Personal opsec: Bling vs bland

Transcript

Hi everybody. Okay, come in, come in, come in. Oh I lost my bling already. Yes, I can. Okay, we're kicked off. Are you warmed up, guys? Yes, we're ready. This debate is called about OBSC. bling or bl bland which is not to say that well Anna is a bit bling but you're not to say that Nicolo is bland but he will be debating not bland and Anna will be debating for bling in terms of personal ops sex so briefly Anna is with galaxy digital on the infrastructure side and a good friend of mine but I am neutral nicola

is also a good friend of mine and needs a little introduction for those of you who've been here all morning he is co-founder of Ledger and uh now with ZK Nox uh whose name should give you some suggestion of what it's all about. Okay. So, we're going to talk about uh personal security. Now, there have been a couple of breaches. We don't want to give anyone post-traumatic stress, okay, from talking about it in too much detail, but there have been some high-profile incidents which have been uh uncomfortable, right? Um Nikolola, maybe you want to talk not specifically about anything in particular, but Is is there an argument for staying low profile even when one has a high-profile

role in an organization which might identify you as such? Yeah, I would say I would say it's very I would say it's very difficult in the end when you are high profile to keep to keep a low profile but it's it's in my opinion it's the best thing to do. Why? Uh because we all love self-custody. I mean I'm self-custodying myself. Uh you wouldn't go outside and wear your credit card on your badge like I did. Uh so it's probably the same idea. it's probably a good idea to do that. I mean when especially when people know that you are doing self custody, you don't want to be identified as a target. So for that well there are a lot of ways in my opinion not to be identified as a target. Uh you can make very boring talks. So I try to do that. Usually I speak about technical

opinions most of the time. So I'm not going in uh I'm not going you know in in trade shows or I'm not showing that well I have a lot of gold rings everywhere on my hand because no I don't. I mean I if you look at me you probably think that I am a hobo or that I am going to steal your to steal your food and it's right because I am a developer so I'm poor so it's something to something to remember as well so you know that that's a good thing about crypto that even if you are high profile or even if you started a company I mean nobody can tell anything about about you about your wealth because if you want to keep it that way you are self c you are in self custody and you can keep it that that way you

can create multiple wallets you can hide what you are doing And it's why also why I like this industry. I mean, if you like to keep things private, you have all the ways to keep them private today. I I mean, do you want to spend your life in various shades of gray or do you really want to stand out and be there? Like the it's the price of success, right? Like why don't we just all do nothing, sit at home behind a closed door and not do anything. Um I think any successful person eventually also reaches a level of financial success, right? We live in capitalism. So blin is not bad. Ble is a sign of competence.

Notoriety is a currency that you can translate into outcomes, right? And those outcomes could be businesses, projects, services that you start for people that make the world a better place. If you blame, if you're successful, if you have a network, if you have resources, people look up to you. You can be a voice on on like important ethics, right? On issues of privacy, for example, which I'm sure you care about. So, who's going to listen to, you know, a hobo off the street talk about privacy? But if I go a co-founder of Ledger talking about privacy, making a stand like staking his reputation on this, I'm going to listen. Yes. And I would say I would say in that case, uh, my wealth or at least whatever you would call wealth is a derivative of that because if you see me talking at

conferences, you could think that people invited me for a reason. And so basically, yeah, I managed to build this network and in the end, the network is the value thing. the network. I won't say that the network is the net worth, you know, to start with a usual joke, but this is the this is the crypto network. Everybody recognizes you in that way, but I mean Ellen Musk, you know, uh Pavil Durov, everybody recognizes them publicly. They're people that I mean, they clearly don't shy away from bling, right? Like, you know, shirtless photos with baby goats. I don't know how many people saw that. I mean, that's pretty impressive. And uh these are the people that we listen to.

So, if you were doing something similar, people would actually listen to you even more. Yes. Um I would debate I would actually debate that. I mean I would take the example of our glorious leader Vitalik for example. I wouldn't say that Vitalik is very famous for his bling and he's someone that everybody is listening to. So you would say okay it's only in the crypto you would say it's only in the crypto ecosystem but I have seen his face on a few normies magazine already. And I would say today he's a face of crypto and for good and for bad because it can be dangerous as well. But I would say that even without showing bling, in the end, uh, he has a lot of he has a lot of visibility. I I think there is a difference between like posting a photo of you with three Lamborghinis, right?

