*nods in ETF approval*

✍️Now that the worse is behind us but while everyone's attention is still on the mattter I am writing a bit of a longer post on this industry's architecture and security practises. @Ledger messed up badly. Having practically no opsec, no proper credential management, and not revoking former employees access and credentials. Amateur hour, and extremely embarassing for a company their size whose entire focus is supposed to be on security. Really bad. But surprisingly they are the least to blame for this failure. This industry has a serious problem. It preaches one thing and does another. Preaches decentralization, and nobody runs their own node. Preaches user being in control and don't trust verify, but everyone uses SaaS and centralized frontends. What you people call "dapps" is a joke. A farce. Centralized SaaS frontends that can monitor you or worse. Apps that are hosted by someone else and can change at any point under your feet. That's not what a decentralized app is. It's a travesty to even use this terms for the apps this industry has available right now. 🐦 I have devoted the last 5 years of my career trying to bring local apps and local-first software back into play. I am a strong believer in self-sovereignty, data ownership and decentralization and this is embodied in @rotkiapp. I want us all to start becoming more aware of what we use and how we interact with web3, otherwirse before you know it web3 will vanish, and this dream of self-sovereignty and the user being back in control will go away with it. To the users: Question every single tool you use. See what it does with your data, where it stores it, how it manages its dependencies, what its security practises are etc. Check the track record of its team. Do your due dilligence. If the tool is anywhere close to your funds, addresses or any private info be extra dilligent. You may not be able to do your due dilligence. Find someone who can! This is not something to just brush off in the name of convenience. Today you see what happens when you do so. To the devs: - Whatever you do, pin all your dependencies. Never ever just yolo pull the latest dependency. Freeze all of them all the way up to the smallest transient dependencies. If you are in JS and are pulling from a CDN then pin the hash too in case the CDN itself is compromised. Otherwise just serve/bundle your dependencies. Today's tragedy was preventable by this simple thing. - Build local-first. Respect your users, give them choices on how to consume your app. This is web3 damn it. Let them save their data locally, let them use their own node, let them self-host the app, let them inspect the code, be opensource! - Avoid centralized points of failure. Using a common library's latest version unpinned from a CDN is one such point of failure. But there is a lot more. Using only infura and/or alchemy. Using centralized indexers (especially if their number == 1). Hosting your app in a single server without any self-hosting capabilities. And so many more ways to fail ... This can probaly get a lot longer but I will stop here. Again I want to re-iterate. Ledger is definitely to blame here but the lion's share of the blame is on our industry and its software engineering practises. Let's stop regressing back to web2 and build the true vision of web3. A world where the user is self-sovereign, owns their data and is free. Freedom is what all this is about.