Richard Moot: It’s kind of funky, because I think most people think of it as separate companies. And I think they were kind of operated functionally that way… But as far as I’ve understood this, it’s all Block. And each one of these other things are brands that are part of Block. But I joined before we became block, so it’s I still have this thing burned in my brain that I work for Square … Recently that’s changed a little bit, so I work on all Block products, doing developer relations now.

So yeah the relationship is each one of these divisions kind of focused on a different audience in the economy. Square is focused on businesses, and trying to run small businesses, midsize businesses… We even have some enterprises. And then cash is all about consumers; trying to give financial tools to people who are “Hey, I want to go invest in Bitcoin”, or “I want to go buy stocks”, or “I want to send money to my barber.” It really helps essentially act as a consumer banking product. And so that’s kind of where there’s a little bit of – getting both sides of the counter is kind of what we talk about.

And then we have our other brands, Tidal with streaming… And that’s kind of focused on artists, and we’re trying to figure out what ways can we enhance artists… Because they kind of operate their own business. And then we’ve got some of the more out there things, like Spiral doing Bitcoin grants, and open source Bitcoin, trying to really transform Bitcoin into the digital currency of the internet. And so yeah.

Song: [04:47]

One day I asked my teacher, What use is math to me?

She answered: When you’re older, someday my boy you’ll see…

There’s a world of computer systems out there

Full of valuable data and not secured with care

And you can make a fortune in ransomware…

With a little bit of math!

It’s called encryption,

Just a little bit of math,

Cause a conniption;

Lock the data, hide the key;

They’ll pay up eventually,

It’s all just math.

Ransomware is big now

Because it’s organized.

You can buy it as a service

And sell it for a prize.

There’s a whole world of tempting targets to hack -

Governments, hospitals, schools to attack

And they pay up in Bitcoin, hard to trace back…

It’s all just math!

We call it crypto - just a little bit of math.

No need to tiptoe,

Hackers whisper, don’t be nervous,

We take pride in customer service…

Well then I told my teacher, I’m feeling terrified;

How can we protect ourselves from all this cybercrime?

She said, “Don’t click weird links, or use “password123”.

Make offline backups, invest in security.”

And that’s when I realized how screwed we might be…

Just do the math!

So many systems.

If they all took a bath,

Wouldn’t we miss them?

Next time there’s no meat or water or gas,

And we slide a little closer to the day of wrath

You can blame IT, or some Russian sociopath,

But personally, I blame math.

Kevin Owocki: [01:03:16.12] I largely agree with you. I think that another parallel is the internet bubble, and I think the key is to invest in the Yahoo! or the Amazon, and not the Pets.com. The internet bubble was a bubble, but it was also a fundamental shift in the way the world organizes its information. I think that what we’re seeing here is the fundamental shift, and possibly a fundamental shift in the way the world organizes its finances. I think that what TCP/IP did for information, there’s the potential that the blockchain will do for the financial system. There’s obviously huge upside there, but under the guise of upside, there’s gonna be the Bitconnects of the world, or projects that are just looking to hang on to the trend.

This is actually one of the reasons I started Gitcoin - to allow people to have the skills to thrive in this new blockchain ecosystem. I think that educating people and helping them learn to use the tools and build meaningful relationships is how we mature the ecosystem. It’s one of Gitcoin’s missions.

Travis Kimmel: Yup. So we incurred a bunch of technical debt along the way, got into Y Combinator. We did that winter ‘16, which was awesome. I mean, the cool thing about Y Combinator is that they do a really good job of giving you a professional network out of nowhere, a powerful one. Everybody has whatever professional network they have, but often time entrepreneurs are so heads down building stuff, or whatever, that you don’t – we’re not necessarily out there doing career development, because we’re maniacally pursuing our ideas… And Y Combinator just drops in a beastly network, and it is awesome! They’re really, really good at it. So we were very fortunate to get in there.

