webdev

Okay, so check this out—crypto security isn’t glamorous. Wow! Most people think locking a seed phrase in a drawer is enough. My gut said it would fail for too many users, and it did. Initially I thought a hardware device plus a paper backup would be safe, but then realized user behavior always finds a way to undo protocol-level safety. Whoa! dApp connectors are the wild west. Seriously? They often act like bouncers that don’t check IDs. Medium-size projects launch connectors quickly and then patch later, leaving users exposed in the meantime. On one hand connectors make Web3 usable, though actually they also widen the attack surface because permissions cascade across chains and contracts. Hmm… here’s the thing. Shortcuts matter. Short sentence. Most people click “connect wallet” without reading the popup. My instinct said, “that’s dangerous,” and that hunch matched logs and incident reports I reviewed. Actually, wait—let me rephrase that: user impatience plus ambiguous UX equals reckless approvals, and that combination is lethal for funds. Wallets should treat permissions like banking permissions. Few do. Developers design connectors that ask for blanket access, which is very very convenient for a quick swap, but it gives dApps the keys to more than they need. I’ve seen approvals that let a contract move tokens across multiple chains—yikes. That pattern is why revocation dashboards are becoming more important than ever. Short aside—(oh, and by the way…) seed phrases are both sacred and stupidly fragile. Really? People store them in cloud notes, in photos, or text messages. That surprises no one who follows exploit threads, yet it keeps happening. Somethin’ about convenience beats caution every time unless you force a better UX. Practical habits that actually reduce risk (without turning wallets into Fort Knox) Start small. Wow! Use a dedicated wallet for high-risk actions and another for cold storage. Medium step: set low-level allowances for routine dApp interactions and reserve higher allowances only when absolutely needed. Longer thought: if you segment funds by intent—daily spending, active trading, long-term storage—the blast radius from a compromised dApp is much smaller, because the attacker gets access to a small bucket rather than everything. Connectors should show intent. Seriously? Good connectors display exactly which token(s) and which chain(s) will be affected, and they explain the permission type in plain English. Designers who succeed here borrow from banking: label the permission, show the limits, and require a transaction-level confirmation for anything outside those limits. On one hand that seems like friction, though actually it prevents many common scams. I’m biased, but multisig is underrated. Hmm… Multisig on a smart contract wallet or a hardware-backed approach forces an attacker to breach multiple barriers. That complexity is annoying for users and wonderful for security. Initially I worried multisig would be adoption-killing, but pragmatic UX (like time-locked approvals and sane recovery flows) makes it viable for many users today. Use purpose-built wallets for different tasks. Really? A browser extension for quick swaps and a mobile wallet for day-to-day signing isn’t enough. Consider a separate vault for bridging assets or staking on new protocols. Something felt off about treating every wallet the same; different activities deserve different security postures. This mental model changes behavior. Permission revocation is your friend. Wow! Check and revoke allowances regularly. Medium note: Web3 dashboards that centralize revocation across chains are maturing fast. Longer thought: if you build a habit—weekly or monthly—of auditing approvals, you dramatically cut the window attackers have to siphon funds, because many exploits rely on long-lived permissions. Where seed phrases go wrong — and what to do instead Seed phrases are single points of failure. Short. People repeat this, but they still do risky things. My instinct said “treat seeds like cash,” and that works: keep them offline, segmented, and redundant. Actually, wait—let me rephrase that—offline alone isn’t enough if the offline backup is predictable or stored with metadata that links it to your identity. Three practical options: metal backups, split-seed approaches, and wallet-based social recovery. Wow! Metal plates survive fire and floods far better than paper. Medium thought: splitting a phrase with Shamir’s Secret Sharing spreads risk, but it creates recovery complexity and custodial trade-offs. Longer thought: social recovery (trusted guardians) is elegant for users who fear losing their keys, but it adds trust dependencies that must be chosen carefully and tested periodically. Don’t store seeds in cloud storage. Seriously? I know you think the cloud is secure—it often is until an OAuth token leaks or an attacker reuses credentials. Most breaches that exposed seed backups were due to poor credential hygiene. So use offline storage, and keep redundancy in geographically separated locations. Test recovery. Hmm… Run dry-runs with mock funds. Practically, write the exact restore procedure, then actually restore to a fresh device every 6-12 months. This reveals hidden