What Do Most People Get Wrong About Bitcoin Security? Blockclock Mini & Bitcoin Treasuries

Hi, you're listening to Stephan Livera podcast. Today for episode two hundred and twenty-four, what are some common errors that people make when learning how to self-custody, should you use multi-signature? Rodolfo Novak of CoinKite joins me on the show to discuss this and more. This show brought to you by Swan. In their effort to spread Bitcoin knowledge and awareness, Swan is giving away a free book. Inventing Bitcoin rated four point nine stars by Swan co-founder Jan Pritzker. To get your free ebook or audiobook of Inventing Bitcoin, go to swanbitcoin dot com slash freebook. All Swan asks is that you pay it forward, share the book with at least three family and friends, and if you join the Swan Force at swanbitcoin dot com slash enlist, you'll get a special link to the free copy of Inventing Bitcoin that will help you recruit new bitcoiners. You can share the book with anyone, and if they eventually start stacking with Swan. You'll get credit for that referral, so it's a great deal. Spread Bitcoin knowledge and Swan Bitcoin, the best and safest way to start accumulating Bitcoin. So go to swanbitcoin dot com slash freebook to get your free copy of Inventing Bitcoin by Jan Pritsker. This show also brought to you by Unchained Capital, building Bitcoin native financial services on a foundation of multi-signature. Their multi-sig vaults are designed for ultra secure long term storage and have no setup or storage fees if you build them on your own. If you want the White glove treatment, their team will teach you all about multi-signature, ship you hardware wallets, answer all of your questions, then deposit a thousand dollars of Bitcoin in your vault through their concierge service. And once your Bitcoin are secured in multi-sig, you can buy Bitcoin through their OTC desk for purchases fifty thousand dollars or higher into your new vault, which is great for self-directed Bitcoin retirement accounts and for companies moving Bitcoin to treasury. Their advanced business accounts, OTC desk, and concierge service can also help move your corporate- Treasury to Bitcoin where your team controls the private keys, no more counterparty risk for corporate Bitcoin, and finally, friends don't let friends sell Bitcoin, so Unchained Capital offers Bitcoin collateralized loans with unparalleled security via multisig. Check them out and enter code livera when ordering a concierge onboarding service to get fifty dollars off, that's one thousand four hundred fifty dollars for two new Trezor Model T's, white glove onboarding, and a thousand dollars of Bitcoin all in a new multi-signature vault. Check out the Their website, unchained dash capital dot com, for more info. This show also brought to you by Knox, a Bitcoin custodian dedicated to ensuring their insurance protection covers the full value of their customers' assets. For example, suppose a fiduciary wants to hold two hundred fifty million dollars of Bitcoin with Knox. Knox will seek to obtain two hundred fifty million dollars of insurance dedicated exclusively to that account and adjustable to volatility, no fractional coverage or narrow scope insurance for what it's worth, a tool to transfer risk. If you are a Bitcoin company, Investment fund, trust, or family office, check out Knox for your insured custody. KnoxCustody dot com. Here's the interview. Rodolfo, welcome back to the show.

Hey man, thanks for having me.

So Rodolfo, there's been a lot of advancement and development, in, you know, the recent year or so. We have a lot more advancement around, you know, obviously multi-signature also. So I wanted to get your thoughts on that. I know you have been publicly sort of Not anti multisig, but just more cautious to say that it's more for the advanced users and things like that. So I guess what's your current thinking on that idea, and at what point do you think it becomes, let's say, accessible for, let's, let's say, the intermediate user?

Right. so I think I, I finally sort of like have this more, clear mantra now. Is if you have to ask, you shouldn't use it, right? Because it doesn't mean you can't learn and, and you, and you can't do it. You, you totally can, but you're just not ready to use it right now, right? And, and I, and I think a lot of people get caught up in this purgatory between Coinbase, right? And, and these ultra-paranoid setups that you have to be an expert, right? So then they end up just staying on Coinbase out of fear. So So wh-what I'm trying to sort of like, like get people on to do now, is to, is to get the basics right. Actually, that, that goes well with that link I just talked about. It actually goes right on this. So, I created this, this quick little sort of, very, very basic rundown of what you should do. It's a Bitcoin security guide, okay? So essentially, all I'm asking is, No matter where you wanna go and how far you wanna go in the security rabbit hole, okay? Get your coins off exchanges, but do that in a safe, secure, and sort of like, very sort of sane way, right? What I'm saying is, you essentially, you set up, a cold card wallet, y-you set up a metal backup seed, okay? You make a backup seed in metal Because I hear the horror stories, from support. and, then you make a couple micro-st encrypted backups just so you have easy recoverability, right? So what happens here is, if you have a very basic backup, okay? a-and you have a basic setup that's in a hardware wallet, like fairly secure, tested, right? Now you can sleep at night, okay? Yeah, you don't have the most sort of like ultra fragile system in the- The world, but against ninety-nine percent of all the attack surface, all the stuff out there, okay, you, you're safe against, right? So, so now you can go and sort of research multisig, you can research services that offer multisig, you can research, very complex, multisig setups that, that, like truly remove trust from, from each of the legs, a-and, And, and, and you know, you, you can continue your journey, right? But, but like, at least you're not stuck.

Yeah, that makes a lot of sense. I think it is about progressively taking a person up the levels of security. I suppose- Someone might say, "Well, hold on, what about if, if, if they just get to a certain level and they, and they haven't been kind of taught that, hey, you need to keep improving your level of security, and that, and maybe that's where someone like a Michael Flaxman might be coming back and saying, "Well, hold on, aren't, aren't you leaving yourself vulnerable there to, let's say, the retirement attack? That, let's say, lots of people just trust one hardware wallet manufacturer, and, you know, that manufacturer might have, The generation that the user is unaware of, that kind of thing. so I suppose that's probably the main counter is something like that, but ultimately at the end of the day, you still just have to improve your security and, focus on that.

Yeah. So, a-and, and, and I totally get where he's coming from, right? Because that's- Kind of like where ColdCite came from, like I just couldn't trust anything else. I totally get that, that, that issue that he has, right? it's fair. Now, I, I can't speak for the other wallets, but like, we built ColdCite so you don't have to trust us, right? Period. Right? so much so that, like, we just recently released this guide on how to prove to yourself, right, verify it, and duplicate The, the dice rolls, right? So you're not trusting our silicon, period. Okay? So, i-i-it really is the, the last sort of like Boundary of tin foil there that it can go, i-i-in, in, in regards to our hardware, right? So the retirement, attack is, is like not possible, right? If you duplicate the math on the dice rolls in a, in a separate device.

