Thread

You didn’t meaningfully engage with any of my arguments, which is a bit sad, but you know that isn’t going to happen. Any QC startup that gets that far is going to have investors that want paid back. They’ll sell about as quickly as they can.

its a social problem masked as a technical problem i dont think preemptively stealing coin because they may theoretically get stolen in the future makes sense once you go down that route it’s a slippery slope

so... the "social problem" is a (perhaps manufactured) crisis? for example, nobody here can gauge the likelihood of QC in the next 10 yrs. how is anybody deficient in information supposed to decide if they support a technical solution to a problem that may not exist? so your slippery slope is an issue becoming precedent for making *technical changes* in response to threats we cant actually measure.

I agree it’s not a technical problem, but of course technical details impact the available options and should be considered. Yes, we agree that “preemptively stealing coins because they may theoretically get stolen in the future” is a terrible idea. Considering such a change at any time prior to when it’s clear that a CRQC is on the immediate horizon and clearly going to happen would be absolutely insane. But once you do reach that point, some vulnerable coins are not going to be claimable by their owners no matter what you do. I prefer to allow some of the owners to get their funds back by freezing and enabling claims via a ZK proof of seedphrase over letting some QC startup steal all the coins. Seems kinda obvious that the community would prefer that to me, but I guess maybe not.

> when it’s clear that a CRQC is on the immediate horizon not sure how we would be able to know this?

No one is advocating freezing QC-vulnerable spend paths any time soon. And if no CRQC ever appears, then no such freezing should ever occur! The question is only what to do if a CRQC is clearly going to exist within a relatively short time period - do you freeze and let people with seed phrases get their money, or do you let the CRQC operator steal it all?

The current QC research world is quite open, and I see little reason to think that that will change any time soon. It’s possible it does, of course, but the companies and scientists working to build them want credit, to attract investment, to attract customers (once they have something useful), etc.

💯 "clear", "(R)elevant", and "immediate horizon" all just seem way to vague in this context to me. As such, forming any kind of consensus on when this has happened seems unrealistic to me... and that's in addition to forming a consensus regarding freezing coins at all.

presumably if a crqc becomes within reach that will all go dark, no?

yes that makes sense. My point is about information availability and social consensus about it. you're assuming people have shared *trusted* information sources to evaluate threats. I'm thinking Matts point of view is developed from an assumption people do not share trusted information sources. As a result, social consensus about the reality of a threat could not emerge. So instead of accurately measuring the real likelihood of a threat, people can also get hype about a threat that is actually very low probability or people can get information that minimizes what may actually be a high probability threat. Thinking that everyone shares your trust in the information sources you prefer is soooo mid-2000s 😂 its unfortunate. but its the information space we live in now.

Certainly possible, yes. I’d be fairly surprised, though. Yes, if a CRQC becomes realistic there may be an incentive to hide it so that you can complete it and go steal a bunch of bitcoin, but generally conspiracies don’t really scale - it seems to me it would be incredibly unlikely that a large team of expert scientists (not to mention investors and executives and support staff) would not be able to keep quite that they’re within shooting distance of a CRQC. More generally, while it’s possible that this happens via some huge breakthrough, that isn’t what we’ve seen so far with QCs - they’ve been very slow deliberate progress iterating in small public steps. A startup making good progress for 5 years then suddenly going dark without shutting down may well also be an indication of something. Ultimately this gets into the “it’s hard to speculate what a future community might do” because there is so much detail to any potential scenario that would go into such a decision. In my (fairly strong) opinion, the community is likely to have enough information to be relatively confident that a CRQC is highly likely at least 1-5 years prior to it existing (where the range is mostly uncertainty about the rate, not uncertainty about the state of things), but it certainly could happen that I’m wrong. Ultimately we can’t decide for the future community, but we do need to at least somewhat predict what they’re going to do because it’s important to understand it to help us decide what to do today to prepare. This all somewhat ignores the possibility that a government gets a CRQC first. I’m admittedly not incredibly concerned about that, both because so far it appears the most advancements have been in private companies willing to throw money at this, but even if that changes, a government leaking that they have a CRQC by stealing Bitcoin doesn’t seem super likely to me either.

Would you expect to know if a government was making advancements towards a CRQC?

Do you have a good source for this? I hear this sometimes but I would like to know how the "quantum attack is impossible" crowd came to this conclusion? I do agree that burning is not the way though.

There are basically three camps, as I understand it, who all agree this is impossible. 1. Gil Kalai and friends who buy QM but says there is "correlated-noise" that will limit scale even with perfect engineering 2. Roger Penrose and friends who don't buy QM as it stands but have another model and would say there is "self-decoherence" because of gravity and such 3. The aristotelian/common sense camp (which I agree with) that says that quantum weirdness is a total misunderstanding because materialists are looking at the world upside down Whoever has the right model, there are more people than you might think who agree it's obviously not physically possible. That doesn't mean we dont think the eimnginers are good enough. It means it is not possible because reality has rules and those rules called physics make it fundamentally totally impossible. I think from a non-insane point of view, as things get bigger you end up with a normal universe and not a quantum weird universe. Have you ever violated the principle of non-contradiction in real life? Have you ever known a cat that was both alive and dead? Whatever the details are, the result is the same. If you are a "Believe the Science" type, rather than a common sense person, I suggest Gil Kalai. They've been running these experiments for a long time and never proven his math or his point wrong this whole time. I am pretty sure a lot of the researchers secretly think he is probably right by now, but what are they going to do? I don't want to burn any coins either, though I have not looked hard enough at The Cat yet to decide if I think it is valid to kill the spam and dust. I do not agree with supporting non-menetary abuses of the network. So maybe that makes sense but I I'm not taking a hard position right now and I'm not focused on that and haven't dug in enough. What I do care about is that doing anything about QC right now is objectively very destructive to Bitcoin and freedom tech in general. ECC is our best weapon and we shouldn't give it up based on an an unfalsifiable and unoroven belief that QC is even possible, much less eminent. If they crack a key with shor we will have plenty of time to deal with it before it becomes and economically viable threat. Which will never happen anyway. So let's shut this FUD attack down for now. There are a lot of bad incentives for promoting this scare and it is all bullshit.

I tend to agree with your conclusion. Talking about and generating new ideas is fine, but until seriously threatened, making any changes now or bip’s without thoughtful application of NIST-tested methods, etc., it’s primarily an academic exercise and shouldn’t be anywhere near bitcoin code.