Hi everyone,

I’m an active Kagi user (Search, Assistant, and Translate) and have been relying on Brave as my daily browser for quite a while.

Being fully inside the Apple ecosystem, Orion has caught my eye recently because of its native WebKit foundation, promise of Safari-level battery efficiency, and support for Chrome/Firefox extensions.

For those of you who use Orion daily on macOS and iOS/iPadOS:

• How has your real-world experience been compared to Chromium-based browsers like Brave?
• How stable are extensions (uBlock, Bitwarden, etc.) in your everyday workflow?
• Are there any major friction points or bugs you still run into regularly?

Also, could someone clarify the practical differences between the free Orion tier and the paid Orion+ plan? Beyond supporting the development and getting early access to candidate builds/Discord perks, are there distinct feature gates between the two?

Would love to hear your thoughts and whether it's worth making the jump. Thanks!

Hi everyone,

I want to start with something that often gets lost in pricing discussions. Beehiiv takes 0% of our subscription revenue. That's a big deal and a real advantage over platforms that take a cut of every sale, and I don't take it for granted.

I'm posting because I've been reading many threads from people who shared frustrations and experiences after the recent plan changes. I noticed a pattern that I think explains some of the friction, and I'd love the team's view on it.

Beehiiv has been shipping a lot of new features, which is great. But every new vertical makes it harder to fit everything into a handful of all-in-one plans. The plans get heavier with features, while the individual limits on each feature get thinner. As more products launch, I think this tension will only grow.

Community is a good example. It's a great addition to the product, but it takes real ongoing effort to keep a community engaged. Many people running large, established newsletters may never use it. They still pay for it as part of their plan, while the limits on the things they do use get tighter.

So I've been wondering whether Beehiiv has considered a modular model:

• Core plan: newsletter + website, the heart of the product.
• Optional add-ons that each project turns on as needed, for example:
  • AI
  • Podcast
  • Community
  • Digital products
  • (and future verticals)

Because each add-on would be sold on its own instead of a little bit of everything bundled together, each one could come with more generous limits for the people who actually need it. A podcaster could get a solid podcast module without paying for community. A large newsletter could stay lean on the core and only add what it uses.

Other platforms already work this way. HubSpot sells separate "Hubs" (Marketing, Sales, Content, etc.) that you combine as needed. Squarespace sells Email Campaigns as an add-on on top of the website plan. Zoom sells things like Webinars and Large Meetings as add-ons to its base plans. It's a familiar model for customers.

I'm not saying this is definitely the right answer. There may be good reasons it doesn't work for Beehiiv, such as billing complexity, how features depend on each other, or the economics. I'd really like to know whether the team has considered it, and if so, why it did or didn't make sense.

Thanks everyone!

I was thinking about my previous post regarding Bartender and waiting around for the compatible version to hit Setapp, and it made me wish Setapp handled app installations differently on Mac.

Right now, having to download and update everything strictly through the Setapp desktop client can be annoying. Whenever a new macOS update comes out or a critical fix is needed, the developer often pushes an update on their own site days or weeks before it actually shows up inside Setapp.

Why can't we just activate apps the same way iOS does it?

On iOS, we just grab the app straight from the App Store and activate it with our Setapp account via browser. It would be so much better if macOS worked like that too. Let us grab the build directly from the developer's website, Homebrew, or the Mac App Store, and just have an "Activate with Setapp" button or hook inside the app.

That way:

• We wouldn't have to wait on Setapp review queues or delays when a system update breaks something.
• People who manage software via Homebrew or dotfiles wouldn't have to break their workflow.
• We still get the subscription benefit without being locked into downloading exclusively from the marketplace app.

Has the Setapp team ever mentioned looking into this? Would love to see this happen.

Hey everyone,

I’m not a Koofr customer yet, but I’m currently trying to decide between Koofr and Filen for my personal cloud storage.

I know Koofr is a much more established and mature company, which is definitely a big plus for me. I like the fact that it has been around for a long time and seems to have a pretty solid reputation.

At the same time, I’ve been looking at Filen and there are a few things that caught my attention, especially the privacy focus, end-to-end encryption, and the backup functionality.

So I’m a bit torn.

