Partially open source is not the same as fully open source

[YellowSwap]

There is no other crypto wallet thread that's as informative as this, I learnt a lot and if you are just starting out trying to find the best crypto wallet to use and trust, look no further.

https://bitcointalk.org/index.php?topic=5288971.msg55583288#msg55583288

If your favourite crypto wallet is not on this list then it's not fully open source, someone sent me a PM on this forum asking what the best open source wallet is and I sent them this link, but after few days they came back to ask why Tangem wallet isn't on the list yet.

He said the person who created the thread needs to update it, well if you don't know, I am seeing that Tangem wallet is getting more interesting in the eye of many beginners, but Tangem isn't a fully open source wallet.

Tangem wallet is partially open source, yes the mobile app is fully open source and available on GitHub, however the firmware on the physical Tangem card is closed source, it's protected under a non-disclosure agreement to prevent cloning.

The closed source nature of the firmware means that users have to trust the company and the audit result, and which is why I can't recommend Tangem wallet to anyone.

I am not trying to make Tangem wallet look bad, I am here to share the knowledge, knowing the difference between open source, partially open source and closed source wallet can be a bit tricky at times.

Make sure you always do strong research before making the decision to purchase a hardware wallet, understand what you are getting atleast.

[KingsDen]

Tangem wallet is partially open source, yes the mobile app is fully open source and available on GitHub, however the firmware on the physical Tangem card is closed source, it's protected under a non-disclosure agreement to prevent cloning.

You quite stated the reason Tangem isn't fully open source, i.e to prevent cloning the firmware.
So, is there any recommendations that will allow them keep everything open without being cloned?

We are actually not blind to the greatest weakness of open source. You can't survive if you are not ready to give out everything.

[Mia Chloe]

~snip

It depends on the wallet. A software like cake wallet is open source but the swap area is closed source. The catch is more like a profit residing problem. Open source comes with a lot of sacrifices including allowing your code to be public which simply means you make no direct profit which is why most of them depend solely on donations.

We are actually not blind to the greatest weakness of open source. You can't survive if you are not ready to give out everything.

This is not true. It's just a profit choice. You'll only be concerned about your firmware and back end if you have a couple things set up for profit else there's no major danger.

[adultcrypto]

Tangem wallet is partially open source, yes the mobile app is fully open source and available on GitHub, however the firmware on the physical Tangem card is closed source, it's protected under a non-disclosure agreement to prevent cloning.

We are actually not blind to the greatest weakness of open source. You can't survive if you are not ready to give out everything.

Is this a mistake? Your statement should be right for closed source and not open source. From what I know,  open source is the way to go as it offer better security than closed source, I don't know of the challenges you are referring to which is why I want to learn them from you unless it's a typographic error from you. Being close source is the main problem of Trustwallet which is why Electrum that is open source is preferred.

[KingsDen]

Tangem wallet is partially open source, yes the mobile app is fully open source and available on GitHub, however the firmware on the physical Tangem card is closed source, it's protected under a non-disclosure agreement to prevent cloning.

We are actually not blind to the greatest weakness of open source. You can't survive if you are not ready to give out everything.

Is this a mistake? Your statement should be right for closed source and not open source. From what I know,  open source is the way to go as it offer better security than closed source, I don't know of the challenges you are referring to which is why I want to learn them from you unless it's a typographic error from you. Being close source is the main problem of Trustwallet which is why Electrum that is open source is preferred.

It is actually not a mistake. Let me explain what I meant;
For the case of Trustwallet you cited above, the reason they stopped being an open source according to them is to prevent malicious actors from cloning the wallet code to create fake apps or browser extensions to scam users.

Now, Tangem's reason for not being 100% open source is this..."however the firmware on the physical Tangem card is closed source, it's protected under a non-disclosure agreement to prevent cloning"

Is this reason not good enough? Just asking...
Anyways, I am not in any way supporting a closed source protocol. Just saying if it can be open source and also be a restriction ito unauthorized cloning, which is not possible.

[nakamura12]

It is actually not a mistake. Let me explain what I meant;
For the case of Trustwallet you cited above, the reason they stopped being an open source according to them is to prevent malicious actors from cloning the wallet code to create fake apps or browser extensions to scam users.

Even if they are close source is that their browser extension still got compromised. In my opinion, it's still useless if their service got compromised and made lots of people lose their funds using the browser extension even if they didn't make their wallet open source or even partially open source. I guess it's the reason why many people not prefer using open source wallet than using open source wallet like electrum and other open source wallets.

[BlackBoss_]

If your favourite crypto wallet is not on this list then it's not fully open source

A half of truth is no longer the truth, and a not-fully open-source wallet is no longer an open-source wallet.
There are only two opposite wallet types in their source code aspect: open-source or close-source. There is nothing in between and any wallet in between should be considered as close-source.

someone sent me a PM on this forum asking what the best open source wallet is

Make sure you always do strong research before making the decision to purchase a hardware wallet, understand what you are getting atleast.

