pull down to refresh

Isn't Knots basically the same as Core with a few extra configurations?

TLDR: The volume of the changes in Bitcoin Knots compared to Bitcoin Core makes it practically impossible to audit.


This is a comparison from Knots' web site: https://bitcoinknots.org/files/28.x/28.1.knots20250305/bitcoin-28.1.knots20250305.desc.html

Then some stats locally:

# add the remotes
$ git remote add bitcoin https://github.com/bitcoin/bitcoin
$ git remote add knots https://github.com/bitcoinknots/bitcoin
$ git log --format=oneline v28.1..v28.1.knots20250305 |wc -l
    1370
$ git log --format=oneline v28.1.knots20250305..v28.1 |wc -l
       0

So, for v28.1, Bitcoin Knots is Bitcoin Core + 1370 more commits. What are those 1370 commits?

$ git diff --shortstat v28.1..v28.1.knots20250305
 550 files changed, 25871 insertions(+), 2640 deletions(-)

So, 550 files have been changed, with about 25k lines of code being added.

reply

I do not know. I didn't check. Did you?

reply

I mean that I did not check the source code, like to make a diff and evaluate the differences.

reply
0 sats \ 1 reply \ @OT OP 13 May

Yeah, I haven't personally. Might be beyond my expertise but I have heard this from multiple sources (devs). I think it's generally understood to be so, it's just that some say that the configurations are "opinionated".

reply

I did some comparison of the source code of both and posted in this thread. Note that a single line of buggy code is enough to end up with a remote backdoor, intentional or not.

reply