Has anyone here actually used both Koofr and Filen? If so, I’d really like to hear what you think about them in everyday use.

How do they compare in terms of sync reliability, speed, desktop apps, mobile apps, file versioning, backup, privacy, and general user experience?

And if you’ve tried both, what made you ultimately stick with one over the other?

I’m not necessarily looking for someone to tell me which one is "better". I’d just like to hear some real experiences from people who have used both before I make a decision.

Thanks!

---

EDIT 1:

In my original post, I mentioned that Koofr does not let you choose which folders are synced or not. However, this information is incorrect. I have updated my text to reflect what Koofr has to offer.

Thank you, u/koofr!

I've been on Professional plan for a while and honestly I like Kagi, so this isn't me hating for the sake of it. But I spent a good chunk of time trying to find any kind of response from Kagi to all the complaints about Translate being pulled from Starter/Pro/Family/Team after Oct 12, and I found basically nothing.

The only thing out there is the Sept 10 blog post. And if you actually read it, the apology is about cutting off free users back in June. There's no apology or even acknowledgement for the people who are paying and losing a feature while the price stays exactly the same.

Also, someone on kagifeedback.org pointed out that the plan types help page was quietly edited back in July to drop "and Kagi Translate" from the Professional description. They asked straight up whether existing members would be grandfathered. From what I can see nobody from Kagi ever replied. Apparently most of the discussion happened on Discord instead.

Idk, that tells me a lot about how the company really works. They call themselves "human-first by design" but the humans paying every month seem to be the last ones told anything. And they keep pushing Ultimate as a way to "support Kagi's mission" while cutting stuff from the plans their loyal subscribers are already paying for.

So did anyone actually get an email about this? Because I didn't.

And that's not just annoying, It's a legal problem in the EU. The Digital Content Directive (2019/770, Art. 19) says that if a company changes a digital service mid-contract in a way that hurts the customer more than minimally, it has to tell you in advance, clearly, and on a "durable medium", which basically means something like an email. You then get 30 days after the notice or the change (whichever comes later) to cancel for free. On an annual plan that should mean getting back what you haven't used yet.

Taking one of the main features out of a paid plan is not a minor change. And a blog post that nobody was pointed to doesn't count as notice.

If you're in the EU and not happy about this, email Kagi support and ask to cancel or get a pro-rata refund, and mention the directive. If they don't sort it out, in Ireland you can go to the CCPC or European Consumer Centre Ireland. Other EU countries have their own European Consumer Centre too.

Has anyone from the Setapp team heard anything about when Bartender will be updated to work with MacOS 27?

I remember that after MacOS 26 was released, Bartender also stopped working, and it took fucking a year for the app to become compatible again. 😅

Should we then expect the same from MacOS 27? Maybe another year waiting for a review.

I know that sounds a bit harsh, but I'm genuinely asking, not trying to be a dick. If this is likely to take another year, I'd rather know now so I can start looking for an alternative instead of waiting indefinitely. We could even make it together.

I also tried posting this on the r/bartenderapp subreddit, but posting is restricted there, so I couldn't ask the question directly.

Does anyone at Setapp have any information on the situation or an expected timeframe for MacOS 27 support?

---

EDIT 1:

It says iOS 27 in the title, when it should be MacOS 27.

Thank you, u/mcosternl, for the heads-up!

One feature I’d really like to see in Proton Sheets is a native way to automatically update the price of cryptocurrencies, stocks, ETFs, etc.

Google Sheets already has GOOGLEFINANCE(), and there’s also an official CoinGecko add-on that lets you use formulas like:

=COINGECKO("id:bitcoin")

This makes it pretty easy to build a portfolio tracker where the prices update automatically.

I think this would make a lot of sense for Proton, especially considering how many Proton users are interested in crypto and financial privacy.

Right now, if you want to build a proper portfolio tracker, you usually end up relying on third-party apps or services. Google Sheets is probably one of the easiest options because of GOOGLEFINANCE() and CoinGecko, but then you have the obvious privacy concerns that come with using Google for something as sensitive as your finances.

A portfolio spreadsheet can contain a surprising amount of sensitive information. It can show what assets you own, how much you've invested, your approximate net worth, your investment strategy, and potentially a lot more about your financial situation.

