Bitcoin OG Has A Confession To Make | Jimmy Song

[00:00:34]All right, so my talk is entitled, Incentives and Ideals.

[00:00:40]So every few years, Bitcoin has some sort of panic attack, or more accurately, Bitcoiners have a panic attack.

[00:00:50]A mining pool gets a little too big, right?

[00:00:53]Somebody refreshes a hash rate chart, sees a slice getting a little too fat towards that magic number, 50%.

[00:01:04]And the whole community just sort of loses its mind, right?

[00:01:08]Twitter lights up, blog posts get written, people start using the word existential.

[00:01:16]You all know the chart I'm talking about.

[00:01:18]It's that big colorful pie, right?

[00:01:20]With names like Foundry and AntPool, ViaBTC, Slush.

[00:01:28]And a long tail of smaller pools, beautiful spread of colors, right?

[00:01:33]A beautiful spread of choices.

[00:01:35]And we're very proud of that pie.

[00:01:37]And we put it on our slides, we tell people, hey look, this is how decentralized we are.

[00:01:44]We have all of these different types of miners.

[00:01:48]Here's the thing though, that pie, that assortment of colors didn't come for free, right?

[00:01:58]It's the result of community engagement.

[00:02:01]We keep it that way by essentially freaking out every single time that the percentage of a single miner gets too big.

[00:02:12]And there's a historical event back in 2014 that illustrates this.

[00:02:19]There was a mining pool by the name of GHash.io.

[00:02:24]I don't know how many of you guys were around back then, but it was a pretty big pool and it kept increasing, right?

[00:02:32]40%, 45%, people started freaking out.

[00:02:35]And at one point it actually reached 51%.

[00:02:39]And the community outrage was so loud that the people running the pool actually said, hey miners, can you get off of our pool so we're not above 50% so that the community doesn't freak out anymore.

[00:02:58]In other words, we policed it and we policed it pretty hard and it worked.

[00:03:03]It worked really well.

[00:03:06]So hold that picture in your head for the next 15 minutes or so.

[00:03:12]And that pie and the panic, because I want you to think about this question.

[00:03:19]Why do we panic about that?

[00:03:21]And only that, or not some of these other things.

[00:03:27]To answer that, we have to sort of look at the story that we tell ourselves about miners.

[00:03:33]And the story goes like this.

[00:03:35]Miners are slaves of short-term economic incentives.

[00:03:39]And that's the assumption that underneath absolutely everything.

[00:03:44]We believe that if a miner can make an extra nickel they will do X, Y, or Z to get it.

[00:03:51]Even if X, Y, or Z make Bitcoin worth less tomorrow.

[00:03:57]Even if it torches the future value of their own business.

[00:04:01]A business which they spent millions of dollars and much blood, sweat, and tears into building.

[00:04:09]We assume that they literally cannot see past the next block.

[00:04:14]And I have a confession to make.

[00:04:17]I've thought this way myself.

[00:04:19]I've sat in rooms and modeled miners as little profit-maximizing robots.

[00:04:26]I've used the phrase incentive compatibility like it was like a law of physics.

[00:04:31]As if no miner could possibly have Bitcoin's best interests at heart.

[00:04:35]The moment ignoring it can earn them an extra basis point of profit.

[00:04:41]So I'm not pointing fingers here.

[00:04:44]This kind of thinking is the water that we swim in.

[00:04:47]And it absolutely dominates the conversation when we talk about miner centralization.

[00:04:53]Now listen to the story that we tell ourselves about another group.

[00:04:59]Because the way we talk about Bitcoin developers could not be more different.

[00:05:05]With developers the default is to assume the best.

[00:05:09]Best intentions.

[00:05:10]That they are always doing what's right for the network.

[00:05:13]That at least collectively they are the long-term guardians of this community, this network of Bitcoin.

[00:05:23]And we expect them to live up to the highest ideals that we have for Bitcoin.

[00:05:28]And here's the almost beautiful part.

[00:05:31]We expect them to do it even if it costs them money.

[00:05:36]Especially when it costs them money.

[00:05:39]In fact the more a developer appears to be sacrificing money the more we kind of tend to trust them.

[00:05:47]So sit with that contrast for a moment.

[00:05:51]One group assumed to be sellouts for a nickel.

[00:05:57]And then another group assumed to be so noble that money is almost beneath them.

[00:06:03]And here's what's really strange about that.

[00:06:06]Both of these groups come from the exact same pool.

[00:06:11]That pool is called humanity.

[00:06:13]And the last time I checked very few people are so depraved that they do the selfish short-sighted thing every single time.

[00:06:25]And very few people are so angelic that they hit the ideal every single time.

[00:06:32]Most of us, and I definitely include myself, live somewhere in the middle between incentives and ideals.

[00:06:42]We bounce back and forth between the things that were selfishly incentivized to do and the things that are the best for the world.

[00:06:50]That's just what being a human is.

[00:06:53]And yet somehow we've handed one group the role of mercenary and the other group the role of a saint.