Yeah. So let's talk a little bit about that. So I saw the video, you've got the rolls dot py. Can you just talk through what would that process look like? Let's say the user wants to do this. Now, let's just note, this is more of an advanced user function. Maybe if you could just talk through what it looks like.

Right. Okay. So, so the idea here is, I'll, I'll be very sort of simple in, in explanation. so the idea here is, right? So on Coldcard, you don't have to use our random number generator to create your seed, right? even though the, the math is good, the, the thing is fine, right? But let's say you really wanna be paranoid, you don't wanna trust it, no problem. You can in-enter your own entropy by throwing dice rolls, right? Now The criticism of that is, well, the cold card could be lying to you, right? It could be saying, "Hey, I'm taking these dice rolls, I'm creating a seed for you from them, but it's a lie, right? Because you're not really seeing the cold run." Now How do you get around that, to prove that it's not happening? So we created this little mini Python script, okay, that you can run on Tails. I, it's like just a few lines of code, literally, and, and it's completely verifiable by anyone. and you can use other tools as well that are not this one. But so what you do is you, you open Tails, right? You have to be really careful if you're gonna do this, because, you'll be exposing the seed to another device, okay? So let's say you have Tails running on an air gap machine, right? And you have Coldcard beside it. So what you do is, you, you throw the dice, you enter on Coldcard each roll, and at the same time you enter each roll on this tool, right? And, you know, these are two separate devices running two different codebases, right? They're different, and both will arrive at the same seed. So it proves that that seed entropy was used, sorry, that, that dice entropy was used to generate that seed, right? It wouldn't be possible for us to, to know that in advance.

I see. And so, how many dice rolls now would be required to make that kind of se-- setup secure? Because, like, what if the user just does, like, you know, two or three dice rolls or something? Like, they would have to do enough to make sure it's actually, like, sufficient entropy there, right?

So, so this- What is the interesting game theory on this stuff, okay? So because you're validating that that portion of the cold base of the cold card is actually like true and honest, right? like practically, you could use like just some rolls, right, to, to make sure that you added some extra entropy, and that, that should be enough, right, for the practical mind. if you wanna be truly paranoid and, and do the full entropy, it's ninety-nine dice rolls. which is really- Like just a few minutes, right? It's not the end of the world, but it's, it's, I, I don't believe it's necessary personally, because remember, right? Even if we know part of the entropy, we would still have to figure out which of this, like, like theoretical table of seeds you have, and then sort of figure out the entropy on top of that, right? And how long the entropy is. Like, it gets pretty crazy.

Yeah, I think that makes a sense to me, and, I guess because someone who's Is using this, they know that this is just a one-time setup, they might well just do the ninety-nine dice rolls to make it, you know.

But what's nice, yeah, what's nice about going through the full entropy process, going through the backup recovery and all that stuff is that If you've gone through the full process, right? like really, really the full process, you, you really sleep at night, right? Because there, there is no part of that that was not Duplicated, verified, and, and, and tested recoverability, right? So, so there really isn't nothing like left in your mind in terms of concerns about your hodl. Like, remember, the idea of a hodl is, is pretty hardcore. I mean, like, this is your life savings in a device, right? So, so, you know, it's, it's also a fun process to, to go through the whole setup. We have videos, you can sort of like go through step by step. I-, i-, it's not hard really. It's just a time Investment, right? Like you, you can put a couple hours and be done with it.

Yeah. So, with the, some of the recent conversation around multi-signature and, that recent episode, episode two fifteen with Michael Flaxman, I'm curious 'cause you had a response thread there. So I guess going back to those ideas, what would you say you agree there or w-- and what points would you say you disagree on?

So it's kind of funny, like in, in theory, I agree with everything Max says, right? Like I actually Talk to him a lot. so, but the problem is, it's, it's very impractical, right, for most people, even for advanced people, right? Some parts of that setup are, are like, like almost on the edge of you have to be a Bitcoin programmer. And, you know what I mean? It, it's like, it's too just Deep in the doub- in the rabbit hole. his second guide is much better, right? The ten times more security, for I can't remember now the, the name of the guide, but it's, it's a good guide. a-and it does, like, you know, increase your security a lot I would argue it more than ten times. now, again, right? I always go back to this, more complexity means more people will lose money, period. Like that's just the nature of this stuff, right? Encryption is great when you have the keys. When you don't have the keys, encryption sucks.

Right? So, so, so, you know, if you can comfortably follow the, the guide, by all means, have fun, right? I mean, it's fantastic. now Some, some of the things that I, I, I hear the horror stories, right, from support tickets, because people do email us in private, you know, mentioning some of the, the things that they come to. I mean, number one is fucking up backups. That is for multisig or non multisig, right? So people need to test Recovering the backup before they deposited. Right? So you, you put a little bit of Bitcoin, right? You, you delete the seed, you recover the seed from your backup, and then You, you see the Bitcoin showed up again when you recover the seed, right? And then you try to sign it out. So if you've done the full cycle, you know that your backups work. So backup is important. Now, backup for a multi-sig is a huge problem, right? Because it's exponential. So now you have to have, you know, like, say it's a two out of three, you have to have three separate backups. And these backups cannot be in the same location. So now you need three different locations, right? now these locations have to be fought through, right? Like they can't be easily-- you can't have two of them be easily accessible. Right? It gets tricky. So what are you gonna do? Are you gonna encrypt those backups? Well, now they're not like paper or metal anymore, right? So you're gonna have to have backups of the backups, and you're gonna have to have backups of the encryption keys. see, like, this thing gets tricky. And then, let's say you use passphrase, right? You have to have backup of the passphrase somewhere else. so, so it's amazing how many people get screwed with backups. and that's the backups of the seeds, right? I'm not even talking about backups of the wallet you use. So For single sig, this isn't as important, still important. Not as much today, but you should definitely do it. Is, you have to have a backup of the wallet you use to generate your wallet, right? So, you know, if it's Pektor, if it's, Electrum, have a backup of the version, the last known working version for you, right? Because time will pass, you will pass, and people won't know how to recover their wallet. Wallet, right? They might not know the derivation paths and all that stuff. So with single sig is a little bit more simple, right? 'Cause you could have just the derivation path and you're good-ish. now with multi sig, you have to have a copy of the redeem script, right? Because the redeem script may vary, right? There might be some, awkward way the developer decided to write that. a-and that will matter. with, legacy addresses, legacy Bitcoin, you had to have the order correct of the signers, for, for the xPubs when you're creating your, your redeem script. i-if I'm not wrong, if I remember right, with, with, at least with now with BIP32, SegWit, you don't have to have the order right in most scripts. so that's a little bit better, but still. you know, have a backup, a USB drive doesn't have to be encrypted, nothing, just put a copy of the current software you're using in it. if you're using Coldcard, you can export your wallet, a skeleton out of Coldcard into the MicroSD, encrypted or not. a-and that's enough for you, for anybody to recover that in case you're not around and can't explain. so that's a massive one for, for, multi-sig problems that we hear. It's like, "Oh, I had a multi-sig on Electrum five years ago." I only have one backup, I have two working wallets, so technically I could sign, but I don't know what script I use. And, you, you know, it's, it's, it gets tricky. and then, y-you know, the derivation path is important because you still need to also find the coins, right? some wallets don't have standard derivation, depths, right? So, so that could get tricky. You could simply not find the coins, even though you could sign for them.

