New release: Electrum-4.0.9

[AhmadM]

Just a few hours ago electrum has released up - Electrum-4.0.9

Release notes -> https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES

- Fixes a regression introduced in 4.0.8, that prevents from paying BIP70 invoices (#6859)
- Reflect frozen channels and disconnected peers in the displayed 'can send/can receive' amounts.

Download link: https://electrum.org/#download

P.S. For the first time I update my electrum wallet twice in a day, lol

[1714965444]

1714965444

[1714965444]

1714965444

[dkbit98]

Update again...
Electrum developers are very active this month and we have four updates in December with potential to see them more.
I can't remember when something like this happening before, but it is good they are working and fixing the bugs.
I would wait some time before updating to latest version.

[pooya87]

Update again...
Electrum developers are very active this month and we have four updates in December with potential to see them more.
I can't remember when something like this happening before, but it is good they are working and fixing the bugs.
I would wait some time before updating to latest version.

They have always been very active, you can check the github repository's pulse every month or the commit history to see all that activity. It's just that they are releasing more versions this month because of the bugs that appear to be affecting Lightning Network usage and have to be fixed.

[NotATether]

I usually verify Electrum checksums before using a new version, but today when I intended to update to 4.0.9, I noticed that all of the downloads on electrum.org have signatures that look like this:

https://download.electrum.org/4.0.9/Electrum-4.0.9.tar.gz.asc

Code:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEZpTY3nvo7lYxvtlQK9WCS3+UcOYFAl/c/ekACgkQK9WCS3+U
cOYUfQ/6AyZb7yHqVGQxyaKoxYdiGZuWUu9S2Hb3/TU1wb7MOsJenpYeI+3wTZDf
8EhiqsU/l6dMR16vLoQ9ZwJqYkkzQsTxr4qLwFz7uR3zmDu+d0FyVu7ZPD/ppXNl
YFZAxcM+BkwIkF3lMlYqffSggqReRtZ1QmS3Ae4dbm12O6FXuTDD2YDjLAjLCw9w
iXC3S/1/IeDBOsrw1gp4YHaRyzMWqDddrgS/vQtS21oJYKkcwZKIzI5uI7tu2ccE
iBwsULaoKkpbZODKiUcJAmWBsv3lcxSdEVT1QxWlmbprGaMOo/NDtDk3lcrED2LA
AnchmQQ+3381d5x7v7Az24+dk1Xyw7C2mgokkp6FE25tTRSHXmylWlcp1tVVQ/xB
Q+NGJ5au+50kqCuu8mq6I6yY01qpKQiM7IE4cHrFAAkckdd2RfVgR4Awvzvjs82D
MXUvMB0GVnzzZ9/MJDeO09kNKLLV1t0tb+ZeNUD8N6gWc7d4qHFsJwXfjixg2WwT
/r1hNpzEGmwtYlqCTGwTq1fdxlgtskzSI9Rshj8flRTJumnqMz+GzO5CrFBwNcGu
IFPeZ19/pfVx0+lJw7SdNTC4kWex1JtnRFB8fChzn+aXgrjXqH4qMPyedBAEhnsZ
FYkdJcguk310dJniuoq+aVBCSMG9c0Tz5zpTMK/fkAE8L3tW6vs=
=1K4Z
-----END PGP SIGNATURE-----

This is a valid signature from ThomasV, but where is the checksum data? Usually it's at the beginning of the signature in the message data. How am I supposed to verify that the Electrum download isn't compromised without a checksum?

[pooya87]

I usually verify Electrum checksums before using a new version,

I don't remember Electrum ever releasing checksum of their releases and the reason has always been to prevent people from relying on checksum for authenticity checks. The signature verification does a much better job compared to checksum already.

[NotATether]

I usually verify Electrum checksums before using a new version,

I don't remember Electrum ever releasing checksum of their releases and the reason has always been to prevent people from relying on checksum for authenticity checks. The signature verification does a much better job compared to checksum already.

The problem now is how am I supposed to use this to verify this particular download, since merely any signed PGP message by ThomasV with nothing else in it doesn't guarantee the authenticity of what I just downloaded. 

[Husna QA]

The problem now is how am I supposed to use this to verify this particular download, since merely any signed PGP message by ThomasV with nothing else in it doesn't guarantee the authenticity of what I just downloaded. 

If the file you download matches the Electrum developer's original signature, it will display "Good signature". However, if the Electrum file and Signature do not match, it will say "no signed data".





See also the Electrum developer statement about checksums:

A checksum on the website does add any security. If the website is compromised, so is the checksum. In contrast, a signature cannot be forged.

[NotATether]

~snip

I seem to have gone blank for a second, thinking that only text could be signed with GPG and that for arbitrary bytes you could only encrypt it. So all this time the signatures were being made using GPG's --sign command with the contents of the Electrum binary?

Can this signature be decrypted to output the original file? Something like what I saw over here?

Code:

gpg --sign gpg.docx
gpg --output gpg.docx --decrypt gpg.docx.gpg

Edit: one more thing, does this verification process depend on the binary being present on disk? If not then what's stopping a bad actor from supplying a bad binary but with the PGP signature for the good binary?

[pooya87]

I seem to have gone blank for a second, thinking that only text could be signed with GPG and that for arbitrary bytes you could only encrypt it. So all this time the signatures were being made using GPG's --sign command with the contents of the Electrum binary?

