10

The single most-trusted canonical source of Bitcoin client is https://github.com/bitcoin/bitcoin

This URL is controlled by a single US company GitHub Inc., headquartered in San Francisco, United States. The US government (nor any other government) is probably not a friend of Bitcoin, and they could theoretically threat the CEOs of GitHub Inc. with an arrest, unless they implement some kind of backdoor into the Bitcoin code, which could be downloaded by a large number of people before it would get noticed.

If and how is the Bitcoin network protected from being poisoned and destroyed this way?

Improve this question
18

You should learn more about the way the git scm system works. First, it is distributed so that everyone has a complete copy of the entire codebase; second, every commit is checksummed, so that if github wanted to (or was forced to) underhandedly change code, it would be detected by everyone.

Improve this answer
8

It's just not a plausible threat model. First, all changes are publicly audited by hundreds of people. Second, releases are signed by the developers.

Third, it wouldn't even do any real damage. Bitcoin once had an overflow bug that did about as much damage as any intentional defect possibly could. The network easily recovered as people identified the bug, distributed fixed clients, and rejected the invalid transactions.

If you're really worried about this, just don't upgrade to any new version until it's been out for at least a week. By that time, any subterfuge would have been discovered by dozens of people and widely reported around the world.

Improve this answer
5

If you follow the advice on this question, you can download the client and verify it's been signed by Jeff Garzik, free from any possible tampering by middle men.

Future client versions are planned to be distributed via other, more p2p-friendly means (the name of the distribution project has slipped my mind right now)

Improve this answer
-3

It does not matter where code is situated. Github may be used just for first time.

Your question is about developers. Anybody who can commit to master branch, can inject malicious code. It will be a little mistake in math, parser, network stack.

It also may be a group of coders, they will try to hide this injection with mass commit to code, with preposition to improve bad places, e.g. improve db size( v0.7 -> v0.8 ).

Behind them may stay a great government's structure, like NSA or FBI, CIA.

Such injection was in OpenBSD project early. One of the developers collaborated with FBI.

Only God know what kind of mistakes(backdoors) contain mass commit by Microsoft to Linux kernel(v3.0).

My 10 cents of paranoia.

Improve this answer
4
  • "Only God know what kind of mistakes(backdoors) contain mass commit by Microsoft to Linux kernel(v3.0)." This is unclear. Are you saying that Microsoft has committed problematic code to the Linux kernel, or that they might do so in the future if it were possible to commit changes in secret? – user3930 Jul 29 '13 at 16:05
  • I say that Microsoft commit "Microsoft's code" to Linux kernel. And only God know how many backdoors will be founded in "Microsoft's code" in the future. – stackkeeper Jul 29 '13 at 16:13
  • I understand the concern, but remember that in terms of the actual amount of code changed, Microsoft hasn't committed that much, and the changes they made are public (and presumably highly reviewed, especially because of concerns like yours), so it seems logical that any supposed backdoors would already have been uncovered. – user3930 Jul 29 '13 at 17:44
  • 2
    You say: " My 10 cents of paranoia. " I'd say this is more than just paranoia. This is bordering on insanity. – Nik Bougalis Jul 29 '13 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.