It's quite scary, right? And I think some of these stories are, in fairness, cases of people using older software and maybe they haven't been following the discussion as much, and they're not using the latest stuff and doing the correct kind of backups and things. But I think you're right, the point is don't try to use standard setups such that you don't lose things. but I, I guess maybe for some of these people, it's that they don't know what the standard setup is. Would you say that's true or no?

Well, I mean, the, the reality See, the, the truth of the matter on this is that in Bitcoin, there is no, no,

there is no right way and wrong way, there is best way and worst way, right? I mean, you're free to do whatever you want, especially as a dev, you're free to write your software however you want. If, if the signature is valid to the network, well, that's all the network cares about, right?

True.

So, they, they may choose to, to, to do this however they want. a-and then, like Different software have different purposes, right? For example, Wasabi will have, non-standard derivation paths because it, it, it was designed for, for you to do, mixing, right? y-y-you know, and then you have, You know, like, w-we have standards, but, you know, they're more like guidelines, right? They're, they're not like a lot of these standards aren't, required standards in order for things to work. So you have to be really careful. you know, it could be that a dev, especially of a closed source wallet, could, could do things in a way that's non-standard and nobody would know until they go away, right? And it wasn't malicious or anything, it's just they thought they were doing it right. Yeah. It's tricky, right? So, so that's why, you know, we created, that, wallets recovery dot org, it's because we just wanted a, a repository of, of like derivation paths and, and ideally some notes about the script.

Yeah, yeah, wallets recovery dot org is a great site, and, yeah, so I guess maybe talking about standards and standard setups for the typical person who's just using single signature, they-- well, I guess in terms of backups, that person should have a metal- Seed backup for their, for their hardware wallet, and then they should ideally also have the, like you said, the skeleton wallet file so they can easily recover it into, you know, Electrum or Specter and things like that. and then they also wanna think about if they've got a passphrase, is that also backed up? Yeah, so, so

what I have here on that Bitcoin Security guide is, so keep it simple, and then, learn the ten commandments of self-custody, people can go look that up later. and then, so, you know, you get your cold card, you, you set it up, right? Like, and you set it up with the guides that we have that explain to you everything and why, okay? And then, you get your seed plate, you mark your ten, your twenty-four words, now you have a metal back- Right? Then you get the micro SD and you make a backup of the, of the code card because that would also save the wallet details, right? So that would make a life a lot simpler in case, you, you need to recover, due to loss or breakage or theft or whatever. And then if you're gonna use a passphrase, great. I recommend people using, choosing words from Bib thirty nine, words for their passphrase. So at least if they get hit their head on a, on a pole, it's gonna be easier for them to remember from a certain subset of words, right? Right. Yeah. and then, and then have another metal backup of that passphrase in a different geographical location. Okay. Anything that is a key has to have a backup.

and then what you do is you test everything. And then you're gonna choose, a, a wallet, right? I recommend, fully noted, Specter, Electrum, Blue Wallet or Wasabi. there's a few other ones, they're, they're still sort of like growing up. but th-these are sort of fairly solid, right? and then you make a backup of those. and then, make a- Yeah, you, you make a backup of that. and then like the key here is, after you're all set up, okay? You send a little bit of Bitcoin to the wallet, this counts for multisig as well, you send a little bit to the wallet, and then you delete The seed from the hardware wallets. You recover the seed from your backups into the hardware wallets, and then you see that the amount showed up, and then you can sign it. So if you went through that, then you're good to go, right? Like you're really, truly good to go, because you, you don't depend on any part of this, in order to, to have your funds recovered somewhere else.

Right. Yeah. I think the, the s-suggestion there to test your backup before you put in your real, you know, put in the real money is, definitely a good one. I think in practice, a lot of people in the industry just started on, you know, maybe in the early days,

Advanced up to having, say, a Trezor or a Ledger, and then, a lot of them now are trying out cold card, and then at that point, then that, you know, maybe they're started to learn putting on passphrases or no passphrase, and then, yeah, p-potentially once they've sort of, they're feeling comfortable with these things, then the next level could be to use a multisig setup where, i-in, in the example, if we're using, you know, Michael Flaxman's guide, you could have a cold card

Suppose you're using multisig, you could sort of say, okay, I'm gonna take a few more simplified assumptions here, like I'm not gonna have a passphrase on that because I'm using multisig anyway. and I guess what you could do is have three metal seed backups, and you could keep each of those with their respective device, again, so long as each of them is in like a safe location. Maybe you've got safety deposit boxes or you have safes in, you know, different places. and then for each location, you would obviously keep That, wallet backup file as well on like a USB stick with each one. So I guess that would be kind of stepping towards better practice, and then even more advanced would be stuff like passphrases and stuff like that, so I guess that's kind of how I'm thinking of it in terms of progressing through the levels of self-sovereign security.

Yeah, no, I, I think that's perfect, right? Because, The, the beauty of this is that the first step is already secure enough for most people, right? And for, for the kind of money that these people are gonna probably put in,

And, and like I, I think like a good rule of thumb in, in Bitcoin is like always, set up your security as if the amount of Bitcoin you have is worth ten to fifty times more. Right? Because that could happen like in a few months. And, and, and, and then like you're not like scrambling, right, to do things fast and, and sort of like Like, you're not in a rush, 'cause like people in a rush fucks up, right? you really, you really wanna sort of put the, the time and care to get the stuff done right.

