Quote from: Lovecove on January 06, 2021, 10:47:46 PM

Every miner uses the newest Update...

They don't. You actually don't need to specifically run Bitcoin Core to operate a mining pool. You can use a derivative of that and function just as well, providing that the transactions and the blocks conform to the rules that are implemented.

Quote from: Lovecove on January 06, 2021, 10:47:46 PM

1. It's officially hosted on one site, downloaded at a central location.
2. Not all miners check or look at the code or even work on it -- a few devs do. If those few devs decide to inject malicious code... everyone else is just going to download and implement it.
3. There are no real security checks with the updates -- no formal body of regulators or official code security team is going to check it for malware... yes, it's open source and everyone can view it -- but then you'd need volunteers to check it regularly. Often, people who check the code only do so after everyone updated already.

The only real way to mitigate your concerns is to learn C++ and start reading the codes. If you can't, there is no way around your concerns.

It is true that you have to trust others if you cannot validate the code in it's entirety. However, each release is signed by several developers within the community[1]. Anyone can create their own gitian signature so the best way is to build a well established PGP WOT to be sure that you can trust the people signing the release and that nothing malicious is added.

[1] https://github.com/bitcoin-core/gitian.sigs

Quote from: BrewMaster on Today at 02:05:18 PM

that is only possible and easy when you check each commit every day individually. but if you are checking the difference from version to version (for example from bitcoin core version 0.19 to 0.20) then there is going to be a large number of commits with a huge amount of code changed, added or removed which makes it extremely difficult.

in core's example there was 2033 commits, 1254 files changed with 78,888 additions and 72,492 deletions.
https://github.com/bitcoin/bitcoin/compare/v0.19.2...v0.20.0

You can compare with each RCs and you'll have way lesser codes to deal with. Normal users shouldn't be running RCs anyways but it'll give you some time before the stable release and have lesser codes to review from the final RC to the actual release.