Title: S17 E4: {ideal} BitVM Optimizations (Robin Linus, Liam Eagen, Ying Tong)
Podcast: Bitcoin Takeover Podcast (host: Vlad Costea)
Guest(s): Robin Linus (@Robin_Linus; inventor of BitVM), Liam Eagen (cryptographer, ex-Alpen Labs; Shielded CSV co-author), Ying Tong Lai (@therealyingtong; cryptography engineer, ex-Zcash/ECC, Halo2) - co-founders of {ideal} (ideal.group, @idealgroup), creators of the Argo garbling scheme for BitVM
Published: 2026-01-24
Duration: 2:03:25
Episode URL: https://bitcoin-takeover.com/audio/?name=2026-01-24_s17_e4_ideal_bitvm_optimizations_robin_linus_liam_eagen_ying_tong_.mp3
Audio: https://bitcoin-takeover.com/audio/media/2026-01-24_s17_e4_ideal_bitvm_optimizations_robin_linus_liam_eagen_ying_tong_.mp3
Transcript: CORRECTED. Base: local Whisper medium.en transcript with automatic speaker diarization (three guest voices mapped by hand), then reconciled against a full local small.en (int16, VAD) re-transcription with word timestamps; three-way comparison (draft vs small.en vs YouTube auto-captions of the livestream) over the whole episode (191 disagreement spots reviewed, then a residual pass). About 58 doubtful, dropped or looping stretches were checked against short audio clips re-transcribed locally with medium.en (int16, with and without VAD), including the greeting and naming exchange at 00:01:43-00:04:33, the "almost three" / '23 exchange at 00:11:43, the witness encryption / indistinguishability obfuscation joke at 00:19:37, the field-arithmetic / introspection / Bitcoin Cash opcodes exchange at 00:23:26-00:24:50, the water-bottle ad aside at 00:59:46, the quantum supremacy passage at 01:05:55, the scottaaronson.blog hand-off at 01:11:41, "Well spoken" at 01:32:51, the STARK vs SNARK passage at 01:45:01, the conference plans at 01:50:00-01:56:42, the "When mainnet?" exchange at 01:57:15, the @idealgroup / "the hard part is naming things" exchange at 01:59:35 and the closing ("Claude Code", "coke over Tor"). Speaker turns were checked with a full-episode local speaker-embedding scan (four reference voices, 1.5 s windows at 0.75 s hop); paragraphs were re-segmented on the small.en word timings (paragraph times re-derived from the YouTube captions where small.en timing collapsed) and short turns re-attributed where the scan and the clips agreed. Sponsor reads (Braiins Hashpower, NoOnes.com, LayerTwo Labs, SideShift.ai, Bitcoin.com News) are read live by Vlad. Names and jargon were checked against the title, the show notes and the web: {ideal} / ideal.group, Argo and Argo MAC (garbled SNARK verifiers, Groth16), Yao garbled circuits, BitVM 1/2/3, BitVMX / Rootstock, BitVM Alliance, Alpen Labs, Citrea, Shielded CSV / Jonas Nick, Tachyon / Sean Bowe, PlasmaFold, Intmax, witness encryption, indistinguishability obfuscation, OP_CAT, OP_MUL, Great Script Restoration, Simplicity / Liquid / Andrew Poelstra, Stone / Stwo / StarkWare, Groth16, GKR, PLONK, RISC Zero, Dan Boneh, Zero Knowledge Podcast, Paul Sztorc / drivechains, Michael Saylor, David Bailey, Matt Corallo, Zerocoin / Zerocash, Sprout / Sapling / Orchard, Zcash sandblasting spam attack, Peter Van Valkenburgh / Coin Center, Matthew Green ("The Coming Privacy Forest Fire" talk), Chainalysis, Sergio Lerner, BIP 360, Scott Aaronson, isogenies / NIST, D-Wave, Craig Wright, Delving Bitcoin UTXO expiry, bare multisig / STAMPs, Ordinals, OP_RETURN / Bitcoin Core 30, Taproot Wizards, full-chain membership proofs (Monero), ETHDenver, Bitcoin 2026 Las Vegas, MIT Bitcoin Expo, BTC Prague, Paralelní Polis / MoneroKon, Bitcoin Film Festival (Warsaw), Real World Crypto (Taipei), MiCA, Nick Szabo, Phil Zimmermann, Jimmy Song, Jack Mallers. Light clean verbatim: ums, false starts and stutters removed; spoken phrasing kept. Intro music omitted. Remaining doubtful words are marked [unclear: best guess].
================================================================================

[00:00:47] Vlad Costea: Welcome to the Bitcoin Takeover Podcast. This is Season 17, Episode 4. This episode is sponsored by Braiins, Bitcoin.com News, LayerTwo Labs, NoOnes.com, and SideShift.ai. And we are live right now with the {ideal} team or the {ideal} group. Three people who decided to start a true revolution with BitVM. They already made it like a couple thousand times more efficient over the last couple of weeks. I saw the announcement. It's amazing. Liam Eagen, he's the genius cryptographer who has already been on the show. Robin Linus is the creative genius who came up with BitVM, which is one of the two reasons why I'm still optimistic about Bitcoin on the long term.

[00:01:32] Vlad Costea: And there's also Ying Tong, who is here, and she's part of the team. She's also a cryptographer, and it's her first time on the show. It's really good to have you guys.

[00:01:43] Robin Linus: Thanks for having us.

[00:01:44] Ying Tong: [unclear: Good to have you.]

[00:01:46] Vlad Costea: So how did you come up with this concept of {ideal} group? What are you building and what's up with these brackets or accolades that you're using for the name?

[00:02:04] Liam Eagen: So I guess I'll go. I've been working on the scheme Argo with Ying Tong for a while. I was previously at Alpen, and I left Alpen. We've been working on this new garbling scheme, and I think it's pretty cool. It is significantly better than the state of the art, as you said many thousand times better. And we think that this enables sort of better bridges, better BitVM garbled circuit style bridges. So that's what we're working on. We're working on shipping Argo and then building a bridge around it, basically. I don't know, Robin can speak to the brackets, maybe, around the name.

[00:03:00] Robin Linus: Yeah, so naming things is hard. So inventing the scheme was easy for [unclear: Liam], but then finding a name and finding a domain was pretty hard. And we had like dozens of sessions and then took us forever to find a name. And then we thought some mathy pun would be funny. And in ring theory, there is a thing called ideal.

[00:03:30] Robin Linus: And then we thought that's it. And then we thought maybe it's a bit too pretentious. So we added brackets to it. No, it's brackets ideal. It looks cool.

[00:03:49] Vlad Costea: It's interesting because the brackets are also how you start and you end a program in C++. Did you think about that? Because C++ was the original programming language in which Bitcoin was written. And basically you put that like the beginning and the ending.

[00:04:08] Ying Tong: That's why we put the brackets on it.

[00:04:14] Vlad Costea: Okay, it's a much easier explanation than saying, well, we search for a domain and tatata. But that's a very nerdy reference right there.

[00:04:29] Robin Linus: But that's okay.

[00:04:33] Vlad Costea: I'm sure that the right people will notice it. I'm curious how you guys were able to get funding. And Paul Sztorc actually has a question for you directly, Robin. Like how much did Michael Saylor pay you for this?

[00:04:49] Robin Linus: Yeah, we sold out to Michael Saylor. He loves Bitcoin updates so much. So he thought, hey, those are the right guys. We need to give him funding. So he gave us half of his Bitcoin and now we can do rocket research.

[00:05:09] Vlad Costea: Right. So how did you get funding for this? I know that David Bailey was offering a million dollars in any project that you guys or you specifically, Robin, might launch. Did you access that or did you find some other investor? Are you basically draining your coffers, your own savings?

[00:05:28] Robin Linus: No, we don't have any investors yet.

[00:05:32] Vlad Costea: Oh, I understand. That's why you're here, right? You know who's listening to this.

[00:05:41] Robin Linus: No, we are actually not even raising right now.

[00:05:46] Liam Eagen: Yeah, I think we would like to kind of bootstrap as much as is feasible. And so far that's worked out. I mean, who knows what the future holds, but we're, you know, I mean, we're only three people.

[00:06:05] Vlad Costea: Yeah, but you three people were able to come up with something which is thousands of times better than what other teams are working on. I know, for example, that Rootstock were very capable and competent. They have a bunch of cryptographers. They came up with BitVMX, which is like their own version of the first iteration of BitVM. And as far as I know, it's not even close to the efficiency of what you guys are building. And I know that Alpen, the team that you, Liam, left recently, they were also working with garbled circuits and BitVM 3.

[00:06:43] Vlad Costea: And Citrea, they're also working with a version of BitVM 2. So you just pushed it to like a whole different level. How do you even do that? I know that Matt Corallo came up with like a 5% optimization in Bitcoin and what that led to was an inflation bug.

[00:07:03] Liam Eagen: I think that the garbled circuits for BitVM type protocols is kind of a unique problem that not a lot of other people have thought deeply about. Like this problem of privacy-free garbling a SNARK verifier is interesting, but I don't know that, at least as far as I'm aware, it wasn't something that a lot of people like in academia were thinking about. So when you encounter problems like that, and then coupled with the application, which was recently discovered, there's often like a lot of room for improvement, low-hanging fruit, so to speak.

[00:07:47] Liam Eagen: And our garbling scheme works quite differently from the kind of state-of-the-art that Alpen and Citrea and the BitVM Alliance are working with. And so by exploiting kind of the specific structure of the SNARK verifier, which is quite algebraic, you can build like a better garbling scheme that's just much more efficient than if you were working with a general circuit, which is usually the setting that people are working with with garbled circuit protocols.

[00:08:25] Vlad Costea: Yeah, I was part of the Citrea ceremony, and that's why I have this construction hat helmet in the background. And I had one of their team members come here to Romania, and we basically ran the whole ceremony software, and then we destroyed the computer and we made a video about it. And when I asked him, why don't you guys just use the latest version of BitVM, he said that that would take them another year of just changing the code and going for another audit, which takes up to six months.

[00:08:57] Vlad Costea: And they would delay their launch for far too long. And I think it was Alpen that was the team that was supposedly going to work with the latest version of BitVM. But you guys just launched the version, which is so much better that I think that maybe they will not launch anytime soon. Like, do you ever think about the fact that entire teams are delaying their work because of you guys?

[00:09:22] Ying Tong: I think this concern about auditing is a real one. And the nice thing about our implementation is that it's really small. Like, it's 4000 lines of code. And because we don't break abstractions, we can make use of very popular and very widely audited cryptographic libraries for like finite field and elliptic curve primitives. And so I think in many ways, using a simpler implementation will save time on the audit.

[00:10:10] Ying Tong: And furthermore, it's about defining interfaces that allow for easy integration. I think, really, to teams who are worried about switching costs, I don't think it will be that bad at all.

[00:10:30] Liam Eagen: Yeah, I think if anything, using Argo is probably easier. Like even if you have started using the existing Yao stuff. Because like, the Yao table, Yao is a scheme that other people are using, like Alpen, the garbling scheme. The tables are like, I don't know the exact figure, I think like 40 to 50 gigabytes. And you need like, you know, 10 ish of them, and you need like one per operator per watchtower. And so it becomes like, huge amount of data to work with. And it poses like real engineering challenges.

