Replying to Avatar rafael_xmr

so the issue with the samourai code is that it got lost when their servers got taken down, then someone tried to recover part of it and published it as "samourai archive" on github: https://github.com/Archive-Samourai-Wallet/

But the problem is, it is possibly not entirely up do date, we can't tell because there is no official source to compare to, and not everything is present, for example this library called bitcoinj: https://github.com/Samourai-Wallet/bitcoinj is from their old github and hasn't been updated in 6 years, which is when they migrated to their own servers before they got taken down, and this library hasn't been found anywhere since, so the new Samourai fork is using code that is a pre-compiled library instead of a public source that can be built by anyone. So this is a red flag for me, my conspiracy theory is this makes it seem samourai themselves are back building this as if no one would notice that part of the code is missing and they are the only ones that have it locally, but overall it's a red flag until the source of bitcoinj-core is released.

But if you just want to compare the rest of the wallet's code in general to find something sketchy they made it easy by making all of their changes into a single commit, so one could get the first commit in the repo, which is supposed to be "clean samourai", and compare it to the recovered samourai code: https://github.com/Archive-Samourai-Wallet/samourai-wallet-android then if there are zero differences it's a proper fork and you'd have to then check the changes they made in the other commit but people said they are fine so far, some UI work and the config changes to remove samourai servers + switch to ashigaru servers

Rafael, thank you for such a comprehensive and thorough reply!

You provided significantly more help than I expected, in a way that I would not have likely found on my own, and you painted a very clear picture of knowns and unknowns, as well as a method to learn more.

This is a perfect case of how “don’t trust verify” can still be applied and scaled in a technical setting for not-necessarily-technical users.

Thank you. And in the spirit of value-for-value, you have easily earned a hearty zap ⚡️🫂💜🤝

Reply to this note

Please Login to reply.

Discussion

thanks man, yeah I may sound crazy but I've been asking people for answers and still got nothing, so I am just looking to be able to verify as well and spread the knowledge for it and why I think something is missing :heart:

Thank you!!

It totally makes sense that it would be incomplete, and while that could be entirely benign, it could also be problematic. Never hurts to be careful around stuff like this!