Quote from: giszmo on Today at 04:10:32 AM

Quote from: DaveF on March 02, 2021, 01:00:34 PM

Seriously? Huh

You talk about security then you send people to an unknown github to download software?

I agree with many of your concerns. I'm not a contributor to YetiCold and only had a lengthy call with the main contributor @JWWeatherman_ which probably is worth nothing if in the end people lose funds but it might have skewed my confidence. I edited my comment above.

Your comment sounds like I was part of YetiCold. I am not. I just see this project is addressing many things in a very good way although I have not audited it very carefully. Many concerns can be mitigated the way they step through the whole process but one of my criticisms was also that there is no concise instructions one could read from start to finish. You actually have to do it to know how it goes. @JWWeatherman_ counters this with the videos that show the whole process.

Sorry about that, from the way I read it you were part of them. My fault, owe you an apology.

I know I have said it before and will keep saying it about open source wallets or anything. Unless you compile it yourself OR make sure that any auto-updating is turned off you are probably getting a false sense of security. Unless they can prove an audit of their update security.

Having a code audit and being open source is good. But it the machine that uploads the files to the play store / itunes is not secure then it all goes out the window.

Employee "Dave" goes evil. Owner / programmer "giszmo" does everything properly, open source, code audits, etc.
3:30 PM on Friday Dave uploads the bad wallets to the online stores. They have nothing to do with the GitHub code. Says to giszmo "See you Monday" as always and walks out the door.
3:45 PM stores start pushing out bad version
4:00 PM Dave arrives at airport
10:30 PM Dave lands in some tropical island
11:45 PM Dave checks and 500 copies of the wallet have been downloaded and have ~ 35BTC in total.
6:00AM Sat 7200 copies have been downloaded and have ~90BTC in total.
Dave sits and wait's till there are 100+ BTC in the compromised wallets. And then hits the "Send to Dave" button.
Will probably get some more BTC till everyone figures out what is wrong and happening.

So is that better then a closed souse wallet that needs 3 checks against their internal code before it's uploaded and the uploads needs 2 different 2fa devices that 2 different people have?

I like open source, I use open source, unless everything has multiple separate checks in the process it's not any better some times.

Sorry, but I am going to keep saying that. And that the above rant or a similar one should be on every page that discussed the benefits of open source.

-Dave