OpSec Fundamentals Web3: Hands-On Tools and Recom. for Everyday Security - DeFi Security Summit 2025

Transcript

presentation. Yeah. Hold it there. Yeah. That good. Okay. Yeah. Okay. So, a little bit uh about me. So, who I am, like I said, I'm Sven or in the internet, I usually go by the name of Shagaki or my Twitter handle is the Shogi. My background is I probably kind of work in IT computer science like

all my life. like I was like for a long time was in IT infrastructure and architecture also looking into security and hardening of that. Then I have like a couple of years experience in fullstack development also doing devstack ops in a big enterprise company and then like the last three years I'm in web3 security doing security research did like smart contract auditing in the beginning uh doing audit contests and since almost two years I'm working with Sherlock uh first as security specialist and right now back to being a developer at Sherlock working at Sherlock AI And uh OBSAC is just a topic where I'm like

personally a bit like passionate about because I think we are all security people and uh sometimes we forget about like the the personal and the operational security around it. So if you guys want we can do like a little bit of the beginning poll on uh so I have like a slido up here. So you can either go to slider.com or scan the QR code and attend the poll to uh say how confident you currently feel about uh your ops personal opsac.

Me get it up. Starting it. See if we got anybody in. Okay. I need to switch back to the other presentation.

Oh, sorry. Where is it going? Okay. See uh wait a moment if you get people coming in. I wanted to switch back to the other presentation though which I lost.

See That's right. Okay.

Oh, yeah. I think I need to show the results. There you go. >> Yeah. Okay. So, yeah, that's pretty good. So, everyone feels a little bit somewhat confident. Um, then I guess let's go into it. So, I was showing this before. I think I might have like uh switched to the other slide too early, but did anyone scan this QR code and ended up at a like uh you could have been porn website? Yeah. So that's like

one point I wanted to talk about is if you scan QR codes at places, you should always verify like the URL. So I was giving you this. It says slido.com. You could have just went there and then there's like a short URL in the in the QR code. It could be anything basically. Could be a fake Slido website or whatever, right? So this is one thing we basically have to be always aware what we're doing and about our surroundings. So always check if you scan QR codes if it's actually the URL you want to go to or better if you know the URL just go to the yourself.

[clears throat] So why does personal obsc matter? Like I think all of us here security people I already said it and there's like kind of an irony to it. So some of us are security researchers. We secure like million dollar protocols checking their code but then on the other side we use like the same browser for looking at Twitter. than like we use for signing crypto transactions. So there's like a kind of a gap between on the one hand we all know there's like uh security risks and we we know how to break things but then there's a sometimes not like 100% awareness of um thinking about what we're doing in our personal life and day-to-day life. So, [clears throat]

so it's um yeah, thinking about separating things and just being aware of like that um we are all like kind of targets like crypto is like a specifically targeted community um for attacks and this is um yeah so if we talk about OBSC or security we can always think about it in multiple layers like there's physical security which is things uh we can uh do easily. Then we talk about devices, networks and then application and also behavioral uh security. Uh I also have like a difference we can see make like there's general things which like valid for everything like uh in web 2 in in

general live and then there's like web 3 specific things like a very easy thing is like you're all at the conference right now you're working here. Do you know who the guy next to you is? Do you know if he can see what you're doing on your screen? Easy thing. You just have to pay like $10 to get like a small privacy filter which is like this and nobody can see from the side what you're doing. It's like easy things like this uh is can secure like what you're doing in a yeah exponential way I say. Then of course using hardware wallets for for crypto is super important. Then talking about devices and uh just having different profiles like uh you have your browser like every modern browser supports doing profiles. So just like we

can separate using that if you're signing if you're a signer on a multisig you should probably like think about having dedicated devices like specific hardware devices like an dedicated computer to sign this multisync. So things like this on the network side thinking about VPNs and using secure DNS settings on on the web three specific side thinking about the RPC. So it's like a central point of failure also they can see uh from where you attack they get your IP address etc etc. Um on the application side password managers two factor authentication really important and then we have things like on the web3 side like uh

transaction simulation and uh yeah um approval revoke tools. Yeah we'll talk about that later and then most important like on the behavioral side is like verify don't trust. So never trust what you see. Same thing with the QR code we had. You should verify what's going on there. And then uh trust the device, not the UI is more like for if you're using hardware wallets, then you can see the transaction data on the screen, but you should always um trust the device more than the UI. So in that case, like the the hardware wallet.

