How to find real Electrum?

[TryNinja]

If you knew the answer, then why are you askig for my source for ThomasV key? If you go to Electrum.org and go to the Download page, there is a link to the same URL I posted above. Both electrum.org and the Electrum github I posted above are legit; both of them lead their users to the same PGP key, which is real.

Yes, bad servers give fake github repos with fake wallets, but I linked you THE REAL GitHub repo, which again, you can confirm either by checking it in the electrum.org website or in any other trusted source.

Why can’t you just do your own goddam research to confirm that what I’m saying is true?

how to know that PGP key is real?
The fake sites have signatures for the fake versions so there is no point in verifying signatures

Look, I’m trying to remain patient and explain everything to you. But for this, you will HAVE to read and understand what I’m trying to say to you.

AGAIN: You download ThomasV’s key ONCE from a well known source, like ELECTRUM.ORG, which is real and not a fake website. Then, everytime you need to download a new update from any website, you use that trusted key to verify the unknown file (you know the PGP key is trusted because you know for a fact that you downloaded it from the real website).

YOU DONT DOWNLOAD A NEW KEY EVERYTIME ALONG WITH THE FAKE SOFTWARE FROM THE FAKE WEBSITE.

[TryNinja]

Look, I’m trying to remain patient and explain everything to you. But for this, you will HAVE to read and understand what I’m trying to say to you.

AGAIN: You download ThomasV’s key ONCE from a well known source, like ELECTRUM.ORG, which is real and not a fake website. Then, everytime you need to download a new update from any website, you use that trusted key to verify the unknown file (you know the PGP key is trusted because you know for a fact that you downloaded it from the real website).

YOU DONT DOWNLOAD A NEW KEY EVERYTIME ALONG WITH THE FAKE SOFTWARE.

Yes I’m trying to remain patient and ask everything to you too
But in case i dont have that key and i go to a fake website?

Then you get scammed.

That’s exactly my point. You SHOULD have ThomasV real PGP key before trying to download anything. Then, you verify the file and if the signature is valid, you are safe to use it.

Take some time to get his real PGP key once and everytime you download a new update, you can verify it.

[TryNinja]

gpg4win has a signature to verify or how to verify gpg4win?

https://www.gpg4win.org/package-integrity.html

[TryNinja]

gpg4win has a signature to verify or how to verify gpg4win?

https://www.gpg4win.org/package-integrity.html

how to verify gpg4win?

< insert same link here >

gpg4win is opensource?

Yes. You can find its source in their download page.

[TryNinja]

how to verify gpg4win?

Wtf dude? I literally just linked you to a page where there are plenty of ways of verifying your gpg4win file. At this point I’m starting to wonder if you’re just troling me.

Again: https://www.gpg4win.org/package-integrity.html

how to build gpg4win from source code?

https://github.com/gpg/gpg4win/blob/master/README

[HCP]

i dont know how to build so i give up. I must use prebuild binary file. So to use electrum i have to trust other softwares?

Yes.

Just like the OS that you're running... unless you're compiling your own OS from source code and have personally verified and checked all the code

This is a very "chicken and egg" problem... the (less than ideal) "solution" is that unless you have a LOT of technical ability and knowledge... then, at some point, you have to trust something/someone.

[TryNinja]

So you trust virustotal and all anti-virus used by virustotal which are closed-source, but you hesitate to trust open-source software? This is contradictive.

stupid Legendary. I just trust their SHA256

First of all, no one here is obligated to answer or help you, so stop with this “stupid Legendary” thing. Do you not know the word respect?

Second, do whatever you want. ThomasV isn’t publishing hashes of the files any time soon and there is nothing you can do about it. Either stop with this bullshit and verify the signatures yourself, or use any other wallet that publishes hashes. Easy.

Now goodbye. This stupid legendary here already gave you way too much attention; and my patient is over.