Absolutely. So let's chat a little bit about the state of multi-signature wallets. What are your thoughts on the current, crop of multi-sig wallets?

I, I think like, I, I mean, it's quite amazing how much things have progressed, right? For all the, the hate on UX. I, I think things are, are going, forward like well. multi-sig isn't a simple problem, even though it may look that way. We used to have, like some reasonably good, multisig wallets that are no longer around, back then. And then sort of like there was this period where like the only place that you could have, like a reasonably compatible multisig wallet with multiple hardware wallets was Electrum. Electrum isn't necessarily bad. The problem with Electrum is that it's not simple. And, and, and it does create room for you to fuck up. So that's why I don't like recommending it for the average person. Now, I, I think Specter has done a tremendous job, it's, it's really good. The multisig is easy. this is young software, so there's still, you know, bugs here and there, but, but they're not like money losing bugs. And, and another plus of Specter is that it's essentially, front end for Bitcoin Core, right? So- A lot of the Bitcoin stuff is done actually on the, on Bitcoin Core, just via the API. So that's a great thing. So essentially you use your own node and you're having Bitcoin Core, which is fairly well sort of research software doing a lot of the hard stuff. and then, there is a Lily wallet, it's really cool as well. it's fairly young, right? i-it's still sort of, you could, you should consider it alpha kind of thing. but, but it has a lot of promise. It's fantastic UI, the software is beautiful.

what else? Blue Wallet just, just started to launch something that reminds me a bit of, the old retired Copay wallet. yeah, yeah. So, yeah, so KoPay wallet was surprisingly good if you didn't have too many UTXOs. then, then it was a disaster. It's, it's good that it was retired. But, but yeah, so Blue Wallet i-is doing some interesting UI stuff because A, another concern with multisig is coordination, right? A lot of people think like, you know, you think you multisig just for yourself, but a lot of times multisig is between you and other people. So having coordination of the multisig, a signing, ceremony if you wanna call it, is very important, and I think, BlueWallet is really sort of working well on that. yeah, th-those are the ones I have played with recently.

Gotcha. Yeah, and there's, there's this interesting one, "Nunchuck" by Hugo, Nuen. So it'll be interesting to see, what comes there.

Oh, I'm, I'm totally looking forward to, to trying it. So another, sorry, another thing that's important is, if you're gonna use a hardware wallet, like make sure the hardware wallet is PSBT compatible or at a minimum HWA compatible. Okay, Hwi is, is a, an Andrew Chow project to connect hardware wallets to Bitcoin Core, okay? Because hardware wallets could go away, they could choose to abandon Bitcoin, right? And, and then, great, you have this, this electronic device that now you can now make it talk to your software wallet to build and sign transactions, right? So, I mean, it, it is my opinion that no one should be using a hardware wallet Doesn't support PSBT anymore, it's Bitcoin Partially Signed Transaction, file. and, because at least with that, you know that's future compatible, right? y-y-you know that even if the vendor decides not to, to support Electrum anymore, Electrum supports PSBT, so you're good to go, right? we really wanna remove the scratches out of this project.

Back to the interview in a moment, but first a message for the sponsors of the show. Check out BitcoinBlackFriday dot com. This is a project from the team behind Bitcoin Magazine and the Bitcoin twenty twenty one conference. It's a celebration of the growing Bitcoin economy. On the site, you can find active deals for up to fifty percent off on your favorite Bitcoin gear and other merchants that accept Bitcoin. It doesn't stop with spending Bitcoins though, the fold team has teamed up with Bitcoin Black Friday to bring you a special promo for the much awaited Bitcoin back card. Spend fiat and earn Bitcoin. Now, if you sign up for early access for the fold card on Bitcoin Black- Black Friday, you will be entered into a raffle to win a whole Bitcoin. That's right, go to bitcoinblackfriday dot com right now and sign up for the Vault Bitcoin Rewards Card to enter and get a chance to win an entire Bitcoin. And lastly, CipherSafe producing the CipherWell product. So we're talking about Bitcoin and security this episode, but have you also considered backup and recovering your bitcoins? Are you keeping your bip thirty-nine seed just on that paper backup? Well, you've got to think about whether it's fireproof and waterproof and rustproof. There were to be an accident or some other event such as that, so look into the cipher wheel. It comes in a wheel shape and it masks the words of your seed, and you get some tiles, and for each of your words, you can slide in the tiles to backup your seed, and in this way, you can make sure that you or your loved ones have access to your bitcoins if an accident occurs. Orders are going out, go to ciphersafe dot io and use the code livera for a discount. Back to the interview. It seems to me like the industry is slowly, is getting Around to that message, and, certainly I'm more, a lot more comfortable using PSBT wallets myself also, just because it's just easier to work with other pieces of software in the, in the ecosystem. So in terms of hardware wallets, are you, bullish or bearish on QR codes?

So, QRs are really cool, right? I mean, I love QRs per se, right? The problem with QRs is the bandwidth, right? The data bandwidth on QRs is garbage, it's very tiny, especially with small screens and the camera resolution. So It's actually, in my opinion, doomed for multisig, because you're gonna need big screens and you're gonna need to do, animated QRs to do any multisig work because the, the PSBT files are gonna be large. And as the complexity of these multisig setups grow, they could become even bigger. Right? So then they won't fit at all in a QR that fits in a reasonably sized screen of a hardware wallet, right? so then you're stuck. And you're not necessarily gaining any more security, like QRs aren't more secure than MicroSDs, right? Unlike people love to believe that, but it's still data, right? Like you're passing around data. I, I could make the case that a QR is worse than a MicroSD for security because at least on the MicroSD, the data vi-is visible, right? So you can see the data, a-and you, and you can verify it. you can even sanitize that, or you can use a computer to pass that information to another microSD or sort of like, y-you can create some incentives for attackers to know that they're be wasting their time, right? with QRs though, you're sending the data directly to the device, and one, I've seen some of the implementations around of QR stuff, they're trash. Nobody's really checking or doing real security on the data coming through the QR. a-and, and two, actually, there was an attack, if I remember correctly, not through, not Bitcoin related, but it was, there, there were some malware, going through QRs, because-- Or, no, actually, no, it was Bitcoin. There was some attack, if I remember, it was essentially the, the-- Because a lot of hard, a lot of wallets out there just sort of forks. First code, they, they used the QR generation code they found in GitHub, and the, the attacker changed the, the, the, this, this library to generate, to, to generate known, addresses that were his. so, so, yeah, exactly, right? So it's tricky, right? Because it is not visible, humans cannot read QR codes, right? So you'd have to, you wanna double-check the QR because you can't- Can't trust it. this isn't to fudge it, right? Like the, the chances of some of the stuff happening, especially in hardware wallets, are much lower, right? But it, it sort of falls in the same category, same category as micro SDs, right? I, it is air-gapped, right? So micro SDs and QRs are air-gapped, so it, they do prevent synchronous attacks, right? So remote attacks, You, you, you, you still have to recover what you tried to attack, although with the QR, you could, you, it's kind of bad because you, you could send them like addresses that, that aren't yours, right? Now, I still think these things are much better than USB. I mean, you-- like, no hardware wallet should be plugged into the USB, the USB, like, period. Okay? It's just, it is not air-gapped, it is stupid, especially if the hardware wallet doesn't have a secure element, right? You're, you're opening yourself for, for being attacked, especially as the price goes up and the, and the reward for the attacker grows. USB is a clusterfuck.

