I think in many ways, using a simpler implementation will save time on the audit.

10:10And furthermore, it's about defining interfaces that allow for easy integration. I think, really, to teams who are worried about switching costs, I don't think it will be that bad at all.

10:30Liam EagenYeah, I think if anything, using Argo is probably easier. Like even if you have started using the existing Yao stuff. Because like, the Yao table, Yao is a scheme that other people are using, like Alpen, the garbling scheme. The tables are like, I don't know the exact figure, I think like 40 to 50 gigabytes. And you need like, you know, 10 ish of them, and you need like one per operator per watchtower. And so it becomes like, huge amount of data to work with. And it poses like real engineering challenges.

11:08And I don't know, I think to the to your point, though, about like companies, they need to launch, right, like Citrea, Alpen, or anybody. And if you have a deadline, you do kind of have to take out at some point, even even in a really fast moving research space, like BitVM has been, and I don't know, I think it makes sense. But but yeah, it's, you know, clearly, there's been very, very large improvements consistently for the last year, two years. It's been two years now.

11:43Robin LinusYeah, almost three.

11:44Liam EagenOh, wow. Okay.

11:46Robin Linus'23 was the first paper. I also think currently it's quite a hassle for all these companies that everything is moving so fast, because they have to make these trade-offs between actually shipping and waiting for the next version. And I think that moved extremely fast in the last two, three years. But I think at some point, it's going to converge, like, now, like, we probably won't see another 1,000x, because you have to put some data on the blockchain, right? So you won't get away with no data. And it's already so... Liam is already thinking maybe there are optimizations.

12:31But yeah, I think like, at some point, it's just going to converge against them close to the minimum. And we are already close to it, like, the on-chain data has been, like, BitVM 1 was like a very long process with like, I don't know, up to 100 transactions or something. In the worst case, then BitVM 2 reduce the number of rounds, but the on-chain cost was quite expensive. And then like, with BitVM 3 garbled circuits, you could reduce the on-chain cost by, I don't know, by a factor of 1000 or something, such that you had to put only a few kilobytes on-chain.

13:12But with that Yao-style garbling, you still needed like, as Liam said, like, hundreds of gigabytes of off-chain data. And now with the most recent iteration with the Argo scheme, you also reduce the off-chain cost by 1,000x or something. And I think we are finally converging against something that is so efficient that we hopefully won't see like that breaking changes anymore.

13:44Vlad CosteaI mean, that's really good news. And I think if there are any companies interested in building L2s and raising money right now, I think there's still time to compete with Alpen and Citrea. If you're into that, you just use the latest version. I was gonna ask you, how would you define BitVM? Because I think a lot of people hear about it. A lot of them dismiss it outright. And they say it's Ethereum stuff, and they're not interested in it. And it should stay away from Bitcoin. But what is it? And what does it do?

14:21Robin LinusI think there are many explanations. But I guess you're asking for kind of like a high level explanation of people who don't know yet know it yet. And like, the best high level explanation is that it's a way to build bridges to bridge Bitcoin into other layers. And why, like many maxis are concerned is that they don't want to see these, like stuff, like applications that we see on Ethereum, for example, automated market makers and lending and borrowing protocols and stuff like that. But you can use it for any kinds of layer twos.

15:00And we, in particular, are interested in privacy protocols. And I think that is something that is pretty aligned with like the original cypherpunk ethos and what I think even the most hardcore maxis should appreciate in my eyes, because making Bitcoin more private and more scalable is fundamental to actually delivering on Bitcoin's promises.

15:32Vlad CosteaOkay, but so let me phrase this in a way that makes sense for the toxic maxis, who might not even listen to this, but I'm still trying. Anyway, how are automated market makers and lending protocols and all of these use cases good for Bitcoin? And why is it better to use something like BitVM to build L2s to bridge Bitcoin onto other layers, which benefit from the security of Bitcoin, as opposed to just bridging your Bitcoin to Ethereum using WBTC, which has a lot more liquidity, has all the applications, has everything out there just for using right now?

16:16Robin LinusYeah, my point was that even if you don't like these applications, there are still other applications enabled by bridges or by BitVM. And in particular, like second layer protocols that are able to give you better privacy and better scalability. Does that make sense?

16:38Vlad CosteaOf course it does. I'm just trying to get an answer for the people who might be very skeptical of anything BitVM related. I'm also curious if this research into BitVM is helping your Shielded Client-Side Validation project, which I know you're promoting like a couple of years ago with Jonas Nick.

17:02Liam EagenYeah, we're, we're very interested in working on that. We're focused on the bridge right now, or at least speaking for myself, I have been since the Shielded CSV work. Because it's sort of the missing piece, in my opinion, if you if you want to have a private transaction protocol that's as sort of trust minimized as possible, that uses Bitcoin, like the asset, you need some kind of bridge. And so but but yeah, I mean, I think that, like Robin was saying that the BitVM work kind of converges into this direction that we're pursuing, we would really like to deploy Shielded CSV, or some, you know, revision, like, updated version, I don't know, I mean, I've been thinking about it.

17:53In the, in the time since publication, yeah, like that's, we want to do that very much. So and I think there's been a lot of really interesting development in like related protocols, like, I don't know, I'm personally very interested in the Tachyon work from Sean Bowe and Zcash folks. And there's also like PlasmaFold, and Intmax, and some other papers on these types of schemes. And so, yeah, yeah, we very much want to build the best possible bridge, and then, like the Shielded CSV layer that bridges to

18:34Robin LinusAnd maybe to answer the high level question, like, that's our focus, like, we are not building BitVM for the sake of BitVM. And we are not building it to like, bring Ethereum to Bitcoin. Our focus is definitely to make Bitcoin more scalable and more private and more cypherpunk in the end.

18:54Vlad CosteaAnd I think the whole appeal of BitVM, which some people would describe as a hacky way of adding Bitcoin upgrades, is that you don't have to wait for soft forks. A lot of the builders in the space, they're waiting for one soft fork to activate. But on the other hand, am I wrong when I say that BitVM could be made much more powerful if there was some sort of covenant soft fork? Because some people see BitVM as the argument against adding any soft fork at all. And they will say, well, we can ossify right now. And these smart people will figure out ways to do stuff.

19:37Robin LinusYeah, I don't think that's a good idea. I mean, eventually, Liam will figure out how we solve witness encryption. Maybe he already announced that.

19:52Liam EagenI think I've got indistinguishability obfuscation. Yeah, I think, I don't know, I kind of see it the other way, but like BitVM is kind of a proof that you can kind of do the sorts of things that you would be able to do with a more like, I don't know, clean solution via soft forks. And therefore, the argument against kind of doing it the right way, like activating a SNARK verifier or something like that becomes weaker. Because if you can already do it, then you're not, there's no benefit in not activating the change.

20:38I mean, I personally would like to see the ability to verify SNARKs on Bitcoin for many reasons, but one of them is just to like kind of build the bridge the right way. And yeah, it's the only way to enable privacy. I mean, like some variants of this, at least, but and I think that we should do that.

21:05Ying TongI think as a newcomer to the BitVM design space, there's many aspects of it that are not satisfactory. Like, so we call it a trust-reduced design because there's a trusted set of signers. Depending on your bridge design, there's like permissioned operators, permissioned watchtowers, there's limits on how many parties can take part in ensuring the security of this bridge. So I feel like it is in no way equivalent to just directly verifying SNARKs on Bitcoin.

21:42Liam EagenAnd it also like that has a like real impact. Like if you want to build, there is like a significant difference between a SNARK that's like verified as part of consensus and a bridge that has permissioned operators in the sense that the permissioned operators have potentially legal liability there. They can be like targeted, whereas like if you could just have a SNARK, it would be very different. So I think there are certain kinds of applications that are really hard to build with BitVM style bridge. I mean, we're trying as best as possible to like support as many operators as possible to make it as trust minimized as feasible, but it's not the ideal solution. Right.

22:33Vlad CosteaSo what would be the ideal solution? Like if in this perfect world where you get what you want, what would you want Bitcoin to have?

22:44Liam EagenI mean, I don't know. I'm not like, I'm not sure exactly, but I think that the version that makes the most sense to me right now is opcodes for field arithmetic so that people can write SNARK verifiers. You can write a STARK verifier, you could write a Groth verifier, whatever you want. It doesn't incur the like maintenance burden for Bitcoin Core developers to like enshrine a SNARK verifier. There's no bikeshedding. People just kind of do what they want. And if you had this, you could do a SNARK verifier, be expensive, but it would work. And I think that's the thing. Yeah, I think that makes sense.

23:33Robin LinusYou need transaction introspection as well. Well, some sort of covenant, like arithmetic are not quite enough.

23:42Liam EagenI mean, I think with sufficiently large field arithmetic, you can simulate CAT. So it's, but yeah, yeah.

23:51Robin LinusSomething clean, you would need a very big field arithmetic because like the entire transaction would have to fit into your field, I think.

23:59Vlad CosteaRight. So by field arithmetic, you mean operations opcodes, like OP_MUL or something, which allows you to multiply.

24:08Liam EagenYeah. I mean, there's a lot of abstraction. Like you can start, even if you just had 32 bit integer multiplication, everything would be very different. But I mean, like a multiplication modulo a prime number. So, you know, for like Stwo, they use the prime two to the 31 minus one. So you just want to be able to say, like, add two things, mod this value, multiply two things, mod this value, that kind of thing.

