copumpkin

I don't think it's silly. Network effects are why Parler failed and Twitter succeeded (thus far at least!), or betamax failed, etc. These things don't succeed or fail for technical reasons, and develop into distinctly different complex systems as a result of in some cases trivial technical differences (or even none) when the people using them are taken into account. And in the case of cryptocurrency in particular, the network effects (even outside of simple success or failure) are ultimately what make it secure/trustworthy or not. Some of the network effects are incentivized by technical measures, like mining rewards, but the stuff I'm talking about here is incidental.

The point is that the community/network/whatever that formed around bitcoin isn't centralized, so even for relatively "tame" changes like taproot, nobody could agree and it took years to merge regardless of technical merit. For better or worse and for a wide number of reasons I can speculate about, the equivalent social structure around Ethereum is far more centralized around the will of Vitalik and a handful of others, and they've demonstrated repeatedly (except around the ETC debacle which has mostly fizzled) that they can get the whole network to adopt even fairly complex and risky changes. Monero regularly forks, and even though it doesn't have a formalized leadership structure, is able to get changes rolled out. Same with ZEC and the electric coin company. Be it a single person, a pseudonym, an organization, or whatever, everything but bitcoin has forked repeatedly, which indicates a degree of central control (and thus central benefit, from the POV of regulators). In most cases outside of bitcoin, the founders have also enriched themselves enormously by remaining in control.

Contrast with the attempted forks of bitcoin: BCH was a huge mess and has been slowly fizzling out for years. BSV is a joke. Yes you could create a new fork today, but the whole point is that the difference isn't technical, it's a network. The network is partially technical (there are still lots of miners that won't mine your new fork) but is also cultural, and bitcoin users/miners/exchanges don't look up to the "dev team" as an authority. That's the key difference IMO. If you just focused on the technical you'd still be arguing that betamax was a better format.

It's different in that nobody can control it. Everything since bitcoin has had some form of leadership, including Ethereum, that can reasonably consistently get the network to fork and cause things to happen.

Bitcoin struggled for years to get a change adopted that most of the community thought was a good one, because nobody, not even Satoshi if they are still around, could change it.

Yeah, so that's why I was more hesitant about Deribit than I was about LedgerX. I have full faith in LedgerX the company and the regulator that oversees is. With Deribit you only really have a track record to go on, because if past performance fails to predict the future then you're kinda SOL.

But if you're outside the US I'm not sure there are many other choices. I think okex and bit.com might both offer some flavor of option, but last I looked were relatively tiny markets.

ledgerx.com is tightly regulated (all trades reported to CFTC) and physically settled with (in my opinion) very good security practices, but it's only available to US residents. Their longest expiry dates are December 2022, so about 2 years out. I haven't seen anything longer, unfortunately. Since it's physical delivery, when you sell an option, the exchange "locks" the coins or USD that would be required if it were to get exercised until the position is closed (either by expiring worthless, getting assigned, or if you trade out of it), so the counterparty risk is against the exchange only. They're aware that it makes people uncomfortable to lock up coins for a long time, so they work with BitGo to actually handle the coin custody, in separate accounts per customer. It's all reasonable enough to me that I feel comfortable sending them a decent amount of money.

Deribit is a larger derivatives exchange by trading volume, and is open to the rest of the world (explicitly not the US), but isn't physically settled so is more of a "side bet" and is riskier. That said, it's been operating successfully for a while now. I haven't used it because I'm not allowed to in the US.

The market is more liquid than it ever has been. But yeah, not as liquid as I or many others would like.

But if you really think it's gonna burst, there are plenty of eager sellers who would love to sell you some put options on LedgerX :) very above board, and the only CFTC-regulated physically settled BTC options exchange out there

Get an account on there, get USD in somehow (either wire in funds the old-fashioned way or send in BTC and sell swaps/futures/options), and then you can sell puts at any strike/date that you want, as long as you have the USD collateral to lock up to maintain them.

So if e.g., you wanted to sell 100 contracts (1 btc worth) of $40k puts for June 2021, you'd be "locking up" $40k until you exit that position, which would be June at the latest. You could also unlock some or all of that money early by buying back some of those contracts on the market, possibly at a profit or loss depending on how things move. Or you could ride it out until expiration and hope BTC is trading above $40k at the end of June.

Does that make sense?

cough

After looking at it more carefully, I'm not positive that it's a failure to check privileges, although the symptoms at the time made it look like that (literally logging an unprivileged process killing a privileged one). Rather, I think it's some sort of race.

Anyway, I'm glad they fixed it now, but the response to our original bug submission didn't inspire a ton of confidence.

Some points & questions:

1. It's pretty easy to add iptables rules to 169.254.169.254 by uid and gid, achieving roughly the same restriction as file-based access. Not the case on Mac OS (although you can do something similar with pf) but almost nobody ever uses a Mac in a multi-user setting anyway.

2. Doing anything to the IAM role behind the instance profile will definitely affect the credentials on the system (they won't retain permissions that are no longer valid in the current role policy). I haven't tried removing the role from the instance profile while it's running. Are you saying that that doesn't work? That's disappointing.

3. You can iptables blackhole it, but you're right that root can still recover access to it. Hasn't really affected me in practice though.

4. Can you elaborate on this a bit? They're definitely traceable through CloudTrail (you see who issued the credentials and what session identifier they use is branded into the ARN), although you'll never see the actual random token material. I haven't had a need to do that though. Is that what you mean?

5. Hologram simulates it on other systems, and works quite well.

Yeah, all API actions will show up as being from ARN "arn:aws:sts::<account-id>:assumed-role/<hologram role>/<ldap username>"

Two questions:

1) Will it be available on the Mac Appstore? :)

2) You mention that adding some bytes on the end is instant, and so is modifying bytes in the middle. It seems that for most filesystems (and definitely HFS+), it should be possible to insert data in the middle of a file (not really that common in most of my hex editing habits, but maybe for some people?) without incurring much of a cost either. If the inserted data is between extents, then you simply stick a new extent between them, and if it's within an existing extent, you can split it in constant time and do the same thing. Do you know of any Mac OS APIs provide low-enough-level access to do this? Or does it not seem feasible for some other reason?