We did that for three months, and at the end of that we ran socially into this woman Lihong. We were having dinner with her, and she was like “Yeah, I’ve looked you guys up…” At the time I was pitching her husband - who’s awesome - to invest. He was like “You’ve gotta meet my wife, Lihong.” So we go over, we were having dinner, and she was like “I’ve looked into you guys and I really like what you’re doing, I really think this is awesome, but you are terrible at selling. Like, you’re the worst. You’re not even trying to sell. You’re not even order-taking.” I’m like, “Whoa…”

Paul Orlando: [01:07:38.27] Oh, that’s a great question, too. My hope is that smart, creative, talented people will be able to better devote their time. So they’ll still do things that they’re passionate about, but if it’s a question of “Hey, I’ve got a lot of options. I’m going to think about timing as a way to make a decision, and then I’m going to do something that I think will benefit from timing, that’s just going to help me along the way.” So related to that, I hope that our cousins in these large corporate environments, where maybe they have in-house labs, or they’ve got like 50 different potential products that they are trying to figure out how to put resources behind, or what to keep, what to kill, I hope that timing will become another way they filter opportunities and decide where to put resources.

Similar things for startups that are pitching for capital, or investors that are evaluating startups. We recognize timing is important. How could I actually step through that with some type of a process that’s helpful, and then get to a place where if I’m the startup, I either represent what we’re doing appropriately? This is why the time is right, in a Why Now slide. Or on the investor side, lots of things we can invest in, but we should be in this area. I don’t know exactly who’s going to win. I’m not predicting which team, if there are 100 different startups doing something similar… But we should have some type of place in this new market.

So I hope it’s things like that, that come out of this. I would really want people to apply this in what they choose to work on, and what they choose to invest in, and what they choose to do. But absolutely, founders do influence what happens in the world… So you can take this book and say “I’m still really passionate about this topic. I’m going to pull the future forward. I’m just going to do it anyway.” Or “I’m willing to wait the 10 years that I think it’s going to take for it to have a supportable business model. I’m gonna get through that in some other way.” But yeah, to your question, I really hope that it’s going to change the way people actually build or invest in companies.

Jerod Santo: Right. Well, this isn’t an investment show, it’s definitely a show about software, so I’ll stop down that route. But let me just say that we’ve been watching this, and watched loosely some of the alternative coins or the things that are changes to Bitcoin or inspired by Bitcoin, and like I said before the break, there’s lots of things that come and go… I was even mining some CoreCoin for a few months just for fun; that’s at 0.00 at this point, and perhaps is completely just a footnote in history.

One thing that we look for as we invest our time and our skills and perhaps even our money into communities and software projects, because this is a very large software and open source software projects - there’s over 80 projects that the Ethereum Organization has on GitHub… We look for sustainability and long-lasting things, and one of the constant themes in our shows and in our community of developers is the JavaScript fatigue and the constant churn of new frameworks and new ways of doing things - some people see it as a Renaissance, other people see it as ridiculous… I personally don’t buy into new JavaScript frameworks very often because I’m just waiting for the next one, and it seems like with the cryptocurrencies there’s very much that possibility. Aside from Bitcoin, many other ones have come and gone, and of course, Bitcoin itself hasn’t been around for all that long in the grand history… So that’s one of the questions I have about Ethereum, especially as we look at it as app platform - and we’ll get back to that. Looking forward, you’ve survived what would be considered a PR disaster and really a crisis in your community over the summer… Looking forward, what is it about Ethereum that you believe makes it have lasting power, and that we can have trust, not just in the currency, but in the platform as something that we can invest in?

Peter Ma: As a hacker, I basically build prototypes a lot, and the entrepreneurs generally follow what the trend is. And the latest trend is blockchain and AI. Blockchain is still really difficult to program, but people get into it because there’s one or two really good applications. They see Bitcoin as one of the things that’s gonna change the world, and all the programmers are starting to study blockchain. And they see self-driving cars, they start seeing this as being deployed in the real world, and they’re like “Okay…” This is a time where you have emerging technology that’s being applied in the real world now, and this is a time for me to invest my time to understand and to execute and to find opportunities within this space.

