Remove Coinomi wallet from "Choose your Bitcoin wallet" page

[sha-265]

This wallet is shady, and its "Basic transparency" is practically none.

The latest commit in their git repo made on February 6th, 2017, when they changed their license from Apache to some custom license (the last actual change made on March 6th, 2016).

On the other hand, the latest version on Google Play Store, released on June 3th, 2017!

The "Basic transparency" attribute of this wallet should be changed to none at least, if not removing this wallet from recommendations. This is a security risk for users.

Thanks.

[Mirobit]

I agree that transparency should be set to 'checkfailtransparencyclosedsource'. Last real code update on GitHub has been in April 2016.

@erasmospunk Comments?

[crwatkins]

@erasmospunk Could you push your recent updates and tag the latest release?

[xeniacx]

There is indeed a delay in publishing the code, however this decision was taken after being accused by hundreds of users that we stole their funds, as they funded their wallets and after a while their funds were gone.

Apparently scammers were cloning Coinomi wallet and then run campaigns, MLM schemes, they even organized proper presentations where they had the investors download the malicious clones and fund their wallets, and after a few weeks their funds were simply gone. They didn't even bother to change the Support link inside Coinomi's menu which was still forwarding all inquiries to our Support e-mail, which is basically why we are aware that so many users were scammed and lost their money and along with that their faith to crypto-currencies. Is this really the message we want to pass on to the new adopters? It's our duty to welcome new users to cryptoland and protect them by all means.

On top of that, delaying the publishing of the source code also puts a hold to parasitic ventures like uberpay.io who basically built their revenue model on top of a clone of an older version of our wallet and didn't even bother to run their own back-end servers, last time we checked they were still parasitizing on our back-end servers, which are paid by us, of course. And uberpay is just an example, there are many more like them who have been making a buck on our sweat. This kind of behavior only harms legit projects like Coinomi which has been serving hundreds of thousands of users for almost 4 years, and to achieve that we have also spent hundreds of thousands of USD in development and operational costs apart from the time and effort we put into this, so maybe we should focus on what is really harming our community instead of going after those who have been helping cryptos evolve since day one.

As for the "shady" part, there's nothing shady about Coinomi. We have been around since 2014 and no user has ever lost their funds because it was the wallet's fault. We are an established company registered in the UK and we are fully liable for the software that we produce. As for the source code, nothing has changed to the private keys management and address generation part which is what you should be focusing on and for which the source code is already available on GitHub for everyone to review.

Will Coinomi's removal from bitcoin.org help the community more than it will harm it? If you believe that the answer is yes then go for it. As for us, we feel obliged to protect the users and therefore we cannot allow scammers to keep on cloning our wallet.

[Mirobit]

@GeorgeKimionis Thanks for stating your postion. I am sorry to hear about your problems with fraudsters and thieves. These uberpay guys do not mention coinomi as a source at all. That is even under the old license illegal. I see that your new license forbids commercial use. Will this change your delayed code publishing?

I think removing you from bitcoin.org was never on the table (at least from my perspective).
I am fine with delayed code updates. Even if you push live updates, as long as you don't offer deterministic builds (which only core does) there is no extra transparency provided to the users.

[sha-265]

@GeorgeKimionis there are multiple open sourced bitcoin wallets who can be forked by anyone, and none of them complained about being forked by scammers and therefore closed their source. I can't see why Coinomi should be anyway different.

Anyway, everything you said about "nothing has changed" in the private keys management and address generation part, can't be verified, and this is the main problem. Users need to trust you that "nothing has changed", and if you didn't understand the fundamentals of bitcoin: we are against "trust".

[Mirobit]

@Bitim To be fair, almost everyone uses the compiled version from the app store. As I mentioned above there is no guarantee that it contains the same code as devs push on GitHub. So there is always trust involved when you installed compiled software.

[sha-265]

@Mirobit it doesn't matter, if you want to be "basic transparent", you should provide users the ability to not trust you. If you're not providing this option I think you do not deserve this title, whatsoever. Otherwise every other scammer can get this title.

[xeniacx]

@Mirobit thank you. It is illegal indeed not to mention the source and keep the same license as the source, even under the old license. The license was changed so we can have control over who is cloning our wallet and in combination with the delayed opening of the source code it seems to be working pretty well. And yes, you are totally right, unless deterministic builds are provided there is absolutely no guarantee that the source code on GitHub reflects the compiled binaries listed under the various app stores (which also answers @Bitim's remark on trust).

@Bitim as we are in contact with many wallet providers in the industry I know for a fact that there are others that faced similar issues, maybe not to that extent, but I'd rather let them speak for themselves. Apart from that, all companies are responsible for their actions and no one shall dictate them what is the ethical way to run their business. Coinomi is currently the only mobile-first wallet that provides true ownership and supports more than 70 different blockchains and many dApps and ERC20 tokens, while the vast majority of the wallets listed on bitcoin.org are bitcoin-only and fraudsters typically have a special affection for coins with a better anonymity than bitcoin, maybe that's why, but then again I'm not going to try to reason the fraudsters' actions or take any defensive position on this matter, Coinomi has a great reputation and that should be enough to inspire trust where trust is needed.

BTW I suppose you performed the same checks for every other wallet listed under bitcoin.org as you did with Coinomi and found their published source code to be in perfect sync with their latest releases and also checked that the compiled version is exactly the same as the one you get when compiling their published source code, right? Because if you didn't one could say that you are targeting Coinomi here and since I don't see any more "Remove XXX wallet from Choose your Bitcoin wallet page" entries in the Issues page, one would have to start wondering why.