[00:11:08] Liam Eagen: And I don't know, I think to the to your point, though, about like companies, they need to launch, right, like Citrea, Alpen, or anybody. And if you have a deadline, you do kind of have to take out at some point, even even in a really fast moving research space, like BitVM has been, and I don't know, I think it makes sense. But but yeah, it's, you know, clearly, there's been very, very large improvements consistently for the last year, two years. It's been two years now.

[00:11:43] Robin Linus: Yeah, almost three.

[00:11:44] Liam Eagen: Oh, wow. Okay.

[00:11:46] Robin Linus: '23 was the first paper. I also think currently it's quite a hassle for all these companies that everything is moving so fast, because they have to make these trade-offs between actually shipping and waiting for the next version. And I think that moved extremely fast in the last two, three years. But I think at some point, it's going to converge, like, now, like, we probably won't see another 1,000x, because you have to put some data on the blockchain, right? So you won't get away with no data. And it's already so... [unclear: Liam] is already thinking maybe there are optimizations.

[00:12:31] Robin Linus: But yeah, I think like, at some point, it's just going to converge against them close to the minimum. And we are already close to it, like, the on-chain data has been, like, BitVM 1 was like a very long process with like, I don't know, up to 100 transactions or something. In the worst case, then BitVM 2 reduce the number of rounds, but the on-chain cost was quite expensive. And then like, with BitVM 3 garbled circuits, you could reduce the on-chain cost by, I don't know, by a factor of 1000 or something, such that you had to put only a few kilobytes on-chain.

[00:13:12] Robin Linus: But with that Yao-style garbling, you still needed like, as Liam said, like, hundreds of gigabytes of off-chain data. And now with the most recent iteration with the Argo scheme, you also reduce the off-chain cost by 1,000x or something. And I think we are finally converging against something that is so efficient that we hopefully won't see like that breaking changes anymore.

[00:13:44] Vlad Costea: I mean, that's really good news. And I think if there are any companies interested in building L2s and raising money right now, I think there's still time to compete with Alpen and Citrea. If you're into that, you just use the latest version. I was gonna ask you, how would you define BitVM? Because I think a lot of people hear about it. A lot of them dismiss it outright. And they say it's Ethereum stuff, and they're not interested in it. And it should stay away from Bitcoin. But what is it? And what does it do?

[00:14:21] Robin Linus: I think there are many explanations. But I guess you're asking for kind of like a high level explanation of people who don't know yet know it yet. And like, the best high level explanation is that it's a way to build bridges to bridge Bitcoin into other layers. And why, like many maxis are concerned is that they don't want to see these, like stuff, like applications that we see on Ethereum, for example, automated market makers and lending and borrowing protocols and stuff like that. But you can use it for any kinds of layer twos.

[00:15:00] Robin Linus: And we, in particular, are interested in privacy protocols. And I think that is something that is pretty aligned with like the original cypherpunk ethos and what I think even the most hardcore maxis should appreciate in my eyes, because making Bitcoin more private and more scalable is fundamental to actually delivering on Bitcoin's promises.

[00:15:32] Vlad Costea: Okay, but so let me phrase this in a way that makes sense for the toxic maxis, who might not even listen to this, but I'm still trying. Anyway, how are automated market makers and lending protocols and all of these use cases good for Bitcoin? And why is it better to use something like BitVM to build L2s to bridge Bitcoin onto other layers, which benefit from the security of Bitcoin, as opposed to just bridging your Bitcoin to Ethereum using WBTC, which has a lot more liquidity, has all the applications, has everything out there just for using right now?

[00:16:16] Robin Linus: Yeah, my point was that even if you don't like these applications, there are still other applications enabled by bridges or by BitVM. And in particular, like second layer protocols that are able to give you better privacy and better scalability. Does that make sense?

[00:16:38] Vlad Costea: Of course it does. I'm just trying to get an answer for the people who might be very skeptical of anything BitVM related. I'm also curious if this research into BitVM is helping your Shielded Client-Side Validation project, which I know you're promoting like a couple of years ago with Jonas Nick.

[00:17:02] Liam Eagen: Yeah, we're, we're very interested in working on that. We're focused on the bridge right now, or at least speaking for myself, I have been since the Shielded CSV work. Because it's sort of the missing piece, in my opinion, if you if you want to have a private transaction protocol that's as sort of trust minimized as possible, that uses Bitcoin, like the asset, you need some kind of bridge. And so but but yeah, I mean, I think that, like Robin was saying that the BitVM work kind of converges into this direction that we're pursuing, we would really like to deploy Shielded CSV, or some, you know, revision, like, updated version, I don't know, I mean, I've been thinking about it.

[00:17:53] Liam Eagen: In the, in the time since publication, yeah, like that's, we want to do that very much. So and I think there's been a lot of really interesting development in like related protocols, like, I don't know, I'm personally very interested in the Tachyon work from Sean Bowe and Zcash folks. And there's also like PlasmaFold, and Intmax, and some other papers on these types of schemes. And so, yeah, yeah, we very much want to build the best possible bridge, and then, like the Shielded CSV layer that bridges to

[00:18:34] Robin Linus: And maybe to answer the high level question, like, that's our focus, like, we are not building BitVM for the sake of BitVM. And we are not building it to like, bring Ethereum to Bitcoin. Our focus is definitely to make Bitcoin more scalable and more private and more cypherpunk in the end.

[00:18:54] Vlad Costea: And I think the whole appeal of BitVM, which some people would describe as a hacky way of adding Bitcoin upgrades, is that you don't have to wait for soft forks. A lot of the builders in the space, they're waiting for one soft fork to activate. But on the other hand, am I wrong when I say that BitVM could be made much more powerful if there was some sort of covenant soft fork? Because some people see BitVM as the argument against adding any soft fork at all. And they will say, well, we can ossify right now. And these smart people will figure out ways to do stuff.

[00:19:37] Robin Linus: Yeah, I don't think that's a good idea. I mean, eventually, Liam will figure out how we solve witness encryption. [unclear: Maybe he already announced that.]

[00:19:52] Liam Eagen: I think I've got indistinguishability obfuscation. Yeah, I think, I don't know, I kind of see it the other way, but like BitVM is kind of a proof that you can kind of do the sorts of things that you would be able to do with a more like, I don't know, clean solution via soft forks. And therefore, the argument against kind of doing it the right way, like activating a SNARK verifier or something like that becomes weaker. Because if you can already do it, then you're not, there's no benefit in not activating the change.

[00:20:38] Liam Eagen: I mean, I personally would like to see the ability to verify SNARKs on Bitcoin for many reasons, but one of them is just to like kind of build the bridge the right way. And yeah, it's the only way to enable privacy. I mean, like some variants of this, at least, but and I think that we should do that.

[00:21:05] Ying Tong: I think as a newcomer to the BitVM design space, there's many aspects of it that are not satisfactory. Like, so we call it a trust-reduced design because there's a trusted set of signers. Depending on your bridge design, there's like permissioned operators, permissioned watchtowers, there's limits on how many parties can take part in ensuring the security of this bridge. So I feel like it is in no way equivalent to just directly verifying SNARKs on Bitcoin.

[00:21:42] Liam Eagen: And it also like that has a like real impact. Like if you want to build, there is like a significant difference between a SNARK that's like verified as part of consensus and a bridge that has permissioned operators in the sense that the permissioned operators have potentially legal liability there. They can be like targeted, whereas like if you could just have a SNARK, it would be very different. So I think there are certain kinds of applications that are really hard to build with BitVM style bridge. I mean, we're trying as best as possible to like support as many operators as possible to make it as trust minimized as feasible, but it's not the ideal solution. Right.

[00:22:33] Vlad Costea: So what would be the ideal solution? Like if in this perfect world where you get what you want, what would you want Bitcoin to have?

[00:22:44] Liam Eagen: I mean, I don't know. I'm not like, I'm not sure exactly, but I think that the version that makes the most sense to me right now is opcodes for field arithmetic so that people can write SNARK verifiers. You can write a STARK verifier, you could write a Groth verifier, whatever you want. It doesn't incur the like maintenance burden for Bitcoin Core developers to like enshrine a SNARK verifier. There's no bikeshedding. People just kind of do what they want. And if you had this, you could do a SNARK verifier, be expensive, but it would work. And I think that's the thing. Yeah, I think that makes sense.

[00:23:33] Robin Linus: You need transaction introspection as well. Well, some sort of covenant, like arithmetic are not quite enough.

[00:23:42] Liam Eagen: I mean, I think with sufficiently large field arithmetic, you can simulate CAT. So it's, but yeah, yeah.

[00:23:51] Robin Linus: Something clean, you would need a very big field arithmetic because like the entire transaction would have to fit into your field, I think.

[00:23:59] Vlad Costea: Right. So by field arithmetic, you mean operations opcodes, like OP_MUL or something, which allows you to multiply.

[00:24:08] Liam Eagen: Yeah. I mean, there's a lot of abstraction. Like you can start, even if you just had 32 bit integer multiplication, everything would be very different. But I mean, like a multiplication modulo a prime number. So, you know, for like Stwo, they use the prime two to the 31 minus one. So you just want to be able to say, like, add two things, mod this value, multiply two things, mod this value, that kind of thing.

[00:24:38] Vlad Costea: Oh, so basically what Bitcoin Cash already has, right?

[00:24:43] Liam Eagen: I don't know.

[00:24:44] Robin Linus: Yeah, I think, yeah.

[00:24:47] Vlad Costea: They restored all the Satoshi opcodes.

[00:24:50] Robin Linus: Yeah, stuff like that is discussed in Bitcoin as well, like Great Script Restoration. That would get us pretty far. They also wanted to re-enable arbitrary integer arithmetic, sorry, arbitrary precision integer arithmetic. But I think the ideal solution at the moment would be to enable Simplicity with a bunch of jets for field arithmetic. The thing that Blockstream is working on that has been activated on Liquid last year.

[00:25:31] Vlad Costea: That's interesting. I've had Andrew Poelstra on the show two years ago, and he was saying that we should activate OP_CAT. And then I had him again, like a few months ago, still in 2025. And he was a big fan of Simplicity. But at the same time, he was arguing that it's too early for Bitcoin to activate it. They just put it on Liquid and they need to play with it for a while before they think it's safe for Bitcoin.

[00:26:00] Robin Linus: It would be a big upgrade for sure. But you asked for the ideal solution. So, yeah, I think it wouldn't be realistic to, yeah, maybe, I don't know. If a lot of people would spend a lot of time on it, maybe we could do it much faster. But currently it's just a few people on Blockstream research team. And I guess it needs to, how do you say, like stew for a while until it can be considered safe for mainnet activation.

[00:26:36] Vlad Costea: Okay, I have a question, another question from Paul Sztorc, and he wants to know what's your favorite Michael Saylor analogy. But in the meantime, I'll let you guys think. And I promised people that I'm going to become a millionaire this year, if not in dollars, at least in number of podcast downloads. Because I was very close last year, I got like half of a million. So I'm going to show some ads and let you think about favorite Saylor analogies. Braiins, the first Bitcoin company, which is also producing the Bitcoin Mini Miner BMM 101, which I have right here in the box unsealed because it's more valuable.