[16:18] As it happened back with mobile. When mobile started getting into people’s hands, all of a sudden, all of the programmers started jumping on mobile. I jumped in before that, and I remember just being one of the independent Android developers; I was invited to give a talk at TED global. That was really rare, because people didn’t get into it. But as soon as that tipping point has been passed through - we have current applications being deployed in the real world - that’s when the programmers all wanna jump in, and this is where opportunity is.

Jerod Santo: Yeah. When you talk about finance as a zero-sum game, I feel like there’s actually been moves now to actually open up about finance as well; I’m not sure if either of you have tracked the celebrity rise of Cathie Wood and Ark Invest, and a lot of the moves that she’s doing in public. They’re an investment fund, and they will actually publish their moves at the end of every day. Like, “We sold these stocks. We bought these stocks.” And people laughed at that for a while, but because she’s been successful with early on Bitcoin, early with Tesla, she’s very much into growth stocks - because of that, people started to follow her very closely and just emulate. And when she makes moves now, it makes news on a lot of the C-SPANs and the… Is C-SPAN the Congress one? What’s the one that’s the finance one…?

James Long: Yeah, so my current – I’m kind of like kicking off my own research phase, which… I wanted to start it a couple weeks ago, and then kids and life and holidays now. So hopefully, over the holidays I’ll get some time to really dig in here. I’m excited about something… And again, this is not mutually exclusive, it’s not zero-sum. I fully support the local-first community. I think it is a really, really cool idea, and cool tech, and I’m surprised at how – it’s not mainstream, but I’m surprised at how popular it’s become.

At some point I was like “There’s no way people are going to actually really invest in this”, because it’s so much work to build a whole new platform. So really cool to see it. But what I am thinking now is that a lot of the benefits, at least that I was after, I might be able to get them with doing things just more on the edge. And so the way that my thoughts have been sort of evolving is that basically the way Actual worked was it ran your whole SQLite database, and it did the entire backend of the app, backend [unintelligible 01:18:15.02] was in a web worker. So it was a different process, but locally on your machine. So once you’re in the web worker, you can do – the SQL queries were literally synchronous. They weren’t even async, because it’s so faster – it’s so fast that the async overhead of doing multiple promise calls is actually slowing it down. And like just architecturally, it was just like having to – you introduce an async call somewhere, and then all the call stack has to be async. It’s just super-annoying.

So going back to Johannes’ development experience there - it’s amazing. Once you’re in that web worker, you async call into it, but then once you’re in there, it’s great. But with all of the problems that I’ve been saying - it’s hard to integrate services, and this kind of hybrid approach can be mentally taxing. I just kind of want things to work the way everybody else works, which is that you hit a server, and you get something back.

What if we do this – this multi-tenant approach is really interesting to me. And there’s a company, Turso, turso.tech, which is building out a scalable infrastructure for this, where every single person, every single request even, could possibly get their own SQLite database. So what if basically I took this web worker backend that is local, but it’s not actually local, and it’s at the closest data center point that could possibly be closest to you? So in that way, I’m still accepting the fact that there is a network call, that there is this boundary there, but it’s very close. So I’m hosting currently my website, jlongster.com, on the Northern Virginia data center, or whatever, and I’m in Richmond. So I’m a couple hours drive. And it’s about 20 milliseconds overhead.

[01:19:53.02] So I think we can assume 20 to 30 milliseconds overhead for a moderately non-fine-tuned network infrastructure. I think that could even be faster. That to me feels acceptable. And once I accept that single round trip cost, then I can move everything to my server, still have the local SQLite database and have my development experience there, and possibly there’s the SQLite syncing going on in the backend. So I’m not ditching syncing. You’re probably going to have to sync these changes across a backend distributed network, but it’s nice to now own that, because now I can do analytics, I can flip something on in just a minute, without having to get everybody to refresh their clients. I can do a multitude of clients. If I wanted a terminal app for my finances, I could curl something fast and get a boatload of charts. I just get that API, like, instantly. It crosses that network boundary which lets me do everything the way everybody else is kind of doing it.