Yeah. So I think I already talked a little bit about it like in general like for OBSAC in terms of authentication you should always use two-actor authentication on every service that supports it and then there's like different uh layers of doing that. Um in the past it was like text messages like SMS or email which were used often but uh these are considered as like uh not secure anymore because there's a lot of attacks like SIM swap attacks and your email can also get compromised pretty easy. So ideally you should use an hardware key like a chubby key or uh if not possible then you should use like an authentication app like uh there's like famous ones like authy and of course like a Google authenticator um which you

can use for that and then yeah enable it on every service be it email GitHub if you're a developer exchanges your socials whatever yeah then about physical security already talked about the um privacy filter really cool thing. Then if you're not on your computer, always lock it. No matter if you think you're in a trusted environment, you should always lock it if you're not there. U yeah, camera covers is also a nice thing. Can buy like a $1 cover to pop up your camera to prevent any unauthorized access there.

And if you travel to risky locations, you probably should bring like burner devices. Um yeah, I think you all got like this little handbook like when you got here. It's like I just had a brief look at it. It's pretty good like in terms specifically for traveling. So yeah, appreciate they hand these out here. Um yeah, next thing is again the digital hygiene like I talked about browser profiles. So you should ideally have like a different profile for work and personal at most and then have another one for crypto or DeFi or if you're doing specific research stuff. Um, like I said, if you're a signer, you should not use the same device uh for

signing on multisex uh as like what's your daily driver. And obviously, you should keep your devices up to date, install security updates and things. Another [clears throat] thing is like out of band verification. Like if you get like a a message from someone you potentially trust. Uh and if it's like an a critical topic, you should probably like verify if it's really them. Like message them on another channel or call them ideally if that's possible. Yeah. Um yeah. about the the threat landscape like we talk a lot about crypto hacks and exploits and stuff but I think that the main risk still is uh actually operational security failures where like

main thing 70% of individual losses for individual users is uh still fishing attacks social engineering and um also a little bit with malicious approvals and like we see recently what pops up a lot is like these fake job offers or they they want to want to uh get you on a call or like if you say if you're security researcher they reach out to you yeah I need an audit and then they have a special meeting software or something they want you to install something on your computer so that's pretty important to be aware here and then of course we had um beginning of the year the bybit hack where which is pretty interesting because it was like basically two different operational

security mistakes that made this possible. [clears throat] Yeah. talking about that. So what happened with bid is we had on the safe wallet which is the um provider of the front end for the for the multisig safe wallet. There was a death that was compromised via malicious PDF uh which led to a key being leaked which allowed the attackers to deploy like a malicious JavaScript on the on the front end um of the safe wallet and then so that was the first operational security break here. So that the deaf got compromised by a PDF. The second one was that the signers didn't verify on the device. They trusted the UI which is uh obviously was showing the another

value than like was shown on the hardware wallet and then multiple signers signed this um transaction which led to the loss that we all know about. Yeah. So awareness building is therefore a pretty important part. I'm going to get a little bit quicker about these slides because I think hopefully everyone knows about that. So, fishing always check like websites like spelling little spelling mistakes like like this or like mimicking tools. Um, take care for like compromised social accounts. Like if somebody like an account suddenly posts something and usually there's like some urgency like claim now to get like these tokens from the adrop or whatever then it's like like a

critical critical sign let's say to say then um obviously social engineering they do a lot of like these chop offer things like I said where they try to to get uh send you like a PDF which is fake or like a fake meeting tool. quite often happens or like an assessment tool could be the case. Uh basically they want to run code on your device and you should just be aware to never do that. And if you're not sure then we have like sandboxing possibilities to do uh to run these tools without doing any major harm.

Yeah. Then there's like a couple of myths around operational security like uh why should they target me? I'm not important. But um like if you have a public public profile on any social or something, you're a potential target always. So a hardware wallet is uh yeah, I'm using a hardware wallet, so I'm safe. So I mean, at the end, it's still the user that decides to sign the transaction or not. So if you don't verify the transaction and you sign a bad transaction, it can happen with a hardware wallet as we've seen with BBIT, obviously. Um yeah, maybe you think I'm good. I can't spot fishing. But sometimes, yeah, it happens to to everyone at some point if they they also get better and better. It almost happened to me at one point. So, uh we

