Bitcoin Wallet for Android
11 messages, 9 Jul 2012. Started by Amir Taaki.
Greg Maxwell (3), Amir Taaki (2), Harald Schilly, Mats Henricson, Andreas Schildbach, Jorge Timón, slush, Ben Reeves
Hey,
I just saw this added to the clients page. One of the conditions we set for that page was that all the clients must have the entire sourcecode available for review, and users should be able to run it from the sourcecode. Is the sourcecode for this client available for review? I couldn't find it.
Otherwise, we should make a separate section for non-opensource clients.
On Mon, Jul 9, 2012 at 11:21 AM, Amir Taaki <zgenjix@yahoo•com> wrote:
Quoted text (1 line)
> Is the sourcecode for this client available for review? I couldn't find it.
yes:
http://code.google.com/p/bitcoin-wallet/ and it is built upon http://code.google.com/p/bitcoinj/
harald
Sources are available here:
http://code.google.com/p/bitcoin-wallet/
Mats
Quoting Amir Taaki <zgenjix@yahoo•com>:
Quoted text (22 lines)
> Hey, > > I just saw this added to the clients page. One of the conditions we > set for that page was that all the clients must have the entire > sourcecode available for review, and users should be able to run it > from the sourcecode. Is the sourcecode for this client available for > review? I couldn't find it. > > Otherwise, we should make a separate section for non-opensource clients. > > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development >
OK thanks. I just went and made those sections then saw your posts.
Anyway we have a section for proprietary clients now. Please tell me if anything looks disagreeable, http://bitcoin.org/clients.html
One thing I'm going to do is randomise the positioning order within sections upon refresh.
----- Original Message ----- From: "mats@henricson•se" <mats@henricson•se> To: bitcoin-development@lists•sourceforge•net Cc: Sent: Monday, July 9, 2012 11:19 AM Subject: Re: [Bitcoin-development] Bitcoin Wallet for Android
Sources are available here:
http://code.google.com/p/bitcoin-wallet/
Mats
Quoting Amir Taaki <zgenjix@yahoo•com>:
Quoted text (22 lines)
> Hey, > > I just saw this added to the clients page. One of the conditions we > set for that page was that all the clients must have the entire > sourcecode available for review, and users should be able to run it > from the sourcecode. Is the sourcecode for this client available for > review? I couldn't find it. > > Otherwise, we should make a separate section for non-opensource clients. > > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development >
I'd suggest adding two links for each client.
One for getting the binary, and one for getting the source. (Obviously, source being optional if you allow non-opensource clients.)
On 07/09/2012 12:44 PM, Amir Taaki wrote:
Quoted text (67 lines)
> OK thanks. I just went and made those sections then saw your posts. > > Anyway we have a section for proprietary clients now. Please tell me if anything looks disagreeable, http://bitcoin.org/clients.html > > One thing I'm going to do is randomise the positioning order within sections upon refresh. > > > > ----- Original Message ----- > From: "mats@henricson•se" <mats@henricson•se> > To: bitcoin-development@lists•sourceforge•net > Cc: > Sent: Monday, July 9, 2012 11:19 AM > Subject: Re: [Bitcoin-development] Bitcoin Wallet for Android > > Sources are available here: > > http://code.google.com/p/bitcoin-wallet/ > > Mats > > Quoting Amir Taaki <zgenjix@yahoo•com>: > >> Hey, >> >> I just saw this added to the clients page. One of the conditions we >> set for that page was that all the clients must have the entire >> sourcecode available for review, and users should be able to run it >> from the sourcecode. Is the sourcecode for this client available for >> review? I couldn't find it. >> >> Otherwise, we should make a separate section for non-opensource clients. >> >> >> ------------------------------------------------------------------------------ >> Live Security Virtual Conference >> Exclusive live event will cover all the ways today's security and >> threat landscape has changed and how IT managers can respond. Discussions >> will include endpoint security, mobile security and the latest in malware >> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ >> _______________________________________________ >> Bitcoin-development mailing list >> Bitcoin-development@lists•sourceforge•net >> https://lists.sourceforge.net/lists/listinfo/bitcoin-development >> > > > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ >
Didn't even know that they were proprietary software bitcoin clients. Should people trust them? Should the web promote them? After all, you can't know what they do. What if one of them contains a back door or something? I would say it's better not risk to apologize later.
