GUIDE:Important factors to take into account while choosing a wallet

[Pmalek]

If a wallet is open-source, but you are not sure whether its secure or not, you can make a new topic in this forum and ask people about the wallet. If the code has been reviewed by many people and the no vulnerability has been reported, it's probably secure.

One might say that's not good enough if one is totally paranoid. I don't know anyone on Bitcointalk who has said they check every single line of code, which is understandable since we are talking about thousands of lines of code and more. So the trust switches from a development team to a group of people who have verified maybe 10%, maybe 20%, or 50% of the code.

Don't get me wrong, this is not a say no to open-source argument. It's just an observation that relying on people one way or the other is always dangerous.   

[1714235076]

1714235076

[1714235076]

1714235076

[1714235076]

1714235076

[1714235076]

1714235076

[1714235076]

1714235076

[1714235076]

1714235076

[pooya87]

My question is whether just looking at the availability of features such as open source before looking at other features including the Replace-by-Fee and Sign and verify a message features without paying attention to the authenticity behind the mask of open source is dangerous?

I say when choosing a wallet there are certain red lines that you don't want the project to cross and if it does, you won't choose it. If it doesn't, then you can start thinking about maybe choosing it. In other words you eliminate the undesirables then choose the best option from what remains.
For example if a wallet is closed source, that is a red line so it is not even considered even if it has all the features in the world.

[AprilioMP]

My question is whether just looking at the availability of features such as open source before looking at other features including the Replace-by-Fee and Sign and verify a message features without paying attention to the authenticity behind the mask of open source is dangerous?

If a wallet is open-source, but you are not sure whether its secure or not, you can make a new topic in this forum and ask people about the wallet. If the code has been reviewed by many people and the no vulnerability has been reported, it's probably secure. It's possible that there's a vulnerability that hasn't been discovered yet, but if many people have reviewed the code and the wallet is well-known enough, that's unlikely.

Inspection and testing of code tends to be neglected. Users only view and search for available features. If the wallet is open source and supports several other features, then stop there and decide that the wallet is worth using and will be the wallet that will be used for storing assets.
For me, this is a phenomenon that can have a bad impact other than wallet users who really understand the science of coding and not the right answer leading to a solution.

✂️

I say when choosing a wallet there are certain red lines that you don't want the project to cross and if it does, you won't choose it. If it doesn't, then you can start thinking about maybe choosing it. In other words you eliminate the undesirables then choose the best option from what remains.
For example if a wallet is closed source, that is a red line so it is not even considered even if it has all the features in the world.

Closed source is on my boycott list even though the wallet has a lot of users because it supports all the feature requirements I want even though the wallet is a hardware device that is not close to an internet connection.

I will continue to look for answers on how to prove the authenticity behind the facade of open source displayed other than on tested wallets like Eletrum.

[Pmalek]

Inspection and testing of code tends to be neglected. Users only view and search for available features.

I don't think it's being neglected on purpose, it's just that not many people have the skillset to do it properly or fully. I don't know how to do roofing or plumbing, so I can't bring anything useful to the table. It's the same with verifying the security of a piece of code.

Let's look at compiling an open-source wallet from the source code. I can easily learn how to take the publicly available code and build the wallet from that. I could then follow instructions to check if my binaries match the source code. What does that tell me? It only tells me that the code the developers use in their software and that is publicly available is the same one I used to get identical build results. It doesn't bring me one step closer to understanding it or knowing what it does and how safe it is. And we are back to trusting a wider community that they have done a good job reviewing the code properly. It's always going to be better than having no code available for public scrutiny, but there is always a BUT! 

[Z-tight]

If the wallet is open source and supports several other features, then stop there and decide that the wallet is worth using and will be the wallet that will be used for storing assets.

It may be worth mentioning that you should not stop your research if you find out that the wallet is open source, because open source doesn't mean that the wallet is automatically secure, but it is surely a positive point to use a wallet. There are wallets that lie in their websites that they are open source and even have Github repositories that haven't been updated for a long time, like Trust wallet; some users at first glance may think they are open source, whereas they are a closed source wallet.

It is difficult for most users to verify every line of code of an open source wallet, but at least if you don't have the skill to do it, it is better you use a wallet that has been well reviewed. What i mean is, let's say Wallet A is a new open source wallet and you are to choose between it and Electrum, without verifying any line of code in any of the wallet, choosing Electrum is the most sensible thing to do because you are sure that it has been reviewed by many users in the community.

[taufik123]

It may be worth mentioning that you should not stop your research if you find out that the wallet is open source, because open source doesn't mean that the wallet is automatically secure, but it is surely a positive point to use a wallet. There are wallets that lie in their websites that they are open source and even have Github repositories that haven't been updated for a long time,
-snip-

Open Source is just a sign that the wallet can be developed by anyone and the code can be verified by the community.
But there is no guarantee that Open Source wallets will remain secure.

When the developer of an Open Source Wallet or a new wallet does not get much attention, there are no revisions or fixes for existing bugs, and no feature updates that must keep up with transaction developments.
Therefore, it is necessary to choose an Open Source wallet with a strong community so that updates can continue to be made.