failure modes like degraded backups, forgotten PINs, or firmware issues. Somethin’ about practicing recovery builds confidence and exposes false assumptions before they cost you real money. One wallet I’ve been watching for sensible defaults is truts. Wow! They focus on permission clarity and offer UX paths that nudge users toward safer choices. Medium point: I’m not shilling—I’m pointing out that wallets that bake security into default flows lower the bar for everyone. Longer thought: if the industry wants fewer hacks, builders must trade some convenience for safer defaults, and vendors like truts show that tradeoff can be tasteful. Common questions from Web3 users How should I use multiple wallets without losing my head? Keep a simple naming convention and a short spreadsheet (locally stored) that lists purpose, chain exposure, and recovery steps. Short tip: use icons/colors in wallet apps to differentiate. Longer: build a habit of checking the “purpose” before connecting to a dApp, and periodically re-evaluate which wallets are active so you don’t accumulate forgotten access points. Is hardware wallet + seed phrase enough? Short answer: often, but not always. A hardware wallet protects live signing keys, and a proper offline backup protects recovery. However, if your seed phrase backup is linked

Whoa! Okay, so check this out—privacy crypto gets tossed around like a buzzword at meetups. My instinct said use Monero, but not all wallets are the same. Initially I thought every XMR wallet protected you equally, but then I ran into real-world tradeoffs that changed my mind. On one hand Monero’s cryptography gives solid anonymity; though actually, the wallet’s design and your habits matter just as much. Seriously? Yeah. I remember setting up my first Monero wallet in a cramped coffee shop in Portland, and I felt untouchable. That feeling was real at first. Then I realized I had leaked data by copying a seed into a cloud note—dumb move. My gut said “somethin’ smells off,” and it did. Hmm… Here’s the thing. Wallets fall into roughly three categories: full-node wallets that validate the blockchain yourself, light wallets that rely on remote nodes or view keys, and custodial services that hold keys for you. Medium-sized projects sometimes blur those lines. On a technical level, running your own node is the gold standard, though it takes disk space and patience. A practical map: risk vs. convenience Short answer: more convenience often equals more trust you must place in others. Seriously? Yes. For most users, a good tradeoff is a light wallet that connects to a trusted remote node you control or one run by a nonprofit you vet. I recommend trying to at least understand node relationships before you trust large amounts. Initially I thought remote nodes were harmless, but then I learned how metadata can leak. On one hand a remote node hides your resource costs; on the other hand the node operator can correlate IPs with wallet activity if you don’t obfuscate network traffic. Actually, wait—let me rephrase that: correlation requires effort, but it’s not impossible. When people ask me for a recommendation, I point them toward projects that prioritize open-source code and transparent ops. I’m biased, but code you can audit matters more than polished marketing. If you want a friendly UI with privacy-minded defaults, try an option that lets you run a node later if you get serious. Check this: I use xmr wallet for day-to-day tests, and I like that it balances usability with powering optional self-custody practices. It isn’t perfect. But when a wallet lets you export your seed cleanly and supports hardware wallets, that’s a very very important signal. Wallet hygiene myths. People tend to think a single cold wallet makes them invincible. Nope. Habits matter—how you store backups, how you type your seed, whether you re-use addresses or not. One bad photo of a paper seed, and you’re toast. I’ve seen it. It sucks. Also, some folks overcomplicate things. They buy fancy air-gapped setups and then email screenshots to themselves. Trust me, that defeats the purpose. On balancing security and usability, think incremental. Start with a simple, well-reviewed wallet. Then harden it: move to a hardware signer, run your own node, and reduce metadata leaks with Tor or a VPN if you need to. These steps add friction. But if you want privacy that actually lasts, the friction is worth it. Practical tips that saved me time and headaches. Write down your seed on paper. Twice. Store copies in separate secure places. Seriously, paper isn’t sexy but it works. Consider a metal backup for fireproofing if you hold significant funds. Use a hardware wallet for cold storage when possible. When transacting, pick the right ring size and fee settings if your wallet exposes them—many modern wallets pick sane defaults, though some advanced users tweak more. On one hand lower fees are tempting; on the other hand too-low fees can delay transactions and reveal timing patterns. There’s a balance. Network privacy is underrated. Running through Tor reduces IP linking, and using a remote node without Tor can let operators knit together activity patterns. Hmm… one caveat: Tor can slow things and sometimes block unreliable