So the same stuff might be going on, even the syncing, because you’re probably going to have to be syncing that SQLite database… Because you’re mutating it locally on that edge instance. It’s going to have to replicate that somehow, elsewhere. But if you draw the line of the app, and local-first is like - at least for the most part - we’re having this hybrid thing where it sort of depends on a server… But for the most part, a local-first app in principle is like you draw the line of the entire app and all of the data, and it’s all on your computer. And then there’s another circle which is the server, and then it’s syncing to this server.

This is like if you draw the line all around your app, but then it reaches over into the server for like one little bit, which is that edge node, and then that edge node is talking to all of the complex server.

And the more I go down this, the more it’s like “Well, I really just want to make a single request to the server. I don’t wanna have to go back and forth.” Maybe I’m evolving to be a ‘use the platform’ person, and I’m leaning to very light client apps, and now I’m starting to lean into this whole React model where it streams live updates… It’s kind of fitting that – it’s taken years to get here, but it seems like React Server Components are actually a thing now. And it is a compelling model. A long time I was like “This is the weirdest idea ever”, especially when I was local-first. I was like “This doesn’t benefit me at all.” Now suddenly if I’m flipping my position a little bit, it’s like, React Server Components are amazing, because I can run the entire app on the backend, get all of this stuff that I want, and stream in just a couple lightweight components that I want to. I do full navigations maybe, even possibly… And the thing that gets me is the ability to flip open new tabs instantly. That’s one of the things that I’m a little bit like - because things are all local, it’s slow to boot up the app. And normally, I was like “Well, you boot up the app once, and you’re digging into your finances for like an hour. I don’t really care.” But the thing that does feel nice is just to Command+click a link and open up a new window, and use my local macOS windowing system to split the screen, have different tabs, and very quickly, in a very lightweight way just spawn tons of tabs… And those tabs load in like 30 milliseconds. That can be hard to do local-first, because you’re buying into this thing where the entire thing must run locally, and so it has to boot up. It has to boot up the thing.

And Johannes, maybe I’m wrong that you can get a 25-millisecond boot-up time on a complex app… I’m curious how Overcast feels, if you’ve optimized for that. But that is where I’m going to be researching, and kind of diving into. So not to say that this is the solution either, but it’s something that I’m very excited about.

Jack Dorsey: I don’t think there’ll ever be a replacement for any of these things, but I do think there will be one that’s more dominant, and I think there’s a very strong potential that the U.S. dollar loses its global singular reserve currency status. And there may be a second one in the Chinese yuan. And there might be a third one in Bitcoin. And I think that’s a net positive. I’m obviously rooting for Bitcoin because of the properties behind it, because it’s transparent, because no company or individual controls it, because no government controls it, because it’s resilient, it’s secure, it’s never been hacked, it’s never gone down… That’s what I want out of my money. But I want the transparency, I want it to be owned by the people as well. So having a world reserve currency that is owned by the people and developed in the way that Bitcoin is developed I think is very, very powerful, and I think it would be ideal for everyone on the planet not to be controlled by the dominance of any one government’s currency. But I do think that we’re moving away from a time when there’s one, and there will probably be many, and then maybe one will become dominant.

Jack Dorsey: I don't think there'll ever be a replacement for any of these things, but I do think there will be one that's more dominant, and I think there's a very strong potential that the U.S. dollar loses its global singular reserve currency status. And there may be a second one in the Chinese yuan. And there might be a third one in Bitcoin. And I think that's a net positive. I'm obviously rooting for Bitcoin because of the properties behind it, because it's transparent, because no company or individual controls it, because no government controls it, because it's resilient, it's secure, it's never been hacked, it's never gone down… That's what I want out of my money. But I want the transparency, I want it to be owned by the people as well. So having a world reserve currency that is owned by the people and developed in the way that Bitcoin is developed I think is very, very powerful, and I think it would be ideal for everyone on the planet not to be controlled by the dominance of any one government's currency.

But I do think that we're moving away from a time when there's one, and there will probably be many, and then maybe one will become dominant.

Jerod Santo: Yeah, exactly. I just changed it to Radiohead. Okay. Well, now you are doubling me in points. Let’s see if we can get back on track. Headline six. “Exxon is mining Bitcoin in North Dakota as part of its plan to slash emissions.”

