Ashigaru's Whirlpool can steal your money. This is something I mentioned in passing in a previous note, but it is important to develop in some detail.

Basically, it is the Whirlpool server that tells the client how much it must pay, and the client trusts that blindly. This allows the server to instruct clients to pay as much as it wants.

But why not simply check that the coordination fee is the promised 5%? Because Samourai had "discount codes" (scode) designed to allow some users to pay lower coordination fees. These codes were opaque to the client and only understandable by the server. This means that the client had no way to know how much it had to pay and it had to be the server the one that makes the math. As a side note, it seems these "discounts" were not verified and could even be negative.

Fortunately, it seems the Ashigaru team removed the "discounts" functionality, which is the right thing to do. The next step should be to hardcode the 5% coordination fee on the client.

It would also be good to clean the code and remove all what it is not being used anymore because all the variables and messages are still there making the auditting much harder.

Public. Read my notes.

Who needs an Ashigaru Whirlpool module on the Dashboard?

Contacting via email to donate BTC seems like a shitty way of setting up BTC donations

Blockstream seized control of Satoshi's Bitcoin Github keys,

just like "White House staff" seized control of Joe Biden's autopen

Ser you assume the node runner wants to transact #HodlTilYouDie

Man in the middle I think

If you are afraid of trading on RoboSats, take a look at this.

An interesting analysis of how orders end up on my coordinator.

Data extracted from the last 90 days (Beginning on 2025-01-23 and ending on 2025-04-23)

2816 Successful orders without dispute

34 Successful orders in dispute

61 Orders punished in dispute

19 Collaborative cancellations in dispute

163 Collaborative cancellations without dispute

Orders with takers (processed): 2816 + 34 + 61 + 19 + 163 = 3093

Disputed: (34 + 61 + 19) / 3093 = 3.7%

Successful in dispute: 34 / 3093 = 1.1%

Punished in dispute: 61 / 3093 = 2.0%

Collaborative cancellations in dispute: 19 / 3093 = 0.6%

Collaborative cancellations without dispute 163 / 3093 = 5.3%

Successful: (2816 + 34) / 3093 = 92.1%

So if you are with a peer in a trade on RoboSats, know that the probability of everything ending well is approximately 92.1%. I consider this a very good success rate. 😀

If you consider that collaborative cancellations without dispute are not a problem, the chance of a successful trade or a collaborative cancellation without dispute is 97.4%.

Bitcoin Core vs. Bitcoin Knots: The Great Bitcoin Spam Fight

The Bitcoin community is engaged in an interesting debate: Bitcoin Core vs. Bitcoin Knots. What are they? Why are they fighting?

Here, I explain clearly and simply, without missing any details, with neutrality and a touch of the "spam" controversy.

What is Bitcoin Core?

It's the main software used by approximately 90% of nodes (computers that keep Bitcoin running).

It's stable and developed by many programmers, but some say it doesn't react quickly to problems like network spam.

What is Bitcoin Knots?

An alternative version of Core, created in 2011 by Luke Dashjr.

It has everything Core has, but adds filters to block "annoying" transactions like NFTs or images on the blockchain.

It is used by approximately 633 nodes and relies on a single developer.

Why the conflict?

Everything exploded in 2023, when transactions like NFTs and "ordinals" (data like images on the blockchain) saturated the network, driving up costs.

Knots filters them to ease the network's burden; Core allows them if they pay fees, dividing the community.

What is "spam" in Bitcoin?

Think of the blockchain as a highway: transactions are like cars. Some (NFTs, JPGs) take up a lot of space, causing "traffic."

- Knots: Blocks them to clear the way.

- Core: Lets them through if they pay a "toll."

But who decides what is "spam"?

As the community says: "Spam is in the eyes of the recipient."

- Some see NFTs as spam, like a fake lottery email. Even if they pay, they don't want them on their nodes.

- Others say: "If they pay and the protocol allows it, it's not spam."

Think about it: someone sending mass emails about fake lotteries pays for the server and plays by the rules of the internet.

But you don't want those emails in your inbox. Likewise, some people don't want JPGs on their Bitcoin nodes, even if they're "valid" transactions.

Is it fair to filter them?

The debate began in 2023, when a bug ("Inscriptions", CVE-2023-50428) allowed data like NFTs to be inserted into the blockchain, overwhelming it.

Knots quickly fixed this in its 25.1 release, while Core was slower, leading some to view Knots as the solution to "spam."

Here are the sides in this debate:

- Team Core: They believe that any transaction that pays is valid. Filtering is like "censorship" and goes against the freedom of Bitcoin. They prefer stability and regulated fees.

- Team Knots: They want to protect the network from saturation, claiming that filters don't break the rules.

- Luke Dashjr (Knots): He says NFTs and ordinals are "spam" that clogs the network and increases costs. His filters help small nodes, but some criticize him for only maintaining Knots.

- Peter Todd: He sees "spam" as a problem, but says paid transactions are valid. He looks for open technical solutions.

Other technical voices

- achow101 (Core): In 2017, he said to use Core unless you need Knots' features, viewing Knots as an "extra."

- Developers like Gloria Zhao have shut down filter ideas in Core, frustrating those who want quick changes.

After asking a few people in the community, we came to different conclusions on both sides:

- Pro-Core: They value stability and fear that Knots, with only one developer, is risky. They say filtering is making decisions for others.

- Pro-Knots: They want anti-spam tools and criticize Core for being slow. They see Knots as an innovation.

The Filter Dilemma

Even if you filter JPGs on your node with Knots, if a miner includes them in a block, your node must accept it. It's like blocking a lottery email, but having to save it if it's already reached the server.

This makes the debate complex: do you filter or accept everything?

Technical explanation (easy)

The mempool is a waiting room for transactions.

Knots lets you choose what comes in (with filters like datacarrier=0), while Core accepts almost anything.

If many nodes used Knots, spam would be more expensive, but it wouldn't disappear.

Core is committed to stability and freedom; Knots is committed to control and efficiency. Spam divides because everyone has a different view of what's "annoying."

The community will decide whether Bitcoin should be "cleaner" or more "open."

Which side are you on?

For the record, the whirpool-client code does have Tor identity management. The code I showed belongs to the new soroban implementation and I did not review the old client (very badly structured code). However neither the android app nor sparrow manage identities.

The android app because it is computationally expensive, hence one of the reasons why wasabi never had a phone client and sparrow because it was not implemented correctly.

I don't know what percentage of people were using said desktop client, but evidently everyone who has used the android client or sparrow has not been protected.

nostr:note15720avmmchg6fy8rqmwxrxut3cy6kfg297l7scn3gjysemmzrfzsxjva9p

What I'm hearing in my tech inept brain is it's basically the same app without a fee for a directory and most of the same anonymity tools?