[00:07:01]Same species, two completely different stories that we have about them.

[00:07:07]And that's not just a quirk of how we talk.

[00:07:10]It has actual real consequences.

[00:07:14]And I wanna give you two of those.

[00:07:17]The first consequence is that we hand the developers an enormous amount of trust.

[00:07:23]Far more than we've ever stopped to really examine.

[00:07:28]Think about what that trust actually buys them because we've decided that developers are selfless guardians of the network, the noble ones, we don't really scrutinize them the way we'd scrutinize anyone else with that much power.

[00:07:43]We assume the code is sound because we assume the people writing it are good.

[00:07:48]And that one assumption quietly hands a small group of people an extraordinary amount of control over what Bitcoin even is.

[00:07:56]And notice where we aim our suspicion instead.

[00:08:00]A misbehaving miner, that's a bounded problem.

[00:08:05]A 51% attacker can do some things like reorder transactions, censor things, maybe even try a double spend.

[00:08:14]But it's really expensive.

[00:08:16]And it's visible in real time.

[00:08:18]And it's self-limiting because they're kind of cutting off the branch that they're standing on.

[00:08:24]The moment they attack, the price of Bitcoin is going to be way more volatile.

[00:08:29]And that threat though, we watch around the clock.

[00:08:34]We reload that pie chart.

[00:08:37]Meanwhile, the software, which has no such boundedness gets waved through on trust.

[00:08:46]And that software is by a very large margin, the attack surface of the entire Bitcoin system.

[00:08:56]For most of Bitcoin's history, well over 90% of full nodes have run that single implementation.

[00:09:04]One code base effectively defining the rules for everyone.

[00:09:09]Even today, after a real shift towards Knots, a large majority still run Core.

[00:09:16]One implementation, one set of assumptions, a shared point of failure.

[00:09:23]And it doesn't take a grand betrayal, like some spook that puts in some vulnerability.

[00:09:30]It just takes a bug.

[00:09:32]The ordinary kind that lives in all kinds of software.

[00:09:37]When most of the network runs the same code, one bad bug doesn't just crash one node, it crashes most of them at the same time.

[00:09:46]A single malformed message and a huge chunk of the network can go offline at once.

[00:09:55]No 51% attack required, just a typo or a bug.

[00:10:03]And this isn't just theoretical.

[00:10:04]There was a bug in 2018.

[00:10:07]I know many of you are familiar with that.

[00:10:10]It was called the inflation bug because it introduced the possibility of inflation.

[00:10:14]But the more serious part of that particular bug was that it would remote crash every node if a block met certain requirements.

[00:10:30]But I don't want you to really remember the bug per se.

[00:10:34]I want you to remember where it came from.

[00:10:37]Wasn't a shadowy attacker, wasn't a greedy miner.

[00:10:41]It came from the people that we put our trust in.

[00:10:45]The careful, brilliant, well-intentioned developers that we have put on a pedestal.

[00:10:52]Our trust didn't catch that bug.

[00:10:56]Thankfully, that bug was fixed and despite it having been on the network for two years, we didn't suffer the consequences of that bug.

[00:11:10]Here's the thing that we don't like to say out loud.

[00:11:14]Developers are not infallible.

[00:11:17]They didn't shed their humanity the day they opened the pull request.

[00:11:22]They're not magically immune to error or to greed or to pride or to wanting to win an argument just because their work happens to be open source.

[00:11:33]And the block size war should have taught us that much.

[00:11:36]Years of conflict, conflicting implementations and activation fights full of conviction and ego, fighting over who gets to define the rules.

[00:11:45]Open source doesn't sand the ego off of a human being.

[00:11:50]Sometimes it just hands them a bigger stage.

[00:11:53]So when I say we trust the developers too much, I'm not calling them bad people.

[00:11:58]Most of them are doing some of the most important work on earth and saying that trust without verification is the very thing that Bitcoin was invented to destroy.

[00:12:11]And we've quietly rebuilt it a little bit, aimed it at the people writing the code and called it a virtue.

[00:12:22]The second consequence is the mirror image of the first.

[00:12:25]If we trust the developers too much, we're inspiring the miners far too little.

[00:12:32]We don't just doubt them, we vilify them.

[00:12:35]We've cast them as people who are villains inside their own story, despite the fact that they are securing the network.

[00:12:47]I mean, listen to the language, like we call them greedy and we talk about incentive compatibility as if it's like some iron law, as if it's simply impossible for a miner to care about anything beyond the next reward.

[00:13:04]We describe people who have sunk hundreds of hours, millions of dollars and stake their livelihoods on Bitcoin as if they're just sitting there waiting to sell us out.

[00:13:16]So let me ask you a genuine question.

[00:13:18]Have you met miners?

[00:13:20]Have you actually sat down and talked to one?

[00:13:23]Because the ones I've met don't sound like profit maximizing robots that we make them out to be.

[00:13:30]They're actually pretty obsessed with Bitcoin.

