Verifying Bitcoin Core Download

[Slot Kid]

Do you guys always verify the download when you update to the latest version?

I’ve been using Core as my main wallet since 2013, I am not a big tech expert. I really hate upgrading my version because I don’t feel comfortable doing it.

I have a question, when downloading from www.bitcoincore.org has anybody ever had funds compromised by being unlucky enough to download a compromised or maliciously altered version? I’m pretty sure this has never happened from an official source like www.bitcoincore.org

I know dumb people get phished but I’m talking about bitcoincore.org
There has never been a rogue software here, no?

I know how to right click the download file & check the digital signature @ Bitcoin Core Code Signing Association.
I can’t verify hashes with other programs etc, that’s beyond my capability.

My reason for this thread is taproot, I am still running 0.17.0 because I hate updating. Other question, if I just kept running 0.17.0 are my funds safe once taproot activates & will I be negatively impacted by staying on an older version?



Edit: Just to confirm my computer is 100% clean & free of malware. It is used for nothing other than Bitcoin Core Wallet.

[1714624712]

1714624712

[1714624712]

1714624712

[1714624712]

1714624712

[1714624712]

1714624712

[BitMaxz]

If 0.17.0 is running fine without issue then you can just ignore it updating to the latest version but the problem is there are new features added on the latest version.

About verifying actually I'm having an issue verifying the latest version of Bitcoin core but it's always recommended to verify them before you install and it's for your wallet safe.

I just want to suggest if you are going to upgrade always do make a backup copy of your wallet file before you install the latest version.

[ranochigo]

It's fine to stay on older versions but I make it a point to be as updated as possible. There are miscellaneous fixes included in every release, and more prominent changes in some of them.

The problem with downloading and verifying from the same site is that you run in the risk of having the website being compromised. Bitcoin.org was just compromised recently, for a short while and more damages could've been done. Digital signing on Windows has been bypassed with signed certificate in the past, for certain phishing campaigns and it is no doubt possible to do so. It is probably the best practice to take sometime to learn how to do so with PGP, and import the appropriate keys after proper verification.

It is not really beyond anyone's capability, it does take a bit more time for the peace of mind.

[hugeblack]

Unless there is a necessary vulnerability that requires an update, check for updates here and if you don't find a compelling reason to update^[1], you shouldn't.
most of this update are bug fixes and performance improvements.

You can subscribe to updates here^[2] and follow the forums from time to time. If there is a necessary update, you will know that.

[1] https://bitcoincore.org/en/releases/22.0/
[2] https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-core-dev

[Pmalek]

I have a question, when downloading from www.bitcoincore.org has anybody ever had funds compromised by being unlucky enough to download a compromised or maliciously altered version? I’m pretty sure this has never happened from an official source like www.bitcoincore.org

Doesn't really matter what happened in the past. How would you feel losing your coins tomorrow because you couldn't bother taking 2 minutes out of your time to verify the authenticity of the software you are using? It wouldn't change a thing if you were the first person that happened to or the millionth. 

...will I be negatively impacted by staying on an older version?

There is a reason that upgrades are issued for computer software. Bug fixes, stability and performance increases, the introduction of new features, code modifications, vulnerability fixes, etc.