24:38Vlad CosteaOh, so basically what Bitcoin Cash already has, right?

24:43Liam EagenI don't know.

24:44Robin LinusYeah, I think, yeah.

24:47Vlad CosteaThey restored all the Satoshi opcodes.

24:50Robin LinusYeah, stuff like that is discussed in Bitcoin as well, like Great Script Restoration. That would get us pretty far. They also wanted to re-enable arbitrary integer arithmetic, sorry, arbitrary precision integer arithmetic. But I think the ideal solution at the moment would be to enable Simplicity with a bunch of jets for field arithmetic. The thing that Blockstream is working on that has been activated on Liquid last year.

25:31Vlad CosteaThat's interesting. I've had Andrew Poelstra on the show two years ago, and he was saying that we should activate OP_CAT. And then I had him again, like a few months ago, still in 2025. And he was a big fan of Simplicity. But at the same time, he was arguing that it's too early for Bitcoin to activate it. They just put it on Liquid and they need to play with it for a while before they think it's safe for Bitcoin.

26:00Robin LinusIt would be a big upgrade for sure. But you asked for the ideal solution. So, yeah, I think it wouldn't be realistic to, yeah, maybe, I don't know. If a lot of people would spend a lot of time on it, maybe we could do it much faster. But currently it's just a few people on Blockstream research team. And I guess it needs to, how do you say, like stew for a while until it can be considered safe for mainnet activation.

26:36Vlad CosteaOkay, I have a question, another question from Paul Sztorc, and he wants to know what's your favorite Michael Saylor analogy. But in the meantime, I'll let you guys think. And I promised people that I'm going to become a millionaire this year, if not in dollars, at least in number of podcast downloads. Because I was very close last year, I got like half of a million. So I'm going to show some ads and let you think about favorite Saylor analogies. Braiins, the first Bitcoin company, which is also producing the Bitcoin Mini Miner BMM 101, which I have right here in the box unsealed because it's more valuable.

27:11Anyway, you can buy this with promo code BTCTKVR and you get 5% off. But they also realize that these hobbyist mining devices are sort of obsolete. And most people don't find them convenient. So they launched a new service last week, which is called no, it was actually this week. It's still Friday. The week is not over. It's called Hashpower. The URL is hashpower.braiins.com. And you can basically rent the equivalent of 1,000 Bitaxes or BMM or these tiny home miners for like $5 per hour.

27:49And you can consider this your lottery ticket. And it doesn't require you to actually hold the hardware in your home. It doesn't make your electricity bills more expensive. You can also use it for other creative projects like trying to mine BSV or BCH for whatever reason. Like I'm not saying you should get to 51%, but you can if you want. I don't know. You can try. It's up to you. Hashpower.braiins.com. Also, there is NoOnes.com, which is trying to end the financial apartheid. Their mission is to empower the global citizens of the global south.

28:25And whenever you trade on NoOnes, you're giving them liquidity that they can use for various reasons, mostly hustling and trying to get as much Bitcoin. And I think they also have stablecoins and stuff into the hands of locals who are dealing with hyperinflation and broken economies. They have a peer-to-peer marketplace. They have a swapping service. They have a spot market. They have a debit card for spending. I'm sure no matter what you're into, you'll find something useful on NoOnes. And the fact that there is a humanitarian mission on top of it only makes it more interesting.

29:02So NoOnes.com is the URL. And last but not least, to make Paul happy, LayerTwo Labs. They have their software, which is ready for testing. It's on layertwolabs.com/download. And you can go today and try the drivechains. They're running on a proprietary version of the Bitcoin signet. They have an Ethereum sidechain. They have a Zcash sidechain. They have a Namecoin sidechain. And a lot of interesting experiments. Check it out and also join their Telegram group, which is called Drivechain Talk. This is it for now. Now, guys, tell me your favorite Saylor analogies. There is no second best.

29:48Liam EagenI was going to say that that's the only Saylor quote I think I know off the top of my head. I don't know.

29:56Robin LinusBitcoin is a city burning in cyberspace or something like that.

30:00Liam EagenOh, wait. Oh, oh. Oh, yeah. No, I know what you're talking about now. I just don't recall any of them specifically, but yeah.

30:17Robin LinusI think someone should finally vibe code like Paul Sztorc's startup idea, which is like a game where you get, you get shown like a quote and you have to guess if it's a real quote from Michael Saylor or something that Paul Sztorc made up to make fun of Michael Saylor.

30:39Vlad CosteaOkay, I love Paul, but that's a bit, that's a bit too much. I don't think I would go to that length with vibe coding. But anyway, nothing about the hive mind or the fact that we are basically expending digital energy, triple maxi stuff. Like, did you guys even know what's a triple maxi?

31:10Liam EagenI saw, I saw this, wait, this was his thing at the Bitcoin conference last year, I think. Right? Isn't that like a quadruple maxi too? Or did I make that up?

31:22Vlad CosteaNo, there is the triple maxi, which is like the highest level.

31:25Robin LinusLike leverage all your assets, but also move into a jurisdiction where you get like tax benefits or something.

31:34Liam EagenOh, all right.

31:38Robin LinusYeah, I find stuff like that extremely scary, to be honest. I think that's extremely far away from what excites me about Bitcoin. I think Bitcoin is not something that you should have like in the basement of Coinbase, something that you should hold yourself, like the entire concept of using it as a money and self-custody and permissionlessness and privacy and all this stuff. It's not very valued by the suitcoiners. And I think it distracts us from the actual thing that makes Bitcoin worthy.

32:15Vlad CosteaI actually wrote an article about this and I sent it to Robin and you told me that you disagree with me on some points. But basically, in 1964, Bob Dylan wrote the song My Back Pages, which was like his exit from the civil rights movement, where he was feeling like he's being used and he sort of mocked the whole movement. And I feel like this article of mine is kind of the same, like I'm pointing out to some of the holes that I observed in Bitcoin maximalism.

32:46And next week, I'm also going to have Paul Sztorc on the show and we're going to talk about his article, which is called Derangements of Bitcoin Maximalism. I think it's very interesting. And for a long time, we had these stories like, oh, if you're pure and you spend all of your disposable income to buy Bitcoin and you mortgage your house to buy more Bitcoin and whatever, you're going to be rewarded with the ETF, which is something that only Bitcoin can get, because only Bitcoin is a digital commodity and everything else is an unregistered security.

33:19And once we get the ETF, we're going to get to $1 million and the bankers will knock at your door with loads of cash saying, please sell me just a little bit of your Bitcoin because I want that. No, how can you not sell it to me? Look, I'll double the cash amount. You can have everything you want for that 0.1 Bitcoin that you have. You're going to have a yacht and private jet. You're going to live in this mansion. And you had all of these derangement stories of people having all the wrong expectations about on one hand, hyperinflation and the other hand demand for actual Bitcoin.

33:55And then you had the institutions that realized, okay, we don't need to do any of that. We're dealing with paper. We're experts in paper. We can print paper. We can sell paper. And I think most of the reason why we never went to the expected million dollars per Bitcoin is just that we were dealing with paper. There wasn't much activity specifically on the exchanges. There wasn't much activity on-chain. It was just these institutions moving amounts that may not even exist.

34:32Robin LinusYeah, I agree with that critique that the more it goes in that direction, the more we just reinvent what we have with gold or with like just other things that you end up with like inflated things. So like with IOUs and they can be printed out of thin air and that dilutes the entire value proposition of Bitcoin. It's just not Bitcoin anymore. And people getting so excited about these things is a bit weird. Michael Saylor likes to say, yeah, we agree on like 99% of the fundamentals or something, but that 1% of like not having an IOU, but actually having the coin, like actually self-custodying the asset and using it as money.

35:19I think that 1% of difference in worldview is pretty important. And I think we should emphasize that more. And I think it's important to.

35:34Yeah, I think like from from our side, it's also important to not get cynical and like not get too depressed by the success of the suitcoiners that do their thing. And they just do the things that the way they are used to do the things right to have ETFs and stuff like that. I think it shouldn't make us cynical, even if it's distracting a lot of the community. I think it's important that the people who still have the original values stay positive and act.

36:10Do what they can do and be excited about doing the stuff that is possible and pushing the frontier of what we can do.

36:25Vlad CosteaWhat I want to add is that 1% difference to which Michael Saylor refers is like 99% of the purpose of Bitcoin. Holding your coins in self-custody and dealing with people peer-to-peer, not going to trust the third parties or legal entities or whatever to transfer your Bitcoin.

36:45Liam EagenIt's sort of the whole point.

36:46Ying TongDo it privately, because without privacy you can be tracked, you can be censored, you can be just excluded in many ways. And that's not truly free peer-to-peer money if it can be censored.

37:09Liam EagenYou can't have fungibility without privacy.

37:12Vlad CosteaPlus, there is also even if people disagree with this and they're like, I don't need privacy, I'm fine with the open ledger. It's important for Bitcoin to be censorship resistant at the protocol level. So if the miners can decide that this transaction is not fine and there is like a large percentage of the mining pools that decide that the transaction should not get added. You can actually have transactions that pay a large fee, but they sit in the mempool for many days or months until you have this tiny miner that picks it up.

