WalletScrutiny turned 6!
We've come a long way over the years. In the beginning, we only looked into Android wallets - 40 of them - and now we've grown to more than 6000 products across many platforms. Your favorite hardware wallet? We got you covered. Desktop? Probably, too. And desktop is a lot of work as here we found many open source and reproducible products!
We’ve been busy but quiet these last months. nostr:npub1qw6sxmwrmwpxqsc8cxty62ujvst6j8pmz8hhtwnv54gpn6dh5c4qms4882 improved the site a lot by adding new features around #nostr based build verifications.
We hope other projects in the nostr ecosystem like nostr:npub1wf4pufsucer5va8g9p0rj5dnhvfeh6d8w0g6eayaep5dhps6rsgs43dgh9 nostr:npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8 will see the value of these verifications and start integrating them. The more products that build on reproducibility, the more users can truly apply the principle of “Don’t trust - verify.” Binary transparency shouldn’t remain a niche feature - it needs to become the default.
If you run software that touches your private keys - be it nostr clients or bitcoin wallets - without binary transparency, only whoever built the binary really knows what code you’re running.
nostr:npub1r709glp0xx2zvgac45wswufjst5xgr7cear5a8me7x9vazhjzmksp2sf7d and nostr:npub1vf6wyw9j38sm96vwfekwvqxucr9jutqrmwdc2qnql79a66al9fzsuvt9ys checked the reproducibility of almost 300 binaries. The 304 verifications by nostr:nprofile1qqspdzm69nvthys9c06hfhj5qcrddaxyvutu29j0gumnlhxw9wwdxdgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds0h54vv are all the old verifications we had migrated to nostr. And the backlog keeps growing as we cover more and more products with frequent updates.
Are we doing something valuable for the space? A nostr:npub1spralxq6jlw5rdy0249vqr5sh43rfrlx2wzv3rhjjqedw559w9psrs8s72 grant says yes, and community endorsements confirm it - but the project itself also needs scrutiny.
We recently introduced "verification endorsements":
This is a simple contribution many could provide. If you read a verification and it looked plausible and complete and you trust the author, mark the verification as verified. If you ran the documented commands yourself on your hardware and got to similar results, please endorse the verification!
Even more importantly label verifications as invalid and leave a comment about what's missing when you find issues! Don't be shy!
Our goal is to document all steps such that all mildly technical users (you should be comfortable with a Linux shell) can reproduce our findings. If that's not the case, please provide your feedback and we will improve ✋.
And if you maintain one of the products we check, share your own verification as a template for others!
nostr:nprofile1qythwumn8ghj7un9d3shjtnswf5k6ctv9ehx2ap0qythwumn8ghj7un9d3shjtnwdaehgu3wvfskuep0qyv8wumn8ghj7mn0wd68ytnxd46zuamf0ghxy6t69uqzpyaap3hnejawguugkqdvdnst9sqnz9xu5nqg6m38zt207u2qtg7rndtyguDesktop app v2.7.0 recently released and we at
nostr:nprofile1qyv8wumn8ghj7un9d3shjtnsd3jkyum5wghxxmmd9uq32amnwvaz7tmwdaehgu3wdau8gu3wv3jhvtcpr4mhxue69uhkummnw3ezucnfw33k76twv4ezuum0vd5kzmp0qqsfzm94lura8dguaalkk6ml23umzqqmgqwqaqj43ms6yfgycl2s0jg6ywxp5 have, in earnest started testing for reproducibility. On that, may we request that the build documentation is updated - some parts are-but not for the reproducible builds part
https://pbs.twimg.com/media/G0C2tzybUAA1Sxa?format=png&name=900x900
https://pbs.twimg.com/media/G0C2Wi4awAEKHZx?format=jpg&name=large
The ByBit Hack Report [1] reveals interesting details.
While many blame ETH and its complexities, it's important to note that a combination of circumstances made this attack possible.
But the core issue clearly was a central point of failure. Multi Signature was used but all signers used the same hacked, remote server.
The server was trusted, supposedly running a well audited open source web wallet software but "open source" is not enough as the source run on that compromised server did not match the well audited code.
At WalletScrutiny we so far do not list web wallets because it is hard if not impossible to attest to the integrity of web wallet code when the server can serve different code every other second or depending on your IP address.
We are investigating options to list progressive web apps that give the user more control of what is being run. While standard PWA manifests primarily contain metadata, a security-focused implementation could leverage several mechanisms to establish stronger integrity guarantees:
Extending manifest files with cryptographic commitments to all resources
Implementing Subresource Integrity (SRI) checks to verify each script matches expected hashes
Using a trust-on-first-use (TOFU) signature model where developer keys are stored after initial verification
Creating transparent, user-controlled update processes that display cryptographic verification before applying changes
Such an approach would significantly reduce trust requirements in the server after initial installation, as the PWA could verify the integrity of updates against developer signatures before execution. Static analysis could also differentiate between PWAs with secure update mechanisms versus those with silent automatic updates.
While not eliminating all risks, this model would provide a more verifiable path than traditional web wallets, potentially bringing them closer to the verification standards we apply to other wallet types.
As described above. We will open up to more people attesting to the reproducibility of binaries and wonder what to call them. Are they attestators? Verifiers would be a more common word and also fit. Wittness would be even more common but sound somebody who only looks but doesn't do the heavy work of actually reproducing anything.
English speakers please help us out here ...
We are close to launching "attestations" where anybody will be able to attest to the reproducibility of binaries. The process is technical and quite involved. Are those who do this ...
