1/31) Scaling a blockchain exclusively through L2s is a terrible idea

As it comes with horrible UX & trust trade-offs; pushing people into centralization

Inevitably leading to failure; as users move to scalable chains instead

L2s have become the greatest source of corruption:

— Justin Bons (@Justin_Bons) May 17, 2023

3/31) Since, ironically, the solution lies in reinventing decentralized consensus for sequencers

Going full circle & ending up in a worse position

As it divides PoS capital between hundreds of L2s instead of combining it all under a single L1

As stake = security in this case

— Justin Bons (@Justin_Bons) May 17, 2023

5/31) This is why L2 sequencers & admin keys end up facing the same challenges as an L1

Without being optimized to solve these problems by virtue of scale, unlike most major L1s

Even though a sequencer cannot steal user funds, it can censor & front-run, which is unacceptable

— Justin Bons (@Justin_Bons) May 17, 2023

7/31) This is not even the biggest problem with L2s

As the UX issues this causes are completely unsolvable in the context of a competitive market

The best way to demonstrate this is by using a simple example;

Two users exchanging value in an L1 world compared to an L2 world:

— Justin Bons (@Justin_Bons) May 17, 2023

9/31) To make things even worse;

The user also now needs to find out whether these specific L2 are even secure or decentralized

As in a free market, there will always be custodian & centralized L2s

Since even today, most L2s have admin keys & or centralized sequencers!

— Justin Bons (@Justin_Bons) May 17, 2023

11/31) Nor should they

Making a fully decentralized & permissionless L2 seamlessly interoperable with a custodian L2 is irresponsible

When the trust model differs; more user choice has to be introduced

However, it is this user choice which makes the UX untenable; a catch-22

— Justin Bons (@Justin_Bons) May 17, 2023

13/31) As the majority of LN users are now on custodian solutions, I correctly predicted this back in 2015

This is all a UX nightmare & far too much to expect from normal users

Inevitably leading to people opting for custodian solutions, which is exactly what happened to BTC

— Justin Bons (@Justin_Bons) May 17, 2023

15/31) However, here comes the twist

In the meantime, blockchains such as NEAR, EGLD, XTZ, TON & more have proven that execution sharding is possible!

This means we can scale on-chain without sacrificing decentralization or pushing the majority of users onto custodian solutions

— Justin Bons (@Justin_Bons) May 17, 2023

17/31) Sharding is a more competitive solution, one that will defeat the modular scaling thesis

As it will provide users with all of the benefits of the L1 chain without any of the inherent trade-offs that come with L2s

This can be done by "enshrining" L2s or sharding the L1

— Justin Bons (@Justin_Bons) May 17, 2023

19/31) This creates a massive bias toward L2 scaling

Even to the point of arbitrarily restricting L1 capacity & not pursuing L1 scaling technologies

We saw this in BTC as well;

As it went against the original vision for Bitcoin by arbitrarily restricting the block size limit

— Justin Bons (@Justin_Bons) May 17, 2023

21/31) The incentives are so terribly misaligned in favor of L2 development

That major L2 companies such as Arbitrum have straight up bought out major clients such as Prysm

History is repeating; as this is what happened to BTC through companies like Blockstream & Chaincodelabs

— Justin Bons (@Justin_Bons) May 17, 2023

23/31) All systems with such perverted incentives will trend toward corruption given enough time

Blockchains are no different at this scale; as it can still be controlled at a center

History is repeating itself; a real tragedy for humanity, as it means ETH & BTC will not scale

— Justin Bons (@Justin_Bons) May 17, 2023

25/31) Thereby providing an indefinite source of L1-biased funding

This is not a new idea, having been pioneered by cryptocurrencies such as DASH, DCR & XTZ

Running live for years before the experiments in DAOs occurred in ETH

The mixed results; were due to a lack of scale

— Justin Bons (@Justin_Bons) May 17, 2023

27/31) I am not against L2 solutions; I definitely do think they have their own niche use cases

However, I disagree with arbitrarily restricting L1 capacity in favor of L2 scaling

Allow both to scale within the bounds of decentralization & let the market decide which is better

— Justin Bons (@Justin_Bons) May 17, 2023

29/31) I was a Bitcoin supporter from 2013 to 2016

I even supported ETH from the first day of launch, mining it with several rigs in 2015

It makes me incredibly sad to see history repeating itself in this way

ETH is a huge improvement over BTC, but it too can be superseded

— Justin Bons (@Justin_Bons) May 17, 2023

31/31) I really do believe in the massive utility cryptocurrency will be able to offer the world

So this critique comes from a deep place of optimism; we can solve the scaling trilemma

I hope the ETH community can take this as a constructive criticism

For a truly better future

— Justin Bons (@Justin_Bons) May 17, 2023

Yesterday I freaked out about the revelation that @Ledger could spit out your private key with a firmware update.

Yet I noticed the smartest people were not freaking out. Was I missing something?