Um, that that's not necessarily making you a target. What makes you a target if you do like a screenshot of your addresses and your balances, which I've actually seen a guy do on a on a webinar. Genius. But like don't do anything stupid, right? Don't go like, "Oh, this is me. This is my live location. Here's my Nano Ledger. Here's my Lamborghini. this is how I store my private keys. Like this is um u I think bull is about show of success which can actually draw a community together. I think it's the mistakes around how you secure your crypto and what you do for access that that that's what gets I mean I think different aspects of bling because there's the there's the Lambo, there's the there's the jewelry, there's the the the showy office and of some of our our acquaintances in Dubai might

might behave but but there's another aspect I think you're saying which is about bling being visible. So there's an it's not just about money, you know, because actually some of the most successful devs have never made a penny and some of the the least successful have made lots, you know, so who who knows? But there's another aspect to the bling thing about being out, which is like as a dev, you know, uh is it better to be an anon and keep that privacy? It is which is the better way of building better community products in the end in terms of visibility in this sense? Is it as an anon or is it someone who gets out there as say a glorious leader does and and speaks and advocates and shows leadership in terms of community development. In my opinion in my opinion

well the the most successful project of our of our community of our very small world has been built by an anon. Uh if you look at Bitcoin in the end nobody knows what who is Satoshi but it's an exception that proves the rule. He's like the only guy who's done it. everybody else. If you want to build product for enterprise, they want a face. You know, a big bank's not going to deal with like, you know, your little hashtag or whatever. They need to know who's behind it. If you want to raise capital, you also need to be a public figurehead. That's so I would say that's right, but it's a difference between the public face representing the project and the developers. In my opinion, you can have anonymous developers and you can have people that put themselves in front of the project and advertise the

project. And actually, uh, it's what we see today in Bitcoin. I mean, nobody knows who Shatoshi is, but you have a lot of identified figures who are pushing the protocol. I mean, you have Michael Cellor, not a big fan of Michael Cer, but still he's here and he's pushing the project and you have other people and so I think you can you can perfectly have two layers of that. I mean the devs who are deving I mean and they are protected from a lot of things I would say not only from being harassed but also from legal consequences. So typically today if you want to build in privacy for example and you want to build in public uh you are either very brave or very stupid I'm not sure but uh considering what you considering where the world is going I think you have to

well you have to you have to take precautions I mean I mean if if you think that being anonymous as a developer protects you that that's not the case really you just walk down you know the beachfront you can spot developers a mile away right you they don't need to have any bling it's like a t-shirt with a logo with a little backpack walking in groups of three like no required. I know exactly who you are. I know I probably should take your backpack with your laptop and your You don't you don't exactly know what they do. And let's say if the only is the only uh appearance I mean if the only way you have of knowing them is a PFP on Twitter, let's say or just name I mean that is not linked to any real identity.

Well, it's cool. I mean, you can take you can try taking out every developer talking about Bitcoin, but yeah, you can't really do anything uh real about that. And yeah, I don't consider myself anonymous, so that's fine. Oh, yeah, that was my next question. How come you have your real name up there? But Anna, doesn't he have a a point that you know actually you need some people who are taking a bit more of a backseat to be able to develop uh in in not in secret but quietly without having to have say the scrutiny of let's say emergent regulatory environments. If they're going to start regulating smart contracts tomorrow and actually people just want to be building open-source software discreetly their best OPSSE strategy actually is sometimes to stay anon. Well, I think maybe that was the

case in the past, but I think now we have a lot more regulatory certainty, right? So people I mean it's eventually it's going to come up with you. You can't stay anonymous forever. May maybe you know in the very early stage of a project that makes sense. Eventually you're going to have to talk to other people. You're going to have to talk to people that you're building this thing for to get feedback so that you get the best product out there. Yeah. But I don't know whether you agree Nicola. I'm not sure whether Bitcoin could have happened unless Satoshi had been anonymous. Unless you mean if he if he if he been a public figure from a personal security point of view considering the radical nature of the project. No, I don't think I don't think it could have happened and and I think it's part of the Bitcoin mystic, you

know. I think it's something important as well because knowing that nobody knows who Satoshi is is super important in the in the Bitcoin story. So that's uh that's also why in my opinion it got successful to show that something like this could happen. But do you think he should come out now and say who he is and help um take this into a better future? Absolutely not. You may not be able to. No, no. And and I think it's a and I think well I really think it's a way to build something. So it's just my my opinion. Okay. Let's go back to some practical stuff about OPSEC. Okay. So whether whether you're visible from a physical point of view, I mean I I kind of agree with you. If you come to can and you know ECC has happened you can feel the concentration

of nerds you know increasing as you get to the venue right but I mean in terms of practical steps to protect oneself there's obviously the custody aspect but there's also just like general you know digital hygiene uh you know of people who use the internet or or or messaging systems like what are what are the the techniques that that would be appropriate or can one just think it's fine I'm going to keep using WhatsApp even though they're collecting all metadata and and Facebook and all the rest of that stuff or or does one have to is there a legitimate argument for being discreet in the name of OBSE while still having a public presence on whatever GitHub, LinkedIn? Yeah. Yeah.