nodes, so test before assuming everything works perfectly. Common pitfalls and how to avoid them Scams are everywhere. People impersonate wallets, clone apps, and set up fake “support” pages. If an app asks for your seed in chat, it’s malicious—no legitimate support needs that. Also, be wary of mobile apps that promise impossible features like “complete anonymous refunds”—most of those claims are fluff. I’m not 100% sure about every project’s roadmap, but track record matters. Projects that update frequently, publish release notes, and engage openly with researchers are better bets. On the flip side, silence from maintainers is a red flag. Privacy is layered. You need cryptographic privacy (Monero provides that), operational privacy (how you connect and behave), and device security. Lacking any one of them weakens the whole stack. So protect your machine: use good passwords, enable disk encryption, and avoid installing sketchy apps. Oh, and do test restores. Don’t assume a seed works until you’ve actually restored it on a clean instance. This is one of those steps people skip and regret. FAQ: Quick answers for busy people Do I need to run a full node? No, not strictly. A full node gives the best privacy and trust model, but you can use light wallets safely if you connect to trusted nodes or route traffic through Tor. If privacy is your priority, plan a path toward running your own node eventually. Is Monero legal? Generally yes. Monero itself is a protocol and crypto asset; legality depends on jurisdiction and how it’s used. I’m not a lawyer, and this isn’t legal advice. That said, owning and using privacy coins for legitimate purposes is lawful in many places in the US. What’s the single best practice? Control your seed. Keep it offline. Test restores. Everything else builds on that foundation. Final notes that feel personal. I’m biased toward tools that are transparent and auditable. This part bugs me: people chase convenience and then complain when privacy evaporates. On the other hand, I get the human side—tech should be usable. So I’m for pragmatic paths: start usable, learn, then harden.

Whoa! Bitcoin feels anonymous at first glance. It’s just numbers on a public ledger. But that’s a first impression that hides a lot. Initially I thought address reuse was the main problem, but then I realized the ecosystem leaks identity in many subtle ways. Really? Yeah. Pseudonymity is the core concept. Your address is a handle, not a secret identity. On-chain analysis groups addresses into clusters, and those clusters can be linked to real-world identities through KYC exchanges, merchant records, or careless behaviour. My instinct said “use new addresses,” and that helps — though it’s far from a complete solution. Here’s the thing. Short-term fixes can create long-term problems. Change addresses, coin consolidation, and even the timing of transactions produce patterns. Analysts use heuristics to link outputs back to the same wallet. On one hand, those heuristics are imperfect. On the other hand, forensic firms are very good at filling gaps with other data sources. Hmm… somethin’ else that bugs me is network-level leaks. Your IP, your node, the peers you talk to — those can betray you. Tor and privacy-preserving routing reduce that attack surface, but they aren’t magic. If you mix network leaks with on-chain patterns, it becomes easier to re-identify you. Okay, so check this out — wallet choice matters. Custodial wallets and exchanges collect identity information by design. Non-custodial wallets give you control, but user interfaces, defaults, and lack of education often lead to privacy slippage. I’m biased, but running your own node and using wallets that prioritize privacy moves the needle meaningfully. What privacy means in practice Privacy is a spectrum. It’s not binary. At one end you have obvious leaks — address reuse, publicizing your addresses on forums, reusing exchange deposit addresses. At the other end, you have layered defenses: careful UTXO management, network protections, and privacy-focused tools. But even with strong controls, you need a threat model. Who are you hiding from? What resources do they have? For hobbyist-level privacy, simple habits often suffice. Don’t reuse addresses. Use different addresses for different relationships. Avoid posting transaction links tied to your identity. These are low-hanging fruits. They’re easy and reduce the most obvious risks. For serious privacy you need more robust practices. Coin selection matters, and so does avoiding combining known and unknown funds. Use privacy-aware wallets that implement coin control and offer mixing primitives conceptually. However, I won’t give step-by-step mixing instructions here — that crosses a line into operational guidance that could be misused. Still, the principle is: reduce linkability. Seriously? Yes, and there’s nuance. Tools like privacy wallets try to break heuristic links. They do this by encouraging or automating transaction patterns that are harder to trace. But no tool is a panacea. A determined and well-resourced adversary can correlate on-chain data with off-chain signals like IP logs or exchange KYC records. Initially I thought a single tool could solve everything, but