* Attestators
* Wittnesses
* Verifiers
* Certifiers
#askNostr
Question for people who looked at individual reviews on http://WalletScrutiny.com: Should we remove the individual coloring of pages based on the product's logo?
Please comment below or vote on Xitter https://x.com/WalletScrutiny/status/1857181765762531729
Today we welcome nostr:npub1qw6sxmwrmwpxqsc8cxty62ujvst6j8pmz8hhtwnv54gpn6dh5c4qms4882 as our new lead developer! He brings a lot of experience not only with Bitcoin and nostr but even was involved with two reproducible wallet builds already years ago besides many other bitcoin tools he contributed to.
Yes, we are paying up to $8k/month for #FOSS development. Others pay for FOSS development, too. Your lack of appreciation for FOSS shows, so you might just not be the right guy for the job.
So far, 11 applied. 3 look like a good fit. We will see ...
Our hope is to find a long term contributor.
As WalletScrutiny is a donations based project, funding can get tricky but the more progress we show, the easier it should get to find donors or grants. Therefore we want to hire somebody who can make considerable progress fast and who as a dev lead can also prioritize for impact, to not lose time on fringe, irrelevant details.
So in a sense, if the hire is worth a grant, he will stay around for longer.
How do we get the attention of job seaking shadowy super-coders that would accept a modest payment (modest for super-coders) for being able to work for us?
* nostr
* bitcoin
* bitcoin only (no shitcoin)
* FOSS
* remote
#jobstr #jobs #bitcoin #bitvocation
At least some 300,000 machines reachable on the internet are vulnerable to a remote code execution vulnerability that appears to be rather easy to execute on all of those.
The vulnerable package is cups-browsed - a tool for printing - which does get installed by default on many desktop linux systems but who knows ... maybe you are running some media server with your bitcoin wallet and your printer reachable via the same RaspberryPi?
Check your machines. Android appears not to run cups but if you run Linux or Mac, you might want to double-check if you're one of the lucky 300,000 that get to update their system **now**.
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
At WalletScrutiny.com, we track 4574 apps on Google Play. 2956 of those are not on Google Play anymore. Can that be right?
The Apple App Store "only" shows 550 of 1291 apps as removed.
Either way, especially if you found a cool new wallet, assume the fun will not last.
Funding is actually looking pretty good right now for achieving this tiny selection within months. If you want to help with funding to further expand our scope, donations are always welcome.
As for priorities with the many desktop wallets, we have not decided which ones to test first. Obviously Bitcoin Core is being tested intensely by others already but if you have ideas on how to prioritize desktop wallets, let us know. There is no easy popularity heuristic to go by. Google search results? Self reported downloads? Stars on GitHub? ... It's all sort of flawed.
We have long been working on testing desktop wallets but it's really tricky as there is just so many binaries floating around for what claims to be the same product. Even Bitcoin Core is showing 8 download options depending on your operating system or distribution channel preference:
With snapcraft obviously being tricky:
Either way, for desktop wallets, most of the time people have download links and want to verify those downloads, so Chris is working on a binary checker. It's still only a draft merge request and clearly needs a design but what it will enable is actually pretty cool:
https://a.nostr.build/DMmxAOaKtPYpb3M7.webm
WalletScrutiny calculates the hash of the file dropped onto it and if it's an apk, it also determines the appId which allows finding the right product. If the hash is known, the verdict is immediately displayed. If not, the page invites the user to upload the file for analysis.
The attestations for artifacts will live on nostr as signed events and nostr will also be used to advertise the existance of new binaries for reviewers.
The designs look repetitive but the chosen materials appear to not always be clearly advertised. Maybe educated guesses are good enough if people ask about any particular new device.
Not all metal backups are made equally. If you use metal to not have to also worry about your bitcoins when your house is on fire, don't use this product:
But running these tests must have been great fun, right nostr:npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp?
If we add these backup solutions to our website, we would certainly heavily lean on Jameson Lopp's work as a hydrolic press and acids isn't what we had planned to play around with ourselves for now.
Jameson are you planning to test more products any soon? Adding "backup tools" to WalletScrutiny might get excessive if we don't draw lines like you did. If it's not at least claiming to be heat resistant, we won't bother to list it or else we end up listing a million different ways to print on paper.
Stay safe! Hope it all turns out well.
Some fan art ✨ 🎶 🎶
Which one do you like best?
https://audio.nostr.build/79aad81cea8141b3fe4ec5d08319735be46420e04f45910453cf3a035ea706e4.mp3
https://audio.nostr.build/1392672adb8cb2f5752cc3241c2d38811ace25b8f5e498801a54918db243a235.mp3
https://audio.nostr.build/569718137b9d20b8c91cbc086179e7b7aab39d6c5e824294fe7324aa092584c2.mp3
https://audio.nostr.build/ec043e98cc163270ca4a66c3b3c46fe5da0695e7cb3a814e76678724a4d49e51.mp3
https://audio.nostr.build/d76cf4c1a3f59f5645a92c1a5126220468939f6ec3001ea9704718d056981541.mp3
https://audio.nostr.build/c09400bb09c8f4b894b88ff078ce28a0c15578c30b508a552f5b3c08dc4a9d41.mp3
https://audio.nostr.build/640d0512152b5edea6458e9196c108ebf32a864694ece156a1c85d36042dfb49.mp3
https://audio.nostr.build/42ddfde0e3ba5bd055d98f79fce2c7de757a4c774cddde5da1d91caf6c72e945.mp3