Okay, so a few things I wanna talk about there. So with the QR code, I suppose the counterargument might be, well, it may be, you know, it'll be animated GIFs and it will just, even if it, with a small screen, it can just still be conveyed, that info can still be conveyed, to, you know, between the computer and the hardware wallets using the QR codes. No, not necessarily.

If the transaction is big enough, not even an emitter would do the job.

I see, yeah. And this would be like, and there's been discussion about this as well for, I think, multi-sig, where there's lots of UTXOs that are going into that transaction, making it a big one, and then therefore it's harder and harder to make it fit and things like that.

Yeah, yeah, but remember, right? This, this is exponential problem, right? So the, the, the file, i-it's the redeem script as well, right? It's the whole signature So the data grows exponentially.

With the QR code, I guess the attack you were talking about, it, it maybe that's sort of analogous to a SQL injection style attack where, you know, there's like a website there and people try to hack it by doing certain codes that might- Manipulate the database in the background and things like that, and I guess in this case, the attacker might try to change the way the QR code is operating such that, you know, you're spending to their address or things like that. Yeah. And- I guess it would, I'd hope, it would be down to whether the hardware wallet correctly shows the user, "Hey, I'm about to sign a transaction for, you know, zero point one Bitcoin to this address, at that point, right?"

It's more than that. So the attack could be happening on a website, right, where you wanna send the, the Bitcoin to, which that, that's eas- that's more easier to foil, right? Because the, if the hardware wallet is doing it right, they're also showing you the address, right, the transaction you Output like they're showing you all the stuff, right, for you to verify before you sign it. Yeah. the problem with QRS on the other end, right? So having the QR on a hardware wallet for you to scan from another hardware wallet, for example, or even the, the cold that reads the QR, you could try to, one, like, make fake addresses show up on the hardware wallet itself, right? So deposit addresses. it's tricky that way. so I, I think ultimately, like the, the, the best, sanity check for anyone, it doesn't matter how, like, advanced or not you are, is before you sign a transaction, always verify the address and either verify the change address or at least make sure that you have a hardware wallet that, that does that for you. Very important because there's a lot of like, one of the, like recently there was a grief attack where you'd send the change to, different address, right? it was a trick that they were doing because, BIP one forty-three, Seg-- there's a, there's an issue with, PSBT and a flaw on how, SegWit addresses are signed, so you could, you could essentially con- reconstruct A PSBT with two signatures, a-and sort of show, a fake, fake, somebody else's, change address, and it would still sort of look valid.

Yeah, scary stuff, but I think, again, these-- some of these are kind of more in the, you know, the edge case kind of- Yeah.

They totally are, and that's why I'm saying, right? Like, you're, you're pretty safe if your device-- like, it's sort of like, think of them as like, that's why the, the whole Bitcoin ten commandments, of self custody. it's like, there's just basic things you do, right? And you're like ninety-nine, nine, nine percent safer Check stuff before you sign, right? don't plug the device on a computer. Like, y-y-you know, y-y- In order for somebody to foil those very basic things, they have to be like, like nation states, NSA level people, right? Like, they-- and, and they would probably need to have physical access to your house, right? So you, you, you can get to that level with very little effort. Just, just, just do the basics.

And so in terms of hardware wallets over the next couple of years, I guess you're seeing it like, it's not like every-- it's not like we're all gonna become QR code maximalists. But it's more gonna be more like maybe people who wanna do multi-sig will use some combo of different wallets, and some of them might be QR codes, and some of them might offer SD card, and that's kind of how you see it developing?

Yeah. So, you know, having QR codes and cameras do increase the cost, right? you, you can't make a physically secure device that is truly open source. You know, and sell for less than, say, two hundred fifty or like two hundred fifty, three hundred dollars, right? so, you know, cheaper devices that will, that offer all the things, you know, it gets tricky, right? It's like you're, you're kinda getting what you pay for, and then, and then, you know, and then depends on also on architecture, on how people are doing the, the, like the, the- The, the openness of their wallet, and, a-and then, y-you know, like I don't believe QR codes are super future-proof, in the same way that I think microSDs are, but, you know, I think that you should just support both, right? Like, i-ideally, you have a, a wallet that does both. And then, you know, you want wallets that don't support shitcoins,

I, I think that the, the, the touch the touchscreen FUD is a, is completely overblown. Y-y-you know, it's totally like the level that you have to be in if you're doing the touchscreen right for you to attack it is, is too high. So like, it's totally fine to have a touchscreens.

and, and then you can have two devices, right? Like, you can have like a, a device that's like super simple, like Coldcard Mark III, that, that does essentially like, it's completely sanitized of things that could be a, an attack vector, and, and you can also have You know, some other device that does QRS, right? Like, you wanna-- With complexity comes more attack surface, right? So if you're gonna have devices that do more things, you have to know that they're coming from people that, you know, y-y-you trusted before, if security and, you know? It's tricky, you don't wanna trust anyone, but, you can definitely leverage some trust heuristics, right? To, to be more practical and know what parts are worth verifying.

