$ /00 · whoami
[ ↳ continue reading ]
[ ↑ collapse ]
$ /00 · whoami
Today I'm still not fully grasping it. No one fully does. That's not a flaw; that's the point.
I'm Marius. Solo-built. Domain held since 2017 — building actively since 2026, when life enabled the work.
$ the mission
The vision is big. The dream is bigger. The mission is what truly matters: equal access to the Bitcoin ecosystem.
The door is always open.
We don't farm the people. We offer non-biased Signals filtering the noise — the good, the bad, and the neutral, laid out side by side, with cited sources.
We are not reinventing the wheel. We are improving how people make use of the wheel 🙌.
$ what this is
The front door to Bitcoin. A simple entrance. A starter package that forever evolves. A full map to the Bitcoin ecosystem — what matters, where to find it, how to evaluate it for yourself. Mapped, listed, accessible.
Five pillars: /learn, /swap, /orange-pages, /radar, /dashboard. Plus the glossary, the authors page, and this — building in public — where every shipped change lands in real time.
$ why this exists
Most "Bitcoin education" online is one of two things: a wallet trying to onboard you ((so you'll buy from them)), or a creator trying to retain you ((so the algorithm pays them)). Neither is wrong. Both are downstream of someone else's incentive.
I wanted a third thing. A quiet resource that tells you the truth, doesn't take a cut of what you do next, and doesn't try to keep you on the page longer than you need to be.
For the billions of people who are, or will be, in the situation I once was in.
$ the rules I won't break
- We do NOT want to know who you are or where you come from. No IP. No cookies. No profile. PERIOD!
- Every piece of content under CC BY-SA 4.0. Take it, translate it, remix it.
- Equal access, no matter where you come from. We don't care.
- Non-biased by construction, not by claim. Every fact paired with its counter. Every quote attributed.
- AI-assisted, not AI-generated. Code mostly Claude under direction; article prose I write by hand.
Not your keys, not your Bitcoin.
Not our data, not our business.
$ who this is for
You. Not the institution. Not the leveraged-treasury-company shareholder. Not the 401(k) administrator.
You, and your friends, whoever needs it, are here and will be here always under the same foundational rules.
The person who is curious and wants to begin their Bitcoin Journey, or wants to find a Bitcoin related service, or to read a topic.
Here is the door, wide open.
The person who has saved $50, $500, or $5,000 and wants to put it on a hard ledger you actually control.
$ where I am right now
Got to admit, silently building this alone, as transparent and as much in public as I can ^ doing my best, learning by doing and growing every day.
Very early. Live in production, but the catalog is small, the visitor count is small, the social presence is tiny. I work on this every day, all day, alone — by choice, because the time has come. No day job. No side projects. Just the Mission.
Brick by brick. Well-placed bricks. Loving the build.
Soft Launch and ongoing work to improve and add as much as possible to the Map.
Why? not wait to launch it as (ready)?
Because there will always be something to add or improve.
$ closed-source — yet
Workers and build scripts are closed-source today. You can't audit our code. Yet — at some point I'll open parts or full, trusted bitcoiners can verify. And/or, I won't work on this alone anymore.
Until then: closed by code, public by behavior. Every header, every policy, every page is yours to inspect.
I am just the keyholder to something that belongs to us all.
$ the one and only fundraiser
There's a Geyser campaign — the only one this site will ever run. A bridge until ethical-affiliate revenue self-sustains. Why? this method? Because it is transparent.
It means it gives me room to focus on the important things, not on focusing to fill +100 available affiliates on The Orange Pages.
Work first, rewards later. Never a paywall, ever.
"Good to know", I am not asking for anything. It's a mix of open door to support the mission if you think it deserves it and makes sense for you. It also helps me out on the long run, allowing me the freedom to not worry about the next months — this is when the foundation is being built.
If sats come in, I keep building full-time. If they don't, I keep building full-time. There won't be any actual difference, why should I lie.
