Apologies for the hasty entry, as I’m writing this between pockets of time during Ethcon (and then losing parts of my draft later on somehow).

The Intended Game

First I want to say thank you to those reading this, especially those that voted for me because I had intended to use this cohort time window to work on Voyageur, a security awareness training platform for web3.

However the cohort had started at the beginning of an exciting series of events, starting with me helping with Bankless Japan at the WebX conference. As my involvement with them increased, my ability to deliver on Voyageur receded.

But throughout my six weeks during the cohort, my passion for working with APAC teams and educating others about crypto security never waned. It had just started to take different forms, as it usually does when one starts with an ideal vision but eventually realized they need to pivot to something more deliverable.

The New Game

Hackathons

As mentioned before, I am writing this from Ethcon, a conference and hackathon in Seoul. While I had failed to deliver on the online hackathons I had signed up for previously, it was much easier to deliver during an in-person hackathon with a relatively smaller time window.

During two days I hacked on a Chrome extension called Hookbreaker, with accurately detects if your current website is a crypto phishing website or not. It does this through analyzing not just the domain name, which most similar extensions do, but also the HTML and external scripts included (to an extent).

While Hookbreaker wasn't the education part of the security duality I have mentioned before, that technology or education can only go so far and you need both to curb crypto fraud, it did help me keep up the momentum of staying in the security tool building game.

I am not sure if I will continue working on this after Ethcon. But at the least I can say I helped push the anti-phishing capabilities of our community a bit and actually did deliver a security product at the end of this cohort. ;)

I also have one more hackathon that I will be participating in at Permissionless at the end of this week. But it would be nice to work on something non-security related for this one.

Collaborations

I’ve learned throughout cohort_3 that building a new platform for security education in six weeks was too ambitious for someone that hadn’t been building much in the past few years.

Part of my new game will be to instead extend what I had been doing with BanklessDAO: collaborate with established platforms to disseminate the security knowledge I have.

Asia

I will continue working with Bankless Japan on pushing the Bankless movement here in Japan, along with our newfound partners and those we come in contact along the way. But as I spend a lot of time in Korea as well, I hope to be able to help both crypto ecosystems flourish somehow. Given their proximity and some similarities I’m betting that there will be a lot of collaborative opportunities here.

That is all for now! I may not be as active on my Mirror going further but I will continue to post on X and Lens going forward if you want to keep up with where my journey takes me next!

The Pivot

Between the time I applied for cohort_3, and receiving news that I was one of three DAOpunks that received a grant, something happened. It was a decision I had made abruptly and one that is turning out to have been a great decision.

It was to return back to Japan sooner than I had planned. To work with Bankless Japan at the WebX conference and make a subsequent trip to Seoul for Ethcon and the Korean Blockchain Week side events.

However, I slowly realized during the trip that this decision resulted in me not being able to focus on the main reason I applied for cohort_3: to work on a security training platform for web3, Voyageur.

But the online hackathons I intended to participate in became a much lower priority compared to helping Bankless Japan and get our GG18 grant out the door.

I had a small, chronic level of guilt knowing that the DAOpunks community voted for me because I pitched that I would be working on Voyageur. But instead I was using the funds to offset costs while I worked in Japan and South Korea.

It hasn’t been until this week that I actually started to come to terms with how everything has gone with cohort_3.

I’m Still in the Game

Voyageur was going to be the main reason I would stay in web3. I’m known for teaching about security and I was hungry to start doing some full-stack web development again.

But I learned three things during the past five weeks:

1. Bankless Japan may end up becoming one of main contributions to the web3 ecosystem and is highly aligned with my interests outside of InfoSec

2. The headaches about front-end web development, that largely made me pivot to InfoSec in the first place, are still there

3. I can still contribute to security education without sacrificing point 1 and without having to deal with point 2

So that is why I’m going to de-focus my time in trying to get Voyageur out the door as I had envisioned. Instead I will try to get more security education out into the world through collaborations, my existing writing practice and playing around with ideas during in-person, short hackathons (since I realized online, long ones are not really my thing).

So while I, and likely nobody else, expected my grant to go towards offsetting my time spent in Japan and South Korea, this pivot may end up being a better use of the grant. Security education is still lacking in the industry, as those that voted for me likely agree with, and I do want to help fix that. But being able to help grow Bankless Japan content and accelerating the web3 ecosystem in APAC has become another mission that I want to see through.

cohort_3 is almost over but I can’t wait to see where things end up by the end of 2023.