the reality is layered defenses are necessary. On the ground, many people pick privacy solutions for different reasons. Journalists and activists need confidentiality. Businesses want transactional privacy. Regular users just don’t want tracking. Each use-case has different safe practices and tolerances for complexity and risk. Let’s talk about tools without getting operational. Privacy-preserving wallets exist, and they’re worth exploring. One notable approach is wallet software that integrates coinjoin-style ideas to mix inputs conceptually with others, reducing direct links between senders and receivers. If you want to try a privacy-first client, look into wallets that emphasize privacy and decentralized participation — such as the wasabi wallet — but read up and understand the trade-offs before using anything intensively. Oops, tangential: usability vs privacy is a real trade-off. People pick convenience. And honestly, I get it. I use a mix of tools myself and sometimes choose convenience. That part bugs me. Cryptography can’t fix human behavior. We have to design habits and defaults that support privacy while not forcing everyone into a steep learning curve. Another important point is custody. If you leave coins on an exchange, your privacy is gone at the platform level. They see deposits, withdrawals, linked accounts, IPs, and KYC data. Even if on-chain flows are obfuscated later, the exchange already mapped funds to a legal identity. So custody decisions are privacy decisions. On the network side, Tor, VPNs, and privacy-focused node setups help. But don’t treat them as perfect cloaks. Network adversaries can still correlate traffic, and endpoint security matters — if your device is compromised, all privacy measures become moot. Keep devices updated, use hardware wallets for large sums, and compartmentalize where practical. Now for a bite-sized threat-model checklist. Who could be looking? Casual sleuths, blockchain analytics firms, scammers, law enforcement, or a state actor. How much can they spend? Can they subpoena an exchange? Do they control parts of the network? Answers to those questions determine which defenses you prioritize. Common questions about Bitcoin privacy Is Bitcoin anonymous? No. Bitcoin is pseudonymous, which means addresses don’t carry legal names by default, but transactions are public. If an address is ever linked to your identity — via KYC exchanges, merchant records, or public posts — the chain of transactions tied to that address becomes attributable. So anonymity isn’t built-in; it must be earned and defended. Can I become perfectly anonymous? Perfection is unrealistic. You can significantly increase your privacy, though. That requires layered measures: careful on-chain practices, network privacy, device hygiene, and thoughtfulness about how you interact with services. Also, be aware of legal and ethical boundaries. I’m not 100% sure about every edge-case, but leaning on multiple defenses is the pragmatic route. Are privacy tools illegal? Mostly no — using privacy tools themselves is legal in many jurisdictions. But intent matters, and laws vary. Tools can be used for lawful privacy protection, like safeguarding journalists or protecting business secrets. They can also be misused. If you’re unsure about legality in your region or for a specific activity, consult counsel. Seriously — don’t wing it. How should I choose a privacy wallet? Look for

Right from the jump I had this nagging feeling: many wallets promise convenience but forget the little things. Wow! The result is clunky swaps, messy histories, and users who bail. In the DeFi world, speed is sexy. But reliability wins the long game, especially for self-custodial folks who want control without the chaos. Initially I thought the biggest problem was fees, but then I realized UX and traceability often play a larger role in whether people actually keep using a DEX on a mobile or desktop wallet. WalletConnect feels like a bridge. Really? Yep. It connects dApps to wallets without sacrificing custody. That shift is huge because it separates key storage from UI, letting users approve on-device while interacting in rich web interfaces. On the other hand, the handshake between dApp and wallet can be fragile. Sometimes approvals stall. Sometimes metadata isn’t passed cleanly. My instinct said that was a corner-case, but repeated testing told a different story—it’s surprisingly common. Here’s the thing. When WalletConnect and the swap engine are in sync, trades feel seamless. When they aren’t, the user blames the wallet. Hmm… I remember a user session where a swap failed twice and the person assumed they were hacked. Panic—then frustration—then abandonment. That was a wake-up call. So we should care about how approvals, swap parameters, slippage and transaction history are presented. Users need clarity, not cryptic hash dumps. Technical detail next, but bear with me—I’ll keep it practical. WalletConnect establishes a secure websocket or QR-based session. It transmits requests to sign transactions and returns responses to the dApp. For swaps this means the dApp prepares the trade call (say a Uniswap or Sushi swap), sends it to your wallet for signature, the wallet submits to the