No marketing budget. The "YouBuyBitcoin .com" will do the heavy lifting.
No growth hacks. It's just me and my focus is on building — let it spread on its own, it will.
The work is the only pitch. Proof of work is the only marketing.
What helps more than sats is people slowly slowly spreading the word — the only way this will grow, by being useful. Any feedback is welcomed — reach out anytime: info@youbuybitcoin.com · marius@youbuybitcoin.com. Or via Socials.
If You think this is useful,
- — Tell one person. Word of mouth is how this grows.
- — Give feedback. If you see one — tell me. I'll fix it. That's the deal.
- — Share ideas. I'm one head; I miss things. I'm open to all of them.
- — Help grow this as a community. Translate, audit, contribute.
→ geyser.fund/project/youbuybitcoin
meanwhile, I keep doing my part…
$ what's below — take a "minute"
This page is the deep dive. Below you'll find the what, the how, and the why — every layer of how this site actually works, unbundled.
- §1–§3 — the what (architecture, workers, content)
- §4–§5 — the how (build & deploy, security & privacy)
- §6–§8 — the why (FAQ, ship log, the road ahead)
Click anything that catches your eye. Audit me without me asking anything of you. Or simply ask me anything.
$ the long arc
What is today to be seen, all of it, is not even 7% of what will be built over the next months, years, decades. or at least what is in my mind of building. This is meant to outlast us — so the work never stops, as the blockchain never does.
Built towards that. No compromises allowed.
ach, and do not forget that every time you remember the URL — six syllables instead of a pitch deck — you make this a little easier for the next person.
The door is open. Always!
ach, and few more things…
why is this page the way it is? well… this page is my playground to share, it took me a week btw ^ allows me to be me
…
— Marius 🙌
[ ↑ collapse ]$ /Architecture & Stack
Pure HTML, CSS, and JavaScript. No frameworks. Hosted on Cloudflare's global edge.
data flow
system status · auto-refresh every 60s
Your browser pings each worker. Status reflects the most recent response.
healthy · slow · unreachable
$ /Workers · Deep Dive
Each of the 7 workers is a small Cloudflare-edge function. Tap any card for what it does.
cd ~/workers
All workers pulse when responding healthy.
healthy · slow · unreachable
ybb-feedback
Counts how many people vote, read, or click — never who.
▶ tap for detailsybb-swap-rates
Compares swap prices from 8 providers — you get the best one.
▶ tap for detailsybb-live-data
Refreshes Bitcoin price, hashrate, blocks & gold every few minutes.
▶ tap for detailsybb-search
Finds words and topics across the site, even when you mistype.
▶ tap for detailsybb-mempool-cache
Stores Bitcoin block data so the dashboard loads fast.
▶ tap for detailsybb-live-counter
Counts who's reading right now. Anonymous — no tracking, no cookies.
▶ tap for detailsybb-admin
Where Marius checks site health. Locked behind a password.
▶ tap for details$ /Content & Community
The numbers below are the answer to "how is this thing actually doing?" Static counts mark what's been built — articles, listings, glossary terms, dashboard metrics. Live counts come straight from the workers — engagement updates every 30 seconds, Bitcoin every 10 seconds. All anonymous, all aggregated, all on this page.
content inventory
live engagement · auto-refresh every 30s
Total since day one. Each chapter completion counts once.
Up + down votes across all articles. Every voice counts.
Unique listing visits per user per 24h. Real discovery, not noise.
right now
-- people are online. Last ship was --. Live data refreshed just now.
live Bitcoin · auto-refresh every 10s
$ /Build & Deploy Workflow
Every change I make follows the same pipeline. No shortcuts, no exceptions. Click any step for details.
Every step automated except review. The pipeline blocks if any verification gate fails. Everything double-double-checked — by me and by the gates.