I’ve shared a bit about what I wanted to accomplish with my security education platform, Voyageur. But these are the three main pillars I wanted to focus on towards getting an MVP out:

1. Cutting-edge security education that goes deep into topics while also providing high-level summaries to get the critical message across

2. Quizzes that put learners into scenarios that they may find themselves in in the dark forest of crypto, not just making them recite information they read a minute ago

3. Using NFTs to credentialize learners and signal to others that they are competent in the associated security topic

As time runs out, the critical thing to get out the door is security education that helps new and existing crypto users remain self-sovereign. So that they have enough trust in themselves that they don’t have to feel that they must rely on another party to custody their crypto assets.

Proof of Knowledge NFTs are not required for this goal, but is a way to help encourage further growth. Quizzes are still important, but may not be rigorous for the MVP (and may allow me to change their direction based on feedback this way).

So I’m going back to just focusing on Pillar 1, now that most of the noise from the hackathons is gone. I also learned through the past month that I’m much more likely to deliver through in-person hackathons that last one or two days, rather than online ones that last several days or weeks.

What Games Are You Playing?

Prompted by Kevin Owocki’s tweet about looking for GG18 grantees with the best memetics, we quickly spun one up for Bankless Japan that both the East and the West could resonate with.

While we created this new ikigai model as a joke – I doubt most degens are actually good at what they do – there’s some truth to this meme. We’re all trying to find that sweet spot that really fits our passion, talent and needs for for belonging and survival.

So while you are continuing to build or write during the bear, ask yourself what games you’re playing and whether you should change the rules or switch to other games. I’m now reminded about this frequently since this is a topic that fellow cohort_3 grantee Allyn Bryce has mentioned a lot.

It's the bear market so many players in this space are making themselves loud or incorporating clever devices to draw attention and funds. Probably into new vehicles that have questionable impact on our ecosystem. If you’re bored of the current market it's easy to get swept away from such noise. Especially when it seems most people in your circle are getting caught up in it.

But now is the best time to remind yourself why you’re still in this game. So choose your games wisely. You don’t need to play the ones that first draw you in. Heck, most people reading this likely left the CORPrat game because they want something better. Ask yourself if you’re playing the game that makes it the most worthwhile to have left that world.

The past week was still a lot of work for Bankless Japan, rather than my intended work with Voyageur and the hackathons. This week was a reminder of how I need to setup a project for success if I’m going to continue web3 development while being a core contributor to Bankless Japan.

Building is a Muscle

One thing I realized a long time ago is that I actually don’t enjoy programming. Rather I program to achieve an end result I want, such as getting a product out the door that I or my friends need.

One reason I had left front-end development for InfoSec was the general fatigue I had with that ecosystem: inefficient package management, obtuse error messages, tons of boilerplate, and other headaches. I don’t find these quirks with modern web development fun, but rather an impediment to a result I actually want to get to.

Coming into web3 development I knew that I would be signing up for enduring some of the pains that made me want try another career path.

At the same time I realized through Superhack that the result I’m aiming for really has to resonate for me to go through the drudgery of going through modern web development again.

While I feel I have this hunger when I work on security topics, or working with friends on really creative projects, I found out later this wasn’t the case with the idea I had in mind for Superhack: an on-chain way for airlines and hotels to attest to the loyalty status of their customers.

It was a neat idea and got me to play around with Ethereum Attestation Service and some of the newer OP Stack chains. But ultimately that idea doesn’t resonate as much as making sure web3 users don’t get scammed.

My building muscles had atrophied from the years of mostly being a white-hat hacker and educator. When it gets to this point it was too easy for me to try to work on something else other than Superhack.

Bankless Japan

I have been writing about Bankless Japan a lot more than I thought I would when I first submitted my DAOpunks application. But the reality is that our team is making a lot of progress in developing partnerships that will help feed new content, new events and eventually a new DAO.

So the momentum has really swept me away from the hackathons I had intended to participate in. While I did do some work for Superhack, ultimately the context-switching that was occurring during the 10 days was too much for me to get a solid hack out (in addition to not being as interested in the idea, as mentioned earlier).

That being said I’m happy with what we were able to accomplish in the past week for Bankless Japan:

• 🧑‍💻 Co-worked at the new Centrum web3 space in Shibuya + figuring out new partnerships we want to tackle

• 📢 Announced our first DAO Night which we’ll be cohosting with Fracton Ventures, Phaver and dYdX, which will take place at the space mentioned above

• 💴 Submitted our Gitcoin grant application for the official launch of Bankless Japan, where we will kickstart our journey towards being a self-sufficient community DAO

• 👕 Planning our バンクレス t-shirt airdrip – not a typo – for Permissionless

My time in Tokyo will be coming to a close soon. With more mental separation between me and the activity in Japan, this should provide me with enough space to start working on Voyageur again and submit something for NAVH (which is due in 8 days).

Voyageur

My next hackathon is due next week. As I had not made as much progress on Voyageur: Prologue as I thought I would, I’m considering just developing a “vertical slice” of the main vision I had for the daap and delivering that for the hackathon.

Time is more of a concern now not only due to wanting to show something useful and useable by the end of the DAOpunks cohort. But to also have something I can show to people at the next three conferences I’m attending: Ethcon, Korean Blockchain Week and Permissionless.

With that I’m now slowly getting back into a consistent building mode and hope to try to maintain that momentum. Let’s see how the next week fairs for me!

My intention for most of August is to work predominantly on Voyageur, a new security awareness learning platform for web3, and variations of it for hackathons. But since coming back to Japan, many opportunities have opened up that are not directly related to Voyageur.

The past week has still been mostly working on SHILLing activities rather than BUIDLing Voyageur. So this week’s post will be about how I am juggling all these new commitments and talk a bit about Voyageur: Prologue’s progress.

Bankless Japan

Although I’ve helped Bankless Japan a few times in the past, including designing their バンクレス shirt, I never really considered myself part of the IMN.

This changed after my experience working with them at WebX, as I detailed in my last post. I’m now a core contributor to their IMN and we have big plans that I want to help them get off the ground.

But this is a different set of priorities than what I had intended to focus on a few weeks ago. So I’ll need to be careful with my time allotment, to ensure that I can work to the best of my ability for both Bankless Japan and Voyageur.

One thing I have started to be more conscious about is time-boxing my work with Bankless Japan, so that I’m not always thinking about what I can be doing for the team at all hours of the day. It’s easy to dive deep into a rabbit hole when you first start something new and exciting with frens. But now I’m conscious of that and coming out of the hole to give time to my other priorities.

Hackathons

I’m currently in the Consensys NAVH. Unfortunately not much progress had been made since my last post. Besides getting most of the written content, wallet integration and HTML structure ready since last time, there is a long way to go to make what I have a functioning dapp.

While there is still close to three weeks before submissions are due, I have also registered for three other hackathons:

• ETHGlobal Superhack, which focuses on technologies built on the OP Stack, including Base, Worldcoin, Zora and many others (this hackathon has started as of today and is due sooner than NAVH)

• Ethcon Korea, which will be my first hackathon in South Korea and probably the first to incorporate quadratic funding into the prize pool (this will start on September 1st and is an in-person, 3-day hackathon)

• Permissionless II, which will be hosting their first hackathon for this year’s conference (I am still pending an invite due to technical issues on their end 🙏)

I applied for all four hackathons before my new commitment to Bankless Japan and thought I could make them all work out at the time. For the multi-week hackathons like NAVH and Superhack I may have to be more scrappy with my submission or join a team to help diffuse the workload but retain a high degree of learning.

Voyageur: Prologue

This is the dapp, or “hack”, I’m currently building for NAVH.

This hack gives security lessons in bite-sized pieces through UX similar to Instagram Stories or TikTok. There will be a topic, say “Why use 2FA?”, that is split up into slides meant to be viewed on a mobile device. After viewing all the slides, you are quizzed on what you have just read. Successfully passing the quiz enables you to mint a Proof of Knowledge NFT for that topic.

There is not much to show for this vision yet. But as I have paired down my schedule a lot in the upcoming week, I’ll be dropping some screenshots of what I will have completed for my Week 3 post.

Right now the tech stack for the dapp is pretty minimal:

• Next.js for the front-end, which uses React for the UI library and has server-side rendering baked-in (which is actually a bit annoying to work with for a hackathon project, so I’ll likely turn all of that off)

• I’m using Tailwind CSS for UI theming, but as I’m used to just writing raw HTML + CSS to get my UI looking the way I want quickly, I may throw Tailwind out

• NAVH necessitates using specific technologies to earn points for judging, so I integrated the MetaMask SDK for wallet integration and wagmi for improving the developer experience when interacting with wallets and chains through React

• I have not written the NFT contract yet, but it will be deployed to Linea Testnet and likely using thirdweb’s deployer

I will not be working on this idea for Superhack and my hack for that event may not be very security related. So I not only have to come up with another idea for that other hackathon, or join another team, but also work on both hacks in tandem. I will certainly be learning a lot through the experience. But I also need to make sure that I do not burn out.

That is all for this week!

This initial post will likely be lengthier than subsequent ones, as I introduce DAOpunks, why I participated in this cohort, and what I ended up doing during my first week.

WTF is DAOpunks?

DAOpunks is an NFT collection and public goods grant platform that grew out of the creative community we have at BanklessDAO. It’s a mission-driven project that promotes the transition from being a corpRAT in a corporate environment to being a DAOpunk and working in web3 or DAOs.

Besides the NFT part of DAOpunks they also have a grants program that rewards accepted grantees with 1 ETH each. This grant is used to help grantees pursue their respective missions in trying to make the shift to predominantly working in web3 or producing an artifact that is valuable to the ecosystem.

As a DAOpunks holder I participated in the previous cohorts by voting on the individuals I thought should have received a grant. I never entertained the thought of actually applying myself as I had no immediate need to fully transition to working in web3.

Until this year…

Voyageur

Voyageur is security awareness training for web3.

CORPrats working at large companies may be aware of existing security awareness training platforms like KnowBe4, Cofense, Proofpoint and many others. These platforms are used to train employees on cybersecurity concerns and hopefully encourage new behaviours that reduces risk to an organization. These mostly focus on email phishing, malware and social engineering.

As the Education Coordinator at BanklessDAO’s InfoSec Team for 1.5 years, I’ve learned a lot about what the current threat landscape looks like for web3 users and organizations (DAOs, web3 companies and established organizations looking to adopt web3 technologies). In my opinion there isn’t a satisfactory solution to not only teaching this ecosystem about security risks but also to encourage the behaviour change needed for people to remain aware of those risks when the time comes.

Exciting technologies like account abstraction and multi-party computation (MPC) may start to improve the dire situation we are in with security UX. But until then, while we still interact with blockchains in ways that can put us in risky situations, we need more education to help one another avoid falling into traps set by hackers and scammers.

This is why I decided to dust off my development and design skillset, which I did before I entered InfoSec 4 years ago, and start building a platform to encourage web3 users to adopt risk-reducing behaviours when interacting with the ecosystem. I am aiming to have a Minimum Viable Product (MVP) done by the end of the DAOpunks cohort in early September. This happens to coincide with my trip to Seoul for a few conferences there.

I applied for the grant not only for the financial flexibility 1 ETH can bring as I build the MVP. But also to act as a forcing function, as I must write weekly articles for this cohort and have something to show at the end of it. In my case it is the Voyageur MVP, which I also hope to use DAOpunks as a platform to help promote as I develop it throughout the next several weeks.

WebX

I’m affiliated with Bankless Japan and had the chance to work with them for their presence at WebX, a large crypto and web3 conference in Tokyo. We were a media partner with a booth at a key spot in the exhibitor floor and took full advantage of it.

Most of my energy was used to help bring more opportunities to Bankless Japan. But I also kept Voyageur in the back of my mind while talking to specific people as Voyageur was another reason I went to WebX:

• I’m aiming to have the MVP available in English, Japanese and Korean. My last visits to these countries showed me the large potential growth East Asia has in web3. I want to help guide their journey into web3 safely, as there seems to be a lack of deep web3 security content in their native languages (and much of Asia, really)

• I have contacts in Japan and Korea that could help promote, develop and possibly fund Voyageur. It was great to see familiar faces from both countries at WebX and this gave me more motivation to make sure our content is available in their native languages, which could also help to sell to extended contacts.

