Quote from: DaveF on February 23, 2020, 02:32:09 PM

Yes but as I posted someplace else, it's somewhat a false security.

Do you check the hash of the file you downloaded against what is posted?
Do you have automatic updates turned off on your phone and not update till people have verified the posted code is the same as what is in the app store / play store?

And as I posted in another thread unless there has been a 3rd party audit of how they push the update to the store this is all just security theater.

Think about it, if there are poor controls to upload the compiled file to the store then it's all pointless.
DaveF gets a job with bigwallet as their IT hardware person. It's open source, it's audited, it's amazing beautiful code.
Friday @ 4:30PM as everyone is leaving for the weekend I post a corrupt fund stealing compiled app to the app / play store and walk out of the building, head to the airport and fly to some island with no extradition. Saturday AM they have the bad wallet pulled but by then I have 1000s (10000s?) of BTC that were sent to me before anyone knew what happened. And I'm on a beach sipping drinks out of a coconut.

On the other hand the shitty closed source wallet needs 2 people with security dongles to log into the PC that updates the code that is in the app / play store.
You might not know what the code is, and it may be crap with bugs, but they at least know that what they wrote is what is up there.

However, since as far as I know NONE of them publish / publicly audit how they push updates to the stores it's all just trust.

You may feel differently. You may disagree. That is fine, but IMO it really needs to be discussed.

-Dave

That depends on the wallet you use (such as Electrum),
1. There's no automatic update if you use Electrum
2. You can use PGP verification (rather than hash) to verify integrity of the files. If someone who don't have the PGP private key attempt to upload malicious version of Electrum, PGP verification will fail and people will realize something is wrong.

It's only false security if you automatically believe open source = good/secure software. If you don't perform automatic update, always perform GPG verification and waiting someone to give feedback on newer version of application, i'd say it's more secure rather than blindly trusting closed-source wallet.
If a user don't do all of those when using open-source software, it's their fault.