Peach because I thought it was a regulated exchange, and I figured I'd just use one of the big ones if I was going to go that route.

Its possible that these sorts of things will always have a target on them and therefore always be somewhat temporary in nature. They exist while no big government person is paying attention to them, and then they get stamped out and we move on to something new.

Then you should really try Mostro :)

If you've used Bisq, I think you'll find it interesting. No regulated company in the middle, non-custodial, and anyone can spin up a coordinator. It's basically one of the experiments we're talking about in this thread.

Yes, Mostro is actually one of the experiments I had in mind.

And I think your concern about consolidation is the important one.

Having a protocol that allows anyone to run a coordinator doesn't automatically give you decentralization. If eventually most liquidity and users converge around a handful of well-known coordinators, you've recreated obvious pressure points — just at a different layer.

The interesting outcome would be exactly what you describe: hundreds or thousands of coordinators, where spinning up a new one is cheap, permissionless and normal, and losing one doesn't really matter to the network.

Whether users and liquidity naturally converge instead is probably the real experiment.

Maybe the hardest part isn't making P2P permissionless at the protocol level. It's preventing convenience, reputation and liquidity from centralizing it again at the social layer.

That's pretty much the distinction I was trying to get at.

Peach is interesting precisely because they tried to build inside the legal framework while preserving self-custody and KYC-free trading. And for several years, apparently, it worked.

But what's happening now shows the weakness of that compromise: if your permissionless properties ultimately depend on a regulator continuing to interpret the rules the same way, they aren't really permissionless properties.

I think the more interesting question is what comes after that realization.

A protocol you can launch and walk away from is probably the endgame for censorship resistance. But getting there while retaining usable dispute resolution, reputation and protection against scammers is the difficult part.

That's where I think the current experiments in P2P Bitcoin get really interesting.

Yes! A new little step to grow again!

I think the main comparison for me is actually a tiny no-KYC VPS.

You could probably do this cheaper with a very small VPS acting as a gateway, especially if all you need is SNI passthrough or a reverse tunnel back home.

But then you own the whole stack: initial setup, WireGuard/tunnel config, reverse proxying, firewall rules, updates, monitoring, and eventually fixing it when something breaks.

So Blindport makes sense to me less as “cheaper than a VPS” and more as “pay a small premium to avoid running another server while keeping the TLS endpoint at home.”

That trade-off is actually pretty interesting.

I’d still personally want to compare the monthly cost against a minimal no-KYC VPS, but operationally this is definitely cleaner.

Yeah, fair point. I think I was giving AI a bit too much credit for changing the rules here.
The Linux kernel example makes that pretty clear — the basic problem was already there.
What AI probably changes is the speed. If patch diffing and digging through the affected code can be automated more and more, that window between releasing the fix and people actually upgrading gets uncomfortable pretty fast.
So maybe it's less "AI is changing responsible disclosure" and more "AI is making the old rules matter a lot more."
Thanks for the Linux reference btw, I'm going to dig into that.

Thanks man.

Yeah, this is the part I hadn't really considered when writing it.

Announcing that something is wrong before operators actually have the binary changes the threat model by itself. You've basically told everyone where to start looking while defenders still have nothing to deploy.

So the 14-day embargo may not even be the most interesting part here. The timing of the announcement vs the availability of the fix might be.

Definitely something I'll revisit once the source drops. Thanks for adding this.