[00:13:33]They've bet their entire livelihoods and careers on it.

[00:13:38]Of course they care about the long term because the long term is all they have.

[00:13:44]And it's not just talk.

[00:13:46]In 2023, a firm accidentally paid a transaction fee of 20 Bitcoin to transfer like maybe half a Bitcoin or something like that.

[00:13:56]And the pool that mined the block, F2Pool, had every legal and protocol right to keep that money.

[00:14:03]But they didn't.

[00:14:06]They actually gave it back.

[00:14:08]And to be fair, it was kind of a messy situation.

[00:14:11]And one of the founders of F2Pool later said he regretted giving that money back.

[00:14:19]But it kind of shows they're not profit maximizing beasts.

[00:14:25]There's a humanity about them.

[00:14:29]And a few years before that, there was a similar incident where they also returned the money.

[00:14:36]Now think about what that vilification actually does.

[00:14:38]When you tell a group of people over and over that they are nothing but mercenaries, that they have no values, that they'll sell you out and betray you the instant that it pays, you are not protecting Bitcoin.

[00:14:53]You are isolating the very people that are securing it.

[00:14:56]You're telling them that they don't get a seat in the conversation about Bitcoin's ideals.

[00:15:03]And then we act shocked, maybe even offended, when a few of them shrug and start behaving like the mercenaries that we always insisted they were.

[00:15:16]And here's the part that really gets me.

[00:15:17]We hold the developers to a towering ideal.

[00:15:22]Now a lot of the time they rise to meet it.

[00:15:24]In that way, it's very good.

[00:15:27]People tend to grow into the thing that you trust them to be.

[00:15:31]But we have never really extended that to the miners.

[00:15:35]We never invite them into the ideals.

[00:15:38]We never turn to them and say, "You too are guardians of this network, "and we are counting on you."

[00:15:45]We kind of assume the worst.

[00:15:47]And we wall them off and we call it prudence.

[00:15:51]So we leave the single greatest source of alignment in the whole system sitting untouched on the table.

[00:15:57]Miners are not just a security budget to be managed.

[00:16:01]They're people, and people can be inspired.

[00:16:05]We inspire the developers, and we vilify the miners.

[00:16:08]And then we have the nerve to wonder why the whole relationship feels so adversarial.

[00:16:16]All right, so to be clear about what I'm saying, I'm not saying that you should be cynical about developers and naive about miners, and that you should flip the saint and mercenary thing around.

[00:16:32]What I'm asking cuts to the root of what centralization is.

[00:16:40]Strip it all down, and centralization is really a question about trust.

[00:16:45]How much we put in to how few people.

[00:16:49]Forget pie charts and node counts for a moment.

[00:16:53]What actually scares us about the 51% pool is that it asks us to trust one party too much.

[00:17:00]And when we turn around and heap that same concentrated trust onto a small circle of developers, that's bad.

[00:17:11]My admonition to you is to stop trusting people blindly.

[00:17:16]Treat both groups as what they actually are.

[00:17:19]They're humans.

[00:17:20]Somewhere in that messy middle, like you, like me.

[00:17:26]And build systems and hold opinions that don't depend on either group being angels, and that survive either group being demons.

[00:17:38]And look, I'd rather not just stand up here and ask you to do the work.

[00:17:42]This is exactly why I'm involved in an organization called ProductionReady, it's a nonprofit.

[00:17:47]The whole idea is simple.

[00:17:49]Fund a conservative Bitcoin client that's an old.

[00:17:54]And fund developer education so that the thing I just spent 10 minutes worrying about, one code base quietly defining the rules for everyone becomes less true every year.

[00:18:05]More implementations, more independent eyes, more builders who don't answer to the same repository.

[00:18:11]The worry that I keep circling back to, that if we lean too hard on one set of developers and barely watch the software they ship, doesn't go away by trusting them less and stewing about it.

[00:18:22]It goes away when we spread the load, so no single group of them ever has to carry the whole network on its shoulders.

[00:18:30]That's better for them, and it's better for us.

[00:18:35]If any of that resonates, if you write code, if you fund things, or if you want to understand the stakes better, come, find me afterwards, or go to productionready.org.

[00:18:43]That's where I'm putting my own time.

[00:18:45]I'd love to get your help.

[00:18:48]So I wanna leave you with this one last thing.

[00:18:51]The next time you see one of those pie charts about the different mining pools and so on, and you see one slice getting a little fatter, and you feel that familiar surge of panic in your chest, I want you to ask yourself this one question.

[00:19:08]Have I ever looked this hard at the thing that the pie chart can't show me?

[00:19:15]Because the people writing the code, and the people that are computing the hashes come from the same place.

[00:19:22]They're the same flawed, brilliant, self-interested, and occasionally generous species.

[00:19:31]And Bitcoin doesn't survive because some of us are angels.

[00:19:35]Bitcoin survives because none of us have to be.

[00:19:39]Thank you.

[00:19:39](audience applauding)