@ Plain Text Nostr

<-- back to main feed

thread · root cd96e5e5…5dcc · depth 1 · · selected cd96e5e5…5dcc

thread

root cd96e5e5…5dcc · depth 1 · · selected cd96e5e5…5dcc

+- hodlonaut -- 1mo ----------------------------------------------------------------------------------------------[...]+
|                                                                                                                      |
| In 2025 Bitcoin Core removed a decade-old mempool policy default — a configurable limit on how much non-financial    |
| data nodes would relay. OP_RETURN was effectively uncapped.                                                          |
|                                                                                                                      |
| Not a consensus rule. A default setting. But defaults govern what most of the network does. Which governs what       |
| miners see. Which governs what gets mined.                                                                           |
|                                                                                                                      |
| The justification: it wasn’t working anyway, data was getting in through a loophole.                                 |
|                                                                                                                      |
| What wasn’t disclosed: that loophole had been deliberately kept open.                                                |
|                                                                                                                      |
| Here’s the documented sequence:                                                                                      |
|                                                                                                                      |
| 2014: Luke Dashjr creates the -datacarriersize configuration option.                                                 |
|                                                                                                                      |
| Its description: "Maximum size of data in data carrier transactions we relay and mine."                              |
|                                                                                                                      |
| Broad by design. Covers all transaction components. That's the operative text for ~10 years.                         |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Late 2023: Developer Marco Falke changes the -datacarriersize description in v26.0.                                  |
|                                                                                                                      |
| New wording inserts "scriptPubKey" — outputs only.                                                                   |
|                                                                                                                      |
| Inscriptions use the input/witness section.                                                                          |
|                                                                                                                      |
| That single word change surgically excluded inscription spam from the option's scope.                                |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| That change was not a typo fix.                                                                                      |
|                                                                                                                      |
| AJ Towns ACKed it.                                                                                                   |
|                                                                                                                      |
| The diff is documented. The before/after screenshot exists.                                                          |
|                                                                                                                      |
| The configuration option Luke built to protect the network had its scope quietly narrowed — while he was still       |
| maintaining the project.                                                                                             |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Sept 2023: Luke submits PR #28408.                                                                                   |
|                                                                                                                      |
| Purpose: extend -datacarriersize to cover the SegWit/Taproot witness loophole inscriptions were using to bypass      |
| existing limits.                                                                                                     |
|                                                                                                                      |
| A direct fix. Using the exact configuration option he built. Nine years earlier.                                     |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Gloria Zhao rejects it.                                                                                              |
|                                                                                                                      |
| On-record comment: "History of this config option suggests datacarriersize is meant to limit the size of data in     |
| OP_RETURN outputs, so this statement is untrue."                                                                     |
|                                                                                                                      |
| She cites curated historical PRs to support the narrowed reading.                                                    |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| She does not mention that the operative description in the codebase had been changed in v26.0 by Marco Falke.        |
|                                                                                                                      |
| AJ Towns — who ACKed that documentation change — then gives an Approach NACK on Luke's patch.                        |
|                                                                                                                      |
| The same man enabled the rejection and then ratified it.                                                             |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Peter Todd also NACKs. Calls Luke's patch "censoring" transactions.                                                  |
|                                                                                                                      |
| He does not disclose he operates Libre Relay — a direct-to-miner relay that routes inscription transactions around   |
| mempool policy.                                                                                                      |
|                                                                                                                      |
| He built the bypass. Then called closing it censorship.                                                              |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| PR #28408 closes. 11 Concept NACKs vs 9 Concept ACKs.                                                                |
|                                                                                                                      |
| The loophole remains open.                                                                                           |
|                                                                                                                      |
| Jan 5, 2024: Luke opens Issue #29187 and formally designates the bypass as a security vulnerability: CVE-2023-50428. |
|                                                                                                                      |
| "Active exploitation... very harmful to Bitcoin even today."                                                         |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Oct 2024: Contributor darosior disputes the CVE.                                                                     |
|                                                                                                                      |
| "The large majority of contributors disagree this is a security vulnerability. I believe the CVE system is being     |
| abused."                                                                                                             |
|                                                                                                                      |
| Next day, achow101 closes the issue.                                                                                 |
|                                                                                                                      |
| The vulnerability is officially declared not a vulnerability.                                                        |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| April 2025: Peter Todd files PR #32359 to remove the OP_RETURN limit entirely.                                       |
|                                                                                                                      |
| He later admits: "This pull-req wasn't my idea. I was asked to open it by an active Core dev because entities like   |
| Citrea are using unprunable outputs instead of OP_Return."                                                           |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Citrea: a VC-funded ZK-rollup whose business model needed more on-chain data storage.                                |
|                                                                                                                      |
| Jameson Lopp publicly advocates for the PR.                                                                          |
|                                                                                                                      |