What I lean on
Claude Code (Anthropic) · Perplexity · Git / GitHub · Cloudflare Pages · Wrangler CLI · Pure HTML / CSS / JS — no JS framework, no bundler
$ to be precise:
The 95%+ Claude Code figure is for code only — architecture, scripts, every line of HTML/CSS/JS. AI generates the patterns; I review every line. Perplexity contributes deep research for education articles, fact-checked against primary sources before any claim ships.
Article prose I write by hand, refining the YouBuyBitcoin .com vision since 2017 — sourced, attributed, never generated. Mistakes get caught. I log them in the ship log — fixed in public, never buried.
The pipeline is the proof, not the patterns.
I move slow on purpose. Real users are reading.
$ /Security & Privacy
Don't trust — verify. No accounts. No trackers. No PII. Every header, every policy, every page you receive — yours to inspect.
The 5 verification gates documented in /workflow enforce this section's claims pre-push — if any header drifts, any external link skips the convention, any count claim falls out of sync, or any ship-log entry leaks internal language, the build blocks.
what we don't collect
- accounts no passwords · no email · no logins
- cookies none on public site (admin dashboard only)
- analytics no Google · no pixels · no PII tracking. Cloudflare Insights = anonymous performance metrics (no IP, no fingerprint, no cookies)
- IPs SHA-256 hashed for rate-limit, then discarded
- workers logs disabled — raw IPs never written
- click-out exposure every external link is marked with ↗ — auto-applied by CSS, enforced by a pre-push gate that fails the build if the convention breaks. When clicked, that service sees your IP at click time. Never collected by us.
what we DO collect — and only this
- vote tallies anonymous · per-section · aggregate counts only
- click counts anonymous · per-listing · aggregate counts only
- read counts anonymous · per-section · aggregate counts only
- visitor heartbeat anonymous · concurrent count only · no session tracking
- never linked all rate-limited via SHA-256-hashed IP — never linked to identity, location, or session
If we don't sell data, how is this paid for? — covered honestly in FAQ Q.06 below.
security headers
- CSP self-only scripts/styles · no inline · no eval (one exception: wasm-unsafe-eval for Pagefind search)
- HSTS preload forces HTTPS · 1-year max-age · subdomains
- X-Frame DENY — no iframe embedding (clickjacking blocked)
- Permissions-Policy 14 browser APIs blocked (camera, mic, geo, payment, USB, Bluetooth, serial, MIDI, sensors, etc.)
- nosniff MIME-type confusion blocked
- Referrer strict-origin-when-cross-origin
code security
- zero CDN all scripts, fonts, styles self-hosted
- XSS-safe user input escaped via escapeHTML() before any DOM injection
- worker auth HMAC cookie · Secure · HttpOnly · SameSite=Strict
- rate-limit 60 req/min per IP · KV-counter brute-force protection on admin login
- no secrets in code env vars only · pre-commit scanner blocks leaks
- rotation secrets rotated bi-weekly
responsible disclosure
- email info@youbuybitcoin.com
- policy .well-known/security.txt
- response time within 48 hours
$ the contract:
Workers and build scripts are closed-source — you can't audit our code. Yet.
Every claim we make about behavior is verifiable from outside (headers, rate limits, response shape, network traces).
The site is private by code, public by behavior. Nothing to hide because nothing to collect.
$ /Frequently Asked Questions
The follow-ups after §1–§5. First-person, mechanical answers, every claim back-able.
Q.01 If your code is closed-source, what can I actually verify?
Plenty — just not the source code itself.
What you can verify from outside:
- HTTP headers (CSP, HSTS, X-Frame, Permissions-Policy) — open DevTools → Network → reload → click any request → see them on the response.
- Rate limits — make a few rapid requests to any worker; you'll hit a 429 with the documented limit.
- Response shape — every worker returns predictable JSON; if it ever changes, you'd see it before me.
- Network traces — full open inspection of every fetch the page makes; no hidden third-party calls.