[00:27:11] Vlad Costea: Anyway, you can buy this with promo code BTCTKVR and you get 5% off. But they also realize that these hobbyist mining devices are sort of obsolete. And most people don't find them convenient. So they launched a new service last week, which is called no, it was actually this week. It's still Friday. The week is not over. It's called Hashpower. The URL is hashpower.braiins.com. And you can basically rent the equivalent of 1,000 Bitaxes or BMM or these tiny home miners for like $5 per hour.

[00:27:49] Vlad Costea: And you can consider this your lottery ticket. And it doesn't require you to actually hold the hardware in your home. It doesn't make your electricity bills more expensive. You can also use it for other creative projects like trying to mine BSV or BCH for whatever reason. Like I'm not saying you should get to 51%, but you can if you want. I don't know. You can try. It's up to you. Hashpower.braiins.com. Also, there is NoOnes.com, which is trying to end the financial apartheid. Their mission is to empower the global citizens of the global south.

[00:28:25] Vlad Costea: And whenever you trade on NoOnes, you're giving them liquidity that they can use for various reasons, mostly hustling and trying to get as much Bitcoin. And I think they also have stablecoins and stuff into the hands of locals who are dealing with hyperinflation and broken economies. They have a peer-to-peer marketplace. They have a swapping service. They have a spot market. They have a debit card for spending. I'm sure no matter what you're into, you'll find something useful on NoOnes. And the fact that there is a humanitarian mission on top of it only makes it more interesting.

[00:29:02] Vlad Costea: So NoOnes.com is the URL. And last but not least, to make Paul happy, LayerTwo Labs. They have their software, which is ready for testing. It's on layertwolabs.com/download. And you can go today and try the drivechains. They're running on a proprietary version of the Bitcoin signet. They have an Ethereum sidechain. They have a Zcash sidechain. They have a Namecoin sidechain. And a lot of interesting experiments. Check it out and also join their Telegram group, which is called Drivechain Talk. This is it for now. Now, guys, tell me your favorite Saylor analogies. There is no second best.

[00:29:48] Liam Eagen: I was going to say that that's the only Saylor quote I think I know off the top of my head. I don't know.

[00:29:56] Robin Linus: Bitcoin is a city burning in cyberspace or something like that.

[00:30:00] Liam Eagen: Oh, wait. Oh, oh. Oh, yeah. No, I know what you're talking about now. I just don't recall any of them specifically, but yeah.

[00:30:17] Robin Linus: I think someone should finally vibe code like Paul Sztorc's startup idea, which is like a game where you get, you get shown like a quote and you have to guess if it's a real quote from Michael Saylor or something that Paul Sztorc made up to make fun of Michael Saylor.

[00:30:39] Vlad Costea: Okay, I love Paul, but that's a bit, that's a bit too much. I don't think I would go to that length with vibe coding. But anyway, nothing about the hive mind or the fact that we are basically expending digital energy, triple maxi stuff. Like, did you guys even know what's a triple maxi?

[00:31:10] Liam Eagen: I saw, I saw this, wait, this was his thing at the Bitcoin conference last year, I think. Right? Isn't that like a quadruple maxi too? Or did I make that up?

[00:31:22] Vlad Costea: No, there is the triple maxi, which is like the highest level.

[00:31:25] Robin Linus: Like leverage all your assets, but also move into a jurisdiction where you get like tax benefits or something.

[00:31:34] Liam Eagen: Oh, all right.

[00:31:38] Robin Linus: Yeah, I find stuff like that extremely scary, to be honest. I think that's extremely far away from what excites me about Bitcoin. I think Bitcoin is not something that you should have like in the basement of Coinbase, something that you should hold yourself, like the entire concept of using it as a money and self-custody and permissionlessness and privacy and all this stuff. It's not very valued by the suitcoiners. And I think it distracts us from the actual thing that makes Bitcoin worthy.

[00:32:15] Vlad Costea: I actually wrote an article about this and I sent it to Robin and you told me that you disagree with me on some points. But basically, in 1964, Bob Dylan wrote the song My Back Pages, which was like his exit from the civil rights movement, where he was feeling like he's being used and he sort of mocked the whole movement. And I feel like this article of mine is kind of the same, like I'm pointing out to some of the holes that I observed in Bitcoin maximalism.

[00:32:46] Vlad Costea: And next week, I'm also going to have Paul Sztorc on the show and we're going to talk about his article, which is called Derangements of Bitcoin Maximalism. I think it's very interesting. And for a long time, we had these stories like, oh, if you're pure and you spend all of your disposable income to buy Bitcoin and you mortgage your house to buy more Bitcoin and whatever, you're going to be rewarded with the ETF, which is something that only Bitcoin can get, because only Bitcoin is a digital commodity and everything else is an unregistered security.

[00:33:19] Vlad Costea: And once we get the ETF, we're going to get to $1 million and the bankers will knock at your door with loads of cash saying, please sell me just a little bit of your Bitcoin because I want that. No, how can you not sell it to me? Look, I'll double the cash amount. You can have everything you want for that 0.1 Bitcoin that you have. You're going to have a yacht and private jet. You're going to live in this mansion. And you had all of these derangement stories of people having all the wrong expectations about on one hand, hyperinflation and the other hand demand for actual Bitcoin.

[00:33:55] Vlad Costea: And then you had the institutions that realized, okay, we don't need to do any of that. We're dealing with paper. We're experts in paper. We can print paper. We can sell paper. And I think most of the reason why we never went to the expected million dollars per Bitcoin is just that we were dealing with paper. There wasn't much activity specifically on the exchanges. There wasn't much activity on-chain. It was just these institutions moving amounts that may not even exist.

[00:34:32] Robin Linus: Yeah, I agree with that critique that the more it goes in that direction, the more we just reinvent what we have with gold or with like just other things that you end up with like inflated things. So like with IOUs and they can be printed out of thin air and that dilutes the entire value proposition of Bitcoin. It's just not Bitcoin anymore. And people getting so excited about these things is a bit weird. Michael Saylor likes to say, yeah, we agree on like 99% of the fundamentals or something, but that 1% of like not having an IOU, but actually having the coin, like actually self-custodying the asset and using it as money.

[00:35:19] Robin Linus: I think that 1% of difference in worldview is pretty important. And I think we should emphasize that more. And I think it's important to.

[00:35:34] Robin Linus: Yeah, I think like from from our side, it's also important to not get cynical and like not get too depressed by the success of the suitcoiners that do their thing. And they just do the things that the way they are used to do the things right to have ETFs and stuff like that. I think it shouldn't make us cynical, even if it's distracting a lot of the community. I think it's important that the people who still have the original values stay positive and act.

[00:36:10] Robin Linus: Do what they can do and be excited about doing the stuff that is possible and pushing the frontier of what we can do.

[00:36:25] Vlad Costea: What I want to add is that 1% difference to which Michael Saylor refers is like 99% of the purpose of Bitcoin. Holding your coins in self-custody and dealing with people peer-to-peer, not going to trust the third parties or legal entities or whatever to transfer your Bitcoin.

[00:36:45] Liam Eagen: It's sort of the whole point.

[00:36:46] Ying Tong: Do it privately, because without privacy you can be tracked, you can be censored, you can be just excluded in many ways. And that's not truly free peer-to-peer money if it can be censored.

[00:37:09] Liam Eagen: You can't have fungibility without privacy.

[00:37:12] Vlad Costea: Plus, there is also even if people disagree with this and they're like, I don't need privacy, I'm fine with the open ledger. It's important for Bitcoin to be censorship resistant at the protocol level. So if the miners can decide that this transaction is not fine and there is like a large percentage of the mining pools that decide that the transaction should not get added. You can actually have transactions that pay a large fee, but they sit in the mempool for many days or months until you have this tiny miner that picks it up.

[00:37:47] Vlad Costea: So the reason why we do refer to Bitcoin as being censorship resistant today is that there is a game theory that incentivizes miners to pick up any transaction if it pays the right fee. But if there is political enforcement over what the miners are doing and there are treaties or laws that tell them what they can mine and what they cannot. There's going to be discrimination, which is going to lead to maybe normal citizens of let's pick a country that's outside of the regular U.S. Enforcement.

[00:38:22] Vlad Costea: Let's say Iran. Okay, someone from Iran wants to send a Bitcoin transaction. They're going to get stuck for many days because it's not going to get picked up by the American miners.

[00:38:34] Ying Tong: And the only true defense against this is for the miners to not be able to discriminate, not be able to distinguish one transaction from another. And this is an argument that Peter Van Valkenburgh from Coin Center put forth. So he has this concept of dumb pipes where it's not that the miners are censoring certain transactions, it's that they cannot even see the content of the transactions and they're unable to make the choice of what to censor, regardless of their beliefs, regardless of their jurisdiction, they are simply unable, unaware and just incapable of censoring.

[00:39:23] Ying Tong: So I do think that is the only true privacy. The only true defense against censorship is just ignorance.

[00:39:36] Vlad Costea: That's beautiful. I've been saying for a while that the only way to make Bitcoin private without actually improving Bitcoin is to stop looking at looking at the blockchain, like to tell everyone, stop looking at the blockchain.

[00:39:49] Ying Tong: Right. Right. Yeah.

[00:39:51] Vlad Costea: But that's not going to happen.

[00:39:53] Ying Tong: Well, then you have to encrypt everything you put on there, basically.

[00:39:59] Vlad Costea: But I remember reading when Sergio Lerner, who is also the creator of Rootstock, he did that Satoshi research when he was the first one to come up with this theory that Satoshi mined 1 million Bitcoin. And when he published it on BitcoinTalk, people were very aggressive, saying, wait a second, you're not supposed to look at the blockchain, you shouldn't do that. You're destroying, like the privacy of Bitcoin. And he was arguing, there is no privacy to speak of, but it's just that at the time, the resources or the tools to look at the blockchain were limited. So you needed to have some sort of technical expertise.

[00:40:40] Ying Tong: You wouldn't, you wouldn't right-click a web page, would you?

[00:40:47] Vlad Costea: So how do you think Bitcoin could add privacy? Like, is there anything that you like or prefer in terms of achieving this?

[00:41:00] Liam Eagen: I mean, I don't know, maybe I'm biased, but I like the Shielded CSV kind of idea. The not putting proofs on-chain, I think is very compelling from like a scalability and block space efficiency point of view. Of course, Shielded CSV by itself, like we said earlier, isn't enough to add privacy to Bitcoin. It's just sort of a meta protocol. So you need a bridge either via a SNARK verifier, or maybe via some BitVM thing. So I think that's my preferred. I mean, I Yeah, that's my preferred way to add privacy.

[00:41:47] Ying Tong: And this is only going to work if there's enough adoption, meaning there's a large enough anonymity set. So if you're the only person using a Shielded CSV, then every action on there is obviously just you. And if there's no other exchanges, no other economic activity, just no other users transacting on there, then there is no anonymity set. So, yeah, I think a meta protocol that is widely adopted. And that is useful enough to be widely adopted.

[00:42:37] Vlad Costea: What about you, Robin, do you like confidential transactions?