On 7/9/12, Andreas Schildbach <andreas@schildbach•de> wrote:
Quoted text (97 lines)
> I'd suggest adding two links for each client. > > One for getting the binary, and one for getting the source. (Obviously, > source being optional if you allow non-opensource clients.) > > > On 07/09/2012 12:44 PM, Amir Taaki wrote: >> OK thanks. I just went and made those sections then saw your posts. >> >> Anyway we have a section for proprietary clients now. Please tell me if >> anything looks disagreeable, http://bitcoin.org/clients.html >> >> One thing I'm going to do is randomise the positioning order within >> sections upon refresh. >> >> >> >> ----- Original Message ----- >> From: "mats@henricson•se" <mats@henricson•se> >> To: bitcoin-development@lists•sourceforge•net >> Cc: >> Sent: Monday, July 9, 2012 11:19 AM >> Subject: Re: [Bitcoin-development] Bitcoin Wallet for Android >> >> Sources are available here: >> >> http://code.google.com/p/bitcoin-wallet/ >> >> Mats >> >> Quoting Amir Taaki <zgenjix@yahoo•com>: >> >>> Hey, >>> >>> I just saw this added to the clients page. One of the conditions we >>> set for that page was that all the clients must have the entire >>> sourcecode available for review, and users should be able to run it >>> from the sourcecode. Is the sourcecode for this client available for >>> review? I couldn't find it. >>> >>> Otherwise, we should make a separate section for non-opensource clients. >>> >>> >>> ------------------------------------------------------------------------------ >>> Live Security Virtual Conference >>> Exclusive live event will cover all the ways today's security and >>> threat landscape has changed and how IT managers can respond. >>> Discussions >>> will include endpoint security, mobile security and the latest in >>> malware >>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ >>> _______________________________________________ >>> Bitcoin-development mailing list >>> Bitcoin-development@lists•sourceforge•net >>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development >>> >> >> >> >> ------------------------------------------------------------------------------ >> Live Security Virtual Conference >> Exclusive live event will cover all the ways today's security and >> threat landscape has changed and how IT managers can respond. Discussions >> >> will include endpoint security, mobile security and the latest in malware >> >> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ >> _______________________________________________ >> Bitcoin-development mailing list >> Bitcoin-development@lists•sourceforge•net >> https://lists.sourceforge.net/lists/listinfo/bitcoin-development >> >> >> ------------------------------------------------------------------------------ >> Live Security Virtual Conference >> Exclusive live event will cover all the ways today's security and >> threat landscape has changed and how IT managers can respond. Discussions >> >> will include endpoint security, mobile security and the latest in malware >> >> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ >> > > > > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development >
I agree. Just imagine those two-inches newspaper titles - "Bitcoin hacked! Backdoor in official bitcoin client!". We have already some experience with shortcuts which journalists do...
slush
On Mon, Jul 9, 2012 at 1:34 PM, Jorge Timón <timon.elviejo@gmail•com> wrote:
Quoted text (3 lines)
> Should the web promote them? > After all, you can't know what they do. What if one of them contains a > back door or something?
On Mon, Jul 9, 2012 at 7:34 AM, Jorge Timón <timon.elviejo@gmail•com> wrote:
Quoted text (5 lines)
> Didn't even know that they were proprietary software bitcoin clients. > Should people trust them? Should the web promote them? > After all, you can't know what they do. What if one of them contains a > back door or something? > I would say it's better not risk to apologize later.
I agree too. Not that being open is _any_ guarantee, ideally we'd want standards of review and testing, but thats a bit much to ask for right now.
On Mon, Jul 9, 2012 at 5:21 AM, Amir Taaki <zgenjix@yahoo•com> wrote:
Quoted text (3 lines)
> Hey, > > I just saw this added to the clients page. One of the conditions we set for that page was that all the clients must have the entire sourcecode available for review, and users should be able to run it from the sourcecode. Is the sourcecode for this client available for review? I couldn't find it.
I've reverted these additions to the page, nothing personal but—
At the moment I'm strongly opposed to including any non-reviewable client options (including centrally operated web services) on the page, and I think this need to be discussed along with establishing requirements.
Any chance the blockchain.info iphone app could be included on the clients page? The source is available under an lGPL license: https://github.com/blockchain/My-Wallet-iPhone. More info:https://blockchain.info/wallet/iphone-app
Also the javascript web front end can be reviewed using a combination of https://github.com/blockchain/My-Wallet and https://github.com/blockchain/My-Wallet-Integrity-Checker but I could see why that might be more of an issue for the the official site.
Thank You, Ben Reeves
On 9 Jul 2012, at 15:00, Gregory Maxwell wrote:
Quoted text (22 lines)
> On Mon, Jul 9, 2012 at 5:21 AM, Amir Taaki <zgenjix@yahoo•com> wrote: >> Hey, >> >> I just saw this added to the clients page. One of the conditions we set for that page was that all the clients must have the entire sourcecode available for review, and users should be able to run it from the sourcecode. Is the sourcecode for this client available for review? I couldn't find it. > > I've reverted these additions to the page, nothing personal but— > > At the moment I'm strongly opposed to including any non-reviewable > client options (including centrally operated web services) on the > page, and I think this need to be discussed along with establishing > requirements. > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists•sourceforge•net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development
On Mon, Jul 9, 2012 at 10:00 AM, Gregory Maxwell <gmaxwell@gmail•com> wrote:
Quoted text (1 line)
> I've reverted these additions to the page, nothing personal but—
Er, to be clear, I left the android software in because the source is available (And I'm told its had some review).
I removed the proprietary software section the plug for the blockchain.info webservices, and the demotion of the armory client.
As far as criteria goes, I don't think we should list anything with a security model weaker than SPV unless users can practically operate their own servers. …and even that I'm a little uneasy with, because most people will use the defaults. Ideally even thin clients would have a near SPV security model, just without the bandwidth. But since the alternative for thin clients is centralized web services the lower standard will probably have better net results for now.
Nor do I think we should list anything which can't currently be subjected to independent review of the whole stack (e.g. including the server components in thinclients, unless the server is untrusted). In the future this should be raised to there existing actual evidence of third party review.