just need to be always aware. I think it's easy to lose track of like we all have like a busy life, a lot of things going on like especially in in web 3 like everything evolves so fast and then uh it's easy to lose track of things and then oh yeah, I need to quickly do this and then you there's one moment you're not aware and then they got you, right? And yeah, last but not least, like VPN protects me. So VPN is can protect you in terms of it hides your IP address, but it's also critical to think about if you use a public VPN provider, you're just shifting the trust from the network you're in right now to that VPN provider. So it's a matter of question if you want to do that, if you trust this provider more than your local

network. Yeah. So what can we do to in terms of tools like a little bit to get more hands-on maybe what can we do to up our object game here? So we have like different categories as you already said like we can talk about isolation which is Docker is like a good start. Then there's uh things like dedicated hardware and even like more advanced things like cubes which is like an operating system which um basically in uh starts a new virtual machine on the device for every process that you're doing like you would have like a own virtual machine for your day-to-day browsing another virtual machine for

signing and so on so on. So, and approval management. If you have like token approvals, like sadly still, if you're a D5 user, you have like a lot of uh D5 applications that by default will still request like an unlimited token approval instead of the amount that you entered. Um, so therefore, revoke.cash is like a really good web tool to check all these approvals and to revoke them eventually. Um then document safety pretty good like I said the safe dev he was uh compromised by a PDF.

There's a tool called danger zone I will show in a second which allows us to securely open like untrusted documents and yeah obviously transaction decoding uh if we h um want to sign transactions we should always know what's going on and if it's like uh not in clear text then we have to know how we can decode a transaction. Um, last but not least, multisix security is I was we're talking a lot about multisc for organizations which is obviously important but I want to raise a point that it's also a valid thing to do as an individual. You can use a multisc you just use multiple hardware wallets and maybe one hot wallet in a

two or three multisc and you increase your security by a lot by that. Yeah. So talking about revoke.cache cache. Um I think it's pretty well known. So maybe hands up who does does not know rebok.cache. Oh, it's a lot actually. So revoke.cache is um a tool which lets you check your wallet address for token approvals. Let me open it up for you. So just open up like a random uh address. So, you can connect your wallet in readonly mode, but you don't even have to. You can just enter the address

um and then it will list you all the token approvals you have. You see on this address there's like a bunch of unlimited token approvals um and you see which uh contract is approved for it and when it was last updated. And um then if you connect your wallet, you can al so directly revoke these approvals and uh make sure you're safe. Um, yeah, there's also like the nice feature you see like the value that that is at at risk. So, um, which means there's an approval for this token here now, an unlimited one, but I don't hold any of these tokens in these wallets.

So, there's technically nothing at risk. Still, it's a good idea probably to revoke these uh, permissions. This is weird. Okay. Um, oh yeah. Yeah. Talking about isolation techniques. [clears throat] Um, yeah. The most basic thing I think we can do is docker containers. So I would recommend if you not don't already have it, install Docker on your device and then especially like if you're for example a security researcher and you run like uh code from a customer like from a client, you should run it inside

an isolated container because even like running foundry tests or something can potentially be malicious code. It's at the end of the day code running on your machine, you should always run it in like an isolated environment like a Docker container. Um, this was like my day-to-day job at Sherlock like the last uh 18 months. I think I was running a lot of foreign codebased tests and I always ran it in a container to make sure uh there's nothing that can compromise us. Then if you want you can use virtual machines of course uh like whether like with parallels or like virtual box to use virtual machines as like an even uh higher isolation. Then we talked about dedicated devices. Like if you have like a high value multi6,

you want to have like a dedicated device just for s signing and then uh you use it only for that. It can be a cheap like $200 notebook. Just install like a secure OS like uh Tails OS or something on it and then uh you're good to go. And then uh yeah, I also wanted to mention cubes OS because that's a really nice project which I already said. It's basically creates a VM for every process that you start. Um, yeah. Now, danger zone, I think I already mentioned it. Um, [clears throat] the website for that is danger zone.

What it does is, um, you need to have Docker to use it. But, um, it's easy to install Docker. Even if you don't know how Docker works in the hood, you can just install it and then use Danger Zone still. Um, and then if you install Danger Zone and then you can open a PDF with it. Um, which is what I want to show. Yeah. So basically um if you receive like unsafe files like PDFs or PowerPoint presentation. So this is just my presentation here. Now then you can open it with danger zone and

okay yeah what happens is that you convert it to a safe version of the document. Let me do that because it takes a moment. And then what happens now is it spins up a Docker container and it reads the PDF and then basically takes a screenshot and uses OCR to create like a uh PDF that has the same content but only the visual content. So if there's like malicious code injected in the PDF, you don't get like the malicious code um at the end. And it works the same for like PowerPoint presentations or office documents, but you will get a PDF out of it, not like the original document format. So that's like a little bit of a bummer, but if you just want to read it, it is a really

good way to do that. Okay, now it finished and it's was opening on my other screen. So you see it's just the the PDF. It looks the same, but um yeah, potentially unsecure code is not in there. So this is like a no-brainer for me. interest. If you receive PDFs or documents from like customers or other persons that you only semi trust, then you should do this and you're way safer already. Yeah. Another thing like we talked about uh transaction decoding. So if you have a transaction hash in your wallet or maybe in in safe then um you can easily decode it with cast which is like a tool

from from tree uh you just use the four byte decode command and you see basically the function signature and also the parameters that were set. So it's an easy thing on the command line. I think maybe I can also show how that might look like. Is it big enough? Yeah, it's probably not like a good one.

Try this one. Yeah, this one. Easy one. So, this was like a the transaction hash. I just copied like 4BD is the the shortand for four by decode. And then uh we see this was like a transfer um transaction and this is the address um it goes to and this is the amount like pretty easy. Yeah. Then um we can talk about RPC privacy a little bit. Um, if you are concerned about your privacy on chain, then you you probably want some privacy in terms you're connecting to the RPC because your RPC is the entry point to the chain. So, they will see your IP address and potentially where you where

you are right now. You can use a VPN if you're concerned about that. You can channel it via the tour network as well or if you um can use uh private RPC providers you pay for uh I mean ultimate control you only get if you run your own node obviously which is always an option of course in our space which is pretty nice. Then uh yeah another thing project I love is rail gun for onchain privacy. Um anyone used rail gun before here in the room? Okay cool no one. Um yeah, Algon is like a privacy protocol. I think Ethereum Foundation also announced they want to integrate with them for their wallet SDK data building soon. And um basically it uses CK Snarks to

connect your wallet and you can shield any ESC20 token and then uh you get it as a private balance and then you can transfer it in their system. You can even swap privately and then you can unshield to another recipient. Yeah. And then uh multi if you use a if you're a signer on a multisc like I said you should have some uh general things uh like there should be no single point of failure in the multisc like if one person is not available or one device is not available the multisc should of course still be able to go through. Um there should be standard procedures for the team or like

for the for the protocol that uses it. Um no safe is the most wellknown I think even if there there was like this incident with bid in the past. Um every signer should be should use like a hardware wallet and ideally the keys will be distributed geographically as well. See and yeah then the another important point verify on device not on screen. Said it before the UI might be compromised. So uh you cannot trust that. Yeah. And then uh another thing which I really like is what I said before is you can use the multisig also for your for your personal usage. So that's what

I use for my main wallet. I have a multisig uh knows this is safe or it's just called safe now I think multisc. Then I have two hardware wallets as a signer and one hot wallet which is like kind of a backup. And um so I always need two of these uh three wallets. So even if one key gets compromised for some reason, I still have like a uh safety because they need two to get my funds out of it. And then if one key gets compromised, I can replace it if I if I uh know about it. And um yeah so if you want we can do some demo and hands-on um like if anyone is interested like never created a multisig on on

nosis for example we can do that right now like um together um maybe hands up who would be interested in that. Yeah. Okay cool. Um yeah all you need is like your machine. You can do it on mainet if you want. You can also do it on on Zapoleia on the test net. Um there's a forcet uh which is sepoleia forcet.com. If you want to use that you need I think uh use an address which has e mainet. Um but yeah so [clears throat] how to do that is yeah so the process would be going to app.safe.global which is the website for noses. Sister

browser go. Oh, find a good way. Yeah, maybe like this. So if you go to app.safe.global global you will probably see at some point something like this. So here you see I already created a a multi so you will not see that but you will get prompted to create a new save um which is similar to what I get when I say say um add

is for an existing actually see insert it just yeah let's add another Then uh yeah, you need connect your wallet and then you can generate uh an address and add it here. Let me see if that works actually. Yeah. Okay. Okay, I think I cannot go through the process with this address because I already created one.

