Still experimental?

[opentoe]

I won't trust my hard earned money with experiments or unproven software. Has this client been elevated to proper testing and verification and out of experimental stages yet?

[1713575785]

1713575785

[1713575785]

1713575785

[1713575785]

1713575785

[jim618]

Hi Opentoe,

You are right to be wary of experimental software when we are talking about money.
I work to my best effort to make MultiBit as good as commercial software (which is my background) but with the manpower I have available there are limits to what can be done.

In reality ALL Bitcoin is experimental to some degree.

The most important thing with a Bitcoin client are the private keys.
You can export your private keys from MultiBit to a file and check they create the correct Bitcoin addresses in some other Bitcoin application (though be careful exposing your private keys to anyone) or by reimporting them to a new MultiBit wallet and checking the addresses.

The encrypted private key export files can be decoded on the command line using openssl as described here (near the bottom of the post):
https://github.com/jim618/multibit/wiki/Export%20and%20limited%20import%20of%20private%20keys
You don't even need MultiBit to decrypt them.

In terms of code audits probably the best indicator is the number of forks of the code base. There are now 14 forks. This means 14 people have taken the repository and have a copy of the source code on their machine. Of course it is up to them to comment on code quality.

The licence on MultiBit is the MIT licence which is basically 'Do what you like with this code. No warranty expressed or implied'. This won't change as I am happy for other people to use the code as they want and for legal liability reasons.

Re: testing. The testing in MultiBit is at various levels:
+ there are unit tests for low level functionality
+ there are a few functional tests which set up a 'MultiBit runtime' and then actually connect to the Bitcoin network and test something.
+ each release I 'put my test hat on' and run through the basic functionality to regression test it. The results of this testing are the release checklists that I then scan and post on the website. You can see them at the https://multibit.org/releases.html. Often I spot something that isn't quite right but is acceptable so I fix it later - you have to be pragmatic.

Probably the best path is for you to try MultiBit out with small amounts of bitcoin. Get familiar with the private key export so that you will always have access to your private keys. Judge for yourself.

[opentoe]

Hi Opentoe,

You are right to be wary of experimental software when we are talking about money.
I work to my best effort to make MultiBit as good as commercial software (which is my background) but with the manpower I have available there are limits to what can be done.

In reality ALL Bitcoin is experimental to some degree.

The most important thing with a Bitcoin client are the private keys.
You can export your private keys from MultiBit to a file and check they create the correct Bitcoin addresses in some other Bitcoin application (though be careful exposing your private keys to anyone) or by reimporting them to a new MultiBit wallet and checking the addresses.

The encrypted private key export files can be decoded on the command line using openssl as described here (near the bottom of the post):
https://github.com/jim618/multibit/wiki/Export%20and%20limited%20import%20of%20private%20keys
You don't even need MultiBit to decrypt them.

In terms of code audits probably the best indicator is the number of forks of the code base. There are now 14 forks. This means 14 people have taken the repository and have a copy of the source code on their machine. Of course it is up to them to comment on code quality.

The licence on MultiBit is the MIT licence which is basically 'Do what you like with this code. No warranty expressed or implied'. This won't change as I am happy for other people to use the code as they want and for legal liability reasons.

Re: testing. The testing in MultiBit is at various levels:
+ there are unit tests for low level functionality
+ there are a few functional tests which set up a 'MultiBit runtime' and then actually connect to the Bitcoin network and test something.
+ each release I 'put my test hat on' and run through the basic functionality to regression test it. The results of this testing are the release checklists that I then scan and post on the website. You can see them at the https://multibit.org/releases.html. Often I spot something that isn't quite right but is acceptable so I fix it later - you have to be pragmatic.

Probably the best path is for you to try MultiBit out with small amounts of bitcoin. Get familiar with the private key export so that you will always have access to your private keys. Judge for yourself.

And backing up my private keys ensures me that I'll never lose any money? Is that what you are saying? I'm ok with doing that, as I use the original bitcoin.org wallet but I'm just not happy with the interface. I also use Electrum, and while that is very nice with the blockchain always updated the interface and transaction history is pretty bad. This is why I wanted to try another bitcoin local wallet. Since the wallet from bitcoin.com is not experimental or in beta really that's why most probably use it. Of course a lot of people use the online wallets.

I'll try it out maybe with a few coin and see how I like it.
Thanks for responding.

[jim618]

As long as you have your private keys you can:
+ import them into a new MultiBit wallet
+ import them into blockchain.info directly
+ the keys are stored in the uncompressed Satoshi format so you would be able (on the command line) to put them into the Satoshi client.

There are probably other places too - practically everything supports that format.

I recommend you store the private key export file encrypted.

[Mike Hearn]

It's very, very hard to actually lose money with Bitcoin - unless you are a software developer doing experimental things with the protocol, but that doesn't describe you.

As long as you have fresh backups of your wallet after each new address you create, you are good to go.

That said, it's not very difficult to get your wallet into a bogus state such that it needs to be "reset". You won't lose money but you'd have to wait a while for rescanning to take place. Bugs that cause this are getting fixed over time.

[St.Bit]

It's very, very hard to actually lose money with Bitcoin ...

No, there have been enough cases of people loosing btc by sending funds from a wallet and deleting the change adress. If you send partial funds a new adress is generated for change. People belived funds are still on original adress and delete wallet because they have a backup at home ...

[R2D221]

It's very, very hard to actually lose money with Bitcoin ...

No, there have been enough cases of people loosing btc by sending funds from a wallet and deleting the change adress. If you send partial funds a new adress is generated for change. People belived funds are still on original adress and delete wallet because they have a backup at home ...

Technically, the coins are not lost, they're just unaccessible. But yes, that's something to be very careful about.

How does MultiBit handle change addresses?

[jim618]

The change address is worked out as follows:

+ if there are two or more addresses in the wallet: the second address is used as the change address.
+ if there is only one address in a wallet it is used as the change address.

The order used is the order keys are created/ imported.

The rationale for using the second address is that in a newly created wallet there is a single address created. If you subsequently import some private keys it will create addresses #2, #3 etc. By using the second address, if present, change will go to the oldest of your imported addresses.

[Mike Hearn]

Yes, alright, it's hard to lose money unless you actually delete your own wallets. I was talking about the case of writing software bugs.

Eventually all wallets will be deterministic and people losing their money by messing up backup/restore will go away as a problem. But we're not there yet.