[sha-265]

@GeorgeKimionis, are you trying to market me your wallet? Because it sounds like that. I don't really care about your product, its features or its "reputation" (great or not); I care about transparency. So everything you said about your product is worthless for me, because I need to trust you on this. So please stop.

Anyway, you shouldn't hide behind some excuses like "scammers forking my wallet" to explain your shady approach, while there are many other fork-able wallets, that are not closing there source, because of this reason. So if you won't take any defensive position on this matter, you should know that you can't have your cake and eat it, meaning you can't boast with the "basic transparency" badge, when this badge have some basic requirements that you are not comply with.

And no, I didn't performed the same checks for every other wallets listed under bitcoin.org. I did some checks on multiple wallets. Actually I targeted shitcoin's wallets, trying to find some transparent wallet for this purpose, and after I found one (Coinomi), that IMO is not transparent, and listed on bitcoin.org website, I decided to take an action against the misleading information regarding this wallet on bitcoin.org website. That's all.

[xeniacx]

if you want to be "basic transparent", you should provide users the ability to not trust you.

@Bitim even if the latest code is available, if the builds are not deterministic then the users have to trust the publisher. And since none of the wallets listed on this website except for Core provide deterministic builds the users have to trust the publisher of each wallet. Maybe you should educate yourself better before deciding to waste more of our time.

Otherwise every other scammer can get this title.

@Bitim I hope you didn't just call us "scammers". (!)

you didn't understand the fundamentals of bitcoin: we are against "trust".

@Bitim that sounded rather insulting. And who exactly is "we"?

Actually I targeted shitcoin's wallets

@Bitim what makes you think that you have the right to call Coinomi a "shitcoin wallet" and more than that to call these coins "shitcoins"? What a hideous approach!!

OK guys, I'm not going to just sit here and listen to @Bitim's insults. He is clearly targeting Coinomi here and his behavior resembles that of a paid troll. The way this conversation goes makes it non-constructive, to say the least. Let's put and end to it, we all have better things to do than to feed the trolls.

[achow101]

even if the latest code is available, if the builds are not deterministic then the users have to trust the publisher. And since none of the wallets listed on this website except for Core provide deterministic builds the users have to trust the publisher of each wallet. Maybe you should educate yourself better before deciding to waste more of our time.

Having the latest code available gives users the option to not trust you. They can choose to not trust the builds that you publish and to build the software themselves. By not even allowing that option, you are providing no transparency.

[harding]

Bitcoin.org has a (mostly) objective criteria for determining what wallets should be listed, so I suggest we try to keep the discussion focused on the following topics:

1. In Coinomi in compliance with Bitcoin.org's written policy?
2. If not, should the policy be changed to factor in Coinomi's current circumstances?

I think the part of the policy relevant to this issue is,

Specifically, it is my understanding that this does not require a wallet to be what most people call open source - but it does require that the wallet vendor keep their publicly-viewable source code up to date. It is also my understanding that that a OSI-approved open source (or FSF-approved free software) license is not required for Coinomi's current transparency score; this was discussed previously in issue #896 - however, I do again believe that we require wallets publish their current code to get that transparency score (even, as discussed elsewhere in the comments, if we have no easy way to check that they do).

@GeorgeKimionis is there anything we can do to get you to keep the public code repository synced with the releases? If not, do you think your situation with the fraudulent clones warrants a change in Bitcoin.org policy? (Edit: and, if so, can you suggest a phrasing for that policy?)

[achow101]

@harding IMO if a wallet is unable to publish source code that corresponds to the latest publicly available version of their software, they should not be listed. This rule should be enforced with no exceptions.

Regarding cloned wallets, breadwallet deals with this issue too (there have been numerous cloned versions of breadwallet on the appstore) and yet it is still open source and the source code publicly available.

[sha-265]

"Basic transparency" according to bitcoin.org website:

The developers of this wallet publish the source code for the client. This means any developer in the world can audit the code. However, you still need to trust developers of this wallet when installing or updating the final software because it was not built deterministically like Bitcoin Core.

So you are not complying with the first requirement: publish the source code for the client.

 

@Bitim I hope you didn't just call us "scammers". (!)

I didn't.

@Bitim what makes you think that you have the right to call Coinomi a "shitcoin wallet" and more than that to call these coins "shitcoins"? What a hideous approach!!

I do have the right to call shitcoins shitcoins, and wallets for these coins "shitcoin's wallet".

OK guys, I'm not going to just sit here and listen to @Bitim's insults. He is clearly targeting Coinomi here and his behavior resembles that of a paid troll. The way this conversation goes makes it non-constructive, to say the least. Let's put and end to it, we all have better things to do than to feed the trolls.

I understand it's not so easy when someone criticize you, but I'm not targeting anyone or anything specifically. I do care about security and transparency with no exceptions. For now, Coinomi is the only wallet listed on bitcoin.org that I found not complying with the basic requirements.

[harding]

@achow101 I personally agree with you. However, Bitcoin.org had for many years listed proprietary wallets with completely closed source code. Over time, we've shifted policy to discourage this and currently the only wallets allowed to have closed code are in web wallet section of the wallets page.

That said, I think it's fair to see if @GeorgeKimionis (or anyone else) can propose a reasonable alternative that the rest of us haven't thought of but which we'd find satisfactory and which would allow us to continue listing Coinomi.