This Okay. Yeah. Going create account. So this is what it looks like if you um create a new multisc wallet. Then you select your networks. So you can create it on

multiple networks at the same time. The benefit is they used to create two op code to give you the same address on every network. So just call it gss demo. Give it a name and then you add signers. So you can start with only the address you created from as a signer. But you can directly add multiple signers as well. You just need to add the addresses here. You can give them alias names as well. Um yeah, maybe let's copy this one.

Give it like a second signer. Then you can say we want to have two out of two signers for example and um gone. Then uh yeah there's you have to pay gas fee to create it but you can uh by now in the UI also say pay later which I do because I don't have Eve on that address. Um yeah and then basically you already have your multisc you have your own address here and you can see assets and then you can also do transactions. So how you can use it, you can um basically propose transactions directly from the UI. But um if you want to use it for DeFi,

that's obviously not super useful. But um you have the little wallet connect I icon here. So you can connect basically to any um any DeFi app um via wallet connect. Maybe can quickly try to do that. And going to a test net. Yeah, if you say connect wallet, you usually have wallet connect at some point and you just copy the the link and go here.

So now I'm connected to AVA with this multisc wallet and I could like uh propose transactions like I would do with any other wallet and then they pop up here and then you have to sign them. so far. Maybe let's just do this with like um the other wallet where I have funds in. Uh yeah, this one. Yeah. Got to hope the internet keeps stable. You know the other days it was a

little bit tricky. Yeah. So we have uh 0.01 ETH on this wallet. So I can just supply it to a for example. If I do that [clears throat] see on the other side in the multisc that pops up the transaction which is um initialize. Okay. Yeah. So what we see here we have the transaction data as well. So the after the buy bit hack actually the safe UI improved a bit. So they show a lot of things. So [clears throat] what you see here for example what was

the case with by bit like the operation in safe like is the first of these parameters here after the data and if it's set to zero then it's a regular call but what happened with by bit was they were tricked into doing a delegate call which was actually changing the the safe smart contract implementation address um which was something they should have spotted when uh verifying your data. So at this point the transaction gets proposed and then uh the first signer in this case I can sign it which is I have not verified the the data which is not good. So what we could do is take that

data or ideally of course if it's like a hardware wallet the data from uh from the hardware wallet then we can decode it and we see it's deposit e and which address and which amount confirm it now. Yeah. So now because there's a two of three multisc there still it's a needs another signer.

So what I'm going to do is switch to the other wallet and then we would have this screen where we see the data again. So the other signer also has to verify all the data uh same way I just did it. And then what's also usually seen uh pretty good is like transaction simulation. So Nosis is directly integrating with Tenderly here. So we can basically run a simulation and open up Tenderly to see exactly the simulation output which is especially like if it's like a critical wallet you should always

simulate and also verify the simulation of the transaction. going to confirm that here now. I'm going to say sign and then anyone of the signers can actually execute the transaction. paying gas and sending it on chain.

So this is again this is now an execute transaction from the from the safe want to decode that we see it's see it's exact transaction and then inside these bytes here we want also want to decode these to see yeah this is our depositive function and we see the first of these uh zeros here this one is the operation parameter which is like the regular call if it's a zero or would be a one if it's like a delegate Cool. Going to send that.

Then uh eventually our transaction goes through. Yeah, test net takes a while to getting that indexed. Anybody was able to create a multisec here or something you want to do later? I think it's like a little bit hard with the timing right now. Hope that's fine. Okay.

Yeah. Uh let's talk about some other potential um attack scenarios which is um interesting and which is just think people should be aware of like there's like things like DNS hijack or like um code injection that can happen [clears throat] for example I think this happened to curve before curve finance which is somebody was able to hijack the a part of the domain and use this to inject JavaScript code into their front end. Um, and this could be easy like as easy as this, which is just um overriding the um Ethereum request which the which starts the wallet and

changing the two parameter to um to an attacker address. And then the only way to verify this is to check in the actual wallet what is the actual two address in the transaction because you would see in the app okay yeah it goes to this address because the app thinks it's it's initiating the transaction to another address but um yeah in in real in reality it's going to be sent somewhere else and this is hard to catch because um the website looks fine the even the SSL certificates and everything is good but uh because it was in the underlying DNS where something was wrong. This uh couldn't be catched like the regular certificates and HTTPS methods you would