So in a way, the lack of this functionality in Proton Sheets pushes people towards sharing this kind of information with third-party companies simply because those are the most convenient tools available.

Having something like a native CRYPTO() or STOCK() function in Proton Sheets, with data refreshing every few seconds or minutes, would fit really well with Proton's privacy philosophy.

It could be something as simple as:

=CRYPTO("bitcoin")

or

=STOCK("AAPL")

I know there are open-source and self-hosted options out there, but those aren't really practical for everyone. Having this built directly into Proton Sheets would make private portfolio tracking much more accessible.

Honestly, I think this could be a really useful feature for Proton Sheets. It would make it much more useful for anyone who wants to track their investments while keeping that information private within the Proton ecosystem, and I think it could also encourage more people to actually use Proton Sheets instead of Google Sheets.

Would anyone else use something like this?

Hey everyone,

Quick question for the team or anyone who follows the roadmap closely: is there any plan to support Kraken's Ink network natively in the Tangem app?

Kraken gives free withdrawals to Ink, so it's quickly becoming my go-to route to move funds off the exchange cheaply, pretty much how Base works with Coinbase.

Technically speaking, Ink is just an OP Stack Ethereum L2 (part of the Superchain) and 100% EVM-compatible. Their docs mention that standard Solidity contracts deploy without any tweaks, so derivation paths, signing, and standard RPC calls should be identical to networks Tangem already supports like Base or Optimism. It shouldn't take the heavy lifting of building out a non-EVM chain from scratch.

Would be an awesome addition for anyone using Kraken. Anyone know if the devs have this on their radar?

Hey r/todoist,

Everyone seems to use Todoist so differently, from minimalist setups to crazy complex webs of tags and filters. I'd love to see how people here actually organize their days so we can trade ideas and pick up some new tricks.

I'll start with my current setup:

Quick capture and daily review

• Everything goes straight into the Inbox throughout the day. Tasks, random thoughts, whatever. Zero friction.
• Once a day on my computer, I sit down and empty the Inbox into its proper home.

Project structure

• Personal
• Work
• Personal projects (with subprojects like A, B, C)
• Maybe one day... (Honestly one of my most important projects. It holds rough ideas, dreams, or things I don't have the time or synergy for yet. Keeps great ideas alive without cluttering my day-to-day.)

Filters (The real core of my workflow)

My golden rule across literally every filter is excluding subtasks (!subtask). When Todoist groups items, it shows subtasks detached from their parent task as if they are floating alone, which completely ruins the view for me.

• Personal views: 3 filters displaying tasks in List, Date-sorted, and Kanban board views.
• Label kanban: A board filter grouped by label so I can view every label side-by-side on one screen.
• Personal projects view: 2 filters covering the parent project and subprojects: one in list mode grouped by project, and one Kanban board grouped by priority.
• Priority views: Dedicated filters for each priority level (p1, p2, p3, p4).
• Recurring tasks: A dedicated filter strictly for recurring routines so they don't drown out my one-off tasks.

How do you organize yours? Any favorite filter queries or small workflow habits that changed the game for you? Let's see your setups!

I’ve been trying to find a workaround for this, but from what I can tell, Todoist currently doesn’t offer one.

For example, if I have:

>Launch new website
Buy domain
Configure DNS
Create pages
Publish website

I would like the parent task and its subtasks to remain visually grouped together when I use "Group by Priority", "Group by Label", etc.

Instead, the subtasks can appear as individual tasks in the grouped view, completely separated from their parent task. This makes the list much harder to understand and organize, especially when you have a lot of tasks and subtasks.

As far as I can tell, there also isn't an option to simply hide subtasks from these views while keeping them available inside the parent task.

Am I missing something? Is there any workaround that I'm not aware of?

I find this particularly surprising because keeping tasks and their respective subtasks organized and predictable across different views seems like one of the fundamental responsibilities of a to-do list app. When changing the sorting/grouping, I would expect the task hierarchy to remain intact rather than having subtasks become essentially "lost" among all the other tasks.

I absolutely love Todoist and use it extensively, but this is one of the issues that still prevents me from fully migrating my workflow to Todoist.

