The Structural Problem He Found on Returning to Bitcoin | Josh (@secsovereign) of Bitcoin Commons

What we talked about.

Josh, known online as @secsovereign, returned to Bitcoin in 2024 after a painful stretch in which he lost both jobs and a ten-year relationship while caring for his sick mother, and then his grandfather passed away. A small inheritance pushed him to revisit Bitcoin, and he remembered an old holding from years earlier. After finding a box of old hard drives in a shed, he identified an aging Ubuntu drive and, with help from a team at a Colorado workshop, moved the coins off a single point of failure into modern self-custody. He has since dedicated himself to Bitcoin full time. Drawing on a background in massively multiplayer game servers, reverse engineering, and security, he began studying Bitcoin's history and concluded that governance of the codebase is heavily concentrated, even though the network itself is decentralized. In conversation with Sunny Ray, he explains why implementation diversity matters, why Bitcoin lacks a true specification, and how his Bitcoin Commons project applies Elinor Ostrom's commons principles to code governance. He also shares where listeners can follow his work.

Josh recovered Bitcoin from an old shed hard drive, then rebuilt from scratch after spotting a hidden centralization in Bitcoin's codebase governance.

The questions, and the answers.

What did you do after your life fell apart and you decided to look at Bitcoin?

I inherited a little money from my grandpa and didn't want it sitting in fiat. After looking at bonds, real estate, stocks and gold, nothing appealed. Then I remembered I had done something with Bitcoin long ago. I searched my house, found old hard drives in the shed, and one booted into a very old Ubuntu.

How did you finally recover the coins?

I met Josh Grath at Porkfest in New Hampshire, where he ran a self-custody workshop. I trusted his integrity and asked for help. Two weeks later, in his basement in Colorado, a small team including Hunter Beast moved the Bitcoin off a single point of failure it had sat on for about 14 years into modern self-custody.

What did that moment feel like?

It was a roller coaster. I was elated to recover life-changing wealth, but also a bit bitter, wishing I had found it two years earlier or that my life hadn't had to fall apart first. Afterward I resolved that Bitcoin is the apex asset and dedicated my life to it.

What prior experience prepared you to take on a full node reimplementation?

My background is in video game technology, especially massively multiplayer games, which are distributed systems with real security demands. I did a lot of reverse engineering with emulators, worked as a full stack web developer, and had startups attacked by hackers. Bitcoin is security critical software, so that experience fit well.

When did you realize one codebase and concentrated merge authority was a structural risk?

I went through Bitcoin's history and found a Princeton talk where Gavin Andresen said technical consensus was solved but social consensus was not. He also said Bitcoin should have several implementations. Then I studied the inflation bug, which a chain split between implementations would have exposed immediately. The monoculture was the risk.

What misconception do people have about implementation diversity?

Many assume an alternative implementation carries the same risk as Bitcoin Core. But Bitcoin has no real specification, unlike HTML, HTTP or SSL. There is nothing independent to check an alternative against, so Bitcoin Core's codebase is effectively the specification. Most people do not understand that.

What are you proudest of in the Bitcoin Commons stack?

The specification. Even if you are not interested in my alternative implementation or governance model, the whole community can use it. It is formally specified in mathematics, roughly two to three thousand lines of pure math, and anyone could build an implementation from it in any language with any governance model.

What is the biggest misunderstanding about why this work matters now?

People confuse decentralization of the technical consensus layer with decentralization of the social consensus layer. Nodes and miners are distributed, but governance of the repository is heavily concentrated. I am not saying it is captured or that anyone is bad. People simply respond to incentives, and that risk needs to be accounted for.