- External links — every one carries
target="_blank" rel="noopener noreferrer". Auto-applied by CSS, gate-enforced before push. - The pre-push gates' behavior — §4 above names every check the hook runs. The hook source itself isn't public today (workers and build scripts are private). Opening as much as possible is the direction; I'll get there. Until then, the effects are visible: every drift the hook catches gets a ship log entry.
What you can't verify (yet): worker source, build scripts. They live in private repos. The tradeoff is honest — I get operational privacy, you get behavioral verifiability. Closed by code, public by behavior. The "Yet" stays — at some point I'll likely open parts to audit by trusted bitcoiners.
Q.02 How does Claude Code fit in? Is this site AI-generated?
The site is AI-assisted, not AI-generated. Important difference.
Claude Code (Anthropic's CLI) writes 95%+ of the code — HTML structure, CSS rules, JavaScript, scripts. I direct it, review every line before commit, course-correct when it drifts. Patterns generated by AI, intent owned by me. If you've spent five minutes here, you've probably noticed it doesn't read like generic AI output — that's because every page passes through human editorial filtering before it ships.
Article prose I write by hand. All 21 core education sections + 8 supplementary — sourced, attributed, primary-source verified. Perplexity contributes deep research (citations only, never published prose). When I'm wrong, I log it. The Saylor case study has had multiple factual corrections post-ship; each one in the ship log.
Why I disclose this: "AI-generated" is a fair concern in 2026. Telling you upfront lets you calibrate trust — and lets you spot if the work falls below the standard a human author would hit. The pipeline is the proof, not the patterns.
Q.03 Why mention Cloudflare Insights if you say "collect nothing"?
Because "collect nothing" was a lie waiting to happen if I left it absolute. Truthful version:
Cloudflare Insights is a performance product running at Cloudflare's edge. It tracks page-load times, response status codes, country-level region, browser type — the signal needed to detect a slow page or regional outage. It does not: log your IP, set cookies, fingerprint your browser, or build a profile of you across visits.
I keep it because performance metrics are the only signal that tells me when something is broken before users complain. The alternative is flying blind. Disclosed openly so you can make your own call — the privacy tradeoff is small but not zero.
Everything else (Google Analytics, pixels, fingerprinting, third-party trackers): not used. Verifiable in your DevTools Network tab right now.
Q.04 What happens if a worker goes down?
Each worker has a fallback chain baked in. Worst case is degradation, not outage:
- ybb-live-data (price/hashrate/blocks): chain = Binance → CoinGecko → Kraken. If all three fail, dashboard shows the last known good values with a stale-data marker.
- ybb-mempool-cache: TTLs range from 30s (block height, fees, mempool) to 1h (long-term hashrate trends); serves the last cache miss until upstream returns.
- ybb-search: client-side Pagefind (WebAssembly) handles searches even if the worker is offline; only deep-vector search needs it.
- ybb-feedback / ybb-live-counter: graceful degradation — page loads, vote/heartbeat just don't record.
- ybb-swap-rates: stale-while-revalidate — last good rate snapshot serves until refresh.
The §1 ledger pings live. If you load this page and see an orange or red dot, that worker is genuinely degraded. I monitor the same ledger from the admin dashboard. Site is designed to degrade visibly, not silently.
Q.05 How do I verify the live data is real?
Three independent ways:
- Cross-check with mempool.space and CoinGecko. Open the dashboard; open the same metrics on those sites. Block height should match within seconds; price should agree closely — small variance between aggregators is normal (different weighting). If they diverge meaningfully, something's wrong on my end — tell me.
- Watch the LIVE pill. Every live-data figure on this site carries a small purple
● LIVE · just nowpill that marks how fresh the data is. If it says "stale" or "X minutes ago", the worker hasn't returned a fresh value. The pill renders from real fetch timestamps — it can't lie about freshness. - Open DevTools → Network. Reload the page. Watch requests to
ybb-live-dataandybb-mempool-cache. Responses are JSON; you can read them directly. If a number on the page differs from the JSON response, that's a bug — file it.
