LLMs are very two-sided for security. On the one hand, long-latent bugs are finally surfacing. On the other hand, before you choose to use a product, you can get your own code review done for incredibly low cost*! In the short term it’s incredibly bad, in the long-term it democratizes code review greatly. “Don’t trust, verify” finally becomes an actual possibility for normal people! * of course LLMs do still make up issues when asked, push any such review to write PoCs to check their analysis!

There are related vulnerabilities in later hardware as well. At this juncture I would migrate funds off of any single-sig (or multi-sig of only) colcard wallets that were generated on-device without dice or passphrase. View quoted note →

LLMs are so well tuned for optimizing the lighting pathfinding problem. Give them a dataset and tell them to optimize a parameter and they go ham. Big things ahead for the LDK pathfinder and lighting payment success rates.

This idea that lightning nodes, by default, store every single invoice or offer you generate over RPC is insane. There’s no reason to bloat the DB and expose users to DoS risk if they generate invoices automatically, the damn things can be stateless and additional metadata you need can be stored in the invoice and retrieved on payment, rather than stored.

I fully do not understand the desire of lightning people to build protocols to “buy a channel”. No one has ever wanted to “buy a channel”, they want to buy reliable HTLC delivery. That might imply multiple channels, splicing, and probably implies just-in-time channels, but it definitely doesn’t imply just buying a channel and calling it a day.