I don't think it's being neglected on purpose, it's just that not many people have the skillset to do it properly or fully. I don't know how to do roofing or plumbing, so I can't bring anything useful to the table. It's the same with verifying the security of a piece of code.
-snip-

As @pmalek said, code testing is not neglected but it is not easy to improve or develop open source wallets without having expertise in wallet programming and so on.
This will be a task for developers who are already experts in the field.

We may only be able to contribute by using the wallet and reporting when some bugs appear.

[apogio]

Open Source is just a sign that the wallet can be developed by anyone and the code can be verified by the community.
But there is no guarantee that Open Source wallets will remain secure.

Yes, absolutely, but it's still better to know what you use than to be absolutely blind as far as the code is concerned. The problem is that some people don't have the technical knowledge to read the code. And that's a big issue because in this case, being open-source is not very different.

[taufik123]

Yes, absolutely, but it's still better to know what you use than to be absolutely blind as far as the code is concerned. The problem is that some people don't have the technical knowledge to read the code. And that's a big issue because in this case, being open-source is not very different.

As I said earlier, Verification of the community and how many people are in the community is very important,
so that those who are completely blind about code will know with the explanation of the developers who are members of the community.

That's why it's important to choose an open-source wallet with an active community and constant updates.
Being Open Source is not much different when users don't know anything and no one is doing the development. 

Electrum is the most recommended Open Source wallet because it has a strong community with ongoing development.

[apogio]

Electrum is the most recommended Open Source wallet because it has a strong community with ongoing development.

No doubt. Sparrow too. I mainly use sparrow to be honest. And yes, your point is correct.

However, the proper question to address here is: should I trust a tiny open source project or a huge closed source one?

To this question I personally go for the open source one most of the times.

[Marvelman]

Electrum is the most recommended Open Source wallet because it has a strong community with ongoing development.

No doubt. Sparrow too. I mainly use sparrow to be honest. And yes, your point is correct.

However, the proper question to address here is: should I trust a tiny open source project or a huge closed source one?

To this question I personally go for the open source one most of the times.

I totally understand you on this one.  It's kind of like trying to decide between some small, homey diner in your neighborhood that everyone raves about, and some huge chain restaurant.  Even though those big places might have a ton more resources and stuff, that definitely doesn't automatically make their food better and  sometimes those little indie open-source deals are like hidden gems - theyve got these hardcore fans backing them and people working on making them better all the time.  How much you trust something is a personal thing for sure but it's cool to see people thinking about more than just how big and famous something is.

[rat03gopoh]

To this question I personally go for the open source one most of the times.

If you can independently verify their code and ensure it is safe, then do it. Trusting tiny companies is also risky because there is little community contribution to verifying their code.

[Pmalek]

The problem is that some people don't have the technical knowledge to read the code.

I want to change what you wrote to make things clearer. Some people (a minority) have the technical knowledge to read and understand code. The majority of everyday users don't possess that skill.

It's kind of like trying to decide between some small, homey diner in your neighborhood that everyone raves about, and some huge chain restaurant.  Even though those big places might have a ton more resources and stuff, that definitely doesn't automatically make their food better and  sometimes those little indie open-source deals are like hidden gems - theyve got these hardcore fans backing them and people working on making them better all the time.

Not in this example. Remember, it's a tiny project, meaning that it's probably relatively unknown with a small team of coders, independent testers and code verifiers, and end-users. 

[Marvelman]

/.../

Not in this example. Remember, it's a tiny project, meaning that it's probably relatively unknown with a small team of coders, independent testers and code verifiers, and end-users. 

I totally get what you're saying. Not all open source stuff is automatically more secure.  A tiny team could mean more personalized attention, but it also sets off alarm bells around potential weaknesses and  compared to the big shots these guys likely don't have the deep pockets for extensive testing and verification. So, the community plays a big role. The bigger the community, the less chance of a security hole. At least in general...

[AprilioMP]

If the wallet is open source and supports several other features, then stop there and decide that the wallet is worth using and will be the wallet that will be used for storing assets.

✂️

It is difficult for most users to verify every line of code of an open source wallet, but at least if you don't have the skill to do it, it is better you use a wallet that has been well reviewed. What i mean is, let's say Wallet A is a new open source wallet and you are to choose between it and Electrum, without verifying any line of code in any of the wallet, choosing Electrum is the most sensible thing to do because you are sure that it has been reviewed by many users in the community.

Yes, right. It takes special skills to test and verify every line of code and I'm one of those people who doesn't have the skills to do that. I mean, using a wallet that has been well reviewed by most users here [not elsewhere] is a logically acceptable choice for me.

I understand what you mean about wallet selection. For example, currently I use Unstoppable and BlueWallet. One of the wallets I mentioned can be connected to Electrum which is the Bitcoin wallet with the best recognition after I have considered it because it has received reviews from great users on the forum.
However, I will decide to create a new address instead of importing the seed phrase from the open source wallet I am currently using.