[00:42:43] Robin Linus: No, I'm, of course, also a big fan of Shielded CSV. Like the key idea behind it is to use the blockchain for what the blockchain is good for, which is an immutable ordering of commitments to prevent double spending. And that's the only thing that you actually need a global consensus on and everything else can be validated on the client side by the recipient, because the recipient, they have an incentive to actually validate all the consensus rules of the coin that they received to be sure that the coin actually carries real value, and that they can can convince the next person that this coin has a valid history.

[00:43:23] Robin Linus: The only thing that you cannot verify on the client side is that no double spending occurred. And that's what you need the blockchain for. And for that, you only need like a tiny amount of block space. Just like on the order of, I think we're down to how much 50ish bytes or something per transaction, 50 bytes in particular. So that's extremely cheap. And, yeah, I think that that's actually how blockchain should be built. Blockchain should not have that, like complicated global consensus. And like, not everyone should verify everything.

[00:44:01] Robin Linus: The only thing that needs to get verified is like this ordering of commitments to have like a global consensus on ordering of things. But what the things are is something that can be like subjective that can be between sender and recipient. And, yeah, that is like that gives you the best of both worlds. On the one hand, it's quite scalable. Because, yeah, these on-chain commitments are small and verification of these on-chain commitments is just hashing them. You don't need to like, do any complicated cryptographic operations, like you don't need to do any signature checks, you don't need to do any, like, SNARK validity checks or something.

[00:44:43] Robin Linus: And, yeah, that gives you good scalability. And on the other hand, since you're not writing any data into the blockchain, and like, on the client side, you can just compress everything into a zk-SNARK, you get perfect privacy, like, pretty much best in class privacy, as you're not leaking anything, except for the fact that a transaction happened, but you don't learn anything about the transaction graph, you don't learn anything about the values in there. And, yeah, that's pretty astonishing, actually, that having this level of privacy gives you that small transactions on-chain.

[00:45:19] Robin Linus: So I really like that. And I think this is how blockchains should be designed.

[00:45:27] Vlad Costea: What do you guys think about Zcash? Because it was supposed to be, so Bitcoin was supposed to adopt something like the Zerocoin or Zerocash soft fork. This was part of a conversation in 2013 and 2014. If you look at Bitcoin Magazine back in the Vitalik era, the front cover in 2013, I think it was July, actually had a picture of this dark, anonymous type of character. And the title was "Zerocoin: Bitcoin Privacy Perfected." And that was part of the conversation almost 13 years ago, but now nobody talks about it anymore.

[00:46:05] Vlad Costea: Zcash launched as an altcoin in 2016. And it seems like Bitcoiners sort of lost interest in following what this is doing. But the Zerocash protocol, which they have been improving for nearly a decade, has gotten better. And you can just take that and soft fork it onto Bitcoin.

[00:46:30] Liam Eagen: I think one technical point that many people in Bitcoin who haven't kept up with Zcash or the broader crypto ZK world is that circa the 2013-2014 discussion, the SNARKs that were used for the transactions were so-called trusted setup SNARKs. And that's no longer the case. So Zcash does not use SNARKs with the trusted setup in their most recent versions of the protocol. And it's not necessary to use trusted setup SNARKs. In fact, with Shielded CSV, you can even use post-quantum SNARKs for your transaction protocol if you so desired.

[00:47:20] Liam Eagen: But I don't know, in talking to people, this often comes up. So I thought it would be helpful to reiterate that.

[00:47:31] Ying Tong: I think Zcash has made lots and lots of improvements from the original Sprout protocol. They went through Sapling, now they're at Orchard. And with every step, simplifying the transaction model, simplifying key derivation, improving, optimizing the proof system. And Liam mentioned at the start this protocol-level innovation called Tachyon by Sean Bowe that is trying to address or trying to remove the ever-growing nullifier set.

[00:48:16] Ying Tong: And basically aggressively prune it and outsource a lot of the nullifier non-inclusion proofs obliviously to a third party. So I think a lot of Zcash's recent optimizations.

[00:48:36] Ying Tong: Another thing that they're doing is they're recognizing that the blockchain shouldn't be used for broadcast. Because that was the so-called sandblaster or spam attack that Zcash went through, whereby the attacker just spammed numerous very low value outputs for super cheap. There's no fee market. And every Zcash wallet tried to decrypt every single one of those transactions. And more or less the rate of output creation was greater than the rate they could be decrypted by the wallet.

[00:49:26] Ying Tong: And so just getting rid of this trial decryption functionality and reducing the responsibility of consensus, that's the direction which Zcash has been moving towards.

[00:49:37] Ying Tong: And so I think that's very much a direction Shielded CSV was inspired by. So I think there's some convergence as well on just minimizing the duties of consensus and getting a more efficient private protocol out of it.

[00:50:00] Liam Eagen: Another point that comes up when talking to people in Bitcoin about private protocols, I'm just trying to think of reasons why people aren't interested in this, but is this like inflation bug possibility? So in private payment protocols, this is like impossible to avoid. That if you have a bug in your protocol, somebody might create money and then you don't know who did it and you can't undo it. Whereas with Bitcoin, if you have this, everything is sort of public, you can kind of see what's happening.

[00:50:36] Liam Eagen: It's true. And I think, in my opinion, the correct mitigation is to have a private pool where people who use the private pool incur some risk that maybe such a bug exists. And the broader protocol is insulated from inflation in the private pool. So you can take as much money out of the private pool as you put into it. So I don't know. I feel like there's just some of these things that people haven't been thinking about these kinds of questions. These are often times what comes up when talking to them.

[00:51:15] Robin Linus: Just to comment on the thing you said that people could just soft fork in Zcash, that would be quite an invasive change to the protocol. And I think that's one of the main reasons why it probably will not happen. But I think the route that we are taking with having Shielded CSV as essentially an embedded consensus protocol, that is way less invasive. It doesn't need any change to the base layer, except for maybe a bridge. But that is a very small change in comparison to actually enshrining a specific privacy protocol into the base layer.

[00:51:56] Robin Linus: And I think that's a much more viable path for Bitcoin to take as it is way more conservative and doesn't require any deep changes to the actual structure of Bitcoin.

[00:52:15] Vlad Costea: To be honest, I'm super impressed how Ying Tong is very up to date with what's happening in Zcash and has a very good background.

[00:52:26] Ying Tong: I worked at Zcash for two years.

[00:52:29] Vlad Costea: Oh, so that's why? Yeah. To be honest, that's the Bitcoin I wish we had. With all of the quirks, of course, they hard forked a lot and they had to address some issues. But I wish Bitcoin was more like that, more cypherpunk as opposed to institutional whatever.

[00:52:50] Robin Linus: That's what we are working on.

[00:52:53] Vlad Costea: Yeah. And maybe that we're going to have the best of both worlds. The institutions will just do their thing and then we have you guys doing something truly amazing with cryptography.

[00:53:06] Robin Linus: No, the institutions will want privacy at some point. They will join our side.

[00:53:11] Vlad Costea: No, there's privacy on paper, right?

[00:53:16] Robin Linus: Can't you just look up how many Bitcoins MicroStrategy has? They never wanted to publish

[00:53:25] Vlad Costea: An audit.

[00:53:28] Ying Tong: If institutions want to access DEXs, they will want a way to do so without exposing their whole strategy, all their beliefs about the market, all their clients, all their counterparties. I think institutions are one of the people who want privacy the most and whom privacy would benefit the most. In every market, privacy benefits the sophisticated traders, the market makers.

[00:54:01] Liam Eagen: I think also it's nice to like, different people mean different things when they say privacy. I think it's kind of a funny historical accident that self-custody exists at all. I don't think any governments or regulatory agencies would be enthusiastically supportive of a protocol that allowed anybody anywhere to own something without pre-registering their identity. It's important to work on this privacy stuff and build the version of privacy that we should have and not some kind of, I don't know, version that fails to deliver on what people actually want.

[00:54:48] Liam Eagen: People should be able to self-custody their funds and spend them without revealing all of their information to third parties. And I don't know, I mean, it's risky, I guess. I don't know what will happen, but we have to try at least. And yeah, I think the analogy between privacy and self-custody is interesting because people kind of take for granted that that's just a non-negotiable. But I mean, it's not really, and privacy is just like a more extreme version of that.

[00:55:28] Vlad Costea: Yeah. Also, I think in Bitcoin, a lot of people assume that deniability equals privacy because they say, well, I withdraw my funds from the exchange to the self-custody wallet. How can anyone prove that it's mine and it's not some friends or I did not get hacked or something like that? And then they think that with every step where they make payments, they're going to get a greater amount of deniability. But I think at some point these coins will end up on some exchange and they will have some identity associated with them.

[00:56:03] Vlad Costea: And then you just have the input and the output and you link the transactions in between and you have pretty interesting data. Of course, it's not 100% accurate. Maybe you can make mistakes, but it's not the ideal design for Internet money, if you ask me.

[00:56:27] Vlad Costea: And I think the bigger problem is not what blockchain analysis can see today, but what pretty much everyone will know in the future. Maybe at some point a lot of this data will get published and some whales will get doxxed and it will be easy to track down what happened there. And maybe that blockchain explorers will actually have names attached to them. So you can see who sent the transaction to whom, what time, how much it was worth at the time, how much it's worth now, whether or not they still have it.

[00:57:03] Ying Tong: I 100% agree. There was this talk by Matthew Green called The Coming Forest Fire. And basically he said the more data, every piece of data we collect is like adding timber to the forest fire is like collecting raw material that is just ready to be set on fire. So like one breach, like one accident and the whole thing goes into flames. And as you mentioned just now, Vlad, we have more tools now to very cheaply and very effectively make sense of huge amounts of data. So, yeah, the only solution really is to not be able to collect it in the first place.

[00:57:55] Liam Eagen: I think it's actually much worse. The blockchain analysis doesn't even have to work. It's just a pretense, basically. I mean, if you're cynical about it, you can just say whatever you want. And I mean, Chainalysis algorithms, as far as I know, are black box. Even in court cases you can't get access to them. So it's just sort of an oracle that says like, this is a bad person, you should arrest them. So I don't know. I mean, eliminating the source of data makes it impossible to make such claims, whether they're true or not.

[00:58:37] Liam Eagen: And I think in many cases, say like a repressive government or something, they're not concerned that much about the accuracy of the blockchain analysis algorithms, right? Like, they have other motivations.

[00:58:58] Vlad Costea: That's interesting. They can even bribe Chainalysis just to come up with a report so that they can arrest someone.

[00:59:07] Liam Eagen: Could be.

[00:59:10] Vlad Costea: Yeah. I have two more ads to plug and then I'll ask you guys about quantum resistance, because Liam, you mentioned something about post-quantum. And I know that Robin is not a fan of anything quantum. He thinks it's a big scam. And that's going to be a spicy conversation. So where do I start? Let's start with SideShift, which is the place where you can swap what someone sends you for pure BTC. So if someone offers to pay you in stablecoins, which is usually the case in a lot of collaborations, you can decide not to deal with gas tokens.

[00:59:46] Vlad Costea: I hope that's not beer, Robin, by the way. I hope it's San Pellegrino or something.

