Verify apps in the start 9 registry?

DIY Community Support
1

Hi everyone!
Quick question: Is there a need to verify app downloads from the Start9 registry or the community registry?

Thanks in advance!

2

Directly, no, in downloading via a specific registry you are trusting that registry.

If you don’t want to trust the registry, then you are able to:

  1. visit the individual wrapper repos listed
  2. clone the repo
  3. run the build process
  4. sideload the resulting binary
2 Likes
3

Hi StuPleb!

Thank you very much for the detailed response! I appreciate it! :heart:

b

4

I have been unable to run the build process for Bitcoin knots (couldn’t figure it out). Would it be a good idea to uninstall it? I appreciate the help!

Thanks again!!!

5

I’m not clear on the purpose here. Why are you considering uninstalling it?

1 Like
6

Hi Rexter

I just thought anything downloaded from the community registry is less “safe”. And since I didn’t complete the steps Stupleb outlined for me- I feel a bit uneasy about using it. Should I feel this way? I’ve done all I can the past couple of days but I’m not that technical.

Thank you!

7

Hi bonez,

You’re perfectly fine running Bitcoin from the Start9 registry. I’m pretty sure most users run it that way. Of course, if you’re particularly security-conscious and don’t want to trust Start9’s packaging, you can build the service yourself and examine the code. However, if you’re not technically inclined, you’ll need to trust someone at some point in the process.

1 Like
8

Hi Homer!

Just to clarify: Does this apply to the community registry as well? I’m deciding if I should run knots on s9.

Thanks!!

9

The fact that a service is in the Community registry does not indicate that it’s “less safe.” It usually indicates that it’s just not specifically packaged or supported by Start9. In the case of Bitcoin Knots, the only reason it’s in the community registry is because this was a hacky way for us to provide both Knots, and Core, as drop-in replacements for each other, on the current version of StartOS. In the upcoming StartOS 0.4.0, this won’t be the case. Both Knots, and Core will be in the official registry. The steps provided by Stuart would allow you to bypass the registry, but you’re still blindly trusting the code you’re building from, unless you have the skill to audit the code yourself. In any software you run, there’s always a small chance some sort of supply line attack.

I’m not going to speculate on what’s safe or not safe. Too many subjective variables in that. But I will tell you that I’m running Bitcoin Knots, from the community registry myself, and I sleep fine with that.

2 Likes
10

Hi Rexter!

I appreciate your thorough explanation of how things work. You broke things down very well.

Thank you!
B

Fyi: I almost completed step 3 (running the build but it was tough) after spending lots of time online and AI. Not fun when things start falling apart :laughing: