This is a guest piece by Keith Mukai, the volunteer Lead Developer of SeedSigner, reporting on the first ever DIY signing device summit in Brazil.
Many projects, one team
Clockwise from top left: Specter DIY with "Shield Lite" smartcard reader, Specter DIY, SeedSigner+, Krux (M5StickV, TZT, Wonder K), CryptoGuide's SeedSigner + Satochip fork w/custom card reader, SeedSigner (default enclosure, deluxe metal enclosure), Jade DIY, original Jade, SeedSigner components, SeedSigner slim build, classic Blinky Specter DIY enclosure, Satochip Javacard, Specter DIY QR scanner module.
Since we all have trash attention spans now, I'll put the key part right here:
The Specter DIY, SeedSigner, and Krux teams (plus Satochip & Jade DIY experts, self-custody educators) gathered in São Paulo, Brazil to meet for the first time, learn from each other, and launch much deeper collaborations going forward. We will be sprinting ahead together like never before. The future of bitcoin self-custody via DIY signing devices is incredibly bright. We're going to conquer the world.
Why bring these teams together?
All three projects rely on the same "embit" library for our bitcoin operations, created by Stepan Snigirev. So while our projects are very different, we've always considered each other siblings due to our shared core library.
But a few years ago Stepan went through a brutal six month dev sprint. Feeling totally fried as a result, he walked away from bitcoin dev. Many of us were worried that we'd never see him again.
If you don't know Stepan, you can't understand what a loss this was. His technical mind is exceptional, of course. But it was his patience and kindness that guided me to start contributing to open-source projects in late 2019.
Over the ensuing years, embit held up extremely well and only needed occasional minor updates. But for the most part, Stepan was gone.
So imagine our collective thrill upon learning that Stepan said YES to the Brazil summit!
Stepan's top priority in attending was to give shared custody of embit to its new stakeholders. He didn't want to be a bottleneck to our collective progress. He also, understandably, wanted to free himself of most of the oversight burden.
A representative each from Specter DIY, SeedSigner, and Krux were nominated to become co-maintainers of the embit github repository. This handoff was a huge, symbolic milestone. A significant passing of the torch. Stepan's pioneering efforts paved the way for our projects to exist and flourish. And there we were, each team stepping forward to pick up the mantle.
By the way, what has Stepan been focusing on since stepping away from bitcoin? His first love: he's literally building quantum computers (yes, I asked, he said bitcoin is probably safe for the next 20-35 years).
Sibling Rivalry?
Humans are so dumb. We can be so needlessly petty or jealous or selfish.
So you could imagine that these three DIY projects might have some awkward, conflicting feelings about one another. We exist as a niche within a niche and a scarcity mindset would say that there's only so much oxygen to go around. In a zero-sum world, if one gains some success, it takes away from the others.
Specter DIY launched the whole idea, but it was SeedSigner that built up the strongest twitter energy and podcaster attention.
Krux has seen support from parts of the bitcoin ecosystem that have rejected SeedSigner.
SeedSigner has (stubbornly?) rejected features that the others have embraced.
So, sure, let's gather all these teams together and see what happens!
Now, of course, there's some exaggeration here. As far as I'd seen, each project had been careful to be respectful of the others. But still, you just don't know what the vibe is going to be until we're all actually face-to-face.
It turns out: the vibes were incredible.
We weren't quite sure who was going to run the show, but Stepan took the lead. We kicked off the first day planning how we'll all work together on embit's future. That set the tone. We were all very well aligned in how we thought it best to steward the library. No one worried if they had enough influence. There was no jockeying. No politicking. No stupid human stuff whatsoever.
Instead there was shared praise for each of the projects' nominees to co-maintain embit. Each person brought forth was a powerhouse. Embit is in very, very good hands.
Then over the course of the four day summit and lots of shared lunches, dinners, morning coffee runs, Uber rides, and exploring São Paulo together, we saw that even us weirdo nerds can bond and build friendships like normal human beings. 😂
But Wait, There Were More!
Aside from the three DIY teams, we had CryptoGuide join us who has built the most successful fork of SeedSigner thus far. His fork brings Satochip smartcard functionality to SeedSigner. He even developed his own custom add-on board to read the cards.
Lots of people struggle with the fact that SeedSigner doesn't have a secure element. The Satochip smartcard is itself a secure element, but it has no screen for a user to interact with. Bringing Satochip together with SeedSigner is seen by many as a perfect marriage. Though note that even here Specter DIY is the true pioneer as it has had optional smartcard support for a number of years.
We also had Lawrence Nahum, former CTO of Blockstream, who shared his deep expertise on the tech behind the Blockstream Jade. By the way, despite being a retail product, the Jade has a natural fit with the summit because you can build a DIY Jade!
A number of educators, self-custody advocates, and more technical experts (miniscript!) rounded out the group to share their insights.
I realized later that the four core members of the SeedSigner team were the only Americans. The Krux team is primarily Brazilians while the Specter DIY founders are Russian expats. That probably has a lot to do with why the different projects have been imbued with such different core philosophies. The other attendees came from Canada, Germany, Italy, Switzerland. We also had a super privacy-conscious anon dev who participated remotely from, well, literally no one even knows.
Giving vs Taking
Since all of our projects are FOSS, Free and Open-Source Software, any innovation from one project can be lifted and brought into another. No permission needed. No licensing. We can all copy and paste to our hearts' content.
But prior to this Brazil summit and because I'm a stupid flawed human, I would have felt some hesitation to copy code from one of the other projects. A big, really stupid part of that is just ego. And also a bit of laziness; it does take effort to dive into a new codebase to understand how things work. Again, bit of an exaggeration here, but it's not a nothing. And "akshually..." SeedSigner already has a python file copied from Krux.
As the summit moved to various presentations by members of each team, the overriding tone was: "Here's something cool. I'd love for you to use it. And I'm happy to help."
That was an enormous unlock for me. Partially because what the other teams have to offer is of course incredible, but at a personal level it makes those previously unsure vibes now so clear. Their innovation is being offered to all of us. They are rightfully proud of their work but it's not about ego wins or bragging rights, it's that all of our projects can be strengthened by leveraging each others' successes.
This is "Well, duh, FOSS Teamwork 101" level stuff, but sometimes you just need to be smacked across the head for things to fully sink in.
But enough fluffy vague talk, let's see some quick specifics.
Cherry-Pick the Best
Specter DIY, the OG, is built by the meticulous masters. Mike Tolkachev presented in detail how their secure bootloader works. Having that in place means that their STM32-based hardware will reject any "evil" firmware that a user might have been tricked into trying to install. This is perhaps the most important security guarantee a signing device can offer.
A big focus for me has been to port SeedSigner off the Pi Zero to a microcontroller. Krux Lead Maintainer odudex is working to port them off of their K210 microcontroller. But neither of us are likely to target the STM32. Thankfully, Mike built in the flexibility for his bootloader to be ported to other microcontrollers. So Krux and SeedSigner seem likely to end up working together to secure our future microcontroller environment (yep, a future SeedSigner with a secure bootloader; FU fudsters! 🤣).
SeedSigner are the UX champions. Our volunteer UX designer, easyuxd, presented his approach to developing SeedSigner's UX, which I think is easily the best in the entire signing device space, including all of the expensive retail hardware wallets. His talk has already inspired Krux contributor tadeubas to try out some new UX enhancements to Krux. No one wants all the projects to just start looking like SeedSigner. It's more that easyuxd's design principles can be applied within existing frameworks, meeting them where they're at, but still pushing them to improve.
Krux are the advanced nerds. Krux contributor jdlcdl created a marvelously cool encrypted multisig challenge that required summit attendees to use the most advanced features that are unique to Krux to unlock separate pieces of a puzzle in order to cosign a shared transaction. It was a demonstration of a wildly ambitious inheritance protocol. Definitely not normie friendly nor ready for real-world use yet, but did show off just how powerful a tool Krux can be when put in the hands of a mad genius.
CryptoGuide's smartcard fork is a developer's dream. CryptoGuide has enhanced his version of SeedSigner with so many dev-friendly conveniences and incredibly powerful automations to support testing. I can't wait to get those improvements into the main SeedSigner codebase.
And beyond: Odudex's work on a new experimental project coded in C (Kern) will likely have a ton of utility for my SeedSigner port. For example, Kern's QR scanning functionality could end up being dropped right into the next gen SeedSigner code as a utility module. This would incentivize the SeedSigner team in turn to review and contribute improvements back to Odudex's code.
The Next Phase
Now we return to what we all do best: BUILD. But we're no longer doing it alone. Each project team has essentially tripled in talent. And our collective expertise rivals or maybe even exceeds what a for-profit company could hope to assemble. In exactly the areas where I'm weak, the others will be providing their considerable strengths.
The next 12-18 months feels like an important, exciting transition period for the bitcoin signing device space.
I think we'll see a common architectural core emerge. Rather than just sharing the embit library, there might be a shared operating system of sorts (wrong term for microcontrollers, but you get the idea). The projects would still differ on UX, features, and overall philosophy. But we don't need three different QR decoding implementations. Instead we'll collectively make the BEST QR decoding implementation.
We'll have a completely FOSS platform to build on. And, of course, any number of other new builders can join the party, leverage our existing work to bootstrap their projects, and bring their own new innovation to the space.
That's not to say that any of this will be easy. But the giant leap forward here is that it's now possible.
Wrapup
In the BB (Before Brazil) era, the space has been dominated by retail hardware wallet companies fighting each other, paying for the splashiest conference sponsorships, bribing all the podcasters for ad reads. All to get you to spend lots of money.
Now in the AB era, I think we're poised to see an incredible flourishing of build-it-yourself project offerings and maturity. In the AB era there will still be no shortage of expensive retail options. But why would you buy one of those when much cheaper, fully self-sovereign DIY options exist? Especially when those DIY options will offer a better user experience and better features. And the DIY options will have nearly zero compromises vs what retail companies can offer.
Change is coming.
Credit to Lucas, Vinteum, and HRF
Lucas Ferreira, Executive Director at Vinteum (a Brazilian nonprofit focused on training and funding bitcoin devs in Latin America), was the driving force that made this happen. It was his idea (which sounded absurd to me at first!). He got the buy-in from all the teams, including the crucial "get" of convincing Stepan to join.
Lucas and Vinteum organized the entire retreat: travel coordination, lodging, the agenda, and even brought in caterers to cook traditional Brazilian cuisine. They secured funding from the Human Rights Foundation to make it all financially viable. And they already had the location: Vinteum's Casa 21 hacker house in São Paulo.
Masterstroke, sir. Well done.
Bonus Info
Congrats on your excellent attention span and desire to learn more! I did my best to keep the above brief so I had to cut out a lot of details. If you want to dig a little deeper, read on:
Buzzword Soup
First, let's cover some core terms:
- FOSS: Free and Open-Source Software. The source code (and any custom hardware designs) are freely available for anyone to review and build off of. No permissions needed. No licensing agreements. A public resource.
- DIY: Do-It-Yourself. Take off-the-shelf parts and build your own device without anyone needing to know what you're building. In many cases there isn't even anything to build; just buy a supported general purpose device from a retailer and flash the FOSS code to it.
- Signing Device: A tool that performs bitcoin math. Create keys, set up new wallets, sign transactions. Retail hardware wallets are signing devices. The main distinction is that the FOSS projects discussed here generally do not store your private key on the device itself.
Why DIY Signing Devices?
Why not just buy a retail product from an established brand?
"The [retail] hardware wallet market pushes you toward convenience, mobile apps, Bluetooth connectivity, and "easy" recovery services. These features are marketed as improvements, but they're actually tradeoffs. Every convenience is an attack surface."
via @GoBrrr_me
Privacy: History has shown: Buy a bitcoin/crypto device from a retail company, your personal information ends up getting leaked. Enjoy the "support" calls and emails from scammers. Even worse, if your shipping address is leaked: "Knock, knock!" "Who's there?" "Kidnappers." 👀
Access: It's easy to buy whatever retail device we want in the U.S. But in many places it's either impossible to buy one or just too dangerous to risk any of the above. And most retail devices cater to the West, with limited language support for the rest of the world. "Bitcoin is for everyone... if you speak one of these 7 languages."
Who's really in control? Retail devices can be designed to trap you within their corporate ecosystem by requiring you (or making you think it's required) to use their proprietary wallet software that can snoop on your bitcoin balance, transactions, and IP address. From there they can lock you out of features, require registration or KYC, force you into firmware updates, or sunset your device when they no longer wish to support it. Their priority is to keep selling you more devices.
Cost: Some affordable retail options exist. But for-profit companies need to charge a premium for their niche products. A $200+ hardware wallet might totally be worth it (🤔), but the majority of the world needs low-cost options.
Minimize supply chain attacks and fakes: Using off-the-shelf components means that the manufacturer, retailer, and the rest of the logistics chain have no idea what you're building. You're hiding amongst a giant crowd of people who are using the same devices to build robots for high school STEM classes, wifi backyard moisture sensors for gardens, etc. But if you order a retail hardware wallet from some Company X, everyone knows exactly what that device will be used for, including attackers who might try to send you a modified fake or one pre-loaded with the attacker's key.
Self-sovereign fun: Building your own signing device is empowering. And if you have the skills or the ambition to learn, being able to change the device's code however you see fit is maximum freedom. Tinkerers gonna tinker.
Best in class(?!): The normie brain cannot comprehend that a zero-profit FOSS project built by volunteers might actually be better in many ways than a premium retail device. When there's no profit motive, our entire focus can just be on what's best for the user. And many innovations have come from the DIY space that are now being adopted by the retail companies. I'm biased, but we're crushing it, y'all.
The FOSS DIY Signing Device All-Stars
Specter DIY: The OG
github.com/cryptoadvance/specter-diy
The Specter team really launched the DIY signing device movement in 2019, led by Stepan Snigirev. From the beginning they insisted on doing everything FOSS, which was unusual at the time since they were actually a for-profit company (later acquired by Swan, then subsequently gifted back to the FOSS world as an independent project once again).
Specter DIY is built from a premium off-the-shelf dev board that features a touchscreen on par with an iPhone 4. It pioneered the use of QR codes for fully air-gapped communication (i.e. there's no physical usb nor wifi/bluetooth connection to an internet-connected device). It also pioneered the concept of "stateless" operation where you load your private key into the device, perform whatever operations you need, and then the device permanently wipes the key from its memory. The signing device just becomes a flexible tool, totally separate from how and where you secure your secrets.
But a signing device can't do anything on its own; you need coordinator software to talk to the bitcoin network. This was provided by their accompanying Specter Desktop software wallet, which was the first wallet to implement QR-only communication. The Specter ecosystem was groundbreaking in how easy it made it for users to roll their own multisig with any combination of DIY or retail devices.
And from the start, Stepan isolated the core bitcoin functions in the reusable embit library. His foresight laid the grounds for the DIY signing device space to bloom.
SeedSigner: The UX Champion
The pseudonymous SeedSigner creator (SeSi "the man") leveraged the embit library and, with a ton of help from Stepan himself, built a basic proof of concept on a $5 Raspberry Pi Zero board in December 2020. From there the project attracted new contributors and rapidly gained a ton of new features, some of which were industry firsts that are now being incorporated into more devices (option to generate a new key via camera data, the SeedQR open standard, UX to transcribe QRs by hand).
I readily confess that we are the least technically savvy of the DIY projects, but as a consequence we have focused on making the SeedSigner UX as beginner-friendly as possible.
And of all the DIY projects, SeedSigner has had by far the most successful twitter and podcaster game. It's a strange thing to point out, but hype and eyeballs are invaluable to a volunteer-based project that has zero interest in revenue and no marketing budget.
Krux: The Advanced Nerds
Krux leverages a robust existing ecosystem for the K210 microprocessor. There are a number of K210 devices of varying sizes and features that can all run the Krux firmware. None of them require any assembly; these devices are sold with screens, cameras, and buttons in a ready-to-use enclosure.
The project was launched in 2021 but the creator handed over the project to other contributors so he could, in Satoshi-like fashion, recede and disappear altogether.
Krux is also built around the embit library and has recently been the leading force behind upgrading that shared library with newer, more advanced features.
Keith Mukai is the volunteer Lead Developer of SeedSigner, recent Krux contributor, OG Specter Desktop contributor, and early Specter DIY builder. He is unabashedly proud of his two ridiculously tiny PRs to Bitcoin Core. His FOSS work is supported by maxing out fiat loans plus grants from the HRF.
Originally published at github.com/kdmukai/article-diy-signing-device-summit. Free for anyone to republish, no permission needed.