37:47So the reason why we do refer to Bitcoin as being censorship resistant today is that there is a game theory that incentivizes miners to pick up any transaction if it pays the right fee. But if there is political enforcement over what the miners are doing and there are treaties or laws that tell them what they can mine and what they cannot. There's going to be discrimination, which is going to lead to maybe normal citizens of let's pick a country that's outside of the regular U.S. Enforcement.

38:22Let's say Iran. Okay, someone from Iran wants to send a Bitcoin transaction. They're going to get stuck for many days because it's not going to get picked up by the American miners.

38:34Ying TongAnd the only true defense against this is for the miners to not be able to discriminate, not be able to distinguish one transaction from another. And this is an argument that Peter Van Valkenburgh from Coin Center put forth. So he has this concept of dumb pipes where it's not that the miners are censoring certain transactions, it's that they cannot even see the content of the transactions and they're unable to make the choice of what to censor, regardless of their beliefs, regardless of their jurisdiction, they are simply unable, unaware and just incapable of censoring.

39:23So I do think that is the only true privacy. The only true defense against censorship is just ignorance.

39:36Vlad CosteaThat's beautiful. I've been saying for a while that the only way to make Bitcoin private without actually improving Bitcoin is to stop looking at looking at the blockchain, like to tell everyone, stop looking at the blockchain.

39:49Ying TongRight. Right. Yeah.

39:51Vlad CosteaBut that's not going to happen.

39:53Ying TongWell, then you have to encrypt everything you put on there, basically.

39:59Vlad CosteaBut I remember reading when Sergio Lerner, who is also the creator of Rootstock, he did that Satoshi research when he was the first one to come up with this theory that Satoshi mined 1 million Bitcoin. And when he published it on BitcoinTalk, people were very aggressive, saying, wait a second, you're not supposed to look at the blockchain, you shouldn't do that. You're destroying, like the privacy of Bitcoin. And he was arguing, there is no privacy to speak of, but it's just that at the time, the resources or the tools to look at the blockchain were limited. So you needed to have some sort of technical expertise.

40:40Ying TongYou wouldn't, you wouldn't right-click a web page, would you?

40:47Vlad CosteaSo how do you think Bitcoin could add privacy? Like, is there anything that you like or prefer in terms of achieving this?

41:00Liam EagenI mean, I don't know, maybe I'm biased, but I like the Shielded CSV kind of idea. The not putting proofs on-chain, I think is very compelling from like a scalability and block space efficiency point of view. Of course, Shielded CSV by itself, like we said earlier, isn't enough to add privacy to Bitcoin. It's just sort of a meta protocol. So you need a bridge either via a SNARK verifier, or maybe via some BitVM thing. So I think that's my preferred. I mean, I Yeah, that's my preferred way to add privacy.

41:47Ying TongAnd this is only going to work if there's enough adoption, meaning there's a large enough anonymity set. So if you're the only person using a Shielded CSV, then every action on there is obviously just you. And if there's no other exchanges, no other economic activity, just no other users transacting on there, then there is no anonymity set. So, yeah, I think a meta protocol that is widely adopted. And that is useful enough to be widely adopted.

42:37Vlad CosteaWhat about you, Robin, do you like confidential transactions?

42:43Robin LinusNo, I'm, of course, also a big fan of Shielded CSV. Like the key idea behind it is to use the blockchain for what the blockchain is good for, which is an immutable ordering of commitments to prevent double spending. And that's the only thing that you actually need a global consensus on and everything else can be validated on the client side by the recipient, because the recipient, they have an incentive to actually validate all the consensus rules of the coin that they received to be sure that the coin actually carries real value, and that they can can convince the next person that this coin has a valid history.

43:23The only thing that you cannot verify on the client side is that no double spending occurred. And that's what you need the blockchain for. And for that, you only need like a tiny amount of block space. Just like on the order of, I think we're down to how much 50ish bytes or something per transaction, 50 bytes in particular. So that's extremely cheap. And, yeah, I think that that's actually how blockchain should be built. Blockchain should not have that, like complicated global consensus. And like, not everyone should verify everything.

44:01The only thing that needs to get verified is like this ordering of commitments to have like a global consensus on ordering of things. But what the things are is something that can be like subjective that can be between sender and recipient. And, yeah, that is like that gives you the best of both worlds. On the one hand, it's quite scalable. Because, yeah, these on-chain commitments are small and verification of these on-chain commitments is just hashing them. You don't need to like, do any complicated cryptographic operations, like you don't need to do any signature checks, you don't need to do any, like, SNARK validity checks or something.

44:43And, yeah, that gives you good scalability. And on the other hand, since you're not writing any data into the blockchain, and like, on the client side, you can just compress everything into a zk-SNARK, you get perfect privacy, like, pretty much best in class privacy, as you're not leaking anything, except for the fact that a transaction happened, but you don't learn anything about the transaction graph, you don't learn anything about the values in there. And, yeah, that's pretty astonishing, actually, that having this level of privacy gives you that small transactions on-chain.

45:19So I really like that. And I think this is how blockchains should be designed.

45:27Vlad CosteaWhat do you guys think about Zcash? Because it was supposed to be, so Bitcoin was supposed to adopt something like the Zerocoin or Zerocash soft fork. This was part of a conversation in 2013 and 2014. If you look at Bitcoin Magazine back in the Vitalik era, the front cover in 2013, I think it was July, actually had a picture of this dark, anonymous type of character. And the title was "Zerocoin: Bitcoin Privacy Perfected." And that was part of the conversation almost 13 years ago, but now nobody talks about it anymore.

46:05Zcash launched as an altcoin in 2016. And it seems like Bitcoiners sort of lost interest in following what this is doing. But the Zerocash protocol, which they have been improving for nearly a decade, has gotten better. And you can just take that and soft fork it onto Bitcoin.

46:30Liam EagenI think one technical point that many people in Bitcoin who haven't kept up with Zcash or the broader crypto ZK world is that circa the 2013-2014 discussion, the SNARKs that were used for the transactions were so-called trusted setup SNARKs. And that's no longer the case. So Zcash does not use SNARKs with the trusted setup in their most recent versions of the protocol. And it's not necessary to use trusted setup SNARKs. In fact, with Shielded CSV, you can even use post-quantum SNARKs for your transaction protocol if you so desired.

47:20But I don't know, in talking to people, this often comes up. So I thought it would be helpful to reiterate that.

47:31Ying TongI think Zcash has made lots and lots of improvements from the original Sprout protocol. They went through Sapling, now they're at Orchard. And with every step, simplifying the transaction model, simplifying key derivation, improving, optimizing the proof system. And Liam mentioned at the start this protocol-level innovation called Tachyon by Sean Bowe that is trying to address or trying to remove the ever-growing nullifier set.

48:16And basically aggressively prune it and outsource a lot of the nullifier non-inclusion proofs obliviously to a third party. So I think a lot of Zcash's recent optimizations.

48:36Another thing that they're doing is they're recognizing that the blockchain shouldn't be used for broadcast. Because that was the so-called sandblaster or spam attack that Zcash went through, whereby the attacker just spammed numerous very low value outputs for super cheap. There's no fee market. And every Zcash wallet tried to decrypt every single one of those transactions. And more or less the rate of output creation was greater than the rate they could be decrypted by the wallet.

49:26And so just getting rid of this trial decryption functionality and reducing the responsibility of consensus, that's the direction which Zcash has been moving towards.

49:37And so I think that's very much a direction Shielded CSV was inspired by. So I think there's some convergence as well on just minimizing the duties of consensus and getting a more efficient private protocol out of it.

50:00Liam EagenAnother point that comes up when talking to people in Bitcoin about private protocols, I'm just trying to think of reasons why people aren't interested in this, but is this like inflation bug possibility? So in private payment protocols, this is like impossible to avoid. That if you have a bug in your protocol, somebody might create money and then you don't know who did it and you can't undo it. Whereas with Bitcoin, if you have this, everything is sort of public, you can kind of see what's happening.

50:36It's true. And I think, in my opinion, the correct mitigation is to have a private pool where people who use the private pool incur some risk that maybe such a bug exists. And the broader protocol is insulated from inflation in the private pool. So you can take as much money out of the private pool as you put into it. So I don't know. I feel like there's just some of these things that people haven't been thinking about these kinds of questions. These are often times what comes up when talking to them.

51:15Robin LinusJust to comment on the thing you said that people could just soft fork in Zcash, that would be quite an invasive change to the protocol. And I think that's one of the main reasons why it probably will not happen. But I think the route that we are taking with having Shielded CSV as essentially an embedded consensus protocol, that is way less invasive. It doesn't need any change to the base layer, except for maybe a bridge. But that is a very small change in comparison to actually enshrining a specific privacy protocol into the base layer.

51:56And I think that's a much more viable path for Bitcoin to take as it is way more conservative and doesn't require any deep changes to the actual structure of Bitcoin.

52:15Vlad CosteaTo be honest, I'm super impressed how Ying Tong is very up to date with what's happening in Zcash and has a very good background.

52:26Ying TongI worked at Zcash for two years.

52:29Vlad CosteaOh, so that's why? Yeah. To be honest, that's the Bitcoin I wish we had. With all of the quirks, of course, they hard forked a lot and they had to address some issues. But I wish Bitcoin was more like that, more cypherpunk as opposed to institutional whatever.

52:50Robin LinusThat's what we are working on.

52:53Vlad CosteaYeah. And maybe that we're going to have the best of both worlds. The institutions will just do their thing and then we have you guys doing something truly amazing with cryptography.