You can encrypt or sign any arbitrary bytes, the source of those bytes doesn't matter. It can be a text (string) or it could be a small file or a gigantic one line a Linux iso file. In this case the binary file is read as a stream of bytes then passed to the signing algorithm which will then produce a signature.

[clip123]

Hi, when creating new wallet under Choose Seed type

Default option is Segwit but text suggests to pick Legacy.

Which one to pick? and any complications with picking one over the other?

[NotATether]

Hi, when creating new wallet under Choose Seed type

Default option is Segwit but text suggests to pick Legacy.

Which one to pick? and any complications with picking one over the other?

You should always pick Segwit unless you have to receive bitcoins from somebody whose using an exchange that does not support sending to Segwit addresses. Sewgit addresses are the newer address type which have lower transaction fees and by using them, you help push their adoption more.

[clip123]

Hi, when creating new wallet under Choose Seed type

Default option is Segwit but text suggests to pick Legacy.

Which one to pick? and any complications with picking one over the other?

You should always pick Segwit unless you have to receive bitcoins from somebody whose using an exchange that does not support sending to Segwit addresses. Sewgit addresses are the newer address type which have lower transaction fees and by using them, you help push their adoption more.

Thank you will do

[pooya87]

~ unless you have to receive bitcoins from somebody whose using an exchange that does not support sending to Segwit addresses.~

Keep in mind that if any service exists that doesn't support SegWit transactions it means that the said service has not updated their infrastructure for 3.5 years and it is wise not to use such incompetent services because they definitely haven't updated a lot of other things including their security.

[acroman08]

just a question regarding updating electrum and I'm still not entirely familiar with electrum. do I have to uninstall my electrum every time there is an update or there a way to update it without deleting electrum from my computer? I tried updating it using the link provided inside the wallet but while updating an error occurred and told me to either abort, retry or ignore. after clicking abort my electrum won't open so I decided to just uninstall it then installing the latest version. again, is there a better way of updating electrum other than uninstalling and stalling it again? TIA!

[Rath_]

do I have to uninstall my electrum every time there is an update or there a way to update it without deleting electrum from my computer? I tried updating it using the link provided inside the wallet but while updating an error occurred and told me to either abort, retry or ignore. after clicking abort my electrum won't open so I decided to just uninstall it then installing the latest version.

No, you don't have to uninstall it. Did you make sure to close the Electrum before proceeding with the update? You won't be able to update it if it is running in the background.

[bL4nkcode]

just a question regarding updating electrum and I'm still not entirely familiar with electrum. do I have to uninstall my electrum every time there is an update or there a way to update it without deleting electrum from my computer? I tried updating it using the link provided inside the wallet but while updating an error occurred and told me to either abort, retry or ignore. after clicking abort my electrum won't open so I decided to just uninstall it then installing the latest version. again, is there a better way of updating electrum other than uninstalling and stalling it again? TIA!

I experienced what you did before I forgot what version it is but the error is normal imo.

What you can do is uninstall and install it again like what you did. But the recommended thing to do is have at least a backup of your wallets inside the wallet folder of electrum or your recovery seed before uninstalling electrum since the entire electrum folder will be removed in the process. Also, verify the electrum software before installing it like what others repeatedly suggests.

[Rath_]

[...] at least a backup of your wallets inside the wallet folder of electrum or your recovery seed before uninstalling electrum since the entire electrum folder will be removed in the process

The data directory ("%APPDATA%\Electrum") is left intact when Electrum is being uninstalled. It never hurts to have an extra backup, though.

[bL4nkcode]

[...] at least a backup of your wallets inside the wallet folder of electrum or your recovery seed before uninstalling electrum since the entire electrum folder will be removed in the process

The data directory ("%APPDATA%\Electrum") is left intact when Electrum is being uninstalled. It never hurts to have an extra backup, though.

Oh, good thing if it's the case, I usually do it for extra extra backup just in case though.

[acroman08]

No, you don't have to uninstall it. Did you make sure to close the Electrum before proceeding with the update? You won't be able to update it if it is running in the background.

thanks for answering. I see I did leave my electrum running while updating. this info helps a lot.

I experienced what you did before I forgot what version it is but the error is normal imo.

What you can do is uninstall and install it again like what you did. But the recommended thing to do is have at least a backup of your wallets inside the wallet folder of electrum or your recovery seed before uninstalling electrum since the entire electrum folder will be removed in the process. Also, verify the electrum software before installing it like what others repeatedly suggests.

I did some necessary precaution(but not what you mentioned) to make it is safe before uninstalling and installing electrum. thanks for telling me.

[clip123]

just a question regarding updating electrum and I'm still not entirely familiar with electrum. do I have to uninstall my electrum every time there is an update or there a way to update it without deleting electrum from my computer? I tried updating it using the link provided inside the wallet but while updating an error occurred and told me to either abort, retry or ignore. after clicking abort my electrum won't open so I decided to just uninstall it then installing the latest version. again, is there a better way of updating electrum other than uninstalling and stalling it again? TIA!

I would not recommend updating from the app itself as there was a malware version pushed (it is noted on electrum.org as well).
Always download from electrum then verify signature and then update it from verified version.

Warning: Electrum versions older than 3.3.4 are susceptible to phishing. Do not download Electrum from another source than electrum.org, and learn to verify GPG signatures.

Edit: Please make sure to Always backup wallet/keys.