Hardware wallets are best to use but only if the users pick open-source and good hardware wallets, then buy these wallets and use them rightly.
[url=https://bitcointalk.org/index.php?topic=5288971.0][LIST] Open source hardware wallets.
[GUIDE] How to buy a Hardware Wallet the right way.
walletscrutiny.com for checking whether a wallet is truly open-source and secure.

[FinneysTrueVision]

This reminds me of a meme posted by Trezor underneath one of Ledger’s replies. Ledger has always been misleading about the openness of their software. They have an article on their website where they say Ledger Wallet code is completely open source. This is the part that shows up in search engine descriptions, but if you read the whole article they actually admit that they are not fully open source.


https://x.com/Trezor/status/1981648021231222983

[Porfirii]

This reminds me of a meme posted by Trezor underneath one of Ledger’s replies. Ledger has always been misleading about the openness of their software. They have an article on their website where they say Ledger Wallet code is completely open source. This is the part that shows up in search engine descriptions, but if you read the whole article they actually admit that they are not fully open source.


https://x.com/Trezor/status/1981648021231222983

It's a real pity that when I started in crypto it seemed that there were only two options: Trezor or Ledger, and that it seemed that the two were the same, when over time it has been proven that they are not, from what you say, without taking into account other problems such as customer data leaks. Even here in bitcointalk Ledger was recommended by many users as the best alternative, or for tastes, and the number of users who will have bought one of their devices thinking that it was the best option on the market must be very high.

I bought a Ledger Blue back then, as an expensive whim, because the price was high but it was supposed to be worth it. I was annoyed that they suddenly stopped providing support for LB and had to switch to a different provider, although in hindsight it was the best.

[hd49728]

This reminds me of a meme posted by Trezor underneath one of Ledger’s replies. Ledger has always been misleading about the openness of their software. They have an article on their website where they say Ledger Wallet code is completely open source. This is the part that shows up in search engine descriptions, but if you read the whole article they actually admit that they are not fully open source.


https://x.com/Trezor/status/1981648021231222983

The meme is funny but practically for security question, people can check and know a (hardware) wallet is either open source or close source. Check open source (reproducibility) of Ledger and Trezor hardware wallets.

You can easily see opposite difference between Trezor and Ledger. Trezor is reviewed as open source (Source available) while Ledger is close source (No source!).
https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=trezor
https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=ledger

[dkbit98]

He said the person who created the thread needs to update it, well if you don't know, I am seeing that Tangem wallet is getting more interesting in the eye of many beginners, but Tangem isn't a fully open source wallet.

That is my thread and I am updating it with new wallets and updates, but I certainly won't add crap like tangem wallet.
I am supporting only hardware wallets that have fully open source firmware, not partially or view only code.
Satochip card is much better alternative for Tangem wallet, it's open source and it can be combined with Seedsigner device.

[EluguHcman]

It is actually not a mistake. Let me explain what I meant;
For the case of Trustwallet you cited above, the reason they stopped being an open source according to them is to prevent malicious actors from cloning the wallet code to create fake apps or browser extensions to scam users.

Even if they are close source is that their browser extension still got compromised. In my opinion, it's still useless if their service got compromised and made lots of people lose their funds using the browser extension even if they didn't make their wallet open source or even partially open source. I guess it's the reason why many people not prefer using open source wallet than using open source wallet like electrum and other open source wallets.

Obviously if they can close their wallet source in avoidance of code cloning in the wallet and admits their site could be vulnerable to be manipulated against malicious scamming attacks, definitely it still outstand unsafe on using the wallet when the extension browser can be compromised.

I am sure users also have the right and would want to test run the Wallets source code to verify legitimacy while closed source would not give the privilege. Moreover we are here talking about self custody for safety purposes so, as Bitcoin open source technology had convinced users safety and privacy, so also reliable wallets should grant users access to any claimed affirmed open source wallet.
I think we should not have to act dumb to developers who are not being transparent.
 
You also can not tell community users that you privatized the wallet code to prevent maliciousness and expects users reliability in a Decentlized network.
I am just being thoughtful as much as I can make my finding.

[tbct_mt2]

Obviously if they can close their wallet source in avoidance of code cloning in the wallet and admits their site could be vulnerable to be manipulated against malicious scamming attacks, definitely it still outstand unsafe on using the wallet when the extension browser can be compromised.

It's can be a reason they use to explain why they keep their wallets as close source but it does not make sense. You can see that best wallets are open source and advice is always towards open source wallets, not close source wallets.

You don't have to use a close source wallet by believing the wallet provider's promise that being close source will make that wallet more secure. Secure or not, it depends on quality of their wallet codes, not whether codes are close source or open source. Hackers know how to do their things while with open source code, a wallet is reproduced by many developers in the community, who can report issues, and help to improve that wallet quality and security.