53:06Robin LinusNo, the institutions will want privacy at some point. They will join our side.

53:11Vlad CosteaNo, there's privacy on paper, right?

53:16Robin LinusCan't you just look up how many Bitcoins MicroStrategy has? They never wanted to publish

53:25Vlad CosteaAn audit.

53:28Ying TongIf institutions want to access DEXs, they will want a way to do so without exposing their whole strategy, all their beliefs about the market, all their clients, all their counterparties. I think institutions are one of the people who want privacy the most and whom privacy would benefit the most. In every market, privacy benefits the sophisticated traders, the market makers.

54:01Liam EagenI think also it's nice to like, different people mean different things when they say privacy. I think it's kind of a funny historical accident that self-custody exists at all. I don't think any governments or regulatory agencies would be enthusiastically supportive of a protocol that allowed anybody anywhere to own something without pre-registering their identity. It's important to work on this privacy stuff and build the version of privacy that we should have and not some kind of, I don't know, version that fails to deliver on what people actually want.

54:48People should be able to self-custody their funds and spend them without revealing all of their information to third parties. And I don't know, I mean, it's risky, I guess. I don't know what will happen, but we have to try at least. And yeah, I think the analogy between privacy and self-custody is interesting because people kind of take for granted that that's just a non-negotiable. But I mean, it's not really, and privacy is just like a more extreme version of that.

55:28Vlad CosteaYeah. Also, I think in Bitcoin, a lot of people assume that deniability equals privacy because they say, well, I withdraw my funds from the exchange to the self-custody wallet. How can anyone prove that it's mine and it's not some friends or I did not get hacked or something like that? And then they think that with every step where they make payments, they're going to get a greater amount of deniability. But I think at some point these coins will end up on some exchange and they will have some identity associated with them.

56:03And then you just have the input and the output and you link the transactions in between and you have pretty interesting data. Of course, it's not 100% accurate. Maybe you can make mistakes, but it's not the ideal design for Internet money, if you ask me.

56:27And I think the bigger problem is not what blockchain analysis can see today, but what pretty much everyone will know in the future. Maybe at some point a lot of this data will get published and some whales will get doxxed and it will be easy to track down what happened there. And maybe that blockchain explorers will actually have names attached to them. So you can see who sent the transaction to whom, what time, how much it was worth at the time, how much it's worth now, whether or not they still have it.

57:03Ying TongI 100% agree. There was this talk by Matthew Green called The Coming Forest Fire. And basically he said the more data, every piece of data we collect is like adding timber to the forest fire is like collecting raw material that is just ready to be set on fire. So like one breach, like one accident and the whole thing goes into flames. And as you mentioned just now, Vlad, we have more tools now to very cheaply and very effectively make sense of huge amounts of data. So, yeah, the only solution really is to not be able to collect it in the first place.

57:55Liam EagenI think it's actually much worse. The blockchain analysis doesn't even have to work. It's just a pretense, basically. I mean, if you're cynical about it, you can just say whatever you want. And I mean, Chainalysis algorithms, as far as I know, are black box. Even in court cases you can't get access to them. So it's just sort of an oracle that says like, this is a bad person, you should arrest them. So I don't know. I mean, eliminating the source of data makes it impossible to make such claims, whether they're true or not.

58:37And I think in many cases, say like a repressive government or something, they're not concerned that much about the accuracy of the blockchain analysis algorithms, right? Like, they have other motivations.

58:58Vlad CosteaThat's interesting. They can even bribe Chainalysis just to come up with a report so that they can arrest someone.

59:07Liam EagenCould be.

59:10Vlad CosteaYeah. I have two more ads to plug and then I'll ask you guys about quantum resistance, because Liam, you mentioned something about post-quantum. And I know that Robin is not a fan of anything quantum. He thinks it's a big scam. And that's going to be a spicy conversation. So where do I start? Let's start with SideShift, which is the place where you can swap what someone sends you for pure BTC. So if someone offers to pay you in stablecoins, which is usually the case in a lot of collaborations, you can decide not to deal with gas tokens.

59:46I hope that's not beer, Robin, by the way. I hope it's San Pellegrino or something.

59:50Robin LinusIt's water, very good water from Germany.

59:54Vlad CosteaOkay, I'll buy that.

59:56Robin LinusYeah, that's the ad. Like, buy Hirschquelle.

1:00:03Vlad CosteaI'll send you an invoice. Anyway, SideShift. So if anyone wants to pay you in stablecoins, you just paste your Bitcoin address in there and you send the stablecoin address to the person wanting to pay you and you're going to get Bitcoin directly to your wallet. Or if you think that the bear market is coming and you want to swap everything you have into stablecoins, you can do that too. Not financial advice. It's just a tool. You use it however you think is right.

1:00:31The URL is s-i-d-e-s-h-i-f-t dot a-i. And last but not least, there is Bitcoin.com News, which I really like because Bitcoin.com used to be this website that was saying that Bitcoin is slow and has high fees and you should use Bitcoin Cash instead. And now they have their logo, which was changed into an orange one. And they know the difference between BTC and BCH. And honestly, I think they have pretty good news coverage. They're not as political as Bitcoin Magazine and not as institutional as CoinDesk.

1:01:04So they strike this middle ground where you find sometimes interesting pieces of news. I check it out every day and I get surprised when I see something that I will not find anywhere else. So check it out. The URL is news.bitcoin.com. Now let's talk about quantum stuff because I know there's BIP 360, which is being pushed right now. And people use it as an argument to say that Bitcoin is not vulnerable to quantum computing because there is actual people working on it. And some institutions announced that they sold their Bitcoin last year because of the quantum threat.

1:01:45And also know that Robin thinks it's a scam. And also know that a bunch of people want to freeze Satoshi's coins with this quantum upgrade, which is also an interesting outcome. So where do we start?

1:02:00Robin LinusI'm not saying that's a scam. I think it's cool that people are researching quantum computers. I'm just trying to induce a bit of rationality into sometimes hysterical conversations.

1:02:21Liam EagenRight. I mean, I don't know. Yeah. I'm not, I'm not a quantum computing expert, but I find it as someone pretty interested in the field difficult to assess like the level of progress. I don't know. I mean, I read Scott Aaronson's blog sometimes, but like, I don't, I really don't know. I'm not trying to be like fudding or whatever. Like I don't really doubt that quantum computers are physically possible, you know, for whatever that's worth. But I have no idea. I hear estimates from many like credible people that range over like really long timescales.

1:03:10Like I've heard people say like there's quantum risk in five years. I've heard people say that if you do the like Moore's law scaling thing, it's more like 20 years, but I really have no idea how to, how to assess these claims, but I will say I don't know, maybe people have heard this before, but the quantum risk for Bitcoin and for SNARKs say is different than the quantum risk for communications. So a lot of the motivation to switch to post-quantum, like say like alternatives to the Diffie-Hellman or RSA for internet traffic is because intelligence agencies can record all of the internet traffic right now.

1:04:02And then whenever they get a quantum computer in the future, they can decrypt it. For Bitcoin and for proofs, it only matters if you verify the proof right now. Like if I don't have a quantum computer now and I produce a proof and I later acquire one, I can't like go back in time and make a proof. So the risk is that you switch before quantum computers exist. It's like, if, as long as you do that, then it's fine. So I don't know, maybe people are already aware of that, but

1:04:36Ying TongHow about the unlocking Satoshi's coins thing, like learning his private keys?

1:04:45Liam EagenYeah, it's a, it's the biggest bounty for building a quantum computer that exists.

1:04:56Robin LinusTo explain my criticism, I think there is like a huge gap between like the hype and the actual substance that we see. And there's a lot of announcements that are just like very far away from what they're actually doing. One example is like Google research. They made like a huge announcement that they finally achieved quantum supremacy. And when I hear quantum supremacy, I think of like this magical capability of quantum computers to do computations like exponentially faster than any classical computer could ever do them.

1:05:45And that's kind of like what the word means. Like it means, Hey, we have achieved this magical property that we want to achieve with quantum computers.

1:05:55But what they actually did is like, they did like some kind of experiment that is, it's not real computation, like it's completely useless computation. You cannot use it to solve any real problem. And they are openly admitting that, but they are still calling it quantum supremacy, which is kind of misleading in my eyes because it might be on like a theoretical level, kind of like true, but it's totally not this magical capabilities. Like it's not that magic that we are promised and it's not even close. It's not that they can say, Hey, we have achieved this now.

1:06:30And now within a reasonable amount of time, we also going to achieve the actual magic. It's, it's extremely far away from that. And when you compare that to other results from Google research, for example, like they were like, Hey, yeah, we build a computer that can play Go. Maybe we're going to play the, the world champion. And then like a week later, the world champion is sitting in the corner crying. And then a year later Google is like, Hey, we built another computer.

1:07:01That beat the first one by a hundred to zero. That's like actual progress that is like substantial improvement of the state of the art. And they have been underselling that actually, but with quantum, it's like, you have to oversell for some reason, everyone is overselling the results by a huge margin. And in particular, like in the case of Bitcoin security, we recently saw someone claiming that they broke like a six bit elliptic curve with a quantum computer. Like to break Bitcoin, you would have to break a 256 bit elliptic curve.