Paul Orlando: [48:10] Yeah, engagement is through the roof, so we wanna boost these posts. And of course, it was doing like the opposite of what they wanted. So in this case, it was a much more modest financial reward for whoever the scammer was. I think it was only around $100,000 in Bitcoin that they ended up getting away with… But you have scams that can scale. So you can scale through a social network, like Twitter, or you have something like the Garmin ransomware situation, where I’m dependent upon this one piece of tech, and now I cannot do the thing that I need to do at this moment. Or now navigating for me is impossible, or it’s really dangerous. So yeah, I like just bringing attention to these things.

For me, when I wrote them, I think I was calling back to some of the writing I did about autonomous vehicles, in both of these examples… If you don’t mind, I’ll loop in the thought on autonomous vehicles there.

Nader Dabit: Yeah, we have a way to actually get around that by programming our own digital scarcity. All you have to have is an internet browser. You can now receive and send payments between parties.

The other thing is state. So to save information - how do we do that today? Well, we have a centralized database somewhere, like AWS, that if we don’t pay the bill, goes away forever and we lose all of our information. Maybe the data leaks, maybe it gets hacked, or maybe we just – I don’t know, there’s all types of stuff… Maybe it goes down because AWS has an outage in U.S. East 1. But there are a lot of things that are not ideal, and I think that with blockchain technology we’ve unlocked native payments and native state… And early on, with Bitcoin, it kind of jsut showed that these types of decentralized protocols were possible, but you couldn’t really write a program in Bitcoin. And I think the reason that you’re seeing it start to become a thing now is that the evolution of that technology and the improvement - you’ve had increased transactions per second, so higher throughput per second, reduced costs…

[40:07] For instance, Solana is a good example of a blockchain that has fractions of a penny for a transaction… So you have all of these things that are kind of happening, that are now starting to become mature enough for people to build on, that people are taking advantage of them… And the things that they’re unleashing are also, I would say, really interesting to people that are developers already, but they also enable people to make money. In the United States, where we can make like a couple hundred grand a year for a senior developer, we might not be that interested in this stuff… But let’s say you’re making 10k as an intermediate or senior developer somewhere else in the world, and you can partake in a protocol and increase your wage by 10x because all these projects are international and they’re completely decentralized, and they’ll hire anyone, anywhere, it doesn’t matter where you live… It’s just very, very interesting to a lot of people.

Adam Stacoviak: Right. “I’ve put all my savings in Bitcoin.” “You did what?!”

Nick Nisi: Mine’s gonna be in Bitcoin.

Brian Bondy: Exactly, yeah. And also, we couldn’t find anyone to give us several hundred million dollars in Bitcoin to give out to users for free to grow our user base. [laughter] So that was part of it as well.

Preethi Kasireddy: Yeah, sure. That’s a great question. I’ll be honest, one of the things that I’m always excited by are problems that are not figured out, and blockchain is definitely one of them in the sense that there is this amazing technology that got created, but the actual applications and use cases have yet to be created, and there’s so much room for creativity and innovation. I’d say that’s one of the main reasons why I’m so attracted to this industry… Because I naturally have the entrepreneurial spirit, I wanna solve unsolved problems, and that’s one of the reasons why I’m gravitating to it. But at a more fundamental level, I think the technology itself is super interesting.

I think earlier you were saying how blockchain is interesting as a digital currency… I’d go a little bit further than that and say I actually don’t get excited by digital currency per se, because digital currency is just one application of the blockchain. There’s so many other applications that I think have potential that haven’t been created yet, and I’m more excited about those applications. In my opinion, it’s really hard for the current currency system in any nation – for example, take the U.S. For cryptocurrency or digital currency to replace fiat currency, that would take a lot. The government has a really tight control over the monetary policy and I just don’t see what benefits digital currencies provide today that would make people switch over, that would make the government friendly to this, and so forth… Because in the end, what digital currency is - it’s completely decentralized, completely open, completely censorship-resistant, which is not something any government really wants.