[00:59:50] Robin Linus: It's water, very good water from Germany.

[00:59:54] Vlad Costea: Okay, I'll buy that.

[00:59:56] Robin Linus: Yeah, that's the ad. Like, [unclear: buy Hirschquelle].

[01:00:03] Vlad Costea: I'll send you an invoice. Anyway, SideShift. So if anyone wants to pay you in stablecoins, you just paste your Bitcoin address in there and you send the stablecoin address to the person wanting to pay you and you're going to get Bitcoin directly to your wallet. Or if you think that the bear market is coming and you want to swap everything you have into stablecoins, you can do that too. Not financial advice. It's just a tool. You use it however you think is right.

[01:00:31] Vlad Costea: The URL is s-i-d-e-s-h-i-f-t dot a-i. And last but not least, there is Bitcoin.com News, which I really like because Bitcoin.com used to be this website that was saying that Bitcoin is slow and has high fees and you should use Bitcoin Cash instead. And now they have their logo, which was changed into an orange one. And they know the difference between BTC and BCH. And honestly, I think they have pretty good news coverage. They're not as political as Bitcoin Magazine and not as institutional as CoinDesk.

[01:01:04] Vlad Costea: So they strike this middle ground where you find sometimes interesting pieces of news. I check it out every day and I get surprised when I see something that I will not find anywhere else. So check it out. The URL is news.bitcoin.com. Now let's talk about quantum stuff because I know there's BIP 360, which is being pushed right now. And people use it as an argument to say that Bitcoin is not vulnerable to quantum computing because there is actual people working on it. And some institutions announced that they sold their Bitcoin last year because of the quantum threat.

[01:01:45] Vlad Costea: And also know that Robin thinks it's a scam. And also know that a bunch of people want to freeze Satoshi's coins with this quantum upgrade, which is also an interesting outcome. So where do we start?

[01:02:00] Robin Linus: I'm not saying that's a scam. I think it's cool that people are researching quantum computers. I'm just trying to induce a bit of rationality into sometimes hysterical conversations.

[01:02:21] Liam Eagen: Right. I mean, I don't know. Yeah. I'm not, I'm not a quantum computing expert, but I find it as someone pretty interested in the field difficult to assess like the level of progress. I don't know. I mean, I read Scott Aaronson's blog sometimes, but like, I don't, I really don't know. I'm not trying to be like fudding or whatever. Like I don't really doubt that quantum computers are physically possible, you know, for whatever that's worth. But I have no idea. I hear estimates from many like credible people that range over like really long timescales.

[01:03:10] Liam Eagen: Like I've heard people say like there's quantum risk in five years. I've heard people say that if you do the like Moore's law scaling thing, it's more like 20 years, but I really have no idea how to, how to assess these claims, but I will say I don't know, maybe people have heard this before, but the quantum risk for Bitcoin and for SNARKs say is different than the quantum risk for communications. So a lot of the motivation to switch to post-quantum, like say like alternatives to the Diffie-Hellman or RSA for internet traffic is because intelligence agencies can record all of the internet traffic right now.

[01:04:02] Liam Eagen: And then whenever they get a quantum computer in the future, they can decrypt it. For Bitcoin and for proofs, it only matters if you verify the proof right now. Like if I don't have a quantum computer now and I produce a proof and I later acquire one, I can't like go back in time and make a proof. So the risk is that you switch before quantum computers exist. It's like, if, as long as you do that, then it's fine. So I don't know, maybe people are already aware of that, but

[01:04:36] Ying Tong: How about the unlocking Satoshi's coins thing, like learning his private keys?

[01:04:45] Liam Eagen: Yeah, it's a, it's the biggest bounty for building a quantum computer that exists.

[01:04:56] Robin Linus: To explain my criticism, I think there is like a huge gap between like the hype and the actual substance that we see. And there's a lot of announcements that are just like very far away from what they're actually doing. One example is like Google research. They made like a huge announcement that they finally achieved quantum supremacy. And when I hear quantum supremacy, I think of like this magical capability of quantum computers to do computations like exponentially faster than any classical computer could ever do them.

[01:05:45] Robin Linus: And that's kind of like what the word means. Like it means, Hey, we have achieved this magical property that we want to achieve with quantum computers.

[01:05:55] Robin Linus: But what they actually did is like, they did like some kind of experiment that is, it's not real computation, like it's completely useless computation. You cannot use it to solve any real problem. And they are openly admitting that, but they are still calling it quantum supremacy, which is kind of misleading in my eyes because it might be on like a theoretical level, kind of like true, but it's totally not this magical capabilities. Like it's not that magic that we are promised and it's not even close. It's not that they can say, Hey, we have achieved this now.

[01:06:30] Robin Linus: And now within a reasonable amount of time, we also going to achieve the actual magic. It's, it's extremely far away from that. And when you compare that to other results from Google research, for example, like they were like, Hey, yeah, we build a computer that can play Go. Maybe we're going to play the, the world champion. And then like a week later, the world champion is sitting in the corner crying. And then a year later Google is like, Hey, we built another computer.

[01:07:01] Robin Linus: That beat the first one by a hundred to zero. That's like actual progress that is like substantial improvement of the state of the art. And they have been underselling that actually, but with quantum, it's like, you have to oversell for some reason, everyone is overselling the results by a huge margin. And in particular, like in the case of Bitcoin security, we recently saw someone claiming that they broke like a six bit elliptic curve with a quantum computer. Like to break Bitcoin, you would have to break a 256 bit elliptic curve.

[01:07:40] Robin Linus: So it kind of sounds like we are making progress in the right direction, but when you look at the paper or like when you look at the announcement, what they actually did is like, they simplified the problem to an extent that is just not the same problem anymore. It's like not even close to the same problem anymore. It's like so far away that they just stripped off everything that is hard about the actual problem. And it's fine to do that for research purposes, but to announce it as like, Hey, we broke a six bit elliptic curve.

[01:08:11] Robin Linus: It's just plain wrong. That's just a lie in my eyes. And that's what I don't like about the quantum discussion that there is so many weird announcements. Another announcement was like by what are they called D-Wave or something. They said like, yeah, we broke an RSA modulus that had like, I don't know, 2048 bit. And that sounds like, wow, holy crap, what's happening here. But the reality was that they crafted this number in a particular way, such that they had to guess just a single bit, just one bit.

[01:08:45] Robin Linus: It's what it wasn't even close to the actual problem. It wasn't related to what the actual problem is. When you hear, we broke a 2048-bit RSA modulus. It was just hype. And I think that hype is really bad here because it scares these investors like crazy. And then there's that upward spiral of more and more fear and hype. There's people having an incentive to make these crazy announcements and then investors get scary. And then these companies get more funding or like the potentially more funding than they have an incentive to over-hype their results.

[01:09:25] Robin Linus: And then investors hear that, and then they believe there is a huge problem. And finally, somebody has to do something and think about the children and whatever. It's, it's, it's just, detached from reality. And once we see an actual quantum computer, once we see something that actually can break like a five bit elliptic curve, I'm the first one who says, Hey, man, we should dedicate a lot of manpower into solving this problem. But right now we are not seeing that at all. We are very far away from just solving the most simple toy problems.

[01:10:05] Liam Eagen: I don't know, I'm not, I feel like the cryptography community generally has been pretty active in post-quantum research. I know there are people working on post-quantum research for Bitcoin, like you said, BIP 360 and like the Blockstream researchers have published some papers about this. But I don't know, I mean, it doesn't seem to be cause for alarm right now. I don't know, I mean, quantum signatures are more expensive, they're slower, they're larger, just fine. But you know, if you don't include a block size increase or something, it means you reduce the capacity of the chain by a lot.

[01:11:00] Liam Eagen: You probably want to use like post-quantum and pre-quantum signatures until a quantum computer actually exists, because the post-quantum algorithms, or at least some of them are much newer, less well studied. There's some sort of existential risk, like for example, isogenies, which is a class of post-quantum cryptographic schemes that was part of the NIST competition actually got broken. Like, so I don't know. I mean, yeah, I don't know. Yeah, I am. Yeah. [unclear: We can solve those problems.]

[01:11:41] Vlad Costea: I actually checked out the blog that you mentioned, which is scottaaronson.blog with a double A. Pretty interesting. Yeah.

[01:11:48] Liam Eagen: And he's a great blogger, and very, very knowledgeable about quantum computing. He's one of the leading researchers.

[01:11:59] Vlad Costea: He's selling a book about it, so he should be knowledgeable. I mean, there are a lot of people writing books about Bitcoin, and they have no idea what they're talking about.

[01:12:08] Liam Eagen: I took his class. He knows what he's talking about. He's good.

[01:12:12] Vlad Costea: Where does he teach?

[01:12:13] Liam Eagen: He's at UT, I think he's at UT Austin. But I think he might have been on sabbatical. I'm not sure, actually. I don't know what he's doing right now.

[01:12:26] Vlad Costea: Yeah, I guess the really good professors get much better offers somewhere else.

[01:12:36] Liam Eagen: He used to be at MIT.

[01:12:41] Vlad Costea: Yeah. Anyway, in the context of Bitcoin, people are concerned that if a quantum computer becomes capable of breaking ECDSA, which is elliptic curve digital signature algorithm, then we will not even know unless they announce it. And they can even lie about it. Like, if you see some of Satoshi's coins moving, and it was actually Satoshi, it can be claimed by one of these quantum computer companies that want to raise more funding, and they will say, oh, yeah, we did that.

[01:13:14] Liam Eagen: Wouldn't it be very easy to make them prove that they did it by just signing something with the private key?

[01:13:21] Vlad Costea: I mean, Craig Wright has basically showed, like, the blueprint for delaying. We're gonna do that again.

[01:13:31] Vlad Costea: Yeah. You can say that basically something happened and you stomped on the hard drive and then you had, what was it, bonded courier that had to deliver something to you, and he did not.

[01:13:47] Liam Eagen: But they have a quantum computer. They, like, broke the, got the private key and then destroyed the computer. I mean, come on, that doesn't make sense. You can't lose the hard drive if you have the quantum computer. You just steal the key again. I mean, I don't know.

[01:14:04] Vlad Costea: But the point is that it's gonna be very hard from someone who analyzes the blockchain to figure out whether it was, like, a legit transfer of coins or someone stole them with a quantum computer.

[01:14:20] Robin Linus: Well, if it's hard to distinguish, then it's also not a problem. Like, if the coins are moving very slowly, then there is actually no problem. The scenario that people are scared about is that, like, a million coins get stolen at once and dumped on the market right away and then that would crash the price and it would take a very long time for Bitcoin to recover from that.

[01:14:43] Vlad Costea: Right, but these coins are stored in different UTXOs, so the effort of doing it is not, like, breaking only one signature. It's a lot of work.

[01:14:53] Robin Linus: Yeah, but if it's very slow, then there is not that much of an issue, really.

[01:15:03] Vlad Costea: Yeah, they will just dump them on the market 50 Bitcoin at a time, which is less than the average whale. Huh.

[01:15:16] Robin Linus: If they wanted to crash it, they could just break a lot of keys at once and then wait until they have, like, a thousand keys or whatever. I don't know how many you would need. I think there is, like, roughly 50 BTC per key, right? That's kind of, like, the bounty of the early keys. So you would need, I don't know, 20,000 or something to get to, like, a million, right? Roughly.