RPC, and the chain confirms. On paper it’s simple. In practice race conditions, nonce mismatches, or dropped messages make it messy. And mobile wake-locks? They introduce their own special brand of pain. Short story: UX needs to expose the trade lifecycle. Medium story: UX should let users see pending, confirmed, and failed swaps with clear next actions. Long story: build a transaction history model that reconciles on-chain events with local intent tracking, because on-chain logs alone often lack the context non-technical users need—like “this was a limit-style swap I attempted at $X” or “this was swapped via a routed path that touched tokens A→B→C”. Making Swap Functionality Feel Safe and Fast Okay, so check this out—swap UX isn’t only about the swap button. Small cues reduce cognitive load and lower error rates. Show estimated receive amounts. Show worst-case amounts. Show gas estimates with a clear way to edit them. Wow! If you hide all that behind “Advanced settings”, people will either overpay or panic. I’m biased, but transparency wins. Also, let users tweak slippage tolerance with presets and a custom slider. That tiny affordance saves many failed trades. Practically, wallet devs should offer at least three confirmation stages. First: a quick summary (token in, token out, gas, slippage). Second: the detailed calldata and route for power users. Third: a final guardrail if the route includes illiquid pools or tokens with transfer fees. On one hand that sounds like overkill; on the other, too much opacity causes user churn. Actually, wait—let me rephrase that—balance the stages so they ship fast but don’t leave users guessing. WalletConnect sessions complicate this because the dApp often drives the confirmation UI. So the wallet has to be proactive: parse the incoming tx, flag surprises, and enrich the info. For example, if the calldata shows a swap router and multiple hops, display the path. If approvals are requested, show what spending limits will be granted. This reduces nasty surprises. Users will thank you, or at least they won’t curse you in a Telegram group… which is something. Transaction History: Not Just a List of Hashes Transaction history is where wallets prove they understand users. Short: users want timelines, not blobs. Medium: they want actions labeled—”Swap”, “Provide liquidity”, “Approve”, etc. Long: they want reconciliation—show me the on-chain outcome and the original intent so I can answer the question: did this trade do what I thought it would do, and how much did it cost me in total after gas and slippage? On-chain data is canonical but raw. It doesn’t tell you the route taken by an auto-router, or whether the gas price was bumped automatically, or whether a transaction was front-run. Wallets should stitch together mempools, on-chain receipt logs, and local event data from WalletConnect sessions to produce a human narrative. Somethin’ like: “You attempted a swap for 100 DAI to ETH at 0.0025; route used two pools; final amount received was 0.0398 ETH; gas used 0.0052 ETH; net cost 0.0102 ETH.” That’s the kind of narrative that keeps users confident. There are tradeoffs. Indexing every event increases storage and sync time. Not every wallet can run a full node or an indexer. But clever caching and targeted queries can work well. Cache recent transactions, fetch logs for only relevant txs, and let users request more detail on demand. Also provide an export option. People like CSVs when taxes roll around—ugh, taxes. (oh, and by the way… taxes are a nightmare). For people who want a single, smooth self-custody experience for swaps and history, I’d point them toward solutions that integrate WalletConnect well and show trade context, like the uniswap wallet if you’re exploring self-custodial options. It meshes web dApp richness with a secure on-device approval flow, and it surfaces swap details in a way that’s approachable for non-devs while still satisfying power users. Security and Recovery: The Quiet UX Security sometimes shows up as friction. Good security feels invisible until it isn’t there. Really? Absolutely. Seed backups, hardware-wallet support, and clear approval languages are essential. Do not rely on vague “permissions granted” messages. Spell out token approvals and let users revoke them easily. That part bugs me when wallets bury revocations under several settings menus. WalletConnect sessions should be revocable from the wallet UI. Show active

Whoa! I got sucked into this topic last week while fiddling with a handful of devices on my kitchen table. My first impression was that cold storage is boring and dry. Then something happened — a tiny smart card sat there, thin as a credit card, and suddenly I started asking better questions. This piece is about why smart-card cold wallets and backup cards matter, how they handle multi-currency needs, and some real-world quirks I’ve learned the hard way. Really? Yep. Cold storage used to mean deep technical hoops. Backups were paper, seeds scribbled on a napkin, or drives hidden in a sock drawer. Most people think: store the seed, done. But seeds leak, degrade, or get lost, and human habits are awful when it comes to security. My instinct said: there has to be a cleaner, less terrifying way