Quote from: pooya87 on February 23, 2020, 03:47:57 AM

Quote from: DaveF on February 22, 2020, 02:27:48 PM

7 or 8 wallets that are all open source but who has time to check the code and verify everything before installing all the new versions as they come out or just 1?

being open source is about being transparent not about every single user checking the code themselves. for example i have not really checked Electrum or bitcoin core source code (not extensively anyways) but i know that many others have and that is enough. but if it were a closed source wallet i know that nobody has ever seen the code or knows what it is doing.

Yes but as I posted someplace else, it's somewhat a false security.

Do you check the hash of the file you downloaded against what is posted?
Do you have automatic updates turned off on your phone and not update till people have verified the posted code is the same as what is in the app store / play store?

And as I posted in another thread unless there has been a 3rd party audit of how they push the update to the store this is all just security theater.

Think about it, if there are poor controls to upload the compiled file to the store then it's all pointless.
DaveF gets a job with bigwallet as their IT hardware person. It's open source, it's audited, it's amazing beautiful code.
Friday @ 4:30PM as everyone is leaving for the weekend I post a corrupt fund stealing compiled app to the app / play store and walk out of the building, head to the airport and fly to some island with no extradition. Saturday AM they have the bad wallet pulled but by then I have 1000s (10000s?) of BTC that were sent to me before anyone knew what happened. And I'm on a beach sipping drinks out of a coconut.

On the other hand the shitty closed source wallet needs 2 people with security dongles to log into the PC that updates the code that is in the app / play store.
You might not know what the code is, and it may be crap with bugs, but they at least know that what they wrote is what is up there.

However, since as far as I know NONE of them publish / publicly audit how they push updates to the stores it's all just trust.

You may feel differently. You may disagree. That is fine, but IMO it really needs to be discussed.

-Dave