[01:15:45] Liam Eagen: If you wanted to crash the price, couldn't you just break one key and then sign a message with it that says, like, I have a quantum computer and I stole this private key and people would just freak out?

[01:16:02] Vlad Costea: I can imagine an early whale doing this. They just short on the exchanges and then they make a lot of money.

[01:16:14] Robin Linus: Right, yeah, that's actually a good attack. Yeah, short Bitcoin and then send a message with an early key saying you have a quantum computer and you're going to dump next week.

[01:16:26] Vlad Costea: If you're a whale, you can actually get rich.

[01:16:29] Robin Linus: Yeah, well, if you're a whale, you are rich.

[01:16:31] Vlad Costea: I mean, yeah, but you can make a lot more than what your BTC is worth today. You just move one and then you're going to make millions. Huh, maybe that there's a market for early UTXOs, like 2009, 2010. Anyway, who said listening to podcasts cannot make you rich?

[01:17:03] Robin Linus: [unclear: Here you get the alpha.]

[01:17:07] Vlad Costea: Right, so why do people obsess with freezing Satoshi's coins? And they're like, yeah, we should not let anyone move them. Isn't that confiscation?

[01:17:18] Robin Linus: Well, I think big institutions, they make these risk analysis and they have Satoshi's coins in there as a potential risk. To assess their own risk, they need to know how many coins there are in circulation. And so they make an estimate based on the assumption that those coins are likely lost. But if suddenly they start moving, then their calculations become inaccurate and their models have to change a lot and their risk assessment has to change. So they would need to sell a lot potentially. And I think they are very scared of that and they see it as a relevant risk.

[01:18:00] Robin Linus: And just burning Satoshi's coins because of quantum would just solve a big problem for them.

[01:18:10] Vlad Costea: Yeah, but once again, we had like, I'm not sure if it was a serious proposal, but there was a BIP written most likely by some sort of AI agent that was suggesting that we can freeze UTXOs smaller than 1000 Satoshis for some node efficiency gains. And how is that different from freezing Satoshi's coins or burning or whatever? It's still confiscation.

[01:18:40] Robin Linus: I actually wrote a similar proposal, like UTXO expiry. It's not a BIP, but I just posted something on Delving Bitcoin. And I think my personal motivation behind that is that I think there is an asymmetry between how much it costs to create a UTXO and how much it is a burden to the network. And there are people who are intentionally spamming the UTXO set with UTXOs that are as big as possible, like this bare multisig, sorry, bare script multisigs and so on. And like the STAMPs protocol.

[01:19:19] Robin Linus: And they are exploiting this asymmetry between like the asymmetry that leads to it being too cheap to create UTXOs. It's a high cost for the network. And I think it would be fair to have some mechanism that essentially says, yeah, we're going to store your UTXO for like a while, two years or something, even if it's small. But after that, we're going to prune it from the UTXO set, and then you need to provide a proof and have to pay the on-chain fees for that to prove that your UTXO was actually in the UTXO set.

[01:19:57] Robin Linus: So the... The burden shifts from the total network to the individual user that wants to store very small UTXOs in the UTXO set.

[01:20:08] Vlad Costea: How is that different from taxation?

[01:20:12] Robin Linus: I mean, it is taxation. There is just a cost to storing all these small UTXOs. And I think if you're storing a large UTXO, you are benefiting the network. Then you put your money into Bitcoin and you're helping the network to degree with that. And I think then it evens out, like the cost that the network has to store your UTXO is smaller than what you are giving to the network. But if you're creating like tons and tons of small UTXOs, then it's parasitic. Like you're taking more from the network than you're giving.

[01:20:46] Robin Linus: And that is an unsustainable situation in the long run. So I think it's only fair in, like for the entire network, for all users, that you're shifting the burden of proof or the cost to the individual user.

[01:21:07] Vlad Costea: It sounds to me like Namecoin or ENS, where basically you have to pay to renew the domain.

[01:21:17] Robin Linus: I mean, it depends. There are parameters to the protocol and it depends on how you're designing it. But I think it would be reasonable to design it such that it only affects small UTXOs. Like if you have like, let's say $10 in Bitcoin, then it won't affect you at all. It's only if you are storing like cents in thousands of UTXOs. Because it's also hard to justify why anyone should do that at all. Like where's the legit use case for that?

[01:21:47] Vlad Costea: Right. But I guess you can also see the slippery slope where miners are gonna decide that since they're not collecting enough fees, that it's better if everyone pays like an annual tax for holding their UTXOs.

[01:22:02] Robin Linus: That is actually a valid argument. Like there is an issue with mining subsidy. Like the subsidy is decaying exponentially and the price or like the purchasing power will probably not keep on doubling every four years. And that means eventually we're gonna end up with a situation that miners are getting paid less and less, and then they're gonna die. And then there is an issue with the security budget. And I think Satoshi's original idea was that we're gonna have bigger blocks and like tons and tons of transactions like orders of magnitude more transactions than what we currently have.

[01:22:40] Robin Linus: And then there's gonna be actually a fee market that pays miners. And I think the fact that we are currently not seeing that is a big issue and we need to think about solutions for that.

[01:22:54] Vlad Costea: I just hope that we're not gonna reinvent taxation. That would be such a bummer.

[01:23:01] Robin Linus: I think we just need more demand for block space somehow, right? That would be the best solution.

[01:23:08] Vlad Costea: That's why we had the Ordinals and now people want to remove them from the UTXO set.

[01:23:13] Robin Linus: I don't agree with that. I think Ordinals was like a short-lived hype. It increased or like it led to a fee market for a short while, but now it's dying off. It's not that evil maxis are killing it or something. It's just that it's not sustainable. It needs some money for people to invest in these things. It's not something that has substance.

[01:23:42] Vlad Costea: The way that I see it is that it's like Pokemon cards or baseball cards or whatever. You have hype cycles when they come back and everyone wants them. And then you have moments when the market feels dead. And for a lot of collectibles right now the market is dead. For example, I used to follow some sneakers YouTube channels where they were just talking about shoes and it's very stupid. I'm not into sneakers but I was watching that and I know for a fact that the market is dead and Jordans or whatever are very affordable nowadays when they used not to be.

[01:24:19] Vlad Costea: And also in the case of Pokemon cards they went down. In the case of audio gear that were vintage the prices are down. Actually if you have some disposable cash I think it's a good moment to buy some some of these collectibles if you want to speculate on them. Assuming that the current Gen Z or Gen Alpha is gonna grow up and want to have anything physical because these guys seem to be very much into Fortnite skins or CSGO or whatever and Roblox and it's gonna be interesting.

[01:24:52] Vlad Costea: But the fact that they're into Fortnite skins only strengthens the case for NFTs and whatever because they're gonna grow up and be like oh of course this has value. I used to buy Fortnite skins but this one is on Bitcoin. It's stored forever on this immutable ledger. And of course I want this picture of a penguin or monkey or whatever.

[01:25:14] Ying Tong: Do you guys think rollups on Bitcoin? How would rollups on Bitcoin affect demand for block space? Genuine question.

[01:25:24] Robin Linus: That's a good question.

[01:25:25] Vlad Costea: I love it. She's doing my job much better than I am.

[01:25:31] Liam Eagen: I think that they will increase demand for block space. I mean assuming that they get traction. Like I mean there are many ways. People use the word rollup in many different ways but yeah.

[01:25:44] Robin Linus: I guess it's good to start with like the naive observation that rollups in the first place they compress transactions. So you could make an argument that they will reduce the demand for block space. But the counter argument I think what you were pointing to is that they also increase the demand for block space because they increase the utility. And the other argument you make is that increase in block space or like having using the block space more efficiently also allows more transactions and more transactions can lead to bigger network effects.

[01:26:23] Liam Eagen: Yeah rollups assuming they put the data on Bitcoin which is part of the technical definition of a rollup but some people don't mean that when they say it. I think the main thing is like extensibility or whatever. Like you can do more stuff. You can have privacy. You could have smart contracts. Like yeah I don't know. The biggest probably I think the thing that would increase the demand for block space the most or like the thing I've heard that makes the most sense would be DeFi stuff.

[01:27:06] Liam Eagen: I'm not I don't know kind of lukewarm on but yeah rollups would definitely increase the demand for block space by increasing the functionality. There's things you can do with it.

[01:27:25] Vlad Costea: This is actually a very interesting conversation because I think Citrea took the blame for a lot of the stuff that happened in Bitcoin including Bitcoin Core version 30 which included an increase in the OP_RETURN transaction size. The funny part is that Citrea is not even using that in its current situation but they took the blame for it. And culturally it seems like these ZK rollups are very frowned upon by the very orthodox Bitcoiners who think that only Lightning and Liquid and maybe Ark are the legit ones and everything else is an affinity scam that comes from Ethereum and is coming to spam the chain and whatever.

[01:28:06] Vlad Costea: And I'm very concerned about this because I realize that there's a lot of genuine research that went into these projects and they have the best of intentions. Like they want to maximize what Bitcoin is doing which is what Bitcoin maximalism used to be about but instead they're being blamed for bloating the UTXO set and increasing the blockchain size. And some people will say, well, I run this on my Raspberry Pi and now the blockchain is at 700 gigabytes and I have to upgrade my one terabyte SSD to two terabytes and it's too expensive for me.

[01:28:49] Vlad Costea: And of course my answer is like, man, you're you're holding an asset, which is like a hundred thousand bucks and you're complaining about spending another 100 bucks to buy a hard drive. But, regardless, these people are very much against anything which is coming via rollups. And they think that it's scammy, rollup comes from Ethereum, that's where it was built. And there's this cultural rift that needs to be mitigated somehow to increase the demand. Because the biggest threat to something like Citrea or Alpen is not that maybe that there's a bug in the code and they need to fix it. It's that they build what they have been planning to build, but the users are not coming.

[01:29:36] Robin Linus: That's a real risk indeed.

[01:29:40] Vlad Costea: And that's also sort of the legacy of BitVM I think. I mean if these projects are not succeeding people will look at BitVM and say well there's nothing interesting or profitable or successful that can be built with this. So you guys can also suffer in terms of raising money to develop. This became depressing very fast.

[01:30:08] Robin Linus: I mean it is a risk but it's not a risk that would just would make it not worth trying.

[01:30:18] Vlad Costea: Oh I agree with this. It's just that we have to work on the culture, that's the whole point. And not in the Taproot Wizards kind of way. Because I think they were too aggressive and too obnoxious and very easy to dislike.

[01:30:31] Robin Linus: I don't think it's that much of a problem because it's a few people, like it's not millions of people or something. The number of people that are potential users and the number of people who hate rollups, I think they are outnumbered by a huge margin. So I think it's important to just stay positive and not get distracted too much by people who just hate everything that is not invented here.

[01:31:02] Vlad Costea: Oh sorry I was muted in OBS. What's also interesting is that if you look at Citrea and Alpen, they seem to be much more welcome in Ethereum conferences. So if they attend something Ethereum related, they're going to have some sort of side event, they will talk with people. And I think that their long-term bet is that Ethereum people are going to come back to Bitcoin and they're going to be using their ZK rollups. Because I don't see too much enthusiasm from Bitcoiners who brag about holding their coins in cold storage and never spending anything.