for everyday users to hold their keys so they don’t accidentally brick their life savings. Short answer: smart-card wallets solve a lot of that. They keep private keys isolated inside a tamper-resistant chip. They act like a tiny vault you can carry in your wallet without broadcasting your secrets. Initially I thought the card form factor was gimmicky, but then I realized the ergonomics beat juggling devices you charge and update and curse at. On one hand you get physical simplicity; on the other hand you must trust firmware and supply chains — so it’s not purely magic. Hmm… here’s the thing. Not all smart-card solutions are created equal. Some are read-only tokens with no recovery options, and others are part of a broader system that supports multi-currency transactions while keeping the private key offline. There’s a trade-off between absolute minimalism and user-friendly recovery. You can choose minimal and pray, or choose built-in recovery and plan properly. Okay, so check this out — think about lifecycle. You buy a smart-card wallet, set it up, move funds, then forget about firmware for months. That’s normal. But what happens if the issuer goes under, or the card’s chip model gets deprecated? You need a backup strategy that doesn’t rely on a single vendor. Some systems use a companion backup card or seed-splitting techniques. Others give you a tangible backup card you store separately. That redundancy is very very important. How backup cards change the cold-storage equation Whoa! Backup cards are underrated. They’re physical, discrete, and you can tuck them into safes or safety deposit boxes. Backups remove the single point of failure, though they introduce their own operational nuances. For example, you must decide how many backup copies to create, where to store them, and how to rotate them if you suspect compromise (oh, and by the way, rotation is often neglected by casual users). If you do backups wrong you might as well have used a poorly written seed phrase. Seriously? I know it sounds dramatic. But consider this: a backup card can be paired to a primary smart card or used as a recovery vector with a small, trusted recovery app. In practice that means you can lose a primary card and still restore access without exposing your private key to the internet. On the flip side, anyone who finds and understands your backup could drain funds (so physical security matters). There’s no perfect solution; you balance convenience against attack surface. Initially I thought a single backup in a fireproof safe would suffice, but then I realized geographic risk and human error complicate things. If your safe floods or you move, that backup could vanish. So the better approach I teach people is to spread risk: one card in a safe, one with a lawyer or trusted friend under strict instruction, and perhaps a cold-storage mnemonic sealed in wax for legal redundancy. Actually, wait—let me rephrase that: have a documented plan, and test it. Test recovery once, then again. Multi-currency support is another big factor. Many people think hardware wallets are single-currency beasts. Not true. Modern smart cards often support dozens of tokens natively or via companion apps. That eases headaches when you juggle BTC, ETH, and some ERC-20s. Though actually, compatibility can vary by chain and by the card’s firmware, so you should verify support before moving large balances — I learned that the hard, messy way when a supported token was dropped from a firmware update. Something felt off about early multi-currency implementations — they were clunky and required trust in an intermediary to build transactions. Now, though, you can find solutions that sign transactions directly on the card using standard derivation paths, so the private key never leaves the chip. That reduces attack vectors substantially and keeps your transaction privacy intact. I’m biased, but here’s why I prefer a smart-card approach for real-world users: the physical form factor is obvious and approachable to folks who won’t install and maintain a Raspberry Pi node. It’s low maintenance, fits a wallet, and scales to many currencies without needing constant firmware babysitting. That said, if you want full node validation and the highest possible decentralization, you still need a node and more complex setups (people with massive holdings usually do both). On one hand the card is great for usability; on the other hand the supply chain matters — who made that chip, how was it personalized, and was the card provisioned securely? These are non-trivial questions. When trust becomes a factor, the user must do a little homework (or rely on a trustworthy brand). I don’t pretend every user will do that, and that bugs me, because bad assumptions lead to big losses. Why I recommend tangem for many users Hmm… I’ve tested a handful of smart-card products and found some clear leaders. For a balance of usability, security, and multi-currency support, I often point people toward tangem. Their cards are plug-and-play in the sense that setup is straightforward, the private key stays inside the secure element, and many popular chains are supported. I’m not saying it’s flawless, but for most users balancing simplicity and safety it hits