So for me, I’m more excited by what else blockchain enables. At a fundamental level, blockchain is a decentralized technology where it’s maintaining a ledger of transactions or basically state changes, and the state changes are cryptographically secure because they are maintained by something called the consensus process. This consensus process in Bitcoin or Ethereum is called proof of work, where a bunch of miners are there and they run a bunch of complex computations to validate these transactions, and they get paid for validating this blockchain. So the entire chain is decentralized, it’s trustless, because there’s no need to trust any central party to maintain this database or this ledger, and then it’s completely censorship-resistant because you can’t have really any central authority trying to censor it… And it’s completely secure, because it’s cryptographically secure. So with those primitives you can do just so much on top, and that’s kind of what I’m excited by.

Chris Beams: [01:41:54.10] That’s right. And you actually are kind of touching here on the power of basically programmable money. We can encode into the logic of BSQ itself certain semantics. For example - this isn’t the way that it’s designed right now, but it easily could be and it may turn to this as we actually roll this stuff out… It could be that the only people who have the right to vote are people who have newly-minted BSQ. When you issue a compensation request and it gets accepted, that’s the issuance of new BSQ, actually new BSQ coming to existence when you get a compensation request accepted, like voted in the affirmative.

That’s because, by the way, remember, BSQ is ultimately backed by Bitcoin; it’s this colored coin riding on top of Bitcoin. Well, what that means is that when you issue a compensation request saying “Hey, I want 10,000 BSQ for this work”, that means that you must actually spend the equivalent in Bitcoin of 10,000 BSQ. You have to actually issue a Bitcoin transaction for 1,000 Satoshis times 10,000 BSQ. It actually costs money for people to issue compensation requests.

The reason that we do that is 1) anti-spam, so that we don’t just have people throwing compensation requests at us because it’s free. People actually have to pay for it, which means they’re gonna wanna have a reasonable degree of certainty that this is gonna be accepted, which means that they have all the correct social incentives to be out there, talking to other people in the network and saying “Hey, do you think this is good work? What should I ask for it?” etc, because they don’t wanna waste that compensation request transaction fee.

Well, when they do that and their compensation request gets accepted, that Bitcoin that they spent on the compensation request becomes BSQ, gets colored as BSQ, by the logic in the BSQ validation processing software that we’ve built. So when I say newly issued, newly minted BSQ, what I actually mean there is somebody who just earned it. And because it’s a blockchain, we can see the movement of every coin, for all of time. We can know that the BSQ that that contributor earned has not moved anywhere; it hasn’t been transferred to anybody else, say. So we can know that’s the BSQ of somebody who just earned it. Maybe only those people should be able to vote. That’s just an example of what you can do.

There are constraints, right? Not anything is possible, but there’s a remarkable degree of creativity that’s happening, and it begins to become evident just how limiting our current monetary world is. You don’t have programmable money. Look at what we’ve done with being able to program the rest of the world. Here it comes, here comes programmable money.

Mikeal Rogers: There actually is a company right now doing mortgages in Bitcoin, but if you buy that house, it’s – say you put $5 into Bitcoin really early on, and that’s worth half a million dollars. So you buy a half a million dollar house with Bitcoin, with that mortgage, you’re good until you sell that house. Then when you sell that house, you owe capital gains from the $5 that you initially put into the currency.

Mikeal Rogers: I think even just beyond privacy, these ad networks have actually also become vectors for people to do different phishing attacks, and things like that… And not just phishing, but also getting you to download something and then taking over your entire computer and having that kind of extortionware model where you have to pay them Bitcoin in order to get your computer back. A lot of that stuff is actually delivered over these ad networks.

Most people, when they put an ad on their site, they don’t do the content deals to get that ad placed; they rely on some kind of ad network to do that placement, and those ad networks are being constantly scammed by incredibly sophisticated attacks to get these ads in. So literally, these are not verifiable; it’s not possible to get them out without just saying “No, we’re not gonna have ads anymore.” Just like it’s not possible to protect privacy without saying “You know what, we’re just not going to allow certain features in the browser that allow this kind of tracking as well.”
Brave has been incredibly aggressive about ad-blocking and tracker-blocking, and as a result a couple sites won’t work, because they’re reliant on those features. But if you look at some of the announcements that came out from Safari, and I know that even some of the Chrome people are looking at it - some of these features that we have on the web that certain sites depend on may actually get turned off because of these concerns.