Yeah, sure. And, and, and maybe that, we see more of a range of different options too. So there may be some that are kind of more at the low end, and then, as you were saying, that, you know, if you wanted to make the kind of device with all the bells and whistles, and that might cost three hundred or three fifty US dollars, well, for someone who's storing, you know, millions of dollars, that's, that might well wa- that might be well worthwhile for

Who store tens of millions of dollars in paper wallets, right? and, you know, I've, I've seen people with millions of dollars in opendimes, you know, I really don't recommend that. I've, I, I, you know, there's lots of people, who store like fortunes on cold cards, right? Like, i-it's, I, I think what's important here is as your holdout grows, you need to sort of like do your own research, right? You have to figure out and, and you have to try to really remove the, the points of, of, of failure, right? Like the single points of failure from, from your setup. one thing that I find cool is that have once a year, A little sort of like a tradition of, of double checking your backups, for example, right? Yeah. Double checking they're still there, that, that your electronic backups, not just for Bitcoin, right? For everything really. Double checked that things are still sort of recoverable, because backups aren't useful if you're not recoverable.

Yeah, of course, of course. you might find that, you know, the- Yeah, the, the USB drive has gone bad or something has gone wrong with it, and yeah, certainly you wanna, you wanna be regularly testing those things. anything you can tease in terms of upcoming cold card stuff?

so we, we are working on, you know, on more devices, right? Like that never ends for us. we, you know, we took a little BlockClock mini detour there, that I don't know why we make those products. like, I mean, they're super fun, right? Like they sell and all that, but like, it, it's amazing how much like this kind of stuff really, like, detracts, right? so, so we do So our plan is to have, like Coldcard Mark III or some revision of it as is, because it is freaking secure, right? Like it's super secure device. So, We don't believe it needs too much change, it'll be always fun to sort of make some upgrades here and there. but we believe a device around that price point is important to be around forever. and then we're building a sort of like a, a Cadillac kind of thing, right? where you'd have all the fun features. It's a product that's been sort of in the making for a long time, sort of as a side internal project. I hope that, who knows, maybe, late next year or something. You'd see it. this, this device would be, would be pretty cool. yeah. But, you know, we, we wanna focus on the stuff that people are using of ours and sort of get that maintained and, and, and, and well featured.

Of course. Yeah, no, I'm, I'm, I'm a big fan as well. And, oh yeah, listeners, if you're not aware, make sure you use my code Livera when you're on CoinKite dot com. and also wanted to, wanted to chat about

Yours yet. Oh, man. So, so, you know, many people who listen to the show probably know the original block clock. some refer as the OG block clock. it was sort of like an electrical mechanical, device to, to display Bitcoin data, right? And price and, and, used, those digits that you find in train stations. it was fun. but it was a bit on the pricey side. So,

It was like ten K, wasn't it? Five, five thousand. Oh, five K, five K. You know,

it's, it's like man, it's like handmade and, like, you know, we went sort of like, listen, we wanna make the ultimate device for Bitcoin ten year anniversary, right? Yeah, yeah. so we've, we've been sort of like as a side project, we, we were sort of trying to come up with something, again, novel, right? Because it's, it's easy to make a screen that shows data, right

Something a little bit more, but more, more novel, and, we've been playing with, with e-ink displays, so we, we've decided to make, another data display, another sort of, Bitcoin, device that this one sort of uses, seven e-ink displays, beside each other, and they can all be used as like sort of single digits to show price big or, you can have like the, you, you can have, All the block data, the height and the difficulty, and, we're gonna be adding sort of like more APIs and, this device also has a USB port for you to plug open dimes, and you-- and it's really cool because you can check the value, you can initialize them, you can verify them. So if you're using it as like a, a, you know, if you have kids and it's like their piggy bank, you can just plug it in to check the balance.

That's very cool. Yeah. I'm looking forward to getting mine.

Yeah, it, it's, it's a, it's pretty, it's a pretty device. that, that was the idea, right? It's like a, sort of like an artistic piece in a way.

Yeah. So it's got, how many digits does it have? I'm just wondering, when, roughly when we'll need to get a new one or its planned obsolescence, right? You said seven?

Yes, has seven digits.

So that, that, that's good till, what, a mill or

just For some people, we actually have to deal with those problems already, right? So for example, if you use Japanese yen, you know, we have to show big numbers, so the, the clock knows how to change it in, into other forms of, of, number, so we can show mils, we can, you know, we can use, there is some, scientific notations there, some options that solve a lot of those problems.

Nice, nice. Yeah, and also we've got a chat about Bitcoin Treasuries, which is a great website. Tell us how you got that idea.

So, you know, I, I started to see like all, all this, these updates, right? Of- Companies started to, you know, you, you always had GBTC and, you know, those aren't necessarily treasuries, but, you know, it's, it's, it's non-ignorable sums of Bitcoin, right? I think there are four or six billion worth of BTC now. and, and then when MicroStrategy announced, their hold though, which is also not un-un-ignorable, I was very curious if there was a place for me to, to keep track of this Right? I wanted to be able to just go look and among other like other indicators that I want to know about their those, those companies. So hey, and oh, what, what do you do when you can't find something? You make it yourself, right? Hah

Yeah, and you're, you're, just like our friend, Matt Adell, you're a bit of a domain name guy. You love to hoard the domain, hoddle, you love to hoddle domain names.

Oh yeah, it's, it's, it's fun, it's fun to have, Bitcoin domains. it, it's also good for miming, right? Like, I get tired of, of like repeating myself on Twitter, so you can just go, like, you know, everything is good for Bitcoin dot

com And, what we're gonna see is a lot more companies, joining that list, I'm sure. So what kind of criteria do you have? Does, do they need to be public companies or is there kind of like a certain minimum threshold? Otherwise, you're just gonna have companies who are saying, "Oh yeah, we've got like six bitcoins, let's, can you put us on the list?"