Open source has its advantage for a wallet quality with contribution for improvement from community while it does not make the wallet more vulnerable to hackers.

[PrivacyG]

You would think that people learn their lesson after what Ledger has done with its own products.  Fully Open Source does not only mean that it is much more Secure for us considering a coder can understand every single piece of how it works.  But it also means if the company behind Trezor disappears, the community can work on a revival of the Software to make sure their Hardware Wallets continue working.  If Ledger goes away I am not sure such a revival could work.

In fact.  You could look up many older Open Source projects that 'died' or whose Developers gave up on and were later revived by the community.  Partially Open Source is only good as long as things work well.  There are no good reasons that make Ledger an overall better choice than Trezor unless you are holding on to Shit Coins.  But then you would already be used to disappearing stuff any way.

[hugeblack]

Even open-source wallets cannot be considered secure unless they have received sufficient reviews. Therefore, you should look for those who have reviewed the wallet and evaluate their accounts on GitHub.

So, it's all about reviews and who conducted the reviews.

[ABCbits]

Being close source is the main problem of Trustwallet which is why Electrum that is open source is preferred.

Related with this thread topic, Trust Wallet actually open few part of their code. For example, they released "Core" aspect of their wallet on https://github.com/trustwallet/wallet-core. But for people who want to audit Trust Wallet itself, AFAIK it's not really different from auditing closed source app.

--snip--
Is this reason not good enough? Just asking...
Anyways, I am not in any way supporting a closed source protocol. Just saying if it can be open source and also be a restriction ito unauthorized cloning, which is not possible.

FWIW scammer and hacker could re-create fake app with very similar UI with some effort and resource. In addition, AI these days also used to write code and create UI, so it's become easier to create fake app.

[NotATether]

Being close source is the main problem of Trustwallet which is why Electrum that is open source is preferred.

Related with this thread topic, Trust Wallet actually open few part of their code. For example, they released "Core" aspect of their wallet on https://github.com/trustwallet/wallet-core. But for people who want to audit Trust Wallet itself, AFAIK it's not really different from auditing closed source app.

Not good enough, as oodles of people still managed to get scammed and rug-pulled from a fake Trust Wallet extension recently.


I would argue that the firmware being closed-source is not really anything to worry about unless people have demonstrated vulnerabilities that can be executed against it and posted it on Youtube or something. You generally need physical access to a hardware wallet to break into it.

[hd49728]

You would think that people learn their lesson after what Ledger has done with its own products.  Fully Open Source does not only mean that it is much more Secure for us considering a coder can understand every single piece of how it works.  But it also means if the company behind Trezor disappears, the community can work on a revival of the Software to make sure their Hardware Wallets continue working.  If Ledger goes away I am not sure such a revival could work.

In fact.  You could look up many older Open Source projects that 'died' or whose Developers gave up on and were later revived by the community.  Partially Open Source is only good as long as things work well.  There are no good reasons that make Ledger an overall better choice than Trezor unless you are holding on to Shit Coins.  But then you would already be used to disappearing stuff any way.

Open source or partially open source does not mean high quality and super security but with available codes for checking, it's more easily for developer community to detect any bugs, security holes or backdoors in a wallet.

With close source wallet, it does not mean it is bad in security but users have to fully trust that company and developers. It's worse if close source is used by scammers as reasons to hide their scam from developer community, and it makes their scams more easily to succeed. High quality companies can build up good wallets but close source, while scammers will surely do their scams and use close source as one of masking layers for their scam plans.

[Aanuoluwatofunmi]

We need to clearly understand the difference between a closed source and open source non custodial wallet, also, i have seen some exchanges claiming that they are non custodial wallet and so on, developers have their own way of verifying for all these, and also in determining whether a wallet is closed source or open source code, because some of these wallet can lie on what they are not, except we know how to verify on their claims.

[dzungmobile]

We need to clearly understand the difference between a closed source and open source non custodial wallet, also, i have seen some exchanges claiming that they are non custodial wallet and so on, developers have their own way of verifying for all these, and also in determining whether a wallet is closed source or open source code, because some of these wallet can lie on what they are not, except we know how to verify on their claims.

You talked about wallets built by centralized exchanges and their web3 wallets are close source. Binance did not build Trust wallet from scratch but they acquired Trust wallet several years ago, and with or without Binance, Trust wallet so far has never been an open source wallet. Similarly, it's almost impossible to have open source web3 wallets from other centralized exchanges. They are big centralized exchanges and you can trust their services from centralized exchanges to Peer to peer marketplaces with KYC, and other products like close source web3 wallets. It's freedom and you can trust them if you want but make sure to know about risk.

Trusting any company and its products can cost you a lot of money of you picked a wrong company and its bad products. New open source wallet is not actually better than a close source wallet with long history and no technical accidents.