On Nodes - Your Next Move \ stacker news ~AskSN

I am not sure people realize how centralized is the development of Knots. There is very little if any code review and a single person with write privileges to the repository.

I guess he can sneak a malicious code any moment without people noticing. He or somebody else if his account gets compromised. And his accounts were compromised in the past, when his Bitcoins were stolen.

I hope the above poll is not representative and 30% of the network will not run Knots just for this reason alone. Nothing against Luke and I am no taking sides in the OP_RETURN debate.

0 sats \ 5 replies \ @OT OP 12 May

Isn't Knots basically the same as Core with a few extra configurations?

0 sats \ 0 replies \ @anon 9h

TLDR: The volume of the changes in Bitcoin Knots compared to Bitcoin Core makes it practically impossible to audit.

This is a comparison from Knots' web site: https://bitcoinknots.org/files/28.x/28.1.knots20250305/bitcoin-28.1.knots20250305.desc.html

Then some stats locally:

# add the remotes
$ git remote add bitcoin https://github.com/bitcoin/bitcoin
$ git remote add knots https://github.com/bitcoinknots/bitcoin

$ git log --format=oneline v28.1..v28.1.knots20250305 |wc -l
    1370
$ git log --format=oneline v28.1.knots20250305..v28.1 |wc -l
       0

So, for v28.1, Bitcoin Knots is Bitcoin Core + 1370 more commits. What are those 1370 commits?

$ git diff --shortstat v28.1..v28.1.knots20250305
 550 files changed, 25871 insertions(+), 2640 deletions(-)

So, 550 files have been changed, with about 25k lines of code being added.

0 sats \ 3 replies \ @anon 22h

I do not know. I didn't check. Did you?

0 sats \ 2 replies \ @anon 12h

I mean that I did not check the source code, like to make a diff and evaluate the differences.

0 sats \ 1 reply \ @OT OP 11h

Yeah, I haven't personally. Might be beyond my expertise but I have heard this from multiple sources (devs). I think it's generally understood to be so, it's just that some say that the configurations are "opinionated".

0 sats \ 0 replies \ @anon 9h

I did some comparison of the source code of both and posted in this thread. Note that a single line of buggy code is enough to end up with a remote backdoor, intentional or not.

reply on another page