Morning Jabulon.
Thanks for taking the time to post. You're concern is a valid one and is something that it's really hard to overcome from my point of view. Apologies in advance for rambling, I had a few thoughts that I needed to put down.
Producing private keys for Bitcoin and other alt-coins is something that should be done with great care and suspicion should rightly fall on anyone who claims to handle that process for you.
As someone who has produced software which handles the creation of private keys, this has been a bit of a tricky point. People in the Bitcoin and other Alt-coin communities are very nervous and ready to label a project as a scam. Understandably so as there have been a lot of scams.
My way around this has been to be as open and truthful as I can.
I have considered paying for code reviews or holding bug bounties but haven't for two reasons.
1) I don't have the capitol to pay for them (the tools I produce are free and I got to the Bitcoin party a little later than I should have),
2) I'm not sure that having a different internet persona say that the code is OK would actually make anyone believe it more than they already do.
As for Bippy, the code is based very closely on my other tool
inuit which in turn is based on several other open source tools (see the thanks page on the linked website for a full list).
Bippy has been used a fair amount while just being used from source. Feedback from users indicated that the biggest hurdle to using Bippy was the difficulty in running it from code. That is the reason that a Windows installer was developed.
As for the executable. The installer itself is built using
AutoHotKey as it produces quick and easy GUIs for windows. An Executable built with AHK isn't a true exe. If you open the Bippy_Installer.exe file in notepad and scroll to the bottom you will see the raw code, viewable as AHK, that makes up the installer. (the code above that that isn't humanly readable is a copy of the AHK interpreter used to run the code. exactly the same as installing AHK on your PC and then running the installer script). If you like, you can read that AHK code to see exactly what the installer is doing on your machine (copying the Bippy code to the Program files/Bippy directory, setting up shortcuts on desktop and start menu and that's about it)
To build the Bippy Executable I used
pyinstaller. The settings I used mean that the full code is viewable in the Program files directory rather than coming as a single, compiled executable. There is still some compiled code in there but it is the minimum I could get away with and still have a functioning installer and executable Bippy.
Really there is only so much I can do. The fact remains that Bippy is a load of code which, without diving into yourself and understanding fully, could do anything. You have my assurances that it doesn't do anything other than the advertised features. There's no hidden database, it doesn't request or need any internet connection, it doesn't store anything in any sort of cache for later use (something possible in browsers). Once Bippy is shutdown it is shutdown.
I have worked closely with Nico from Woodwallets both during the creation of Bippy and since and he will, I'm sure, lend his assurance that Bippy is safe.
The end decision is yours though. The Windows installer makes the process nice and easy but could contain something malicious where as running from source is safer but requires more work (the amount of work isn't huge if that's any help). If you are really worried about the security of the Installer, you could always run it in a Single Use Virtual Machine, in something like VirtualBox or Docker. There's a bit of work to get those working too though. (I have considered creating Docker Images to make things easier but, as it's me doing it, the same uncertainty would remain for any end user).
I hope that my continued presence here and on other forums and my reachability as well as my understanding of the quandary you find yourself in counts somewhat in my favour. I put a large amount of time and effort into both inuit and Bippy and the best compliment for me is to hear that people are using them and finding them useful.
(Just to cloud the argument even more, Nico is offering every WoodWallet product at 50% off today for Bitcoin Black Friday. sorry, I just had to put that out there)
TL;DR - As I'm the creator of Bippy, there's not much I can say to assure you that the software is safe. I have done what I can but the final decision remains with you.
In my opinion. the safest way to use Bippy if you are worried would be to run up a Docker container using Ubuntu. Install Python, Kivy and the Bippy source code and run it from there with your internet connection turned off (you will need to forward X from Docker to view the UI). After that, destroy the Docker container.