Yeah. So, so this actually happened. So, so I started with this with only publicly traded companies, right? And, and I had an explanation of why not tah

The thing about public companies is that the information is public, right? And they're liable for it. So, sure there is some accounting lying that, you know, public companies do. Hello, Enron. Hello, Enron. but, you know, but at least it's a heuristic, right? Like, you, you have something that, like, I can trust-ish, right? At least for a non-like a, a for entertainment purposes website. So, so public traded company is great and it's really cool. Because you also have, access to very easy to their market capitalization, so you know the percentage of the holder versus their, their size of the company. so, so that part is really fun. so I added, you know, the, the ones, the public traded companies that were available that had it, and there's quite a few actually, and, and quite a few actually in, in, in Canada, and I think a couple in Australia. Canada, has a, a very interesting is a polite way of saying how the stock, the, how companies are-- public company, companies are open in Canada, most of the time they're reverse takeovers for, for that. so, anyway, so, so, you know, listed them, we're all there. and then, and then there is all the ETF-like products, right? I call them ETF-like, so Grayscale, CoinShares, i3Q. ETC Group and some other one there. those, those are sort of like, you know, they, they, they, they have a claim on BTC on your behalf, right? They don't necessarily even have the BTC on custo- on custody, I think, some of them. it's called, Assets Under Management. but the amounts are very big, and most of those do have also public numbers, so fun to, fun to show, right? And then, and then there were other sort of like three companies that, that, had, you know, like trustworthy, like they're private companies, so you, you know, you have to take it with a grain of salt. But these are big sort of Trusting-ish companies that, or at least, you know, they had to, to do some, certified accounting, for the shareholders, and they make that public. so I, I created a little, the threshold for a private company is fifty million dollars worth of Bitcoin. and they have to pass the smell test,

even though one of them is, I think, the Tesla Foundation, right? I mean, like clearly scam, but a legal scam. and it's funny, right, that they hold a ton of BTC, they, they have three hundred million dollars worth of BTC.

and, there's Block One, I can't even remember what scam that one was, but, you know, they, they have, like almost two billion dollars worth of BTC. Yeah,

that's crazy, right? And, I mean, the cool, yeah, the cool thing is you show the basis price, what they paid for it, and then what it's worth today. So it really, if, if you send people there, it can really drive some FOMO, hey?

Yeah, so, so that was like my, my, my first- Like need was for me to see it, right, to, to have a place that tracks it. The, the second purpose was to create Fomo, right? You know, it's a tiny little website on the internet, but hey! You, you know, it's, like competitive people need scoreboards, right? So, you, you know, you want a place for these guys to go and see, hey, you know, I'm not on the scoreboard, or I clearly have too little, right? This is, a-and there's a reason why this, this-the reason why the, the, the, this is sorted by total today's total value, right? It's like today's total amount of Bitcoin that- These companies have, that's the sorting there. and then to the right of that, it shows the percentage of all Bitcoin that they have. So MicroStrategy is at, a two basis point, a respectable two basis point there.

Yeah, so they've got thirty-eight thousand two hundred and fifty bitcoins, and it's point one eight two percent of all bitcoins. That's right. Is that all of all bitcoins that will ever exist or the current?

the, the total that will ever exist.

Of the twenty-one million, yeah, or just under. Yeah, right. So listeners, you can go to bitcoin treasuries dot org if you wanna see this one. but yeah, that's a very cool one. So, Rodolfo, do you have any predictions on what companies might be next out of

I think, like a, a much more important, announcement than MicroStrategy was to the actual, like, markets was the, the, the Square, white paper, right? Because, you know, MicroStrategy is cool and all, but, you know, he, he's gonna be considered sort of like a, a smart lunatic, right? And, y-y-you know, th-this is, in, in most companies don't have cash either, right? So they, they don't have that kind of treasury percentage anyways. but what Square did, though, is super important. This is, this is a monster, right? I mean, like, Square is like seventy billion dollars company, and that's not to count Twitter, which is sort of sister company too, right? So Square buying even just one basis point, in, in Bitcoin, but w-w-with the kind of pool that they have, create the framework for other public traded companies to buy Bitcoin is a big deal. That, that investment white paper that they created is a very big deal. and, and what I think people may not know is that the way these public companies work is like, it's slow, right, for them to sort of do things, especially the reg-regulatory side. the paper does accelerate, but We probably won't see, companies like a large amount of them doing this, like buying Bitcoin on their treasuries up until, un-unless the price goes crazy, right? if, if Bitcoin price is like, you know, fifty thousand dollars next week, we're gonna probably see, like, like a wave of that coming. But, you know, if the price just, if the price keeps on sort of like, kind of inching, inching up, these guys are gonna take their time, a-and, you know, we're gonna probably see This stuff on like either Q4 this year, like late Q4 or maybe Q2 next year, you, you take them a bit of time to sort of catch up, and then you're gonna start see, seeing them trickling in, and then the foam is gonna really build.

Yeah, and I think the other important factor is corporate DCA, right? Just regular buying of company, like companies who are buying Bitcoin regularly. So I imagine Square, they're probably not finished with buying Bitcoin, right?

Yeah, no, I, I mean, like, and, and it's very possible that they're not even buying on the, on the market, right? Like maybe they're just buying from their users that are selling too, right? it's, it's a much cheaper way for you to accumulate, is, is to, then you're not, you're avoiding external fees, right? so you buy on the behalf of the user, but when the users decide to sell, then you take it off their hands, right? It just goes back into this pool. I, I, I don't know, I, I haven't looked enough at how they are, they're doing their, their treasuries and, and, and like how they're managing the BTC of the users either, to, to, to have

But you're gonna see a lot of that, and, I, I think the, the main difference now than, than the last bull run is, like, you know, last bull run was essentially like, you know, Joe with a hundred bucks buying Bitcoin, right? w-when you have like large companies and publicly traded companies coming into this space You know, it's, one of their purchase is equivalent to all the retail that came in last time at the same time.

Yeah.

Like all of it, right? Like it's like these guys can move what all the Joes did that day, you know, in a single day plus, right? I think Sailor was mentioning that you, you don't move the market buying less than, you know, seventy million dollars or something per day.

Yeah, it's wild to think about. And that's what I guess

for these guys.

Yeah, and do you see it like, well, okay, I think at some point we're gonna see the whole corporate level FOMO. so I wonder, are some of these corporates actually gonna be really weak hands relative to some of the more hardened individuals in the space?

I don't know. I don't know. It, I, I don't think it's, be- so

you depend on their corporate structures, right? Because i-i-i-it's not that simple on, on, on this kind of, like- Very complex, entities. You know, most, most publicly traded companies, the CEO don't ha- don't have the kind of power that You know, Sailor does or that Jack does inside their companies, right? they can't just do whatever they want, so they might have, in place some policies about cutting losses, right? So, so- Might, that might actually dampen, some of the, some of the, the, the volatility, because you see those just happening, right?

