France has fallen; I predicted it privately in 2020, and Hitler predicted it in 1926.
This is what public education achieves: indoctrination, the creation of slaves—slaves who do not defend themselves against either the government or an invader.
The system only creates docile workers who lack critical thinking and any sense of morality.
We have to be honest.
That’s why I broke away from “maximalism” of any kind—a form of maximalism that often involves denying the obvious.
I’m just a user of tools, and I criticize or praise them even while using them; I’m not going to criticize anything I don’t use because that’s ignorance, and I’ve made that mistake in the past.
Maintaining privacy with CoinJoin requires ongoing care: avoiding timing and amount correlations, address reuse, linking change outputs, consolidating mixed coins, and combining them with identity-linked funds. You also face intersection attacks, Sybil participants, malicious coordinators, wallet fingerprints, network metadata leaks, and identification through exchanges or merchants. The effective anonymity set may be much smaller than it appears, and additional rounds cost time and fees without guaranteeing proportional privacy gains. Bitcoin’s ledger remains public, so later spending can weaken earlier privacy.
You need to stay in CoinJoin forever.
At this point in history, with everything we know, defining oneself as left-wing or right-wing is a sign of profound brain damage.
There are only two kinds of people: those who try to be free—and therefore try to prevent others from stealing from them—and those who are slaves and don’t care if others steal from them.
All those who believe in the system belong to the group of slaves.
The left-right dichotomy is merely a flawed social construct designed to make slaves believe they have a choice.
After examining the current state of self-custody, my views on what setup to recommend to the average user have evolved.
As you know, I have not always advocated multisig. I previously believed that a strong passphrase with sufficient entropy provided adequate protection. However, following the Coldcard incident, I began reconsidering that recommendation: a passphrase can add security, but we still depend on the device on which it is used, leaving us exposed to both software flaws and supply chain attacks. A compromised device capable of capturing the passphrase or the derived keys can defeat that protection.
This led me to recommend multisig using devices from different manufacturers. However, the severity and scope of the Ledger attack have also made me question relying exclusively on hardware wallets, even when combining multiple brands.
A device being open source makes it possible to review how it works, but it does not guarantee that anyone has reviewed it thoroughly enough. We cannot assume that comprehensive, ongoing, independent audits exist, or that there are sufficient incentives to discover and disclose vulnerabilities.
Setups such as Yeti attempt to address this problem by relying on widely reviewed software, such as Bitcoin Core and Ubuntu, and on general-purpose hardware. The latter has an advantage: purchasing it does not directly identify the buyer as someone intending to hold bitcoin, which may make certain targeted supply chain attacks more difficult.
However, I also see limitations in this approach. If several keys are generated or used on the same computer, compromising that computer could compromise the entire setup. We still depend on Bitcoin Core, the operating system, and the hardware itself. A tampered download or a vulnerability in any of those layers could undermine security. Keeping the computer offline reduces risks, but does not eliminate the possibility of introducing malicious data or leaking information through the signatures it produces.
I also believe that a 3-of-7 setup adds too much complexity for the average user. Securely distributing and maintaining seven keys and their backups is difficult in practice. Nor am I comfortable relying on digital backups for long-term recovery: they require maintenance and may become tied to storage media, software, or formats that are no longer accessible.
For these reasons, my proposal would be:
- A 2-of-3 multisig setup, balancing security, redundancy, and ease of management.
- Durable physical backups, such as metal plates, while also preserving the complete multisig wallet configuration.
- Three independent general-purpose devices, from different manufacturers and running different applications.
- Only one private key on each device, generated independently, with no device ever having access to the other two keys.
One combination I would consider exploring is:
- An Android device running Electrum.
- Another Android device from a different manufacturer running MetroVault.
- An iPhone running BlueWallet.
The idea is to diversify the hardware, the software, and, to some extent, the operating system. This way, compromising a single device or application would not be enough to spend the funds.
For this purpose, I would choose devices dedicated to signing, kept offline and separate from everyday phones. Backups should also be distributed so that a single incident cannot expose two keys or cause a loss of access.
This approach still has one significant weakness: **the level of review and auditing of the applications**. We cannot assume that all of them have undergone sufficient security analysis; MetroVault, for example, acknowledges that it has not yet undergone a formal independent audit.
That is why I believe the community should support the review of these tools, fund audits, and improve their interoperability and recovery procedures. The goal would be to have independent, straightforward signing applications subject to sustained scrutiny, using Bitcoin Core’s level of review as a benchmark.
This is the direction that currently seems most reasonable to me for reducing dependence on any single manufacturer, device, or application. Any criticism or suggestions for improving the setup are welcome.