You can totally combine both, right? Like first thing is that you don't do anything stupid like as I said you don't publish your you don't leak your address, phone number, your wallet addresses. You you try to separate your public life and your actual crypto holdings. you don't talk about where you store your private key, who you use for that. Um, but but to be honest, I think even if people know exactly who you are, you got to think about um organized crime, right? They're not going to just go for somebody who took a picture of themselves on a yacht because they think, "Oh, that person has crypto, right?" They're going to be they they need return on investment like uh orchestrating a kidnapping, for example, that's a a big project. And if I put myself in in the shoes of those people,

not to at all validate, you know, it's a terrible crime. Maybe you have something to tell us. No, sorry. But but I will be trying to verify that damn well I'm going to get return on my investment. So I would actually be purchasing databases online going, okay, well here's the top 100 Ethereum addresses that that guy definitely has money and then working around that. That has nothing to do with bling. That has to do with information that's on the dark web. And then the the most important thing is that you as a person don't have a single control and access to the funds of the company or your own funds. So even if something does happen, it's not you that just does like one transaction and all the funds get withdrawn, right? You say, "Oh no, I

actually have, you know, I'm using an MPC, I'm using a multisig, I have policies set up." Uh so actually there are other people in other countries and places that need to sign on that transaction. And as long as you can make that a compelling argument in like I'm talking about dire situation, right? Like someone is holding a gun to your head, then your funds are safe. Yeah. Guys, don't forget to vote. We've only got a few minutes left. Doesn't she have a point, Nicola, that that if you make some sensible precautions, if you actually understand how custody works and you you're using NPC, multi, whatever it is, that then you should be fine. You should be comfortable. You don't need to. I know plenty of devs who have will have no social media presence and and and be slightly obsessive not just for OBSC reasons but for privacy

reasons obviously but is is are those counter contradictory? I mean from from what I have observed so I think that the problem is that well you manage organized crime and and yeah organized crime will do everything they can to find as much data as possible. So today what you want is avoid feeding them data and that's pretty difficult because with all the data breaches that you get basically if you order something if you do something if people can just take let's say the list of people subscribe to uh well your electricity bill and whatever they can find you. So the problem is that I think today you want to be as discrete as possible in the digital world because everything you do can be a leak later and what I have seen is that even if you don't have control

of your funds uh when we are talking about organized crime what they are doing is that basically they are just going to tell you okay I know that you don't have access to your funds I know that you don't have custody of your funds I know that you have to call someone that you that it will take three days uh to get access to something I don't care I want money right now and you are going to borrow money or or I'm going to cut one more finger. That's basically what they say. So they don't they don't give a to be honest. They just know that you have money and they know that you have the network to be able to find money. So the only way to prevent that in the end is to prevent to have as much you want to prevent prevent as much leaks as possible and

the only way to do that is to yeah be as discreet as possible. I don't know if any of you were in Dev um uh Devcon in Cancun in 2018 or whatever. There was uh a lot of people who didn't come. So, there was a kind of 50-50 split with people who were too scared and staying at home, you know, uh because of the personal offset risks from organized crime and and those who were like, "No, it. I need to be with my people." And so, it's a difficult balance, but and in the end, we had more incidents in Brussels. Just saying. Yeah. Yeah. Lovely Brussels. Well, um, no can is can is a lot more sunny and hopefully safer.

I think I think uh I think we're ready to take the vote uh up online. Thank you both so much for a great Thank you. And so I'm voting for No, sorry. I'm not voting for me. And no one is bland here. Oh, it's close. Nicola. Nicola, we're going for we're going for bland. Yeah. Yeah. This was a good fight. And I think you should have brought more people, you know, in the room. That's it. I bribed everybody. Sorry. No, I'm not rich. So, thank you and we'll let Christina close now because Thank you everyone. It's been a great morning of debates. I hope you've enjoyed it. This is the most entertaining stage, third year running.

Uh hopefully we'll be back next year and um and you'll you'll find it entertaining and uh educational. Thank you all so much.