He might be a bitcoin core Dev but does he use ledger/trezor etc?

Is his PGP key on his hardrive or a smartcard?

In this day and age your computer not a bastion it once was. (It never really was but it's more of a problem in 2022 than 1982).

The system needs to be tolerant of failures and faults of multiple natures. And cryptocurrency is very intolerant or many types of failures and faults.

So why is crypto the only thing getting attention?

> Soon you will see people saying you should have done this or that complicated thing

and you answer:

> Is his PGP key on his hardrive or a smartcard?

you're proving their point.

I would assume that if you are a major player in the bitcoin world, you should do complicated things to secure yourself.

Its sort of like if someone wins the lottery, and tells the world they are putting the money under their mattress in their home. Its not unreasonable to say that such a person faces more risk than an ordinary person and should install an alarm system or something.

The Bitcoin model is broken. It very intentionally got rid of all the institutions that regulate and control finance, and in doing so, it got rid of everything that protects regular people from the wolves. The regular people aren't up to the task of protecting themselves, and they regularly show it. The model is broken.

But to the specific point, there is no model that fully takes this into account. There is no model that puts risk to zero. There will always be adversaries that can attack you if the payoff is large enough. There will always be people with increased risk exposure who have to take special precautions because the effort/reward calculus makes sense for malicious people to attack them.

The reason bitcoin sucks is not because its model includes such situations; it sucks because the bar for someone to be the type of person who has to care about such things in bitcoin is so much lower than in traditional banking.

If you don't take up the easy convenient solution to your problem that's on you.

Hopefully this is a starting red flag for the bitcoin Dev team to implement hardware wallet support.

That's the absurd confirmation bias going on in this thread.

Cryptos piffy catchphrase is be your own bank. you can own security far beyond a bank vault for like £40 if you get a ledger nano...

Agreed, and the problem is that this is a feature. Without that feature of a lack of central control, Bitcoin's main use case is invalid.

If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.

Internet security is 99% "nobody gives enough damn to do it".

This is my opinion of the entire software industry.

Chrome exploits, iPhone hacks, etc. These are nearly trillion dollar companies. If they can't do it then nobody can. Something is fundamentally broken.

People have touted capability-based security, but I don't think that's the answer, at least for consumer devices (phones and not-administered-by-IT computers). Users will give an app whatever permissions it asks for in order for it to shut up and start running, and those permissions will be used to gut their security. It may limit the damage somewhat, depending on how disciplined the app and the user are, but it will only reduce the damage.

We need a completely different answer. I don't know what it is.

As another poster said, we need some other computing paradigm, but I don't know what that would look like. All I know is something is broken if these behemoth companies with limitless resources still get it wrong.

Yes, Qubes does not solve the problems like Spectre and Meltdown. Yes, you must trust your hardware to use it. If you are looking to solve such problem, then you might be interested in a stateless laptop: https://blog.invisiblethings.org/papers/2015/state_harmful.p....

Apart from that, I believe, the best computing paradigm is free software and free hardware, but it does not seem too widespread now unfortunately. This would be the actual solution. The "behemoth companies" are not trying to solve computer security. They are trying to get as much profit as possible, and it goes against security of the users. This is why they are not supporting free software.

My current "good enough" solutions are disabled and neutralized ME in a laptop and Librem 5 phone.

So, rather than the consumer being responsible for their actions you support consumers engaging in whatever risky behavior they like as long as someone else is there to protect them or give them a do-over?

Yes. Every time you make a foolproof system the world brings us a bigger fool. I'd rather a few irresponsible people get a do-over than a few otherwise responsible people get rekt like this.

Then again, the point the GP seems to make is that this kind of platform should not be adopted for anything important, let the gamblers gamble if they want but don't try to sell it to the general public.

That's unreasonable for something that's supposed to be used as money

There is a big middle ground between "cover for users engaging in whatever risky behavior they like" and "cover for nothing whatsoever".