use. Uh another one pretty common right now is like malicious VS code extensions like I think there's a famous uh solidity um VS code extensions which has 550k installs which um extracts basically all your secrets you have locally. um [clears throat] how this works it look it it does the actual thing the um extension is doing but it does in addition to that it's reading all your secrets from ssh orn directory so think important here is uh even like a kind of social proof with 50k installs is not enough of a proof that it's like a secure um application in that case

yeah so how to defend against this. Um, again, if you have like a signing device or like you you work with secrets, it should be like a different device. Um, always check the actual transaction ideally in the hardware wallet display. Um, yeah. And then I mean the last one is a little bit hard. DNS and certificate dependencies. You have to be aware that there's this attack vectors. Um, I think if you're hosting like a website, you should check your dependencies on DNS providers and what you're using to make sure you're on the safe side there.

Um, yeah, I think we can can skip that. If you want, you can go to rebok.cash. I showed the website before um and check your wallet, see if you have any hanging token approvals and ideally get rid of them. Um yeah. Yeah. So in if you see like I showed before like there's unknown contracts and especially unlimited um approvals, you probably want to get rid of them and want to change it to only have the approvals while you actually use the protocol and you need these set up there.

Yeah. Then uh another thing about cubes like it uh I think I already talked about it multiple times can do like some more advanced like device isolation. I wanted to do a demo but it was hard with the hardware I have here was uh hard to set up the cube. I have it at home but um yeah unfortunately didn't make it to show it here in the demo but if you want to try it it's a cool project. You basically install it. You have an hypervisor and every task you want to start it, it creates another VM for you.

It's fully isolated on the OS level. So, um, even if you have like a mailware on your browsing device, like your daily browsing device, it will never affect anything on the VMs you use for wallet operations or for development even or whatever. >> [clears throat] >> I mean, yeah, there's a the the other alternative is if you just want something to sign crypto transactions securely, just get a cheap cheap $200 laptop, install Tails OS, install Tails OS or something on it. Can it can be even any Linux distro. Tails is like a little bit more tailored to uh private security.

But uh yeah, just get a separate device and do your signing and crypto operations uh while this and don't use your daily driver for crypto operations. Yeah, this sprinkles actually already to wrap up. Um I guess key takeaways, there's always multiple layers in terms of um operational security in security in general. Um and it's not enough to have only one layer, but we need all layers because after all security is not like we can fully protect against something, but it's just trying to make it harder to get exploited with every layer we add. It's getting harder and harder for uh attackers to exploit us.

[clears throat] Then verify everything. Don't trust. Um use always official sources. Uh that that's for getting software also for getting hardware. Um especially like uh hardware wallets of course. Never get like uh used ones. Always go to the vendor directly and uh get your hardware there. Um, yeah, try to minimize like a a tech surface. Like if you don't have like a lot of exposure outside, you're you're a less public person. And obviously that's not always possible, but if you're less public, then uh you're a smaller target and have like a smaller attack surface. after all regular audits like we do regular audit

of course recommend regular audits for code but also regularly audit your own obsseac um what are you doing how you're achieving things and maybe even make a checklist to um what you want to do regularly and stuff um yeah and stay current like keep your device devices up to date but also keep your knowledge about what's going on in the space up to date and uh uh yeah maybe there's new tech vectors coming up every day, whatever. And you should be aware. Yeah, like I said, uh if you want, you can commit to up your OBSAC and create your personal action plan like maybe there's a tool like danger zone you want to do. You want to set up a multisc um

you want to audit your token approvals. Um maybe there's like a habit you have like uh browsing and mixing browsing and crypto on the same device you want to change. Um yeah, feel free to uh get set up a plan and if you want you can tag me on Twitter and uh send me your action plan to have like some um responsibility there. Okay. So now if you guys want we can have a closing poll would be great to see now after this workshop how do you feel about it?

uh feel you. Yeah. How do you feel about your obsc now after the workshop? Basically, let me get that up. Cool. Yeah, looks great. Uh, I hope you you learned something. Um, if you want,

stay connected. Follow me on Twitter. I'm Dshogaki on Twitter. And um yeah, let's add some final thoughts. [clears throat] Yeah, good quote. The best time to improve your object was obviously yesterday. The second best time is today. So, you should get started. You should be aware. You should know some tools. There's always new tools coming up though. Get an action plan and plan and uh just yeah, just start improving your game, I guess.

So, thank you. I I hope you could uh learn something and yeah, if there's any questions, I'm here for another 15 minutes almost and then we can go all go to lunch.