The status strip at the top of this page also auto-derives from data/ship-log.json at page-load — every count there (ship total, since-LIVE, this-month) is computed from the public log. View source if you want to see the JS doing it.
Q.06 If you don't track or sell data, how is YBB funded?
Honestly: right now, by me.
YBB is pre-revenue. Domain, Cloudflare workers, KV storage, R2 buckets, fonts, hosting — all paid out of my own pocket. Has been since 2017 (the year I bought the domain), through every iteration since. I pay the renewals and cover the bills while building, because the work matters to me whether or not it ever earns.
The future revenue model (when it starts):
- Affiliate partnerships — disclosed openly. The focus of the site is building something useful; affiliates exist as disclosure, not the goal:
- /swap — 7 of 8 providers carry affiliate links (LetsExchange, SimpleSwap, ChangeNOW, ChangeHero, Exolix, FixedFloat, Godex, StealthEX). Selected on rate competitiveness, no-KYC support, and reputation. Built first to compare rates honestly — the affiliate side is secondary.
- The Orange Pages — 1 of ~130 listings carries an affiliate link. I haven't actively pursued this side; listings get added because they're worth cataloguing, not because they pay.
- No ads, no VC, no sponsored content, no paid placement. Directory and education stay non-biased by construction.
- 21% of net profits pledged on-chain to Bitcoin education organizations. Verifiable transactions when revenue starts flowing.
Until then, what you see is built and supported personally. Part of why the build is slow on purpose — no investor pressure to ship faster than the discipline allows.
Q.07 Why publish such a detailed ship log?
Because building in public means building in public — not "building in public except the embarrassing parts."
Every ship gets logged. Bug fixes. Stale-data corrections. CSS regressions. Mobile-overflow patches. Voice edits. All of it — including the ones that betray earlier mistakes. Fixed in public, never buried.
That decision came from a simple test: if I edit a number and don't tell anyone, did I really fix it? Or did I just change it and hope nobody noticed? The ship log forces me to acknowledge every drift before it gets quietly overwritten.
The detailed data-popup text on each entry exists for the same reason — anyone who wants to know what S183 did, or which 8-K filing the Saylor numbers came from, can read the full diff. For nerds, but not only.
Drift is a fact of every project. Hiding it is a choice. I made the other one.
Q.08 How can I report a bug, suggest a listing, or contribute?
A few channels, depending on what you want to do:
- Bug or content error: email info@youbuybitcoin.com with what you saw + the page URL.
- Security vulnerability: same email, or .well-known/security.txt for the machine-readable policy. 48-hour response window.
- Suggest a listing for The Orange Pages: email with service name + URL + why it belongs (1–2 sentences). I review personally; non-Bitcoin services don't get added.
- Article corrections / source updates: same email. Include the exact paragraph + the source you're correcting against. Every correction lands in the ship log.
- Translations: every article is CC BY-SA 4.0 — translate freely; backlink + CC notice is the only requirement.
No code PRs accepted from outside today (source repos are private — see Q.01 above). That may change.
$ /Ship Log
Every ship, every drift, every fix. 212 entries logged. Most recent first.
density · auto-derived
filter
10 most recent · green = last 3 days · tap any row for details
fresh window
$ updated by ship · CC BY-SA 4.0 · drift caught here, fixed in public
$ /Roadmap
14,537 things on the roadmap. ~6% done.
20-40 things a week, covering every aspect.
Publicly in progress — as it’s meant to be.
All rights reserved · the roadmap can shift at any time.
Steady and meaningful building > quick builds.
Focused on the long run.
Shipped · what’s already built and live …
Work in Progress · currently active …
Short-term · days to weeks …
Mid-term · weeks to months …
Long-term · year+ horizon …
Since 2017. Forever.
This roadmap reflects the founder’s personal vision and direction. It is not a promise, guarantee, or legally binding commitment. Priorities may shift. Timelines are intentionally omitted.