Has there been any indication on the roadmap about improving this behavior? Even something as simple as an option like "Keep subtasks with parent task when grouping" or "Hide subtasks in grouped views" would make a huge difference.

Would love to hear if anyone has found a workaround or knows whether this is something Todoist is planning to address.

For my critical accounts, I register my hardware keys directly on each service and manage backups the right way. No issues there.

The headache is low-priority, throwaway accounts. Manually registering and re-registering physical keys across hundreds of random sites is just too much maintenance. Right now, I mostly use a password manager with basic TOTP for these.

I'm thinking about switching up my approach and wanted to see what others do. Between these two options, what makes more sense to you?

Regular username/password (no hardware key): Kept in Bitwarden/1Password, maybe with TOTP if the site supports it, or just a strong random password if it's completely disposable. Keeps every service siloed, but auth security is obviously weaker.

Social login via "Sign in with Apple": My Apple ID itself requires my YubiKey to log in, so using Apple SSO basically extends that hardware security to third-party sites without having to add my physical keys to every single one. I lean toward Apple over Google here for privacy, as it shares less data than Google.The downside is putting eggs in one basket and relying on an IdP.

How do you guys handle low-risk or throwaway sites? Do you prefer keeping accounts completely separated with standard credentials, or do you leverage an IdP secured by your keys?

I know this has been talked to death, but after seeing the recent Proton Ask Me Anything comments about contacts and contact sync finally sitting on the 2027 roadmap, I wanted to bring up the standalone app debate. The team mentioned they haven't decided if it will be a dedicated app or just a shared module inside existing apps.

Please, please make it a standalone app.

Here is the underlying issue: native OS contacts are a privacy nightmare. Whether you are on iOS or Android, your cloud-synced contacts are not end-to-end encrypted. Even if you use Apple's Advanced Data Protection, they specifically exclude contacts because of legacy CardDAV support. Plus, if you leave everything in the native phone address book, every random app you install begs for full access to harvest your social graph.

Right now, using Proton Contacts inside the Mail app is just too cluttered. Because there is no dedicated space, my actual real-life phone numbers get mixed together with every single random email address I have ever replied to. It makes managing a true phonebook impossible.

Having a dedicated, FOSS, E2EE Proton Contacts app that acts as a secure vault isolated from the OS would be incredible. It would let us finally delete people from iCloud or Google and keep them safe. A simple background sync tool that just dumps everything back into the unencrypted Apple/Google address book completely defeats the purpose of sandboxing the data in the first place.

Does anyone know if the team is leaning one way or the other yet? And for everyone else waiting on this, do you prefer a standalone app or just better integration with the native OS?

I didn't go to a single-sex school myself, but looking back, going to a mixed school felt pretty ideal for me. Boys and girls tend to behave quite differently at that age, and in my experience, having girls around really helped smooth out the rough edges for the lads, while the lads helped ground things a bit too.

I'm not saying mixed schools are definitively better than all-boys or all-girls schools, especially since I haven't experienced both firsthand. That's really why I'm asking here. I'm genuinely curious to hear what people think and learn from your own experiences, whether you went to single-sex, mixed, or sent your kids to either. What's your take?

Been using Signal for a while and love it, but there's one thing that keeps bugging me and I can't believe it's still not a thing.

Right now, your profile photo gets shared with everyone in any group you're in. Not just your contacts. Everyone. I'm in a couple of group chats for work and community stuff where I don't know half the people, and they can all see my profile picture. I get that Signal shares your profile with people you interact with, but there's no way to limit it to just your actual contacts.

WhatsApp has had this forever. You pick My Contacts, Everyone, or Nobody. Simple. Signal gives you... nothing. It's all or nothing. Either you're in a group and everyone sees your photo, or you don't set one at all.

I know the usual advice is "just use a generic photo then." And yeah, I get it, that's what I do right now. But that kind of defeats the purpose. I want my friends and family to see my actual photo, and I don't want random people from a work group to see it. That shouldn't be an unreasonable ask.

Would love to see a setting like:

• My Contacts (only people saved in my phone can see my photo)
• Everyone (current behavior)
• Nobody

And ideally this would apply inside groups too. So if I'm in a group with 30 people and only 5 are in my contacts, those 5 see my photo and the other 25 don't. I don't know how hard that is to implement under the hood but from a user perspective, it's what makes sense.

Has anyone heard if this is on the roadmap at all? I found a thread on the Signal Community forum, but it doesn't seem to have gotten much traction.

If anyone knows of a better workaround than just using a blank/generic photo I'm all ears.

I’ve been thinking about this for a while and wanted to get everyone's perspective. Why does privacy advocacy feel so selective, even among people, creators, and projects that supposedly care about digital rights?

I’m not talking about beginners who simply don't know how tracking works. I’m talking about knowledgeable folks, privacy advocates, and even privacy-focused organizations who constantly compromise and stick to Big Tech or less private solutions:

• Privacy creators hosting their main discussion hubs on Discord, WhatsApp, or Telegram instead of Matrix, Signal, Threema, or SimpleX.
• Major privacy-focused companies using X or YouTube as their primary outreach channels, while treating open protocols like Mastodon or Nostr as an afterthought.
• Hesitation around truly private, decentralized alternatives in favor of whatever is commercially convenient.
• Reliance on centralized ecosystems and app stores instead of actively promoting and maintaining open alternatives.

It often feels like many people just switch to a privacy browser, create an encrypted email account, and call it a day. (Nothing against these tools, they’re great, but you get what I mean.)

When even prominent privacy figures and companies won't actively dogfood privacy-first alternatives, it creates a feedback loop: 'If the privacy experts aren't bothering with decentralized protocols and are using X, why should I?' As a result, genuinely great privacy-first solutions get left behind and struggle to survive simply due to convenience and network effects.

Is pure convenience and network effect really the only bottleneck, or is there something deeper going on with how we balance threat models and practicality? I don't know if I'm too OG, but what do you think would actually push the community to bridge this gap?

Back in 2017, the Signal Chrome/web app was discontinued when the standalone desktop app launched, and it was officially deprecated.

Now, almost 10 years later, is there any possibility we might see a web client return in the near future?

I know it was phased out originally due to browser security concerns and sandbox limitations, but web tech and security standards have evolved a lot since then. Other secure messengers like Threema have managed to build functional web clients using modern workarounds and session models.

Signal is incredible, but not having a browser version can be frustrating, especially on work computers and managed machines where installing custom desktop software isn't permitted.

Curious to hear thoughts from the community or if anyone has heard of any updates/discussions around this!

I know the Beehiiv ecosystem is getting massive and complex with everything being built, but is there any word or timeline on an official mobile app for creators?

I don't even expect a full post editor on mobile (drafting and designing newsletters on a phone sounds like a nightmare anyway). But having a proper mobile companion app to:

• Check the main dashboard and real-time subscriber metrics
• View website, podcast, and community analytics
• Check and reply to DMs / community messages
• Get push notifications for new free/paid subs, milestone alerts, etc.

Logging into the mobile browser version just feels clunky when all you want to do on the go is check stats, respond to messages, or see alerts.

Has the team mentioned anything on the roadmap about a native app anytime soon?

Been chewing on this for two weeks and I want to hear where people actually land because I keep flip flopping.

Quick recap in case you missed either one. Coldcard: a build error in firmware from March 2021 meant some devices generated seeds using a software PRNG instead of the chip's hardware RNG. Effective entropy dropped to around 40 bits on older models, which is brute forceable offline. Nobody got phished. Nobody's device was stolen. Nobody typed their words into a fake site. Something like 1,800 BTC gone from 5,000+ addresses, and updating the firmware doesn't fix a seed that was already generated weak.

Then Trezor's fulfilment partner got breached. About 13,700 customers, and for most of them it was full name, email, phone number and home address. Credit where it's due, Trezor's own systems were never touched, and no keys were exposed, and their 90-day retention policy is the only reason it wasn't every buyer in company history. But think about what that list is. It's confirmed hardware wallet owners with the address the box was delivered to. Phishing by email, phone, and physical mail. Someone sends a letter on branded paper about an urgent recall or a mandatory firmware update, and I'd bet a decent number of people follow the instructions. Reports are already saying the data is being used to ask people for their 24 words.

Ok, so here's the thing I want to argue about, and I want to say upfront I don't think there's a correct answer. I'm not saying cold wallets are unsafe. I'm not saying hot wallets are safe. I own hardware wallets, and I'm not getting rid of them.

Conceptually, cold is obviously better. That's not in question. What I'm less sure about is how much of that advantage survives contact with a normal human being.

Take bad products out of it. There's garbage on both sides, and there are wallets that used to be good and aren't anymore. Assume the person picked well either way.

Good hot wallet, the chain is short. Most don't ask for any personal info. You install the app, generate the wallet, and after that, it's two questions. Is the seed handled properly, and is the phone clean. That's basically the whole thing.

Good cold wallet, the logic after generation is identical. Seed safe, wallet safe. But now look at everything that has to go right before you even hold the device. Did you buy from the real site or a clone. A lot of manufacturers don't ship everywhere so now you're trusting a reseller, or a third-party seller on Amazon because that's your only option. Was the package tampered with. And to buy it you hand over name, email, phone, home address and payment method, and that data then gets handed to fulfilment and courier companies you never picked and can't audit. That's the exact link that failed at Trezor.

That's a lot of companies holding a file that proves you own crypto. Half this space cares about privacy above almost everything else, and buying a hardware wallet is one of the least private purchases you can make. Once it leaks, it's also something a tax authority can cross-reference, which is a very different conversation for anyone whose declarations don't line up.

And then there's the part nobody wants to bring up. Loads of people buy a hardware wallet, generate the seed offline exactly like the manual says, and then save the 12 or 24 words into their password manager. Bitwarden, Proton Pass, a local KeePass file, whatever. They think it's fine because it's encrypted. What they actually did was turn a cold seed into a hot seed, and the device is now a paperweight with a screen.

I'm not laughing at anyone for that. Errors are the price of being your own bank. We have a long, very public list of people at the top of this industry who lost absurd amounts to small operational mistakes, so it's clearly not a beginner thing. It's a human thing. If you haven't made your mistake yet, give it time.

Which gets me to the part I actually believe. People point at funds and custodians running cold storage as proof that cold is the answer. Sure, but those operations know how to handle a seed, they don't go connecting their savings wallet to random contracts, they keep firmware current, and there are people whose entire job is that. Retail buyer has none of that. So when the standard advice is "buy a hardware wallet, or you're doing it wrong," two things happen that, I think, are worse than the alternative.

One, someone with a small stack gets intimidated by the whole ritual, decides self custody is above their level, and leaves the coins on an exchange. Which we all agree is the worst option available.

Two, someone spends 250 bucks on a device to protect 50 bucks of crypto because they were made to feel irresponsible for not buying the "safe" option.

So my position, and tell me where it's wrong: a hardware wallet is a tool that quietly assumes a level of knowledge and paranoia that most of this market doesn't have yet. For people who don't have it, a good hot wallet with a couple of boring habits, like a cheap dedicated phone that does nothing else, might be the better real-world outcome than a hardware wallet used badly.

Anyway. If you're advising a friend with a few hundred dollars and no technical background, what do you actually tell them and why? And does the purchase and shipping surface bother anyone else, or do you think anonymous delivery and paying in crypto solves it? Also, curious whether the Coldcard bug changed how anyone thinks about "it's open source" as a security argument. Most of the people can't read that code, and even the people who can have no way of knowing how many other qualified eyes actually looked. Open-source means auditable, not audited. Or do you file this one as a fluke and move on?

Not looking for a winner, I just think this sub gives better answers than "not your keys, buy a hardware wallet, done." Sorry for the wall of text.

Been chewing on this for two weeks and I want to hear where people actually land because I keep flip flopping.

Quick recap in case you missed either one. Coldcard: a build error in firmware from March 2021 meant some devices generated seeds using a software PRNG instead of the chip's hardware RNG. Effective entropy dropped to around 40 bits on older models, which is brute forceable offline. Nobody got phished. Nobody's device was stolen. Nobody typed their words into a fake site. Something like 1,800 BTC gone from 5,000+ addresses, and updating the firmware doesn't fix a seed that was already generated weak.