1:07:40So it kind of sounds like we are making progress in the right direction, but when you look at the paper or like when you look at the announcement, what they actually did is like, they simplified the problem to an extent that is just not the same problem anymore. It's like not even close to the same problem anymore. It's like so far away that they just stripped off everything that is hard about the actual problem. And it's fine to do that for research purposes, but to announce it as like, Hey, we broke a six bit elliptic curve.

1:08:11It's just plain wrong. That's just a lie in my eyes. And that's what I don't like about the quantum discussion that there is so many weird announcements. Another announcement was like by what are they called D-Wave or something. They said like, yeah, we broke an RSA modulus that had like, I don't know, 2048 bit. And that sounds like, wow, holy crap, what's happening here. But the reality was that they crafted this number in a particular way, such that they had to guess just a single bit, just one bit.

1:08:45It's what it wasn't even close to the actual problem. It wasn't related to what the actual problem is. When you hear, we broke a 2048-bit RSA modulus. It was just hype. And I think that hype is really bad here because it scares these investors like crazy. And then there's that upward spiral of more and more fear and hype. There's people having an incentive to make these crazy announcements and then investors get scary. And then these companies get more funding or like the potentially more funding than they have an incentive to over-hype their results.

1:09:25And then investors hear that, and then they believe there is a huge problem. And finally, somebody has to do something and think about the children and whatever. It's, it's, it's just, detached from reality. And once we see an actual quantum computer, once we see something that actually can break like a five bit elliptic curve, I'm the first one who says, Hey, man, we should dedicate a lot of manpower into solving this problem. But right now we are not seeing that at all. We are very far away from just solving the most simple toy problems.

1:10:05Liam EagenI don't know, I'm not, I feel like the cryptography community generally has been pretty active in post-quantum research. I know there are people working on post-quantum research for Bitcoin, like you said, BIP 360 and like the Blockstream researchers have published some papers about this. But I don't know, I mean, it doesn't seem to be cause for alarm right now. I don't know, I mean, quantum signatures are more expensive, they're slower, they're larger, just fine. But you know, if you don't include a block size increase or something, it means you reduce the capacity of the chain by a lot.

1:11:00You probably want to use like post-quantum and pre-quantum signatures until a quantum computer actually exists, because the post-quantum algorithms, or at least some of them are much newer, less well studied. There's some sort of existential risk, like for example, isogenies, which is a class of post-quantum cryptographic schemes that was part of the NIST competition actually got broken. Like, so I don't know. I mean, yeah, I don't know. Yeah, I am. Yeah. We can solve those problems.

1:11:41Vlad CosteaI actually checked out the blog that you mentioned, which is scottaaronson.blog with a double A. Pretty interesting. Yeah.

1:11:48Liam EagenAnd he's a great blogger, and very, very knowledgeable about quantum computing. He's one of the leading researchers.

1:11:59Vlad CosteaHe's selling a book about it, so he should be knowledgeable. I mean, there are a lot of people writing books about Bitcoin, and they have no idea what they're talking about.

1:12:08Liam EagenI took his class. He knows what he's talking about. He's good.

1:12:12Vlad CosteaWhere does he teach?

1:12:13Liam EagenHe's at UT, I think he's at UT Austin. But I think he might have been on sabbatical. I'm not sure, actually. I don't know what he's doing right now.

1:12:26Vlad CosteaYeah, I guess the really good professors get much better offers somewhere else.

1:12:36Liam EagenHe used to be at MIT.

1:12:41Vlad CosteaYeah. Anyway, in the context of Bitcoin, people are concerned that if a quantum computer becomes capable of breaking ECDSA, which is elliptic curve digital signature algorithm, then we will not even know unless they announce it. And they can even lie about it. Like, if you see some of Satoshi's coins moving, and it was actually Satoshi, it can be claimed by one of these quantum computer companies that want to raise more funding, and they will say, oh, yeah, we did that.

1:13:14Liam EagenWouldn't it be very easy to make them prove that they did it by just signing something with the private key?

1:13:21Vlad CosteaI mean, Craig Wright has basically showed, like, the blueprint for delaying. We're gonna do that again.

1:13:31Yeah. You can say that basically something happened and you stomped on the hard drive and then you had, what was it, bonded courier that had to deliver something to you, and he did not.

1:13:47Liam EagenBut they have a quantum computer. They, like, broke the, got the private key and then destroyed the computer. I mean, come on, that doesn't make sense. You can't lose the hard drive if you have the quantum computer. You just steal the key again. I mean, I don't know.

1:14:04Vlad CosteaBut the point is that it's gonna be very hard from someone who analyzes the blockchain to figure out whether it was, like, a legit transfer of coins or someone stole them with a quantum computer.

1:14:20Robin LinusWell, if it's hard to distinguish, then it's also not a problem. Like, if the coins are moving very slowly, then there is actually no problem. The scenario that people are scared about is that, like, a million coins get stolen at once and dumped on the market right away and then that would crash the price and it would take a very long time for Bitcoin to recover from that.

1:14:43Vlad CosteaRight, but these coins are stored in different UTXOs, so the effort of doing it is not, like, breaking only one signature. It's a lot of work.

1:14:53Robin LinusYeah, but if it's very slow, then there is not that much of an issue, really.

1:15:03Vlad CosteaYeah, they will just dump them on the market 50 Bitcoin at a time, which is less than the average whale. Huh.

1:15:16Robin LinusIf they wanted to crash it, they could just break a lot of keys at once and then wait until they have, like, a thousand keys or whatever. I don't know how many you would need. I think there is, like, roughly 50 BTC per key, right? That's kind of, like, the bounty of the early keys. So you would need, I don't know, 20,000 or something to get to, like, a million, right? Roughly.

1:15:45Liam EagenIf you wanted to crash the price, couldn't you just break one key and then sign a message with it that says, like, I have a quantum computer and I stole this private key and people would just freak out?

1:16:02Vlad CosteaI can imagine an early whale doing this. They just short on the exchanges and then they make a lot of money.

1:16:14Robin LinusRight, yeah, that's actually a good attack. Yeah, short Bitcoin and then send a message with an early key saying you have a quantum computer and you're going to dump next week.

1:16:26Vlad CosteaIf you're a whale, you can actually get rich.

1:16:29Robin LinusYeah, well, if you're a whale, you are rich.

1:16:31Vlad CosteaI mean, yeah, but you can make a lot more than what your BTC is worth today. You just move one and then you're going to make millions. Huh, maybe that there's a market for early UTXOs, like 2009, 2010. Anyway, who said listening to podcasts cannot make you rich?

1:17:03Robin LinusHere you get the alpha.

1:17:07Vlad CosteaRight, so why do people obsess with freezing Satoshi's coins? And they're like, yeah, we should not let anyone move them. Isn't that confiscation?

1:17:18Robin LinusWell, I think big institutions, they make these risk analysis and they have Satoshi's coins in there as a potential risk. To assess their own risk, they need to know how many coins there are in circulation. And so they make an estimate based on the assumption that those coins are likely lost. But if suddenly they start moving, then their calculations become inaccurate and their models have to change a lot and their risk assessment has to change. So they would need to sell a lot potentially. And I think they are very scared of that and they see it as a relevant risk.

1:18:00And just burning Satoshi's coins because of quantum would just solve a big problem for them.

1:18:10Vlad CosteaYeah, but once again, we had like, I'm not sure if it was a serious proposal, but there was a BIP written most likely by some sort of AI agent that was suggesting that we can freeze UTXOs smaller than 1000 Satoshis for some node efficiency gains. And how is that different from freezing Satoshi's coins or burning or whatever? It's still confiscation.

1:18:40Robin LinusI actually wrote a similar proposal, like UTXO expiry. It's not a BIP, but I just posted something on Delving Bitcoin. And I think my personal motivation behind that is that I think there is an asymmetry between how much it costs to create a UTXO and how much it is a burden to the network. And there are people who are intentionally spamming the UTXO set with UTXOs that are as big as possible, like this bare multisig, sorry, bare script multisigs and so on. And like the STAMPs protocol.

1:19:19And they are exploiting this asymmetry between like the asymmetry that leads to it being too cheap to create UTXOs. It's a high cost for the network. And I think it would be fair to have some mechanism that essentially says, yeah, we're going to store your UTXO for like a while, two years or something, even if it's small. But after that, we're going to prune it from the UTXO set, and then you need to provide a proof and have to pay the on-chain fees for that to prove that your UTXO was actually in the UTXO set.

1:19:57So the... The burden shifts from the total network to the individual user that wants to store very small UTXOs in the UTXO set.

1:20:08Vlad CosteaHow is that different from taxation?

1:20:12Robin LinusI mean, it is taxation. There is just a cost to storing all these small UTXOs. And I think if you're storing a large UTXO, you are benefiting the network. Then you put your money into Bitcoin and you're helping the network to degree with that. And I think then it evens out, like the cost that the network has to store your UTXO is smaller than what you are giving to the network. But if you're creating like tons and tons of small UTXOs, then it's parasitic. Like you're taking more from the network than you're giving.

1:20:46And that is an unsustainable situation in the long run. So I think it's only fair in, like for the entire network, for all users, that you're shifting the burden of proof or the cost to the individual user.

1:21:07Vlad CosteaIt sounds to me like Namecoin or ENS, where basically you have to pay to renew the domain.