| He is an investor in Citrea.                                                                                         |
|                                                                                                                      |
| This was not disclosed.                                                                                              |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Samson Mow calls it "PR laundering" — routing through Todd to fake independent initiative.                           |
|                                                                                                                      |
| Antoine Poinsot (Chaincode Labs) connected to early discussions.                                                     |
|                                                                                                                      |
| The same Poinsot who disputed Luke's CVE in October 2024.                                                            |
|                                                                                                                      |
| He sits at both ends of the sequence.                                                                                |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| June 9, 2025: Gloria Zhao merges the uncapped OP_RETURN change.                                                      |
|                                                                                                                      |
| The primary public justification: inscription data via the witness loophole is less prunable, so OP_RETURN should be |
| uncapped to redirect it.                                                                                             |
|                                                                                                                      |
| The harm reduction argument.                                                                                         |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| That argument is entirely dependent on the witness loophole remaining open.                                          |
|                                                                                                                      |
| If PR #28408 had been merged in 2023, the loophole would be closed.                                                  |
|                                                                                                                      |
| The harm reduction argument would not exist.                                                                         |
|                                                                                                                      |
| It would have had nothing to reduce harm from.                                                                       |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| The person who rejected the patch that would have closed the loophole is the same person who merged the change that  |
| used the open loophole as its justification.                                                                         |
|                                                                                                                      |
| That is not a coincidence.                                                                                           |
|                                                                                                                      |
| That is a sequence.                                                                                                  |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| The last entry in Luke's closed CVE issue reads:                                                                     |
|                                                                                                                      |
| "glozow mentioned this on Jun 9, 2025 — policy: uncap datacarrier by default #32406"                                 |
|                                                                                                                      |
| The issue opened to fix the vulnerability referenced from the PR that exploited the unfixed vulnerability.           |
|                                                                                                                      |
| GitHub closes the loop.                                                                                              |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Every step is documented:                                                                                            |
|                                                                                                                      |
| → Docs narrowed (v26.0, ACK: Towns)                                                                                  |
| → Patch rejected using narrowed docs (Zhao, Chow)                                                                    |
| → CVE designated (Luke, Jan 2024)                                                                                    |
| → CVE closed (darosior, achow101, Oct 2024)                                                                          |
| → Removal PR commissioned (Todd)                                                                                     |
| → Uncap merged (Zhao, Jun 9 2025)                                                                                    |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Adam Back claimed the narrowed definition "was always the original intent."                                          |
|                                                                                                                      |
| The original 2014 text has no mention of OP_RETURN, scriptPubKey, or outputs.                                        |
|                                                                                                                      |
| That restriction was introduced in v26.0.                                                                            |
|                                                                                                                      |
| He treated an amendment as original intent.                                                                          |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| The PR had 423 thumbs-down against 105 thumbs-up.                                                                    |
|                                                                                                                      |
| Ava Chow had said publicly in Dec 2023: "If it is controversial, then we don't touch it."                            |
|                                                                                                                      |
| It was merged anyway.                                                                                                |
|                                                                                                                      |
| Luke Dashjr was muted on the PR. Bitcoin Mechanic was muted on the PR.                                               |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| Bitcoin Core's response:                                                                                             |
|                                                                                                                      |
| → 31 devs sign a letter calling opposition "censorship"                                                              |
| → GitHub moderators mute the loudest critics                                                                         |
|                                                                                                                      |
| And:                                                                                                                 |
|                                                                                                                      |
| → Nick Szabo breaks 5-year silence: "run Knots"                                                                      |
| → 22% of the network switches to alternative software                                                                |
|                                                                                                                      |
| ***                                                                                                                  |
|                                                                                                                      |
| The documentation was rewritten.                                                                                     |
| The patch was rejected using the rewrite.                                                                            |
| The loophole was kept open.                                                                                          |
| The open loophole became the justification.                                                                          |
| The justification enabled the uncap.                                                                                 |
| The person who rejected the patch merged the uncap.                                                                  |
|                                                                                                                      |
| All on the public record.                                                                                            |
|                                                                                                                      |
+-- reply ------------------------------------------------------------------------------------------------ [1 reply] ---+
0149170fe78b -- 1mo [parent] 
     make bitcoin indistinguishable from crapcoin? yes! let's uncap "random-data" limit and clog the network.
     
     guys if you really need that, just use eth! 😂
     reply

Write a post

Sign in with a signing-capable method to publish.