Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.212.51 as permitted sender)
	client-ip=209.85.212.51; envelope-from=grarpamp@gmail.com;
	helo=mail-vb0-f51.google.com; 
MIME-Version: 1.0
In-Reply-To: <CABsx9T1EmYer-85zrEdC-N0uS_nnuGVgz0QcZ+ROrn51uPSNLQ@mail.gmail.com>
References: <CAKaEYhK5ZzP8scbhyzkEU+WdWjwMBDzkgF+SrC-Mdjgo9G9RnA@mail.gmail.com>
	<CACezXZ94oDX1O7y7cgh+HvDj4QiDWmy1NVQ4Ahq=gmzhgmUaHQ@mail.gmail.com>
	<CAKaEYhK4v3mhkGMKDW9g7km+5artBAjpukQdwx17psgdJaqvgA@mail.gmail.com>
	<CAHQs=o4pKBoVO-14dqoq9EoNxq2BNnKE+zmOjLBw+XqJfAp8yA@mail.gmail.com>
	<CAKaEYh+bePsmzM5XU1wpb_SFrTnbKB8LxMvWLLqP4p8KuesuSA@mail.gmail.com>
	<20130401225107.GU65880@giles.gnomon.org.uk>
	<20130401225417.GV65880@giles.gnomon.org.uk>
	<CA+s+GJBLUTfu8q2zE4pJ+HO5u-GweGNKZebV=XRhBe7TCPggPg@mail.gmail.com>
	<CA+8xBpcZtsZ=p30hJtqLTBJPEE3eD=gQ+x6bKy46z0hc8XNB1Q@mail.gmail.com>
	<CAD2Ti2-quRpfARLHw3riFpFihwYy2+R+4AW7Ovxq-W3qkzKptw@mail.gmail.com>
	<CABsx9T1EmYer-85zrEdC-N0uS_nnuGVgz0QcZ+ROrn51uPSNLQ@mail.gmail.com>
Date: Wed, 3 Apr 2013 12:23:21 -0400
Message-ID: <CAD2Ti2_54CfHS8oy=b3VQTqZMighmjfiaYFEqMB+Xou8Uamr9w@mail.gmail.com>
From: grarpamp <grarpamp@gmail.com>
To: bitcoin-development@lists.sourceforge.net
Content-Type: text/plain; charset=UTF-8
Subject: Re: [Bitcoin-development] bitcoin pull requests
Precedence: list

> Eliminate the "if you get a bad bitcoin-qt.exe somehow you're in big
> trouble" risk entirely

This isn't really possible. A trojaned client will spend your coin as
easily as the owner can, passphrases will be logged, windows box will
be owned, secondary remote spendauth sigs into the network chain
break similarly, securely hashcheck the trojaned client from cracked
userspace on a hacked dll/kernel with uefi backdoor and a trojaned
hasher, etc.

It's easier for a few developers to meet in person to init and sig
a new repo than to try fixing the world's userland and users :)
At least that way you get something verifiable back to the root.