• Figuring out by talking to those in and out of security as to whether my idea makes sense. While I believe the web3 ecosystem needs something like Voyageur, that may not match reality. But at the very least I met people at WebX that operate in web3 individually, in DAOs and in companies just starting to get into web3 that echoed my sentiment that there is a lack of needed, effective end-user security education in the space

Voyageur: Prologue

One decision I made a few weeks ago was to pause development on Voyageur as I had imagined it could be upon MVP release. This was so that I could develop a concise version of the same concept for Consensys’ Not Another Virtual Hackathon (NAVH).

I have some experience with dapp development, but I’m not a strong buidler. I have participated in a few hackathons this year, including ETHGlobal Waterloo where we won a prize, which helped bring me up to speed on modern dapp development. But I need more experience building a dapp with a more complex architecture.

As NAVH is skewed towards rewarding hacks that use as many Consensys and partner services as possible, I figured this was the best opportunity to learn a lot in a small amount of time. But I didn’t want to work on a project that took time away from Voyageur. Thus I’m working on security education hack that could possibly fit as a learning module in Voyageur. Or actually become Voyageur if it could accomplish the objective better that what I had first imagined.

BUIDL & SHILL

Productivity wise I will be packaging my days into BUIDL mode or SHILL mode.

BUIDL mode is where I’m developing my security project, Voyageur, and the mode I intend to be in for most of the cohort. I will be in SHILL mode for the times when I am attending conferences, where I will be doing product-market fit research and trying to promote Voyageur.

During BUIDL mode I aim to show the process of developing a dapp, which I have some experience in but still very much a novice at. During SHILL mode I will mostly be discussing how I see my security project, Voyageur, fitting in the wider web3 ecosystem and specifically the Asian ecosystem as this is the region I want to focus on past a general English audience.

Week 1 was mostly SHILL mode as I spent most of the week in Tokyo working with Bankless Japan on their presence at the WebX conference. Next week will be my first BUIDL post and where I will talk more about my NAVH version of Voyageur and its design and development process.

Stay tuned…

I argue that we should move towards an ecosystem where we do not have to rely solely on core developers to improve the security UX of their wallet clients. As our crypto ecosystem was forged from the cypherpunk ethos, we should work towards decentralizing more parts of the user’s transaction process.

By integrating the best solutions available through composability, not just what the core developers have the cycles to work on, we can better safeguard the transaction experience as a whole.

Until this happens, the bad guys will continue to have the asymmetric advantage in their attacks against crypto users, which can impede mass adoption.

To bridge the gap towards a robust era of wallets that protect users from scammers, please humour me as we look to the genre of cyberpunk for inspiration.

My Vision Is Augmented

Enhancements and augmentations like exoskeleton suits, cybernetic limbs, and ocular implants are cyberpunk tropes that empower individuals to transcend the limitations of human flesh and bone. In these fictional worlds—and let’s ignore that they are often dystopian for now—augmentations are created by multiple parties, from sprawling mega-corporations to solitary garage innovators.

Anyone can order augmentations from these parties through an open marketplace and install them at will. These added pieces of technology result in step function changes for the people that use them, enabling one to accomplish physical and cognitive feats that were not possible before.

What the wallet ecosystem needs are open marketplaces of augmentations mentioned above. An ecosystem that enables users to install extensions that enhance and protect their transaction experience, and thus their overall interactions with crypto and trickling down to a more robust ecosystem as a whole.

Developers have been taking advantage of the composability offered by smart contracts and dApps for years. But wallet clients still lack the systems needed to build "wallet legos" that can truly interoperate with other software. Thankfully, there are efforts to start moving towards a more decentralized way of observing and building transactions through wallet clients:

• Browser extensions that simulate transactions before they are submitted, such as Fire or Wallet Guard, that work alongside existing wallet clients

• MetaMask Snaps, which enables developers to extend the MetaMask experience and will allow users to acquire these extensions through a new marketplace

If wallet clients can further embrace this composability, we can alleviate the existing security UX gaps while allowing teams that may be more agile in developing solutions for tomorrow's threats to improve those same wallet clients.

Rebuilding Stronger Wallets for Tomorrow

The archetype for a wallet client has not changed much since the first ones like MetaMask, MyEtherWallet, and Status entered the scene several years ago. We have settled on useful security UX heuristics that have carried us to this point.