[01:31:44] Ying Tong: I think the culture wars are not interesting and are distracting. And really what it's about is the ideals of privacy, of decentralization. And why rollups are interesting is because they can offer better security. Why we're working on Argo and garbling circuits, garbled circuits for BitVM bridges is for the same reason. Just fundamentally better security guarantees, more decentralized bridges. And I'm pretty optimistic that these real qualitative differences will translate to more users.

[01:32:31] Ying Tong: Will make these bridges actually feasible for more users, like institutions. Doesn't matter if they're from Ethereum or whatever.

[01:32:42] Ying Tong: They want security, they want privacy. And at the end of the day, that's what matters.

[01:32:51] Robin Linus: Well spoken.

[01:32:53] Vlad Costea: I like that. By the way, what is Argo? I feel like I dropped the ball on this one. I'm not referring to the 2012 movie starring Ben Affleck.

[01:33:06] Liam Eagen: That's our garbling scheme. The garbled circuit, that's the piece of research that we've produced. We published a paper about part of it.

[01:33:19] Liam Eagen: Like we said earlier, the BitVM Alliance uses a garbled circuit scheme based on Yao's garbled circuits. And it's like 50 gigabytes and takes, I don't remember, like tens of seconds on a laptop to garble. And our scheme is 15.5 megabytes to garble a Groth proof and less than 100 milliseconds to garble. So that's what Argo is.

[01:33:55] Robin Linus: To give maybe like a bit more of a high-level view, I like the word off-chain computation. Like these garbled circuits in general, they enable off-chain computation. And the way how it works, in particular in bridges how it works, it's like some user says, hey, I'm going to take money out of the bridge because I initiated a valid peg-out on the side system, on the sidechain or the rollup or whatever. And they make that statement in form of a proof, a proof of validity, and they post that proof on-chain.

[01:34:33] Robin Linus: And with these garbled circuits, you can evaluate that proof. You can check that proof off-chain. And if it's incorrect, then you learn a secret. And that secret can be used to slash the person and stop the peg-out on-chain. So it's essentially just a hash lock mechanism. And what is amazing about it is that this simple primitive of a hash lock gets extremely powerful now because you can combine it with like arbitrary computation, arbitrary complex computation, and you can in particular combine it with these kind of proof systems.

[01:35:09] Robin Linus: And yeah, garbled circuits, the general idea, I think it came up last year at some point. And now Argo is like making it extremely efficient. Previously it was a bit clunky and needed lots of off-chain data, and now Argo is making it extremely efficient.

[01:35:29] Ying Tong: And the efficiency is not purely and simply a performance gain. It passes this threshold where it actually enables a different kind of bridge. So it enables orders of magnitude more operators to participate. And so this decentralizes the set of operators. It enables permissionless challenging. So this allows every user to contribute to the security of the protocol. And so this is a qualitatively different bridge than what was possible with the Yao garbled circuits. So that's actually why the performance of Argo is interesting. It's just a step change in the types of bridges that are possible. Better security, more decentralized.

[01:36:22] Vlad Costea: Here's a suggestion. Whenever you guys start doing marketing, you should hire someone named Jason. And his name is going to be Jason and the Argonauts. Yeah.

[01:36:37] Vlad Costea: Just a funny pun. So it's really interesting what you guys are doing. I'm a big fan. As I said, it's part of the maybe two reasons why I'm still excited about Bitcoin yet. I would be very pessimistic. I would [unclear: mic her and myself] if it wasn't for a BitVM and it wasn't for the concept of drivechains, which are basically enforced by miners and allows them to collect extra revenue. And I'm really happy that you started something which looks very promising. I'm not sure how you're going to get paid doing this.

[01:37:12] Vlad Costea: I hope that someone listening to this is going to come up with ideas to help you guys keep going. And I also have a bunch of Monero people listening to this. And I know we spoke about Zcash and you guys are big fans and you like what they're building. And you're trying to bring some of that to Bitcoin. And I think that's super noble. But what do you think about Monero?

[01:37:35] Liam Eagen: Monero is cool. Yeah, I like their full-chain membership proof stuff. I have not followed it as closely recently, but my understanding is it's going and that's cool. I think the ethos of Monero is reminiscent of Bitcoin from a long time ago in some ways, which is a bit nostalgic for me. So I like that. Yeah, I don't know.

[01:38:12] Vlad Costea: It's funny because what you're praising about Monero is the upgrade that's coming, but not what it currently is.

[01:38:20] Vlad Costea: Like the 16 decoy ring signatures and stuff like this. You think it's old tech?

[01:38:32] Liam Eagen: I don't know. Is that an inflammatory thing to say? I mean, it's been around for a long time.

[01:38:39] Robin Linus: I also think it's not necessarily bad in cryptography, right? That's actually a good thing.

[01:38:45] Liam Eagen: Yeah, I think it's cool. Like people use Monero to buy things, which is maybe the most important thing for cryptocurrency. But yeah, I don't know. I mean, I don't know what. I assume this was kind of like everybody agreed that switching to the full-chain membership proofs is just obviously the right thing to do. It's better privacy for not negligible cost. Just a matter of doing it carefully.

[01:39:26] Vlad Costea: Okay, but coming back to Bitcoin, if you guys succeed and you're going to be able to build your garbled circuits and we're going to get a covenant soft fork and maybe also some of these operation opcodes like multiplication and addition. Where do you see Bitcoin in like five years? Like what do you imagine is going to get built?

[01:39:55] Liam Eagen: I think we're going to make a bridge based on Argo. Better than the existing BitVM bridges. I think there's one world in which we're able to somehow activate a SNARK verifier, and then we can just use that. I hope that there's a way for people to use Bitcoin privately and without relying on centralized third parties, which unfortunately has been the direction things have been trending for a while now. So that's my optimistic vision for the future. I mean, of course it could also go the opposite way and everything gets worse, but I hope not.

[01:40:41] Vlad Costea: Robin?

[01:40:43] Robin Linus: Making Bitcoin more useful as money, I think that's the vision. That's the hope. I see the obstacles with that, but I also think that this is just where we have to head. Making Bitcoin as useful as possible for the use case of money. And what it needs, I think, is better scalability, better privacy and better usability. And that's what we're going to focus on.

[01:41:19] Vlad Costea: Ying Tong, where do you see Bitcoin in five years?

[01:41:26] Ying Tong: I see Bitcoin being a lot more interesting, just as significant as it is today, reaching more people and more use cases. And I think the great strength of Bitcoin is in its consensus and in the security that these rollups can derive from it. And I think if we could have rollups on Bitcoin, we could just allow more people to benefit from that security. So that's my vision.

[01:42:08] Vlad Costea: You guys mentioned SNARK verification quite a few times, and I'm curious what you think about ZK-STARKs, which is something that's being built by StarkWare. And even Blockstream researchers seem to be very interested in that.

[01:42:23] Liam Eagen: Yeah, so SNARK is like the larger category. STARKs are like a type of SNARK. So when I say SNARK verification, I mean in the broad sense. Mostly just because it's not possible at all now, so I feel like any step in that direction would be very positive. But yeah, STARKs are, the ZK world, I mean, it depends on how you define things. But I think most of the big proof systems use STARKs or something like that now, because they're fast and that's what people want. For on-chain stuff, people on Ethereum I think typically use Groth16 because it's small, and you can combine them.

[01:43:15] Liam Eagen: But yeah, in relation to the post-quantum conversation earlier, STARKs are post-quantum, which is really cool that you can have proof systems that are post-quantum. So maybe we solve the post-quantum thing by just getting a STARK verifier on Bitcoin. Personally, the reason I think that what I described of activating field arithmetic versus a monolithic STARK verifier is because what STARKs are has changed over time. So StarkWare, for example, has had different proof systems. I think it's called Stone and now Stwo. So the risk of enshrining a specific verifier into Bitcoin is that the state of the art changes, and the state of the art of SNARKs and STARKs has changed quite a bit in the last five years.

[01:44:10] Liam Eagen: So I mean, who knows? In five years, maybe we'll have proof systems that use binary fields or that use GKR. So you just want the flexibility to not be locked into something, because it's so hard to make changes that I really want to make sure we get as much as we possibly can out of any changes that we do make. But yeah, I don't know. Pro STARKs. They're cool.

[01:44:36] Ying Tong: We're going to be looking into STARKs for Shielded CSV for sure, because they're very efficient for client-side proving, and there's efficient STARK recursion implementations. Yeah, I'm also, I think STARKs are a very exciting area of research.

[01:45:01] Robin Linus: What we haven't mentioned here is that STARKs don't require a trusted setup.

[01:45:06] Liam Eagen: Oh, yeah.

[01:45:07] Robin Linus: So the security guarantees, they are just superior, but they are already kind of like an industry standard, right? Like all these big proof systems, they are using some sort of STARKs. It's just like the last mile. You don't quite want to put the STARK on the blockchain because they're vastly bigger than these SNARKs. That's the key advantage of SNARKs. They're slow, require a trusted setup, but the advantage is that they are extremely small. They're just almost as small as the signature.

[01:45:52] Vlad Costea: It's interesting. Usually when people bring up the ZK stuff, it's a bit intimidating. I remember last year I was at BTC Prague and I tried to explain to someone what's a zero knowledge proof, and he was like, no, I'm not interested. And it's shitcoin stuff. Please just leave me alone. And I was super excited about it, but it is to some degree like moon math, you know, it's very complicated. It's sort of like trying to explain algebra to someone who only did arithmetics. And they want to see the numbers, but you try to explain to them that the numbers have been compressed in this formula. What's a good place to start to learn ZK stuff?

[01:46:41] Robin Linus: Dan Boneh's classes. There are a few videos on YouTube and I think there's also a MOOC about it. There's a massive online course on Coursera or something.

[01:46:55] Liam Eagen: There's also the ZK podcast. There's a podcast about ZK stuff that's, in my opinion, pretty accessible. I think it depends on the person. If it's someone who's not at all mathematically inclined or interested in math, then I would say that. If it's someone who is interested in how SNARKs work, there are a lot of resources, like tutorials. I think Ying Tong has a tutorial about PLONK. The PLONK paper, for example, for someone who has a good algebra background, is very accessible.

[01:47:40] Liam Eagen: It's easy to read. Some SNARK papers are pretty difficult to read, even as someone pretty familiar with the material. PLONK is very well written and accessible.

[01:47:53] Robin Linus: The other thing for engineers, I think it's also interesting that you don't need to understand how a SNARK actually works to be able to use it and to have these amazing compression capabilities. There are lots of libraries that are easy to use. Most people who are using signatures don't really understand how signatures work under the hood. You don't have to be able to understand that, to use the tool.

[01:48:23] Vlad Costea: Are you guys coming? Oh, I'll let you say it before.

[01:48:26] Ying Tong: Yeah, just adding on, I'm an engineer myself, and it helps me to learn when there's hands-on examples, like self-contained mini examples. So this company, RISC Zero, they actually built a ZK-STARK in a Google spreadsheet. It's going to take you step-by-step to compute a STARK proof, like all in an Excel, Google spreadsheet. So looking for toy examples really helps me build intuition.

