Another weird narrative post-ColdCard is that if we'd just had covenants (CTV, I guess?) it wouldn't have happened. This is nonsense. The many people who wanted the simplicity of generating one set of keys on one device couldn't use vaults - vaults require generating multiple sets of keys in different ways in order to get security from these kinds of attacks. The people who were willing to do that already did - they used multisig across different wallet vendors and ended up safe. Vaults are cool and may be used by some, but the kinds of folks who used ColdCard were definitely not going to use them, sorry. I, too, wish there were something simple we could "just do" to prevent this kind of thing.

The average person does not try to solve their problems or struggles. They get stuck in a routine and live the same day over and over. It does not cross their minds to snap out of it, engage in strategic thinking, and change direction so they can eventually reach a more advantageous position in life. If you want to get ahead of 90% of people, all you have to do is pause, think, and actually attempt to overcome the struggle you're faced with.

Gentle reminder: Block out time away from the screen. Force yourself if you have to. Read a book for once. Hit the coffee shop. Do anything that gives your mind space to process all of the noise you've accumulated. You will feel the immense difference in mental clarity.

LLMs are very two-sided for security. On the one hand, long-latent bugs are finally surfacing. On the other hand, before you choose to use a product, you can get your own code review done for incredibly low cost*! In the short term it’s incredibly bad, in the long-term it democratizes code review greatly. “Don’t trust, verify” finally becomes an actual possibility for normal people! * of course LLMs do still make up issues when asked, push any such review to write PoCs to check their analysis!