I spent the evening educating myself, and now I'm in the "nvm it's fine" camp.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

This was my initial mental model: I thought Ledger's Secure Element was like Apple's Secure Enclave—a box that a private key lives in which can only sign things, but "keys can never leave the device." h/t @roinevirta

But it's not! Firmware can exfiltrate the private key! Oh god! pic.twitter.com/heXxRVSJPs

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

This take is actually nonsensical. This *can't be how it works*.

Because Ledgers *upgrade*.

Many people's instinct is "wait why even? I don't want my hardware wallet to ever upgrade."

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

But Ledgers upgrade to support evolving blockchains. Ethereum now requires BLS signatures. Then there's Solana, NEAR, Aptos, all the new stuff. They have new signing algorithms, new key derivations, all sorts of fanciness. Aside from Bitcoin, every single blockchain evolves.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

If a Ledger were an un-upgradeable box with a private key inside, then it would need every algorithm that every blockchain will ever use already available inside the box. And if they didn't think to include a newer algorithm, you'd have to throw it away and buy a newer model.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

Consumers will not sign up for that. So they accept a compromise:

The box can take in new code that touches the private key if the user approves it. *But only code that was signed by Ledger Co.*

Their signoff is how they keep you from getting owned by malicious apps/phishing.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

Every Ledger app (for any blockchain you run) can in principle extract the private key on your device.

Of course it can!

Because Ledger Apps often have to derive a key for another blockchain, which originates from the master secret on the device.

There is no way around this.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

So yes, you're trusting Ledger. Although you only need to trust them once, since you are never *forced* to upgrade firmware.

__This was always true.__

Either you throw away your device every time a new blockchain ships, or you embrace this trust model. Can't be both.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

The important point is: every major hardware wallet works this way.

That said, Ledger did some terrible corporate comms and freaked everyone out.

But the more I reflect on this, the main reason was people don't understand how hardware wallets actually work (myself included).

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

People want hardware wallets to be ASICs. But they're actually FPGAs, and consumers have chosen that.

That said, maybe there will now be a market for an "ASIC" hardware wallet. It's easier now that the landscape of blockchains has settled down a bit compared to 5 years ago.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

TL;DR: Ledger is fine, regardless of model. Choose your hardware wallet provider on the merits.

Also shoutout to @OneKeyHQ which is one of my daily driver HW wallets and is fully open source, invaluable in understanding this (disclosure: Dragonfly is an investor).

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

1/31) Scaling a blockchain exclusively through L2s is a terrible idea

As it comes with horrible UX & trust trade-offs; pushing people into centralization

Inevitably leading to failure; as users move to scalable chains instead

L2s have become the greatest source of corruption:

— Justin Bons (@Justin_Bons) May 17, 2023

3/31) Since, ironically, the solution lies in reinventing decentralized consensus for sequencers

Going full circle & ending up in a worse position

As it divides PoS capital between hundreds of L2s instead of combining it all under a single L1

As stake = security in this case

— Justin Bons (@Justin_Bons) May 17, 2023

5/31) This is why L2 sequencers & admin keys end up facing the same challenges as an L1

Without being optimized to solve these problems by virtue of scale, unlike most major L1s

Even though a sequencer cannot steal user funds, it can censor & front-run, which is unacceptable

— Justin Bons (@Justin_Bons) May 17, 2023

7/31) This is not even the biggest problem with L2s

As the UX issues this causes are completely unsolvable in the context of a competitive market

The best way to demonstrate this is by using a simple example;

Two users exchanging value in an L1 world compared to an L2 world:

— Justin Bons (@Justin_Bons) May 17, 2023

9/31) To make things even worse;

The user also now needs to find out whether these specific L2 are even secure or decentralized

As in a free market, there will always be custodian & centralized L2s

Since even today, most L2s have admin keys & or centralized sequencers!

— Justin Bons (@Justin_Bons) May 17, 2023

11/31) Nor should they

Making a fully decentralized & permissionless L2 seamlessly interoperable with a custodian L2 is irresponsible

When the trust model differs; more user choice has to be introduced

However, it is this user choice which makes the UX untenable; a catch-22

— Justin Bons (@Justin_Bons) May 17, 2023

13/31) As the majority of LN users are now on custodian solutions, I correctly predicted this back in 2015

This is all a UX nightmare & far too much to expect from normal users

Inevitably leading to people opting for custodian solutions, which is exactly what happened to BTC

— Justin Bons (@Justin_Bons) May 17, 2023

15/31) However, here comes the twist

In the meantime, blockchains such as NEAR, EGLD, XTZ, TON & more have proven that execution sharding is possible!