But these heuristics were developed at a time where we were a bit naive about the threat models in Ethereum—MEV for example—and we did not reach this point unscathed. Arguably, there are some heuristics that we should look towards completely rebuilding, like how operating systems switched their UIs from skeuomorphic design principles to one that resembles a pure and flat aesthetic.

Entrusting a few developers to build and evolve their wallet clients as new security threats loom is one holdover that we should rethink and rebuild. Towards an ecosystem where composability will help wallet clients weather the storm of the evolving security landscape.

Take the 💾 floppy disk, which used to visually represent the act of saving work or progress. The idea of using that metaphor in this day of SSDs and cloud storage would feel antiquated. It was already antiquated when internal hard disks were being used to save work more often. It would also be confusing to those that were born after the day-to-day use of floppy disks ended.

Since the inception of Bitcoin we have used the wallet as a metaphor for “some client that stores a private key and signs messages with it”, or even as simple as a wallet being a public-private key pair (paper wallets). It was a convenient way to convey the idea that a wallet contained the means to send and receive coins of some value.

But in a smart contract ecosystem that has spawned use cases past just transferring units of value between parties, does the wallet metaphor still hold true? Or should we do away with them as we have with floppy disks?

Here I will argue why the wallet is still our best metaphor for these new use cases in the web3 ecosystem. In addition I will be pitting wallets against passports, an up-and-coming metaphor that has captured some interest in Crypto Twitter, but one that I feel is still lacking compared to the wallet in many respects.

What Can You Do With a (Physical) Wallet?

Physical wallets are a container that can hold anything the owner wants, as long as they fit within the form factor. Specifically wallets can hold three key types of items that many addresses on programable blockchains like Ethereum may have:

• 💴 Money

• 🪪 Identities

• 🃏 Collectibles

Let’s go through each of these and figure out why wallets still work for this use case and why passports cannot fulfill our needs.

Wallets Store Money

The whole “Is Ether money?” argument aside, this is the clear use case for both physical wallets and wallets that can manipulate token counts on a blockchain. Your Ethereum wallet may not technically store the tokens, but it does hold the means to access them. Similar to how your physical wallet may have credit cards that don’t actually have money stored on them, but are a means to access the value associated with them.

Compare this with passports. Past the subjective value of visas that may reside in them, which cannot be transferred, or the value of the passport itself, passports cannot contain money (you could try to slip money to an immigration officer, but this is not advisable).

Wallets Store Identities

You likely have some form of identification in your physical wallet: drivers license, health coverage card, membership card, etc. Those are “strong” forms of identification that you would show to someone to prove your identity or association with a group. You may also have loose forms identification like your credit card or a train ticket that have your full name or seat number.

Wallets are often associated with a single private key, which can have multiple blockchain addresses derived from that key. Each of these addresses can have identities associated with them, from strong forms (ENS, Lens) to loose ones (POAPs, NFTs). An address is not restricted to one identity and could be associated with multiple identities, such as Satoshi Nakamoto's address since it’s not beyond the realm of possibility that Satoshi could be more than one person.

Passports are limited to association with a single identity and can’t be changed easily (addresses can change their identities at any time, such as when an ENS or Lens name is transferred). This may be too inflexible a metaphor in a time when many crypto users are used to having multiple addresses for different use cases and may tie a different identity to each of them. An individual may have multiple passports but these are not easy to obtain for most people, compared to being able to derive a new address and creating a new ENS name for it.

Wallets Store Collectibles

As mentioned earlier, physical wallets are containers that can hold whatever the owner wants, as long as it fits. It’s not uncommon to find personal collectibles in a wallet, such as family photos, novelty transit fare cards and memorable tickets or business cards.

Repurposing this as a metaphor in blockchains works just as well. Your wallet contains the addresses that are associated with collectibles on the blockchain, likely NFTs.

Passports can store collectibles too, but mostly in the form of visa stamps. Otherwise it’s a very inflexible container for any other collectible as other decorations inside the passport would be considered tampering.

Conclusion

Wallets are still the best method we have for conveying what someone can do with a private key on a blockchain.

Until a new utility has appeared in the physical realm that can act as a better metaphor for wallets, we should lean into making the best use of this metaphor to improve crypto UX for new crypto users. Not shoe-horn other objects, like passports, that do not fit our needs and can be explained more clearly with the wallet.