Quote from: jackg on December 31, 2018, 01:10:28 PM

Quote from: pooya87 on December 31, 2018, 04:25:08 AM

Quote from: Sauaba on December 30, 2018, 08:21:55 PM

~

its a matter of who you want to trust.
- your Antivirus program that can report false positives
- the Electrum developers that have released the software for a long time
- or no one.

for most people it is enough to verify the PGP signature of Electrum and be sure that it is released by the real developers and is not fake one. and then they ignore their AV.
if you want to trust no one then you will have to go through the source code which can be found here https://github.com/spesmilo/electrum and then when you trusted the "code" you need to compile it yourself and then trust the compiled .exe and ignore your AV.

Or use a cold storage option and still trust no one. If done properly (2 cameras with qr codes) then you can trust no one by signing the transaction, making it a QR code and scanning it into a document which can then be screened and broadcast once you're happy.

The electrum source code loses me at some points. The bitcoin.py file for example took a lot of effort to understand...

it is lack of documentation and is for me my lack of knowledge about python but also i think it is partly due to the fact that a file there does a ton of things that may not be related to each other.
for example the bitcoin.py is dealing with scripts (read/write) converting bases, encode/decodes, deals with seeds, coverts addresses, and more. although this file is one of the good ones.
maybe it is just me thinking too much in terms of strongly typed languages and full object oriented language + my newbishness in programming but i prefer a much better categorization of files (classes) that are responsible only for one thing. for example base conversion. another one for scripts (interpret, read, write,...), another one for seeds,...