1:21:17Robin LinusI mean, it depends. There are parameters to the protocol and it depends on how you're designing it. But I think it would be reasonable to design it such that it only affects small UTXOs. Like if you have like, let's say $10 in Bitcoin, then it won't affect you at all. It's only if you are storing like cents in thousands of UTXOs. Because it's also hard to justify why anyone should do that at all. Like where's the legit use case for that?

1:21:47Vlad CosteaRight. But I guess you can also see the slippery slope where miners are gonna decide that since they're not collecting enough fees, that it's better if everyone pays like an annual tax for holding their UTXOs.

1:22:02Robin LinusThat is actually a valid argument. Like there is an issue with mining subsidy. Like the subsidy is decaying exponentially and the price or like the purchasing power will probably not keep on doubling every four years. And that means eventually we're gonna end up with a situation that miners are getting paid less and less, and then they're gonna die. And then there is an issue with the security budget. And I think Satoshi's original idea was that we're gonna have bigger blocks and like tons and tons of transactions like orders of magnitude more transactions than what we currently have.

1:22:40And then there's gonna be actually a fee market that pays miners. And I think the fact that we are currently not seeing that is a big issue and we need to think about solutions for that.

1:22:54Vlad CosteaI just hope that we're not gonna reinvent taxation. That would be such a bummer.

1:23:01Robin LinusI think we just need more demand for block space somehow, right? That would be the best solution.

1:23:08Vlad CosteaThat's why we had the Ordinals and now people want to remove them from the UTXO set.

1:23:13Robin LinusI don't agree with that. I think Ordinals was like a short-lived hype. It increased or like it led to a fee market for a short while, but now it's dying off. It's not that evil maxis are killing it or something. It's just that it's not sustainable. It needs some money for people to invest in these things. It's not something that has substance.

1:23:42Vlad CosteaThe way that I see it is that it's like Pokemon cards or baseball cards or whatever. You have hype cycles when they come back and everyone wants them. And then you have moments when the market feels dead. And for a lot of collectibles right now the market is dead. For example, I used to follow some sneakers YouTube channels where they were just talking about shoes and it's very stupid. I'm not into sneakers but I was watching that and I know for a fact that the market is dead and Jordans or whatever are very affordable nowadays when they used not to be.

1:24:19And also in the case of Pokemon cards they went down. In the case of audio gear that were vintage the prices are down. Actually if you have some disposable cash I think it's a good moment to buy some some of these collectibles if you want to speculate on them. Assuming that the current Gen Z or Gen Alpha is gonna grow up and want to have anything physical because these guys seem to be very much into Fortnite skins or CSGO or whatever and Roblox and it's gonna be interesting.

1:24:52But the fact that they're into Fortnite skins only strengthens the case for NFTs and whatever because they're gonna grow up and be like oh of course this has value. I used to buy Fortnite skins but this one is on Bitcoin. It's stored forever on this immutable ledger. And of course I want this picture of a penguin or monkey or whatever.

1:25:14Ying TongDo you guys think rollups on Bitcoin? How would rollups on Bitcoin affect demand for block space? Genuine question.

1:25:24Robin LinusThat's a good question.

1:25:25Vlad CosteaI love it. She's doing my job much better than I am.

1:25:31Liam EagenI think that they will increase demand for block space. I mean assuming that they get traction. Like I mean there are many ways. People use the word rollup in many different ways but yeah.

1:25:44Robin LinusI guess it's good to start with like the naive observation that rollups in the first place they compress transactions. So you could make an argument that they will reduce the demand for block space. But the counter argument I think what you were pointing to is that they also increase the demand for block space because they increase the utility. And the other argument you make is that increase in block space or like having using the block space more efficiently also allows more transactions and more transactions can lead to bigger network effects.

1:26:23Liam EagenYeah rollups assuming they put the data on Bitcoin which is part of the technical definition of a rollup but some people don't mean that when they say it. I think the main thing is like extensibility or whatever. Like you can do more stuff. You can have privacy. You could have smart contracts. Like yeah I don't know. The biggest probably I think the thing that would increase the demand for block space the most or like the thing I've heard that makes the most sense would be DeFi stuff.

1:27:06I'm not I don't know kind of lukewarm on but yeah rollups would definitely increase the demand for block space by increasing the functionality. There's things you can do with it.

1:27:25Vlad CosteaThis is actually a very interesting conversation because I think Citrea took the blame for a lot of the stuff that happened in Bitcoin including Bitcoin Core version 30 which included an increase in the OP_RETURN transaction size. The funny part is that Citrea is not even using that in its current situation but they took the blame for it. And culturally it seems like these ZK rollups are very frowned upon by the very orthodox Bitcoiners who think that only Lightning and Liquid and maybe Ark are the legit ones and everything else is an affinity scam that comes from Ethereum and is coming to spam the chain and whatever.

1:28:06And I'm very concerned about this because I realize that there's a lot of genuine research that went into these projects and they have the best of intentions. Like they want to maximize what Bitcoin is doing which is what Bitcoin maximalism used to be about but instead they're being blamed for bloating the UTXO set and increasing the blockchain size. And some people will say, well, I run this on my Raspberry Pi and now the blockchain is at 700 gigabytes and I have to upgrade my one terabyte SSD to two terabytes and it's too expensive for me.

1:28:49And of course my answer is like, man, you're you're holding an asset, which is like a hundred thousand bucks and you're complaining about spending another 100 bucks to buy a hard drive. But, regardless, these people are very much against anything which is coming via rollups. And they think that it's scammy, rollup comes from Ethereum, that's where it was built. And there's this cultural rift that needs to be mitigated somehow to increase the demand. Because the biggest threat to something like Citrea or Alpen is not that maybe that there's a bug in the code and they need to fix it. It's that they build what they have been planning to build, but the users are not coming.

1:29:36Robin LinusThat's a real risk indeed.

1:29:40Vlad CosteaAnd that's also sort of the legacy of BitVM I think. I mean if these projects are not succeeding people will look at BitVM and say well there's nothing interesting or profitable or successful that can be built with this. So you guys can also suffer in terms of raising money to develop. This became depressing very fast.

1:30:08Robin LinusI mean it is a risk but it's not a risk that would just would make it not worth trying.

1:30:18Vlad CosteaOh I agree with this. It's just that we have to work on the culture, that's the whole point. And not in the Taproot Wizards kind of way. Because I think they were too aggressive and too obnoxious and very easy to dislike.

1:30:31Robin LinusI don't think it's that much of a problem because it's a few people, like it's not millions of people or something. The number of people that are potential users and the number of people who hate rollups, I think they are outnumbered by a huge margin. So I think it's important to just stay positive and not get distracted too much by people who just hate everything that is not invented here.

1:31:02Vlad CosteaOh sorry I was muted in OBS. What's also interesting is that if you look at Citrea and Alpen, they seem to be much more welcome in Ethereum conferences. So if they attend something Ethereum related, they're going to have some sort of side event, they will talk with people. And I think that their long-term bet is that Ethereum people are going to come back to Bitcoin and they're going to be using their ZK rollups. Because I don't see too much enthusiasm from Bitcoiners who brag about holding their coins in cold storage and never spending anything.

1:31:44Ying TongI think the culture wars are not interesting and are distracting. And really what it's about is the ideals of privacy, of decentralization. And why rollups are interesting is because they can offer better security. Why we're working on Argo and garbling circuits, garbled circuits for BitVM bridges is for the same reason. Just fundamentally better security guarantees, more decentralized bridges. And I'm pretty optimistic that these real qualitative differences will translate to more users.

1:32:31Will make these bridges actually feasible for more users, like institutions. Doesn't matter if they're from Ethereum or whatever.

1:32:42They want security, they want privacy. And at the end of the day, that's what matters.

1:32:51Robin LinusWell spoken.

1:32:53Vlad CosteaI like that. By the way, what is Argo? I feel like I dropped the ball on this one. I'm not referring to the 2012 movie starring Ben Affleck.

1:33:06Liam EagenThat's our garbling scheme. The garbled circuit, that's the piece of research that we've produced. We published a paper about part of it.

1:33:19Like we said earlier, the BitVM Alliance uses a garbled circuit scheme based on Yao's garbled circuits. And it's like 50 gigabytes and takes, I don't remember, like tens of seconds on a laptop to garble. And our scheme is 15.5 megabytes to garble a Groth proof and less than 100 milliseconds to garble. So that's what Argo is.

1:33:55Robin LinusTo give maybe like a bit more of a high-level view, I like the word off-chain computation. Like these garbled circuits in general, they enable off-chain computation. And the way how it works, in particular in bridges how it works, it's like some user says, hey, I'm going to take money out of the bridge because I initiated a valid peg-out on the side system, on the sidechain or the rollup or whatever. And they make that statement in form of a proof, a proof of validity, and they post that proof on-chain.

1:34:33And with these garbled circuits, you can evaluate that proof. You can check that proof off-chain. And if it's incorrect, then you learn a secret. And that secret can be used to slash the person and stop the peg-out on-chain. So it's essentially just a hash lock mechanism. And what is amazing about it is that this simple primitive of a hash lock gets extremely powerful now because you can combine it with like arbitrary computation, arbitrary complex computation, and you can in particular combine it with these kind of proof systems.

1:35:09And yeah, garbled circuits, the general idea, I think it came up last year at some point. And now Argo is like making it extremely efficient. Previously it was a bit clunky and needed lots of off-chain data, and now Argo is making it extremely efficient.