Then Trezor's fulfilment partner got breached. About 13,700 customers, and for most of them it was full name, email, phone number and home address. Credit where it's due, Trezor's own systems were never touched, and no keys were exposed, and their 90-day retention policy is the only reason it wasn't every buyer in company history. But think about what that list is. It's confirmed hardware wallet owners with the address the box was delivered to. Phishing by email, phone, and physical mail. Someone sends a letter on branded paper about an urgent recall or a mandatory firmware update, and I'd bet a decent number of people follow the instructions. Reports are already saying the data is being used to ask people for their 24 words.

Ok, so here's the thing I want to argue about, and I want to say upfront I don't think there's a correct answer. I'm not saying cold wallets are unsafe. I'm not saying hot wallets are safe. I own hardware wallets, and I'm not getting rid of them.

Conceptually, cold is obviously better. That's not in question. What I'm less sure about is how much of that advantage survives contact with a normal human being.

Take bad products out of it. There's garbage on both sides, and there are wallets that used to be good and aren't anymore. Assume the person picked well either way.

Good hot wallet, the chain is short. Most don't ask for any personal info. You install the app, generate the wallet, and after that, it's two questions. Is the seed handled properly, and is the phone clean. That's basically the whole thing.

Good cold wallet, the logic after generation is identical. Seed safe, wallet safe. But now look at everything that has to go right before you even hold the device. Did you buy from the real site or a clone. A lot of manufacturers don't ship everywhere so now you're trusting a reseller, or a third-party seller on Amazon because that's your only option. Was the package tampered with. And to buy it you hand over name, email, phone, home address and payment method, and that data then gets handed to fulfilment and courier companies you never picked and can't audit. That's the exact link that failed at Trezor.

That's a lot of companies holding a file that proves you own crypto. Half this space cares about privacy above almost everything else, and buying a hardware wallet is one of the least private purchases you can make. Once it leaks, it's also something a tax authority can cross-reference, which is a very different conversation for anyone whose declarations don't line up.

And then there's the part nobody wants to bring up. Loads of people buy a hardware wallet, generate the seed offline exactly like the manual says, and then save the 12 or 24 words into their password manager. Bitwarden, Proton Pass, a local KeePass file, whatever. They think it's fine because it's encrypted. What they actually did was turn a cold seed into a hot seed, and the device is now a paperweight with a screen.

I'm not laughing at anyone for that. Errors are the price of being your own bank. We have a long, very public list of people at the top of this industry who lost absurd amounts to small operational mistakes, so it's clearly not a beginner thing. It's a human thing. If you haven't made your mistake yet, give it time.

Which gets me to the part I actually believe. People point at funds and custodians running cold storage as proof that cold is the answer. Sure, but those operations know how to handle a seed, they don't go connecting their savings wallet to random contracts, they keep firmware current, and there are people whose entire job is that. Retail buyer has none of that. So when the standard advice is "buy a hardware wallet, or you're doing it wrong," two things happen that, I think, are worse than the alternative.

One, someone with a small stack gets intimidated by the whole ritual, decides self custody is above their level, and leaves the coins on an exchange. Which we all agree is the worst option available.

Two, someone spends 250 bucks on a device to protect 50 bucks of crypto because they were made to feel irresponsible for not buying the "safe" option.

So my position, and tell me where it's wrong: a hardware wallet is a tool that quietly assumes a level of knowledge and paranoia that most of this market doesn't have yet. For people who don't have it, a good hot wallet with a couple of boring habits, like a cheap dedicated phone that does nothing else, might be the better real-world outcome than a hardware wallet used badly.

Anyway. If you're advising a friend with a few hundred dollars and no technical background, what do you actually tell them and why? And does the purchase and shipping surface bother anyone else, or do you think anonymous delivery and paying in crypto solves it? Also, curious whether the Coldcard bug changed how anyone thinks about "it's open source" as a security argument. Most of the people can't read that code, and even the people who can have no way of knowing how many other qualified eyes actually looked. Open-source means auditable, not audited. Or do you file this one as a fluke and move on?

Not looking for a winner, I just think this sub gives better answers than "not your keys, buy a hardware wallet, done." Sorry for the wall of text.