Anna Derbakova: Yeah, that’s the basic concept; that’s still there, because in Bitcoin you’re exchanging essentially value, right? You would be exchanging value of Bitcoin, but in Ethereum you could be exchanging some kind of coin, but you could also be exchanging an asset, because they have the idea of a smart contract. But the idea is it’s a different type of blockchain, it’s a different implementation, and Hyperledger also is slightly different. But who owns it? That’s a good question. I mean, there’s not gonna be one blockchain to rule them all. They are gonna be different, and I think that’s a very good forward-looking question, because then people will wonder, “If we have this blockchain here for this group of banks, and this blockchain here for supply chain, if they ever need to interoperate, or something of as far as transferring records from one to the other, what are we gonna do?”

So I think that’s a question that’s definitely gonna need to be explored fairly soon. If you have two different blockchains with different consensus algorithms, how do you deal with that? These questions… I’m not sure if IBM, for example, is researching anything into that - at least I’m not directly involved in it - but if it doesn’t come up soon, it will in the very near future.

Feross Aboukhadijeh: Yeah, they had malware twice, getting into their installer files on their websites. I’m not really sure how that happened, they didn’t really give a full explanation of how they got hacked, but it was pretty sad. If you installed transmission from their website during a certain period of time, you would get this BitCoin ransomware on your computer that would encrypt all your files and then try to get you to pay a BitCoin in order to get your files back.

Autumn Nash: Dude, and people were going in on Bitcoin, which - you know, justifiable. But then we came up with something worse, and they were like “It’s going to be great.” And it still doesn’t do anything for us. The mom in me – like, during COVID, I wanted to sit all the adults down and make them listen to Daniel Tiger and Elmo, so they could be nice to each other. I just want to be like “Did y’all watch WALL-E? Did you? Did you?” We need to watch – what’s that one movie, The Lorax? Y’all, I want to be able to exist, and my kids to have somewhere to just – like, what are we doing? We’re not even getting a good product. You know what I mean?

Shawn Wang: Well, first of all, I’m not the most informed person on security. Probably Feross would be a better person to talk to about this… I’m not optimistic or pessimistic. I’m just kind of neutral on it. I don’t think it’s like a focus of anyone, apart from Feross, who is the founder at socket.dev. [laughter] And his approach is “Let’s just audit everything and give you ten different reports telling you that–” And we have some of these automated audits as well. It’s not clear exactly how venture funding was gonna affect this either way. Obviously, you can have people who are paid better to maintain these repos, but supply chain attacks happen in perfectly well-funded companies as well. It’s not just like someone’s acting out in open source… Which has happened repeatedly, and just puts a Bitcoin miner in a repo, or something like that.

I think it really has to be fixed at the runtime level, or the toolchain level. Deno has an attempt at doing this by locking down the permissions. People are realizing, unfortunately, that it’s just not that useful. You’re just gonna enable all the flags anyway. So it has to be per-module, and as far as I know, nobody’s tackling that, except for a company that I’m hopefully invested in, that might be trying to solve that issue. But it’s kind of an open question right now. I’m not aware of anyone else really tackling sort of per-package permissioning and just reinventing the npm ecosystem. For better or worse, the npm ecosystem is what we have, and therefore the security defaults that they choose - which is none [laughs] - we inherit those decisions.

Mat Ryer: [15:48] There you go. Exactly right. So I wanted to just see the Bitcoin price in my menu bar. And there wasn’t really a way to do it. There was no app to do it, so I started to build the little project just for myself. That’s why it’s called Bitbar, because it comes from Bitcoin.

Johan Vos: No, but there might be signs… For example, with the same quantum computer you could also trick the whole Bitcoin system and do the mining… So you would see that in the Bitcoin price, for example. Now, not to worry people, but even if we think that breaking encryption is ten years away, that is still something to worry about today.