1:35:29Ying TongAnd the efficiency is not purely and simply a performance gain. It passes this threshold where it actually enables a different kind of bridge. So it enables orders of magnitude more operators to participate. And so this decentralizes the set of operators. It enables permissionless challenging. So this allows every user to contribute to the security of the protocol. And so this is a qualitatively different bridge than what was possible with the Yao garbled circuits. So that's actually why the performance of Argo is interesting. It's just a step change in the types of bridges that are possible. Better security, more decentralized.

1:36:22Vlad CosteaHere's a suggestion. Whenever you guys start doing marketing, you should hire someone named Jason. And his name is going to be Jason and the Argonauts. Yeah.

1:36:37Just a funny pun. So it's really interesting what you guys are doing. I'm a big fan. As I said, it's part of the maybe two reasons why I'm still excited about Bitcoin yet. I would be very pessimistic. I would mic her and myself if it wasn't for a BitVM and it wasn't for the concept of drivechains, which are basically enforced by miners and allows them to collect extra revenue. And I'm really happy that you started something which looks very promising. I'm not sure how you're going to get paid doing this.

1:37:12I hope that someone listening to this is going to come up with ideas to help you guys keep going. And I also have a bunch of Monero people listening to this. And I know we spoke about Zcash and you guys are big fans and you like what they're building. And you're trying to bring some of that to Bitcoin. And I think that's super noble. But what do you think about Monero?

1:37:35Liam EagenMonero is cool. Yeah, I like their full-chain membership proof stuff. I have not followed it as closely recently, but my understanding is it's going and that's cool. I think the ethos of Monero is reminiscent of Bitcoin from a long time ago in some ways, which is a bit nostalgic for me. So I like that. Yeah, I don't know.

1:38:12Vlad CosteaIt's funny because what you're praising about Monero is the upgrade that's coming, but not what it currently is.

1:38:20Like the 16 decoy ring signatures and stuff like this. You think it's old tech?

1:38:32Liam EagenI don't know. Is that an inflammatory thing to say? I mean, it's been around for a long time.

1:38:39Robin LinusI also think it's not necessarily bad in cryptography, right? That's actually a good thing.

1:38:45Liam EagenYeah, I think it's cool. Like people use Monero to buy things, which is maybe the most important thing for cryptocurrency. But yeah, I don't know. I mean, I don't know what. I assume this was kind of like everybody agreed that switching to the full-chain membership proofs is just obviously the right thing to do. It's better privacy for not negligible cost. Just a matter of doing it carefully.

1:39:26Vlad CosteaOkay, but coming back to Bitcoin, if you guys succeed and you're going to be able to build your garbled circuits and we're going to get a covenant soft fork and maybe also some of these operation opcodes like multiplication and addition. Where do you see Bitcoin in like five years? Like what do you imagine is going to get built?

1:39:55Liam EagenI think we're going to make a bridge based on Argo. Better than the existing BitVM bridges. I think there's one world in which we're able to somehow activate a SNARK verifier, and then we can just use that. I hope that there's a way for people to use Bitcoin privately and without relying on centralized third parties, which unfortunately has been the direction things have been trending for a while now. So that's my optimistic vision for the future. I mean, of course it could also go the opposite way and everything gets worse, but I hope not.

1:40:41Vlad CosteaRobin?

1:40:43Robin LinusMaking Bitcoin more useful as money, I think that's the vision. That's the hope. I see the obstacles with that, but I also think that this is just where we have to head. Making Bitcoin as useful as possible for the use case of money. And what it needs, I think, is better scalability, better privacy and better usability. And that's what we're going to focus on.

1:41:19Vlad CosteaYing Tong, where do you see Bitcoin in five years?

1:41:26Ying TongI see Bitcoin being a lot more interesting, just as significant as it is today, reaching more people and more use cases. And I think the great strength of Bitcoin is in its consensus and in the security that these rollups can derive from it. And I think if we could have rollups on Bitcoin, we could just allow more people to benefit from that security. So that's my vision.

1:42:08Vlad CosteaYou guys mentioned SNARK verification quite a few times, and I'm curious what you think about ZK-STARKs, which is something that's being built by StarkWare. And even Blockstream researchers seem to be very interested in that.

1:42:23Liam EagenYeah, so SNARK is like the larger category. STARKs are like a type of SNARK. So when I say SNARK verification, I mean in the broad sense. Mostly just because it's not possible at all now, so I feel like any step in that direction would be very positive. But yeah, STARKs are, the ZK world, I mean, it depends on how you define things. But I think most of the big proof systems use STARKs or something like that now, because they're fast and that's what people want. For on-chain stuff, people on Ethereum I think typically use Groth16 because it's small, and you can combine them.

1:43:15But yeah, in relation to the post-quantum conversation earlier, STARKs are post-quantum, which is really cool that you can have proof systems that are post-quantum. So maybe we solve the post-quantum thing by just getting a STARK verifier on Bitcoin. Personally, the reason I think that what I described of activating field arithmetic versus a monolithic STARK verifier is because what STARKs are has changed over time. So StarkWare, for example, has had different proof systems. I think it's called Stone and now Stwo. So the risk of enshrining a specific verifier into Bitcoin is that the state of the art changes, and the state of the art of SNARKs and STARKs has changed quite a bit in the last five years.

1:44:10So I mean, who knows? In five years, maybe we'll have proof systems that use binary fields or that use GKR. So you just want the flexibility to not be locked into something, because it's so hard to make changes that I really want to make sure we get as much as we possibly can out of any changes that we do make. But yeah, I don't know. Pro STARKs. They're cool.

1:44:36Ying TongWe're going to be looking into STARKs for Shielded CSV for sure, because they're very efficient for client-side proving, and there's efficient STARK recursion implementations. Yeah, I'm also, I think STARKs are a very exciting area of research.

1:45:01Robin LinusWhat we haven't mentioned here is that STARKs don't require a trusted setup.

1:45:06Liam EagenOh, yeah.

1:45:07Robin LinusSo the security guarantees, they are just superior, but they are already kind of like an industry standard, right? Like all these big proof systems, they are using some sort of STARKs. It's just like the last mile. You don't quite want to put the STARK on the blockchain because they're vastly bigger than these SNARKs. That's the key advantage of SNARKs. They're slow, require a trusted setup, but the advantage is that they are extremely small. They're just almost as small as the signature.

1:45:52Vlad CosteaIt's interesting. Usually when people bring up the ZK stuff, it's a bit intimidating. I remember last year I was at BTC Prague and I tried to explain to someone what's a zero knowledge proof, and he was like, no, I'm not interested. And it's shitcoin stuff. Please just leave me alone. And I was super excited about it, but it is to some degree like moon math, you know, it's very complicated. It's sort of like trying to explain algebra to someone who only did arithmetics. And they want to see the numbers, but you try to explain to them that the numbers have been compressed in this formula. What's a good place to start to learn ZK stuff?

1:46:41Robin LinusDan Boneh's classes. There are a few videos on YouTube and I think there's also a MOOC about it. There's a massive online course on Coursera or something.

1:46:55Liam EagenThere's also the ZK podcast. There's a podcast about ZK stuff that's, in my opinion, pretty accessible. I think it depends on the person. If it's someone who's not at all mathematically inclined or interested in math, then I would say that. If it's someone who is interested in how SNARKs work, there are a lot of resources, like tutorials. I think Ying Tong has a tutorial about PLONK. The PLONK paper, for example, for someone who has a good algebra background, is very accessible.

1:47:40It's easy to read. Some SNARK papers are pretty difficult to read, even as someone pretty familiar with the material. PLONK is very well written and accessible.

1:47:53Robin LinusThe other thing for engineers, I think it's also interesting that you don't need to understand how a SNARK actually works to be able to use it and to have these amazing compression capabilities. There are lots of libraries that are easy to use. Most people who are using signatures don't really understand how signatures work under the hood. You don't have to be able to understand that, to use the tool.

1:48:23Vlad CosteaAre you guys coming? Oh, I'll let you say it before.

1:48:26Ying TongYeah, just adding on, I'm an engineer myself, and it helps me to learn when there's hands-on examples, like self-contained mini examples. So this company, RISC Zero, they actually built a ZK-STARK in a Google spreadsheet. It's going to take you step-by-step to compute a STARK proof, like all in an Excel, Google spreadsheet. So looking for toy examples really helps me build intuition.

1:49:05But yeah, I think, like Robin said, the aim really is to get STARKs and their security to that level where we shouldn't have to worry about it. And we shouldn't have to interface with it as the end user. Like, do you think about HTTPS, for example? Do you think about the TLS handshake? No. So hopefully it becomes invisible and secure.

1:49:38Vlad CosteaOh, that's really beautiful. I was going to say that you, Robin, forgot to retweet the podcast. Really? You should do that ASAP. Also, are you guys coming to any conferences this year to talk about your work, to interact with other researchers or whatever?

1:50:00Liam EagenI'm going to go to Bitcoin Vegas. And be in Denver next month.

1:50:09Vlad CosteaYeah, I'll see you there.

1:50:11Liam EagenOh, nice.

1:50:13Vlad CosteaI was actually invited to MC on one of the stages. They have like a Bitcoin stage and a shortage of personnel.

1:50:21Liam EagenOkay, cool. I don't know other than that. Oh, I think I might go to the MIT Bitcoin Expo. I'm not sure beyond that.