[01:49:05] Ying Tong: But yeah, I think, like Robin said, the aim really is to get STARKs and their security to that level where we shouldn't have to worry about it. And we shouldn't have to interface with it as the end user. Like, do you think about HTTPS, for example? Do you think about the TLS handshake? No. So hopefully it becomes invisible and secure.

[01:49:38] Vlad Costea: Oh, that's really beautiful. I was going to say that you, Robin, forgot to retweet the podcast. Really? You should do that ASAP. Also, are you guys coming to any conferences this year to talk about your work, to interact with other researchers or whatever?

[01:50:00] Liam Eagen: I'm going to go to Bitcoin Vegas. And be in Denver next month.

[01:50:09] Vlad Costea: Yeah, I'll see you there.

[01:50:11] Liam Eagen: Oh, nice.

[01:50:13] Vlad Costea: I was actually invited to MC on one of the stages. They have like a Bitcoin stage and a shortage of personnel.

[01:50:21] Liam Eagen: Okay, cool. I don't know other than that. Oh, I think I might go to the MIT Bitcoin Expo. I'm not sure beyond that.

[01:50:40] Vlad Costea: So basically only US events?

[01:50:44] Liam Eagen: I guess those are all in the US. But no, no, I don't. There's a ZK Summit, I think, this year in Europe. I don't know if they've announced where it is, but I might go to that. I like those. If you're interested in ZK, you could go to that chat with some ZK people.

[01:51:12] Ying Tong: We're also really open to suggestions. What are good events? I'm based in Singapore. So any cool events around Asia, this region? I was thinking about Real World Crypto, which is in Taipei. It's in Taipei this March. Yeah.

[01:51:38] Vlad Costea: I know that the Intmax people are also doing an annual conference in Japan. I'm actually tempted to go to that one because I've always wanted to visit Japan.

[01:51:55] Liam Eagen: Do you know when it is?

[01:51:57] Vlad Costea: Usually it's later in the year, around October or November. I was also thinking about doing a privacy-centered conference here in Romania, but it's tough with the new regulations. Because basically if you're gonna do a conference, you cannot have any payments on the venue that deal with privacy coins or any other coins. Like you need a MiCA license and you need to pay lawyers to draft that. And it's a lot of work.

[01:52:30] Vlad Costea: So maybe I can do it, but just academic without any sort of official way to buy stuff or make transactions.

[01:52:43] Vlad Costea: Yeah. Anyway, the plan was to have like a Halloween party. That was sort of the excuse to get people next to Dracula's castle on Halloween Day.

[01:52:55] Vlad Costea: Work in progress. Don't think too much about it. I'm curious if you guys have like a speaker's rate or something that people usually pay you to go speak to places.

[01:53:07] Ying Tong: Nobody has paid me ever.

[01:53:12] Liam Eagen: No, I've gotten free tickets as a speaker, although I feel like that's kind of mean to make you pay for your own ticket if you're speaking somewhere.

[01:53:23] Vlad Costea: Sort of, yeah. You guys are selling yourselves very short. Robin, did anyone ever pay you?

[01:53:36] Robin Linus: I think I got reimbursed travel expenses once, but I never got paid to actually go somewhere. I never got a salary for it.

[01:53:45] Vlad Costea: I'm going to send an angry letter to David Bailey.

[01:53:49] Liam Eagen: Are other people getting paid to speak at conferences?

[01:53:52] Vlad Costea: Man, I've heard some numbers like Nick Szabo or Phil Zimmermann, but these are like heavyweights. I've also heard that people like Jimmy Song, they have like a pride that they want to be the best paid. And they're like, oh, if I'm coming to your event, you got to pay me more than the other guy.

[01:54:14] Vlad Costea: But you got to grind to build your brand for this. And that's the part that sucks. If you're only doing your work, people will be like, oh, that's cool. But if you have like 100,000 followers on Twitter and you engage people and whatever, they think that you're going to sell tickets. So if you sell tickets, then they're going to feel like they can pay you.

[01:54:41] Vlad Costea: Like they put your face on a poster and they're like, oh, Michael Saylor is coming to whatever. And people actually pay to watch him and then go into debt.

[01:54:56] Vlad Costea: This this became depressing once again. Okay, so you guys, I'm not sure if you were very specific in talking about the conferences. You mentioned one in Taipei and you also said that you're open to others. Robin, to how many events are you going this year?

[01:55:15] Robin Linus: Yeah, like there's a few Bitcoin events at ETHDenver. Then I'm going to Bitcoin Vegas. MIT Bitcoin Expo, hopefully. Or BTC Prague, maybe.

[01:55:47] Vlad Costea: That's so vanilla. But I guess it's the largest in Europe. So that's [unclear: a good example].

[01:55:55] Liam Eagen: I mean, what is the one in a Paralelní Polis, MoneroKon? I've been to that one a few times if I'm around Prague. I like that.

[01:56:06] Vlad Costea: Yeah. Last year it happened in Paralelní Polis, but this year it's going to happen in Warsaw.

[01:56:12] Liam Eagen: Oh, really? Oh, wow. Okay.

[01:56:14] Vlad Costea: Basically, there is a Bitcoin Film Festival and next door there is going to be the MoneroKon.

[01:56:24] Vlad Costea: I guess, you know, I'm going to be at the Bitcoin Film Festival because the Monero people hate me. Like, I actually got threats. Like, I'm going to break your legs if I ever see you in person, 'cause I... Oh, shit. They felt betrayed because I prefer Zcash over Monero.

[01:56:40] Liam Eagen: Oh, no. Oh, no.

[01:56:42] Vlad Costea: And at some point I became angry and I was like, you know what? I'm going to sell all my Monero. Fuck you guys. It's very personal and dramatic, so I'm going to have to look behind my shoulder the whole time.

[01:57:00] Liam Eagen: Yeah, stay safe.

[01:57:04] Vlad Costea: Is there anything that you wish I asked you and I failed miserably by not asking you?

[01:57:15] Robin Linus: When mainnet?

[01:57:17] Vlad Costea: Yeah, when mainnet? When token? When ICO?

[01:57:22] Robin Linus: It's not going to be a token. I got to cut off my hands before I launch the token.

[01:57:33] Liam Eagen: Yeah, but hopefully soon. I think [unclear: they take] all the stuff except the token.

[01:57:41] Vlad Costea: By mainnet, what do you actually or what do you mean by mainnet? You're not going to be like a separate blockchain. It's just going to work.

[01:57:50] Robin Linus: Our technology is going to be used on the Bitcoin mainnet.

[01:57:55] Vlad Costea: Yeah, that's an important distinction.

[01:58:00] Liam Eagen: Argo is fully implemented and so we haven't released it yet because we're still making modifications and have to get it audited and stuff like that. And the bridge is in progress. But yeah, so it's coming along. We've only been doing this for a little while.

[01:58:24] Vlad Costea: So you guys have called your project {ideal}, but is it really ideal? I let this be the final question.

[01:58:35] Robin Linus: Ideal is a math term from ring theory and we thought it's kind of funny but it's not really [unclear: landing], I guess.

[01:58:42] Liam Eagen: I think an ideal is like something you approach. Like we aren't the ideal, but we're like a limiting sequence of steps that gets close to the ideal.

[01:58:54] Robin Linus: That's beautiful.

[01:58:58] Vlad Costea: Liam, once you retire from cryptography, you should write philosophy, man. You're going to sell a lot of books.

[01:59:04] Liam Eagen: [unclear: I'm not going to sell a lot of books.]

[01:59:08] Vlad Costea: Anyway, thank you very much. It's becoming awkward and I don't want to hold you past. I don't know. A couple of you guys are in East Asia, if I'm not mistaken, and it must be very late. Maybe past your bedtime. I don't want to hold you too much.

[01:59:24] Liam Eagen: It's okay.

[01:59:28] Vlad Costea: Big fan of your project. How can people follow it on GitHub or Twitter or whatever?

[01:59:35] Robin Linus: @idealgroup.

[01:59:40] Vlad Costea: That's Twitter, right?

[01:59:41] Robin Linus: Sorry?

[01:59:42] Vlad Costea: That's Twitter?

[01:59:45] Robin Linus: @idealgroup.

[01:59:45] Liam Eagen: And I think the GitHub is also idealgroup.

[01:59:49] Vlad Costea: You guys also have a web page or something? Ideal.group. Oh, fancy. Oh, that's why you said you searched for a domain for such a long time.

[01:59:59] Robin Linus: That's the hard part. Like, the cryptography, that's easy. The hard part is naming things.

[02:00:05] Liam Eagen: That's true. I'm terrible at naming things.

[02:00:09] Vlad Costea: This is beautiful. Love your web page. Love your project. I hope you succeed. I hope Citrea and Alpen spend another year in development and audit just to implement this. And I hope you bring another 1,000x improvement afterwards, if that's even possible at this point. Thank you guys for your time. Thank you for your work. I gotta say that if I was at a conference and I saw a bunch of guys like Michael Saylor and Brian Armstrong and I don't know who else, like all of these big money people that you see on TV and then I saw you guys, I would come to you guys and just be a fanboy.

[02:00:50] Vlad Costea: I really like what you're doing. You're bringing back the spirit of Bitcoin. You're keeping me bullish and you're making me pay attention to what's happening in Bitcoin because it's so easy to lose hope.

[02:01:04] Liam Eagen: Thank you.

[02:01:06] Robin Linus: I like your podcast. Like you have a very wide view on the cool things and not as narrow as some people who take Bitcoin overly serious.

[02:01:20] Vlad Costea: Oh, thank you Robin Linus because I see Bitcoin more like Linux, you know, like something that you build on top of like the blueprint. Satoshi gave us the open source code and we can take it and build stuff with it.

[02:01:35] Robin Linus: And I hope you're going to become a click millionaire this year. Yes. I'm going to retweet your podcast.

[02:01:40] Vlad Costea: Hopefully with this interview.

[02:01:46] Robin Linus: Hopefully with this interview. Yeah.

[02:01:48] Vlad Costea: You never know when you publish it what happens. So thank you guys. Go to ideal.group to read more about their project and also follow them individually. It's Robin underscore Linus and Liam Eagen. And in your case, it's the real or is it with the let me check for a second. Yes, it's therealyingtong. Y-I-N-G-T-O-N-G. Follow them because they're very interesting people.

[02:02:25] Ying Tong: Thank you, Vlad.

[02:02:27] Vlad Costea: Thank you.

[02:02:27] Robin Linus: Thanks for having us.

[02:02:29] Vlad Costea: Thank you for building this. And I hope I'll interview in one year and you're going to tell me that the progress that you wanted to make in five has already been reached. And you're on some beach somewhere.

[02:02:39] Robin Linus: Well, then you got Claude Code.

[02:02:41] Vlad Costea: Yeah. And you're basically retired and just enjoying life.

[02:02:49] Robin Linus: On Bitcoin. Paying everything in Bitcoin privately.

[02:02:53] Vlad Costea: Yes. You buy your coke over Tor, as Jack Mallers promised in 2022. Okay, I'll go before I get arrested. Bye. Bye. Thank you. Bye.