In this case, the problem is expecting users to be perfectly diligent, and either discard all convenience or all security.

Cryptocurrency continues to be a case study demonstrating why so many of the systems it's trying (unsuccessfully) to replace operate in ways that it doesn't.

Like in the non-crypto world, banks are the experts on storing money securely, but people still try and rob banks despite ordinary people being much easier targets.

cryptocurrency is stupid. regulation around banks is there for many very good reasons.

Do we know that? The tweet you linked to basically says, we have no idea what happened so we have no idea if it was targeted or not.

But i do agree generally that i have no idea why "imagine the financial system but with no regulation or oversight" is considered a selling point.

A lot of hope, actually. If he followed the simple and oft repeated advice of using a cold wallet and/or offline computer, this attacked would have been mitigated. Hell, if some of the comments/speculation in this thread is true (ie. he kept his wallet.dat on a server connected to the internet), then this hack wouldn't have affected the user with the most basic setup of a software wallet running on a computer behind a NAT firewall.

Anyways those doing the foisting also includes all the shills, the laser-eyed, the influencers. [edit] It's not enough to say because they weren't forced at gunpoint, it's not coercive or immoral. We don't accept that behavior from people shilling penny stocks. And of course Salvadoran shopowners were in fact coerced with force.

Sure, there are institutional investors holding crypto, but how is this related to the current discussion of securing crypto? They're not exactly keeping their crypto holdings in a software wallet connected to the internet. They typically outsource that to companies that specialize in crypto custody, which presumably have better security practices than the OP.

It preys of financially illiterate people who don't know better because they have been bombarded without any pause by endless list of bullshit as soon as they put the word 'investment', 'money', 'market' or whatever in any search box in the world, that being the one from your local bookstore, online newspapers, youtube, google, reddit and on and on and on...

And if you tell me fractional banking system is a ponzi scheme then you either don't have a clue of what they are or you pretend to.

It doesn't matter which companies, individuals or wathever .org or 'coin something' websites promote them or make a business of them because they're all fucking hucksters at worst or paid shills at best.

Talking 'security' about investment scams is like talking personnal safety in '101 suicide' book.

Except in this case, it seems like he went out of his way to make it less secure, by putting his wallet on his server. This isn't a case of someone losing his mattress savings in a random home burglary, this is a case of someone leaving a duffle bag of cash in the seat of a car.

I mean this guy is already demanding the FBI get involved when the FBI's position is you should just put it in a bank account and not need to call us in the first place.

https://www.newyorker.com/humor/daily-shouts/l-p-d-libertari...

I think you're conflating "someone who is defending crypto in this particular instance" with "someone who thinks bitcoin will take over the world".

>I mean this guy is already demanding the FBI get involved when the FBI's position is you should just put it in a bank account and not need to call us in the first place.

Yeah, I think we're in agreement here that he was acting like an idiot.

We've talked a few times, I always appreciate your perspective :)

But even if that weren't true, that doesn't mean its a good idea to use it or advocate for it or pretend it doesn't have these glaring flaws as folks march onward toward the abyss and take down the normies with them.

It's everyone's responsibility to call out bad ideas that harm us all. Especially when as soon as anything goes wrong, the afflicted yell "HELP! POLICE!!" just like our tweeter down-thread. That's a draw on public resources which puts this discourse squarely in the public interest. Not to mention spending like 0.6% of the world's electricity on coal-powered lotto ticket scratcher machines undergirding the whole thing.

The funniest part is when things start to go wrong all the talking heads jump in and start saying "crypto deserves better critics!" It has fantastic critics - you just have to listen. Critics aren't supposed to say things you want to hear.

Your average user will install whatever crap they find on the Internet. Hell, a friend of mine (in their 20s, not a grandma) recently installed god knows what when “Windows support” called. And it’s not the first time a friend fell for this kind of scam.

[1] https://twitter.com/peterktodd/status/1609655629903265795