1:50:40Vlad CosteaSo basically only US events?

1:50:44Liam EagenI guess those are all in the US. But no, no, I don't. There's a ZK Summit, I think, this year in Europe. I don't know if they've announced where it is, but I might go to that. I like those. If you're interested in ZK, you could go to that chat with some ZK people.

1:51:12Ying TongWe're also really open to suggestions. What are good events? I'm based in Singapore. So any cool events around Asia, this region? I was thinking about Real World Crypto, which is in Taipei. It's in Taipei this March. Yeah.

1:51:38Vlad CosteaI know that the Intmax people are also doing an annual conference in Japan. I'm actually tempted to go to that one because I've always wanted to visit Japan.

1:51:55Liam EagenDo you know when it is?

1:51:57Vlad CosteaUsually it's later in the year, around October or November. I was also thinking about doing a privacy-centered conference here in Romania, but it's tough with the new regulations. Because basically if you're gonna do a conference, you cannot have any payments on the venue that deal with privacy coins or any other coins. Like you need a MiCA license and you need to pay lawyers to draft that. And it's a lot of work.

1:52:30So maybe I can do it, but just academic without any sort of official way to buy stuff or make transactions.

1:52:43Yeah. Anyway, the plan was to have like a Halloween party. That was sort of the excuse to get people next to Dracula's castle on Halloween Day.

1:52:55Work in progress. Don't think too much about it. I'm curious if you guys have like a speaker's rate or something that people usually pay you to go speak to places.

1:53:07Ying TongNobody has paid me ever.

1:53:12Liam EagenNo, I've gotten free tickets as a speaker, although I feel like that's kind of mean to make you pay for your own ticket if you're speaking somewhere.

1:53:23Vlad CosteaSort of, yeah. You guys are selling yourselves very short. Robin, did anyone ever pay you?

1:53:36Robin LinusI think I got reimbursed travel expenses once, but I never got paid to actually go somewhere. I never got a salary for it.

1:53:45Vlad CosteaI'm going to send an angry letter to David Bailey.

1:53:49Liam EagenAre other people getting paid to speak at conferences?

1:53:52Vlad CosteaMan, I've heard some numbers like Nick Szabo or Phil Zimmermann, but these are like heavyweights. I've also heard that people like Jimmy Song, they have like a pride that they want to be the best paid. And they're like, oh, if I'm coming to your event, you got to pay me more than the other guy.

1:54:14But you got to grind to build your brand for this. And that's the part that sucks. If you're only doing your work, people will be like, oh, that's cool. But if you have like 100,000 followers on Twitter and you engage people and whatever, they think that you're going to sell tickets. So if you sell tickets, then they're going to feel like they can pay you.

1:54:41Like they put your face on a poster and they're like, oh, Michael Saylor is coming to whatever. And people actually pay to watch him and then go into debt.

1:54:56This this became depressing once again. Okay, so you guys, I'm not sure if you were very specific in talking about the conferences. You mentioned one in Taipei and you also said that you're open to others. Robin, to how many events are you going this year?

1:55:15Robin LinusYeah, like there's a few Bitcoin events at ETHDenver. Then I'm going to Bitcoin Vegas. MIT Bitcoin Expo, hopefully. Or BTC Prague, maybe.

1:55:47Vlad CosteaThat's so vanilla. But I guess it's the largest in Europe. So that's a good example.

1:55:55Liam EagenI mean, what is the one in a Paralelní Polis, MoneroKon? I've been to that one a few times if I'm around Prague. I like that.

1:56:06Vlad CosteaYeah. Last year it happened in Paralelní Polis, but this year it's going to happen in Warsaw.

1:56:12Liam EagenOh, really? Oh, wow. Okay.

1:56:14Vlad CosteaBasically, there is a Bitcoin Film Festival and next door there is going to be the MoneroKon.

1:56:24I guess, you know, I'm going to be at the Bitcoin Film Festival because the Monero people hate me. Like, I actually got threats. Like, I'm going to break your legs if I ever see you in person, 'cause I... Oh, shit. They felt betrayed because I prefer Zcash over Monero.

1:56:40Liam EagenOh, no. Oh, no.

1:56:42Vlad CosteaAnd at some point I became angry and I was like, you know what? I'm going to sell all my Monero. Fuck you guys. It's very personal and dramatic, so I'm going to have to look behind my shoulder the whole time.

1:57:00Liam EagenYeah, stay safe.

1:57:04Vlad CosteaIs there anything that you wish I asked you and I failed miserably by not asking you?

1:57:15Robin LinusWhen mainnet?

1:57:17Vlad CosteaYeah, when mainnet? When token? When ICO?

1:57:22Robin LinusIt's not going to be a token. I got to cut off my hands before I launch the token.

1:57:33Liam EagenYeah, but hopefully soon. I think they take all the stuff except the token.

1:57:41Vlad CosteaBy mainnet, what do you actually or what do you mean by mainnet? You're not going to be like a separate blockchain. It's just going to work.

1:57:50Robin LinusOur technology is going to be used on the Bitcoin mainnet.

1:57:55Vlad CosteaYeah, that's an important distinction.

1:58:00Liam EagenArgo is fully implemented and so we haven't released it yet because we're still making modifications and have to get it audited and stuff like that. And the bridge is in progress. But yeah, so it's coming along. We've only been doing this for a little while.

1:58:24Vlad CosteaSo you guys have called your project {ideal}, but is it really ideal? I let this be the final question.

1:58:35Robin LinusIdeal is a math term from ring theory and we thought it's kind of funny but it's not really landing, I guess.

1:58:42Liam EagenI think an ideal is like something you approach. Like we aren't the ideal, but we're like a limiting sequence of steps that gets close to the ideal.

1:58:54Robin LinusThat's beautiful.

1:58:58Vlad CosteaLiam, once you retire from cryptography, you should write philosophy, man. You're going to sell a lot of books.

1:59:04Liam EagenI'm not going to sell a lot of books.

1:59:08Vlad CosteaAnyway, thank you very much. It's becoming awkward and I don't want to hold you past. I don't know. A couple of you guys are in East Asia, if I'm not mistaken, and it must be very late. Maybe past your bedtime. I don't want to hold you too much.

1:59:24Liam EagenIt's okay.

1:59:28Vlad CosteaBig fan of your project. How can people follow it on GitHub or Twitter or whatever?

1:59:35Robin Linus@idealgroup.

1:59:40Vlad CosteaThat's Twitter, right?

1:59:41Robin LinusSorry?

1:59:42Vlad CosteaThat's Twitter?

1:59:45Robin Linus@idealgroup.

1:59:45Liam EagenAnd I think the GitHub is also idealgroup.

1:59:49Vlad CosteaYou guys also have a web page or something? Ideal.group. Oh, fancy. Oh, that's why you said you searched for a domain for such a long time.

1:59:59Robin LinusThat's the hard part. Like, the cryptography, that's easy. The hard part is naming things.

2:00:05Liam EagenThat's true. I'm terrible at naming things.

2:00:09Vlad CosteaThis is beautiful. Love your web page. Love your project. I hope you succeed. I hope Citrea and Alpen spend another year in development and audit just to implement this. And I hope you bring another 1,000x improvement afterwards, if that's even possible at this point. Thank you guys for your time. Thank you for your work. I gotta say that if I was at a conference and I saw a bunch of guys like Michael Saylor and Brian Armstrong and I don't know who else, like all of these big money people that you see on TV and then I saw you guys, I would come to you guys and just be a fanboy.

2:00:50I really like what you're doing. You're bringing back the spirit of Bitcoin. You're keeping me bullish and you're making me pay attention to what's happening in Bitcoin because it's so easy to lose hope.

2:01:04Liam EagenThank you.

2:01:06Robin LinusI like your podcast. Like you have a very wide view on the cool things and not as narrow as some people who take Bitcoin overly serious.

2:01:20Vlad CosteaOh, thank you Robin Linus because I see Bitcoin more like Linux, you know, like something that you build on top of like the blueprint. Satoshi gave us the open source code and we can take it and build stuff with it.

2:01:35Robin LinusAnd I hope you're going to become a click millionaire this year. Yes. I'm going to retweet your podcast.

2:01:40Vlad CosteaHopefully with this interview.

2:01:46Robin LinusHopefully with this interview. Yeah.

2:01:48Vlad CosteaYou never know when you publish it what happens. So thank you guys. Go to ideal.group to read more about their project and also follow them individually. It's Robin underscore Linus and Liam Eagen. And in your case, it's the real or is it with the let me check for a second. Yes, it's therealyingtong. Y-I-N-G-T-O-N-G. Follow them because they're very interesting people.

2:02:25Ying TongThank you, Vlad.

2:02:27Vlad CosteaThank you.

2:02:27Robin LinusThanks for having us.

2:02:29Vlad CosteaThank you for building this. And I hope I'll interview in one year and you're going to tell me that the progress that you wanted to make in five has already been reached. And you're on some beach somewhere.

2:02:39Robin LinusWell, then you got Claude Code.

2:02:41Vlad CosteaYeah. And you're basically retired and just enjoying life.

2:02:49Robin LinusOn Bitcoin. Paying everything in Bitcoin privately.

2:02:53Vlad CosteaYes. You buy your coke over Tor, as Jack Mallers promised in 2022. Okay, I'll go before I get arrested. Bye. Bye. Thank you. Bye.