So that's one thing. depending on the timing, right? Like, I mean, you know, if, if, if some of these companies- Like, let's say, I don't know, like, let's say another company comes in, buys five, ten percent of their treasury in, in, in Bitcoin, right? You know, and they, they're not a Bitcoin believer, they don't care about Bitcoin, right? It's just another asset that looks right, and you buy it, right? if, if, if they're sort of like forced to hold that with like nice appreciation, right? you know, in Bitcoin terms, slow so it's doubling every year kind of thing, right? they probably wouldn't, they probably wouldn't touch it, right? Especially if it's only five percent, of their hold. Now If a company like that finds itself in a position where the ten percent they have of treasury now goes a hundred x, and that becomes bigger, right? Then their actual treasuries, the, the other ninety percent of the company's, balance sheet, it's very likely they would at least liquidate half Because, like, you know, these guys aren't like believers, they're not-- no, just, like, that's just prudent, right, in, in their minds.

Right. They'll re- they'll rebalance it back down.

They'll probably would have some policy to handle that. But, but I think what's gonna happen is you're gonna see just like, that'll be the growing pains, right, of, of like public and large entities learning how to deal with Bitcoin on the balance sheet. It's not a simple problem when it's not your personal cash. Right? Your personal cash is easy, right? Like, you know, it sucks, you feel your gut wrench, maybe you shit your pants, right? When the Bitcoin price like completely like flattens, right? like it hits the ground, it's like, you know, after a bull run, right? Like, you know, that's just a personal vomit situation, right? Like, and it's your own personal choice on how to handle that. Now, when it's a, a, a large company or whatever that has like responsibility Or their, their employees and all the, all the, and the creditors and everything else, like they're gonna have to have ways of dealing with that, with that volatility or, or that possible, maybe not daily volatility, but like, this sort of like long-term, crash cycles, right? they're gonna probably have to figure out how to deal with that. It's not a simple problem.

Yeah, and, I mean, it also does depend on, you know, how crazy the cycles get and whether this is the, you know, the final cycle. Now, I think it's unlikely, but, I guess, that, that's my recent discussion with Preston, reminded me of that as well. What's your view on kind of, what's the earliest you could sort of see it, happening and like the latest that you could see that idea of, the hitting that, that, just that knee of the S curve That you know the four year cycles, yeah.

I, I, so I don't buy the final cycle, theory just because, I don't think the, the MMT people are dumb. I think they're very misguided, evil or whatever, right? But, I mean, ju-just think about this, right? Like, i-i-it's like, it's like, it's a very evil but one of the wonders of the world what they managed to, to do for the world not to end after 2008. Right? I mean, you know, they, they completely rebalanced, right? Like the, the purchasing power, like they, they screwed poor people, but they didn't cause wars, right? you know, I completely disagree with how everything was managed, right? And we're gonna pay for all that in long term, and these guys are playing a different timescale. But you can't deny, right, that they managed to keep the world from ending. and, and that took a lot of skill. So, I think with the amount of cash, the amount of power these guys have, if Bitcoin looks like it's entering a kind of like a final cycle kind of situation, I think they can do a lot to control that. I, I, it could be a, a slow boiling frog situation, right? That's where you end up, where they, they can just manage it, d-- instead of just letting it go, so that at least they save Their asses on, on two, three election cycles, right? a-and, and I think most Western countries can save one or two election cycles, even in a sort of end-of-the-world situation financially. You know, you could always invade another country. Go steal their shit, right? Like, I mean, this isn't new, right? Like, go drop some bombs, man. It's like, you know, they'll find a way, right? Like, these guys, these guys aren't going down quiet, right? This is what I think maybe people miss, right? This, this isn't gonna be pain free.

So, anyways. I, and, and I think, even though like, y-you know, I don't hear chatter anymore between like large older holders, about like sort of like selling price, selling price, right? So like people used to have, especially back in the days, oh, if it reaches X amount, I'm gonna probably liquidate, you know, ten, twenty percent, whatever it was, right? So that, you, you know, I can sort of mitigate some of the Bitcoin risk, right? Because if you've been in Bitcoin for Long enough, you remember when Bitcoin was definitely an experiment that'll probably end, and then slowly switching to may end, may not end, it's not likely to end, right? Yeah. so, you know, people sort of had different risk profiles through this time. So I think a lot of these old coins, that were like going to be sold have been already sold at the last cycle, right? That's when you had like individuals dumping a hundred million dollars of personal Bitcoin so they, they could, you know, buy a lot of Lamborghinis. So, I, I think that phase of Bitcoin, you know, there's always gonna be some, but I think that phase of Bitcoin, in terms of like, like a large amount, is sort of done now, right? So, so that's one interesting heuristics that's an interesting thing because there's-- means there's gonna be a lot less Bitcoin available, right? to buy. Now, this Bitcoin might come back as true loans, right? So these guys might be taking Bitcoin backed loans, right? So their coins might actually be coming back into the market re-pa- re-pa- rehypothecated, right? and might show up on the exchanges as, as liquidity. I don't know. I'd guess some of that will happen. But, so anyway, so, so what I think is gonna, like, it's more likely to happen is we're gonna have a run up, it's gonna be some absurd number, and then If we don't have a new, wave of entities, right, for that size now, so like a lot of public companies or, or just like very large private funds or, some sovereigns coming in to pick up some of that, you might have like an awesome, you know, an awesome crash, like Bitcoin is like, you know, say, not even too crazy, right? So like a hundred and fifty thousand dollars it crashes all the way down. All the way down to twenty five, right?

Yeah. And then Peter Schiff will come out and

say, "Oh, look, Bitcoin is dead, guys." That's right, right? I, I think that's, that's, that's a very possible scenario, but again, because it's a very possible scenario, i-it's, it's already in the models that people are building on how they wanna trade it out, right? So it, it might not happen that way just because. It's, it's impossible to know. i-it's just, it's just interesting to see. y-you know, as usual, if you're day trading Bitcoin and you're not like a really, really good at that, you're gonna probably lose money. So, you know, just buy Bitcoin and, and hold it.

That's right, stack 'em and hold. So, listeners, make sure you follow Rodolfo on Twitter at n v k and, go to coinkite dot com. and, Rodolfo, anything else you want the listeners to know?

No, I, I think, I think it's mostly it. Like, just follow me on Twitter and, you know, go check out our products like OpenDime and ColdCard and SeedPlate and BlockClock Mini and, and there is more coming. I want your sats. Hahahahah.

Awesome. Thanks for joining me.

Hey, thank you.

So get the show notes at stephanilivera dot com slash two two four. I'll have