This means we can scale on-chain without sacrificing decentralization or pushing the majority of users onto custodian solutions

— Justin Bons (@Justin_Bons) May 17, 2023

17/31) Sharding is a more competitive solution, one that will defeat the modular scaling thesis

As it will provide users with all of the benefits of the L1 chain without any of the inherent trade-offs that come with L2s

This can be done by "enshrining" L2s or sharding the L1

— Justin Bons (@Justin_Bons) May 17, 2023

19/31) This creates a massive bias toward L2 scaling

Even to the point of arbitrarily restricting L1 capacity & not pursuing L1 scaling technologies

We saw this in BTC as well;

As it went against the original vision for Bitcoin by arbitrarily restricting the block size limit

— Justin Bons (@Justin_Bons) May 17, 2023

21/31) The incentives are so terribly misaligned in favor of L2 development

That major L2 companies such as Arbitrum have straight up bought out major clients such as Prysm

History is repeating; as this is what happened to BTC through companies like Blockstream & Chaincodelabs

— Justin Bons (@Justin_Bons) May 17, 2023

23/31) All systems with such perverted incentives will trend toward corruption given enough time

Blockchains are no different at this scale; as it can still be controlled at a center

History is repeating itself; a real tragedy for humanity, as it means ETH & BTC will not scale

— Justin Bons (@Justin_Bons) May 17, 2023

25/31) Thereby providing an indefinite source of L1-biased funding

This is not a new idea, having been pioneered by cryptocurrencies such as DASH, DCR & XTZ

Running live for years before the experiments in DAOs occurred in ETH

The mixed results; were due to a lack of scale

— Justin Bons (@Justin_Bons) May 17, 2023

27/31) I am not against L2 solutions; I definitely do think they have their own niche use cases

However, I disagree with arbitrarily restricting L1 capacity in favor of L2 scaling

Allow both to scale within the bounds of decentralization & let the market decide which is better

— Justin Bons (@Justin_Bons) May 17, 2023

29/31) I was a Bitcoin supporter from 2013 to 2016

I even supported ETH from the first day of launch, mining it with several rigs in 2015

It makes me incredibly sad to see history repeating itself in this way

ETH is a huge improvement over BTC, but it too can be superseded

— Justin Bons (@Justin_Bons) May 17, 2023

31/31) I really do believe in the massive utility cryptocurrency will be able to offer the world

So this critique comes from a deep place of optimism; we can solve the scaling trilemma

I hope the ETH community can take this as a constructive criticism

For a truly better future

— Justin Bons (@Justin_Bons) May 17, 2023

Yesterday I freaked out about the revelation that @Ledger could spit out your private key with a firmware update.

Yet I noticed the smartest people were not freaking out. Was I missing something?

I spent the evening educating myself, and now I'm in the "nvm it's fine" camp.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

This was my initial mental model: I thought Ledger's Secure Element was like Apple's Secure Enclave—a box that a private key lives in which can only sign things, but "keys can never leave the device." h/t @roinevirta

But it's not! Firmware can exfiltrate the private key! Oh god! pic.twitter.com/heXxRVSJPs

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

This take is actually nonsensical. This *can't be how it works*.

Because Ledgers *upgrade*.

Many people's instinct is "wait why even? I don't want my hardware wallet to ever upgrade."

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

But Ledgers upgrade to support evolving blockchains. Ethereum now requires BLS signatures. Then there's Solana, NEAR, Aptos, all the new stuff. They have new signing algorithms, new key derivations, all sorts of fanciness. Aside from Bitcoin, every single blockchain evolves.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

If a Ledger were an un-upgradeable box with a private key inside, then it would need every algorithm that every blockchain will ever use already available inside the box. And if they didn't think to include a newer algorithm, you'd have to throw it away and buy a newer model.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

Consumers will not sign up for that. So they accept a compromise:

The box can take in new code that touches the private key if the user approves it. *But only code that was signed by Ledger Co.*

Their signoff is how they keep you from getting owned by malicious apps/phishing.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

Every Ledger app (for any blockchain you run) can in principle extract the private key on your device.

Of course it can!

Because Ledger Apps often have to derive a key for another blockchain, which originates from the master secret on the device.

There is no way around this.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

So yes, you're trusting Ledger. Although you only need to trust them once, since you are never *forced* to upgrade firmware.

__This was always true.__

Either you throw away your device every time a new blockchain ships, or you embrace this trust model. Can't be both.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

The important point is: every major hardware wallet works this way.

That said, Ledger did some terrible corporate comms and freaked everyone out.

But the more I reflect on this, the main reason was people don't understand how hardware wallets actually work (myself included).

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

People want hardware wallets to be ASICs. But they're actually FPGAs, and consumers have chosen that.

That said, maybe there will now be a market for an "ASIC" hardware wallet. It's easier now that the landscape of blockchains has settled down a bit compared to 5 years ago.

— Haseeb ＞|＜ (@hosseeb) May 17, 2023

TL;DR: Ledger is fine, regardless of model. Choose your hardware wallet provider on the merits.

Also shoutout to @OneKeyHQ which is one of my daily driver HW wallets and is fully open source, invaluable in understanding this (disclosure: Dragonfly is an investor).

— Haseeb ＞|＜ (@hosseeb) May 17, 2023